Privacy Policy

Effective Date: October 12, 2026

Switchback is owned and operated by Point Chalet, LLC. Point Chalet, LLC, a California limited liability company ("we," "us," or "our"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your information when you use the Switchback website, mobile app, watch app, and related services (the "Service").

By using the Service, you consent to the practices described in this Privacy Policy. Please also review our Terms of Service, which govern your use of the Service.

1. Data Controller

For the purposes of the General Data Protection Regulation (GDPR) and other applicable data protection laws, the Data Controller is:

Point Chalet, LLC
A California limited liability company
1401 21st St, Ste R, Sacramento, CA 95811
Email: support@switchback.fit

Point Chalet, LLC is responsible for deciding how your personal information is collected, used, and protected in connection with the Service.

2. Information We Collect

We collect only the information necessary to provide and improve the Service. The specific categories of data we collect are:

2.1 Account Information

• Email address -- required for account creation, authentication, and communication
• Display name -- optional, used for personalization within the Service

2.2 Workout and Program Data

• Program and schedule -- the program you choose to track, the day you start on, and your position in the program
• Workout logs -- the exercises, reps, weights, and completion data you record, used to track your progress and recall your previous numbers
• Activity and health metrics -- when collected by your paired watch or included in files you import, we receive and store heart-rate samples and summaries, calories, training effect, and other available activity metrics. Depending on the device and file, these can include respiration, stress, Body Battery, heart-rate zones, and activity timing. We also store raw activity telemetry and activity files, including FIT files, to preserve your workout record and support history, trends, and export.
• History and calendar -- your completed workouts and the days you have finished

2.3 Device Pairing Data

• Paired-device records -- when you pair a Garmin watch, we store a device pairing token and basic device information (such as the model and a label you can set) so the watch can sync securely with your account

2.4 Billing Data

• Trial and subscription status -- your trial start and end, selected billing interval, and access status
• Stripe customer identifier -- a reference ID used to link your account to your Stripe payment record

2.5 Consent Records

• Consent timestamps -- when you accepted the Terms of Service and Privacy Policy
• Consent version identifiers -- which version of the Terms and Privacy Policy you accepted

3. Information We Do Not Collect

Transparency about what we do not collect is equally important. We do not collect:

• Payment card information -- all payment data is handled entirely by Stripe, our payment processor. We never see, store, or have access to your credit card numbers, expiration dates, or security codes.
• Advertising or cross-context tracking data -- we do not build advertising or behavioral profiles

We do not use any cookies beyond those strictly necessary for authentication (see Section 13).

4. How We Use Your Information

We use your information solely for the following purposes:

• Account authentication -- verifying your identity when you sign in to the Service and authenticating your paired devices
• Providing tracking -- storing your workout logs, recalling your previous numbers, and syncing your data across the web, your phone, and your watch
• Billing -- managing your subscription and coordinating with Stripe for payments
• Service improvement, security, and abuse prevention -- maintaining the reliability, performance, and security of the Service

We do not use your information for advertising or ad targeting, remarketing or behavioral profiling, sale to third parties, or any purpose unrelated to providing and improving the Service.

5. Third-Party Processors

We share your information only with the following third-party service providers, each of which processes data solely on our behalf and in accordance with our instructions:

Processor	Purpose	Data Shared	Privacy Policy
Google Cloud / Firebase	Authentication (Firebase Auth), database (Firestore), Cloud Functions, push notifications (Firebase Cloud Messaging), and web hosting	Account information, workout and program data, stored activity and health metrics, raw telemetry and uploaded files, paired-device records, feedback, notification records, and subscription data	Firebase Privacy
Stripe	Payment processing and subscription management	Email address (for receipts and invoicing). Payment card information is provided directly to Stripe by you and is never transmitted through our systems.	Stripe Privacy Policy
SMTP2GO	Email delivery, including account emails, workout reminders, billing and renewal notices, legal update notices, and optional marketing messages	Recipient email address and message content, including any personalization needed for that message; delivery, bounce, unsubscribe, and available email engagement information	SMTP2GO Privacy Policy

We do not share your information with any other third parties. We do not sell, rent, or trade your personal information.

