FORTUS.

Privacy Policy

Your data in FORTUS

Effective 2 October 2026

Who we are

FORTUS is a coaching program for Catholic men, run by Ryan Freng Productions LLC. The FORTUS app is how a man in the program prays, trains, studies, and reports to his coach. Questions about this policy go to [email protected].

What we collect and why

Account details

Your name, email address, and, if you give it, your phone number. Your coach enters these when he invites you, or you enter them yourself when you create an account. We use them to sign you in, to reach you about the program, and, if you have a coach, to tell him who submitted what.

Signing in with Apple or Google

If you sign in this way instead of with a password, the provider gives us an id and an email address, and a name when it offers one. That is all we get. FORTUS never posts anything on your behalf.

Time zone

Set from your device or by you. The app uses it to decide when your day starts and ends, when your Fidelity count rolls over, and when reminders are allowed to fire.

Your track

Married, single, or single dad. It decides which formation content you are shown.

Prayer records

The date you prayed, how long, whether you marked it manually, the Gospel citation for that day, and the word or phrase you saved at the end of prayer. Your coach sees these.

Formation answers

Your journal responses inside lessons, and which lessons and blocks you have finished. Your coach reads your answers. This is the point of the program.

Habits, objectives, and challenges

Which ones you marked done and on what day.

Check-in answers

Your weekly written answers, ratings, and selections, plus the replies you and your coach send each other about them.

Weight

The number you enter on weigh-in days, and, if you connect Apple Health or Health Connect, the weight your scale records there. It is stored as a weight history so you and your coach can see the trend. A number you type yourself always outranks one that arrives from your scale, and typing over an imported reading replaces it for good. If you have connected a health store, a weight typed into FORTUS, by you or by your coach, is also saved into that store, so it sits with the rest of your health record.

Steps

If you connect Apple Health or Health Connect, your daily step count. It is stored as one total per day. It sits under your weight trend as context for it. It is not scored, it does not affect Fidelity, your habits, or any completion figure in the app, and your coach can see it the way he sees your weight.

Workouts from other apps

If you connect Apple Health or Health Connect, the workouts other apps recorded there: when each one started and ended, how long it ran, what kind of activity it was, the name the app gave it, which app recorded it, and, where the store holds them, the distance and calories it reported. They are shown in your training history beside your FORTUS sessions, and your coach sees them the same way. They are not scored: an imported workout does not complete a FORTUS training day and does not affect Fidelity or any completion figure in the app. On Android, Health Connect only hands back the records from the 30 days before you first connected, so older workouts do not arrive.

Apple Health and Health Connect

Connecting Apple Health or Health Connect is your choice and it is off until you make it. You turn it on in Settings and your phone asks you to allow it. FORTUS reads three things from Apple Health or Health Connect: your body weight, your daily step count, and the workouts other apps recorded. It writes back a workout you finish in FORTUS, a weight typed into FORTUS, and, on Android, each food you log in FORTUS. A weight FORTUS read from your health store is never written back to it, and your step count is never written. FORTUS never imports what it wrote: a workout or a weight it filed itself is skipped when it reads. We read nothing else that is in Apple Health or Health Connect, and you can disconnect in Settings at any time. Disconnecting stops new readings arriving; the ones already in your weight, step and workout history stay there, because they are your history. If you want them gone, deleting your account destroys them with everything else.

Samsung Health

Samsung Health reads and writes Health Connect, so on a Samsung phone the same things flow through it once you turn on Health Connect inside Samsung Health. FORTUS has no direct connection to Samsung Health and asks it for nothing.

Food logs

What you logged, when you logged it, and the numbers attached to each entry: calories, protein, carbohydrate, and fat. Your macro targets, which your coach sets. The days you marked off plan and any note you left on them. Your coach sees all of it. That is the point of logging it. On Android, each food you log in FORTUS is also written to Health Connect, with its name, the time you logged it and those four numbers, so Samsung Health and any other app you allow to read Health Connect can show it; an entry you undo is removed from Health Connect too. FORTUS never reads food from Health Connect, and nothing you logged in another app enters your FORTUS day.

Progress photos

The front, side, and back photos you choose to upload on photo day. They are taken or chosen by you. Nothing is captured in the background, and the app never opens your camera on its own.

Label photos

When you scan a barcode the app does not know, you can photograph the nutrition panel and the app reads the numbers off it. The photo is sent to Anthropic, the company behind Claude, to be read. Read Foods you add below before you use this, because it is the one place in the app where something you put in can end up in front of other men.

Meal photos

If you photograph a plate instead of a package, that photo goes to the same service and comes back as an estimate of what is on the plate. Keep other people out of the shot. The photo is deleted seven days later, and it is never added to the shared food library.

