1. Who runs this
Better Beast is a personal independently-run service built and operated by Alex Taliaferro. It is not a company and not a commercial service. If you have a question, concern, or want your data deleted, email alexandertaliaferro1@gmail.com and I will respond personally.
2. What I collect
I only collect what's necessary to run the product:
- Account info — your email address (used to sign in and send the verification link) and your password. Passwords are never stored as plaintext; they are hashed with bcrypt (cost 12) before being written to the database.
- Workout data you create — the plans you generate, the sessions you log, the exercises you save. This is the entire point of the app, so deleting your account also deletes this data.
- Biometric data (optional) — if you connect a Whoop or Oura account, I store an encrypted copy of the OAuth tokens (AES-GCM, keyed by an HKDF-derived per-record key) and a copy of the recovery/readiness readings the providers return. You can disconnect a provider at any time, which deletes both the tokens and the readings.
- Operational data — basic HTTP server logs (request path, status code, request id, user agent). Retained for ~7 days for debugging. No third-party analytics, no advertising trackers, no fingerprinting.
3. What I don't collect
- No Google Analytics, Meta Pixel, Hotjar, or any analytics platform.
- No advertising IDs.
- No location data beyond what's implicit in a request IP.
- No payment information — the service is free and has no billing system.
- No data is sold or shared with marketing partners. There are no marketing partners.
4. Who I share data with
Only the infrastructure providers required to run the app, and only what they need to do their job:
- Fly.io (United States) — runs the application server.
- Neon (United States) — hosts the Postgres database.
- Resend (United States) — sends the email verification message (only your email address is shared).
- Cloudflare (United States) — provides DNS for the scrift.dev domain (no application traffic is proxied through Cloudflare).
- Whoop / Oura (United States) — only if you choose to connect a biometrics account, in which case OAuth flows are between you, them, and the application.
I do not share data with anyone else. There are no advertising or analytics relationships.
5. How long I keep it
Account and workout data is retained until you delete your account or until I take the project offline, whichever comes first. Operational logs are retained for approximately 7 days. Biometric tokens and readings are retained until you disconnect the provider.
6. How to delete your data
Email alexandertaliaferro1@gmail.com from the address on your account and ask for deletion. I'll remove your row and cascading data within 7 days and reply to confirm. (A self-service "delete account" button is on the roadmap; until then, email is the path.)
7. Cookies
The app sets exactly one cookie: session, an opaque HttpOnly
session token used to keep you logged in. It is flagged
Secure; SameSite=Lax, expires after 30 days, and contains no
personal information. There are no tracking, advertising, or analytics
cookies.
8. Security
Passwords are bcrypt-hashed. Session and verification tokens are stored as SHA-256 hashes rather than plaintext, so a database compromise cannot be used to forge active sessions. Biometric OAuth tokens are AES-GCM encrypted at rest with per-record HKDF-derived keys. The application is served over HTTPS (Let's Encrypt certificates via Fly.io). That said: this is a portfolio project, not a hardened production system. Do not store sensitive personal information here.
9. Your rights
Depending on where you live (GDPR / CCPA / state privacy laws), you may have the right to access, correct, or delete your data, and to ask for a copy of what's stored. Email me and I'll honor all of these without arguing.
10. Children
The service is not directed at people under 13 (or 16 in the EU). If you are under that age, please do not create an account.
11. Changes
If this policy changes, the "Last updated" date at the top will reflect it. Material changes will also trigger an email to existing accounts before they take effect.