6. Garmin Devices and Garmin Connect

The Switchback watch app runs on your Garmin device. To use it, you pair your watch to your Switchback account and sync through the Garmin Connect Mobile app.

When you complete a workout with the Switchback watch app, the app can save an activity to your Garmin account through Garmin Connect and synchronize workout records and activity telemetry to your Switchback account. We collect and store the activity and health metrics described in Section 2.2, including heart-rate data when available. This data is used to provide workout history, comparisons, trends, synchronization, and data export. Garmin separately handles the copy in your Garmin account under its own terms and privacy policy.

Using the watch app is optional. You can also import activity files into Switchback; we store the uploaded activity data and supported metrics. Deleting your Switchback account does not delete activities from Garmin Connect or copies you have downloaded or shared elsewhere.

Your use of Garmin devices, the Garmin Connect Mobile app, and your Garmin account is governed by Garmin's terms and privacy policy. Please review Garmin's policies to understand how Garmin handles your data.

7. Data Retention

We retain your information only for as long as necessary to provide the Service and fulfill the purposes described in this Privacy Policy:

• Account data and files -- account information, program and workout records, stored activity and health metrics, raw telemetry, uploaded files, device records, feedback, and account-linked notification and email records are removed from active Switchback storage when account erasure completes. We delete account-attributed records rather than retaining individual workout histories or feedback under replacement identifiers.
• Audit records -- account-attributed audit records are included in account export and removed during account erasure. While an account exists, these records have a 60-day retention period.
• Deletion processing -- deletion is a background process. Failed cleanup is retried. Temporary deletion records and any billing mapping needed to stop a subscription remain only until the cleanup succeeds.
• Recovery copies and operational logs -- deleted Cloud Storage files remain recoverable under the bucket's seven-day soft-deletion period before permanent removal. Firestore retains recent document versions for up to one hour. Application logs have a 30-day retention period and can include account identifiers and diagnostic information. These copies are not available through normal account access. Provider-managed security and audit records may have separate required retention periods.
• Shared service records -- published policies, campaign records, service configuration, and other accounts’ access settings remain available, with the deleted account’s authorship, administrative, and recovery-request attribution removed.
• Aggregate statistics -- statistics that contain no individual account identifiers may remain after deletion.
• External copies -- Stripe retains payment and invoicing records under its own policies and applicable accounting, tax, and legal requirements. Activities in Garmin Connect, messages already delivered to email providers or recipients, and copies you download or share are not erased by deleting your Switchback account.

8. Your Rights Under GDPR (EU/EEA Users)

If you are located in the European Union or European Economic Area, you have the following rights under the General Data Protection Regulation:

• Right of access (Art. 15) -- You have the right to request a copy of the personal data we hold about you.
• Right to rectification (Art. 16) -- You have the right to request correction of inaccurate personal data.
• Right to erasure (Art. 17) -- You have the right to request deletion of your personal data ("right to be forgotten").
• Right to restriction of processing (Art. 18) -- You have the right to request that we restrict the processing of your personal data under certain circumstances.
• Right to data portability (Art. 20) -- You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to object (Art. 21) -- You have the right to object to the processing of your personal data based on legitimate interests.

You may exercise these rights by:

• Using the "Download My Data" feature in your account settings to download account records, workout and health metrics, history, account-attributed audit and email records, and stored files. Authentication secrets and duplicate copies of previously generated exports are excluded. For operational logs or provider-held records, contact us about an access request.
• Using the "Delete Account" feature in your account settings for erasure, subject to the processing and retention periods in Section 7. Account export and deletion remain available without accepting an updated policy.
• Emailing support@switchback.fit for any rights request

We will respond to your request within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with your local Data Protection Authority.