Your daily schedule

The times you set for waking, prayer, training, work, family, and bed, plus any line you add yourself, and the hours of sleep those times imply. You build it in onboarding and you can revise it whenever you want. Every version is kept rather than overwritten, so you and your coach can see how your day has changed. Your prayer time also sets when the prayer reminder fires.

Community posts

If you accept the Community rules, what you post in a room, when you posted it, who you named in it, and any photo you attached. Also the date you accepted those rules and which version you accepted, because both stores require us to be able to show that you agreed before you posted. Also the men you have blocked and the messages you have reported. The other men in a room see your posts, your name and your photo; the coaching staff see all of it, including what has been removed. Decline the rules and none of this exists for you.

Push token

If you allow notifications, your device gives us an Expo push token so the reminders can reach you. It identifies the device, not you personally.

Notification history

What we sent you, when, and whether it was skipped for quiet hours or the daily cap. This is how the daily cap is enforced.

Usage analytics

A short, fixed list of in-app events: that the app was opened, that a prayer or lesson was started or finished, that a habit or objective was marked, that a check-in or photo set was sent. Each event carries your account id, your cohort, and which week of the program you are in, and nothing else. We never send your name, your email, or anything you wrote: journal answers, check-in answers, prayer notes, weight readings, and photos stay out of analytics entirely. We use this to find what is broken and what is unused.

Coaching notes

Your coach may keep private notes about your progress. These are written by staff, are never shown in your app, and are not written by you.

Purchases

If you subscribe, we keep your plan, whether you are in a free trial, when it renews or ends, and whether it came through the App Store, Google Play, or the web. If you subscribe on the web, we also keep the customer id Stripe gives you, so you can manage the subscription. We do not see or store your card number in any case. Deleting your account cancels a subscription you started on the web. A subscription through the App Store or Google Play is cancelled in that store's subscription settings, and deleting your account does not cancel it.

What we do not collect

No location. No contacts. No microphone or audio. No advertising identifier. No browsing outside the app. No payment or card details: Apple, Google, and Stripe handle those directly and we never see them. No data about your family, only what you choose to write yourself.

Where your data lives

On Supabase, our database and file host, in the Canada (ca-central-1) region. Photos and profile pictures sit in private storage buckets that require a signed link to open. Everything travels over HTTPS.

Push notifications go through Expo's push service, which needs your push token and the text of the notification to deliver it.

Usage analytics go to PostHog, and you can turn them off in Settings. When crash reporting is enabled on a build, a crash or a handled error goes to Sentry so it can be fixed; it carries your account id and nothing else about you, no name, no email, and nothing you wrote or logged.

Your weekly check-in is read by Anthropic, the company behind Claude, so your coach gets a first draft of his review before he writes it. What is sent is your first name, your answers to that check-in, your recent weight readings and food entries, and the reply thread on it. Your full name, your email, your account id and your coach's private notes are not sent.

Label photos and meal photos go to Anthropic, the company behind Claude, so the numbers can be read off them. Anthropic runs in the United States, which makes this the one thing in the app that leaves the Canadian region. What is sent is the photograph. Your name, your email, and your account id are not.

Each of these companies processes your data on our instruction, to run the app. None of them are allowed to use it for their own purposes, including to train their own systems, and we do not sell or share your data with anyone else.

If you subscribe in the app, Apple or Google processes the payment; on the web, Stripe does. RevenueCat validates what the stores tell us about a subscription and holds an app user id and your purchase history, and nothing else about you.

Who can see your data

You, and the FORTUS coaching staff. That is the whole list. There are two exceptions and both are spelled out below.

Other men in your cohort cannot see your check-in answers, your journal, your progress photos, your weight, your food logs, or your prayer records. There is no public profile and no way for one client to read another client's records. This is enforced in the database, not just in the interface.

Community

The first exception is Community, and nothing is in it that you did not put there yourself. Community is a set of rooms where the men in the program talk to each other. It is optional: you agree to the Community rules before you can read or post anything in it, and until you do, the rooms are shut to you and nothing of yours is in them.

What the other men in a room see is your name, your photo, and what you post. That is the whole of it. Your check-ins, your journal, your prayer records, your weight, your progress photos and your food log are not in Community and are not opened by it. Nothing is posted on your behalf: a workout, a meal, a weight or a Fidelity number never appears in a room unless you type it there.

The coaching staff read every room, including what is reported and what is removed. Community messages are not encrypted in a way that hides them from us, because we cannot take down what we cannot read, and being able to take it down is the promise that makes a room safe for every other man in it.

We also keep the reports you file and the men you block. A block is private. The man you blocked is never told, and neither is anyone else.