9. Your Rights Under CCPA (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to know -- You have the right to know what personal information we collect, how we use it, and with whom we share it.
• Right to delete -- You have the right to request deletion of your personal information.
• Right to correct -- You have the right to request correction of inaccurate personal information.
• Right to opt-out of sale or sharing -- You have the right to opt out of the sale or sharing of your personal information.
• Right to non-discrimination -- We will not discriminate against you for exercising your privacy rights.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

We do not offer financial incentives for the collection, sale, or deletion of personal information. To exercise your CCPA rights, use the "Download My Data" or "Delete Account" features in your account settings, or email support@switchback.fit.

10. Legal Basis for Processing (GDPR Art. 6)

We process your personal information based on the following legal grounds:

• Contract performance (Art. 6(1)(b)) -- Processing necessary to provide the Service you requested when you created an account, including account management, tracking your workouts, and subscription management.
• Legitimate interests (Art. 6(1)(f)) -- Processing necessary for our legitimate interests, including service improvement, fraud prevention, and security. We balance these interests against your rights and freedoms.
• Consent (Art. 6(1)(a)) -- Where we rely on your consent for specific processing activities. You may withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

11. International Data Transfers

Point Chalet, LLC is based in the United States, and your data is processed and stored in the United States. Firestore data is stored in the United States multi-region (nam5). Backend services run in the Google Cloud us-central1 region.

If you access the Service from outside the United States, including from the European Union or European Economic Area, your personal data will be transferred to the United States. These transfers are governed by:

• Google Cloud / Firebase -- Google's Data Processing Addendum and standard contractual clauses for international data transfers
• Stripe -- Stripe's Data Processing Agreement and standard contractual clauses
• SMTP2GO -- SMTP2GO's data processing terms for email delivery

12. Children's Privacy

The Service is intended for adults and is not directed to anyone under the age of 18. We do not knowingly collect personal information from children under 16 years of age.

If we become aware that we have collected personal information from a child under 16, we will take immediate steps to delete that information from our systems. If you believe that a child under 16 has provided personal information to us, please contact us at support@switchback.fit.

13. Cookies and Tracking Technologies

Switchback uses essential authentication cookies only. These cookies are strictly necessary for the Service to function and are used solely for Firebase Auth session management (maintaining your logged-in state).

We do not use:

• Analytics cookies
• Marketing or advertising cookies
• Third-party advertising tracking cookies or pixels on the website
• Cross-site tracking of any kind

Emails sent through our email provider may use tracking pixels and tracked links to report delivery, opens, clicks, bounces, complaints, and unsubscribes. We use these records to operate and improve our communications. They are not used for third-party advertising. Optional marketing messages include unsubscribe controls; mandatory legal notices are sent independently of notification preferences, where delivery is possible.

Under GDPR, strictly necessary cookies do not require explicit consent. However, we inform you of their use through our cookie notice. You can manage cookies through your browser settings, but disabling essential cookies may prevent you from using the Service.

14. Security

We implement specific technical measures to protect your information:

• HTTPS everywhere -- all communication between your device and our servers is encrypted using TLS
• Content Security Policy (CSP) -- prevents cross-site scripting attacks and unauthorized code execution
• HTTP Strict Transport Security (HSTS) with preload -- ensures your browser always connects via HTTPS
• Firebase security rules -- granular access controls ensure users can only access their own data
• Data encrypted at rest -- all data stored in Google Cloud is encrypted at rest using Google's default encryption
• Principle of least privilege -- access to systems and data is restricted to the minimum necessary for each component to function
• X-Frame-Options: DENY -- prevents the Service from being embedded in iframes on other sites
• Referrer-Policy -- controls what referrer information is sent with requests to protect your browsing privacy

While we strive to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, but we are committed to implementing industry best practices.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. For material changes, we provide at least 30 days' advance notice by email to the address associated with your account, update the effective date, and publish a dated version in our policy history. We require you to agree to the published Terms of Service and Privacy Policy before continuing to protected product pages, and record the accepted versions and timestamps. You can manage your account, download your data, or delete your account without accepting an updated policy.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Point Chalet, LLC, 1401 21st St, Ste R, Sacramento, CA 95811
Email: support@switchback.fit

If you are located in the European Union or European Economic Area, you also have the right to contact your local Data Protection Authority with questions or complaints about our data practices.