Foods you add

The second exception is the food library, and it runs in one direction only. A food you type in by hand is private: nobody but you and the staff ever sees it, and it is destroyed with your account. A food you add by photographing a nutrition panel is shared, and the screen says so before you add it. The panel is read, you check the numbers and name the food, and when you add it, it joins the shared FORTUS library under that product's barcode, so the next man who scans the same product can log against it. A coach can correct it, confirm it, or take it down.

What is shared is the food, never you. The shared row carries no name, no account id, and no link back to who photographed it. Nobody can look at a food in the library and work out who added it, or what anybody eats. The record that you photographed it stays on your own scan, which only you and your coaches can see, and it is destroyed with your account along with your photograph. What you are giving FORTUS when you add a food to the library is set out in the Terms of Use.

We will disclose data outside that list only if the law requires it.

How long we keep it

While your account is open, we keep your records so your coach can see your history across the program.

Meal photos are the exception in the other direction. They are deleted seven days after you take them, whether or not your account is open, because they are worth nothing once the entry is confirmed.

When your account is deleted, it closes at once and your records are held for a 30 day restore window, then destroyed permanently on the first scheduled purge after that window closes. The purge runs weekly, so the destruction lands within a few days of the 30 day mark. The section below sets out exactly what goes and what does not.

What you posted in Community is the other thing that outlives your account, and it is kept without you. When your account is destroyed, your name and your photo come off every post you wrote in a room and the words themselves are emptied, so what remains is a marker saying something was said there. The replies other men wrote around it still read. A conversation is not only yours, and pulling one man out of it leaves holes in what everybody else said. If you want a particular post gone before you go, delete it yourself and it goes for everyone, immediately.

One thing is kept on purpose after you go, and it is not about you. A food you added to the shared library stays in it, because other men log against it and it describes a product rather than a person. It carries the name and the numbers you gave it and nothing else: no name of yours, no account id, no link back. Your photograph of the panel is destroyed with your account like every other photo you upload.

Deleting your account

There are three ways to start it. Open the app and go to the Me tab, Settings, then Delete account, and type DELETE to confirm. Or email [email protected] from the address on your account and ask, which is the route to use if you can no longer sign in. Or ask your coach to close it for you.

Here is exactly what happens. Your account closes immediately: you are signed out on every device, the app stops working for you, and no further notification is sent to you. Your records are then kept for 30 days, where only the coaching staff can reach them, so an account closed by mistake can be put back. After those 30 days a scheduled job destroys them permanently. That deletion cannot be undone.

What the purge destroys:

• Your profile and your login, so the account no longer exists
• Prayer records and saved prayer notes
• Formation answers and lesson progress
• Habit, objective, and challenge history
• Check-ins and the replies on them
• Weight history
• Step history
• Workouts imported from Apple Health or Health Connect
• Food logs, macro targets, and off-plan marks
• Foods you typed in by hand, which nobody else could see
• Every version of your daily schedule
• Progress photos and your profile picture, the image files themselves
• Label photos and meal photos you uploaded, the image files themselves
• Push tokens and notification history
• Your cohort membership
• Your coach's private notes about you

Three things honestly survive it. Usage analytics events, if analytics was running in your build, sit with PostHog under an account id and carry nothing you wrote, and they are not part of the purge. Operational server logs record that a deletion happened and age out on their own schedule, as do routine encrypted backups. And a food you added to the shared library stays in it, carrying the product's name and numbers and nothing about you, as described above. None of the three is used to rebuild your account or to contact you.

If you want your account back inside those 30 days, ask your coach. After that it is gone and cannot be restored. The full account deletion page is at /delete-account.html.

Your choices

Notifications

Turn any category off in the app's settings, or turn them all off in your device settings. The app still works.

Photos

Uploading progress photos is a task in the program, not a technical requirement. You can decline camera or photo library access and the rest of the app is unaffected.

Community

It is optional and it stays optional. You can decline the Community rules and use the rest of the app with nothing missing. Inside it you can block a man, report a message, mute a room, or delete anything you posted. Ask your coach and he will take you out of Community entirely without touching your coaching.

Corrections

Ask your coach, or email [email protected], and we will correct or remove what you name.

A copy of your data

Email [email protected] from the address on your account and we will send you what we hold.

Children

FORTUS is for adult men enrolled in the coaching program. It is not directed to children, and we do not knowingly collect anything from anyone under 13. If you believe a child has an account, email [email protected] and we will remove it.

Changes to this policy

If we change what we collect or who sees it, we will update this page and change the effective date. Material changes will also be sent to your email. This version is effective 2 October 2026.

Contact

[email protected]