YOUR DATA.
ITS PURPOSE.
YOUR CONTROL.

This Privacy Policy applies to The Muscle School, the public website, and the learner-account service operated by Endure Beyond Media LLC. It describes how information is collected, used, stored, and shared when you access the public site or create a learner account.

By using the service, you acknowledge this Privacy Policy. This policy is incorporated by reference into the Terms of Use.

When you create an account, you provide:

• Full name — used to personalise your learner record
• Email address — used as your unique account identifier and for account communications
• Password — stored exclusively as a one-way bcrypt hash; the plain-text password is never stored

Support communications: if you contact Endure Beyond Media LLC for assistance, the content of those communications may be retained to resolve your request.

Account modification requests: information provided when requesting changes to your account, data export, or account deletion.

When you access The Muscle School, the following information may be collected automatically:

• IP address — recorded in server access logs by the platform infrastructure
• Browser type and version — captured in server logs and by analytics
• Device type and operating system — captured by analytics
• Referring URL and pages visited — captured by analytics
• Session timing and interaction events — captured by analytics
• Session recordings — visual playback of browser interactions, captured for authenticated sessions by the analytics service
• Security and authentication events — such as login attempts, token issuance, and logout events

Authentication tokens (JWTs) are stored in your browser's localStorage under the key ms.auth.token. These tokens expire automatically after 14 days and are removed when you log out.

If you create an account, The Muscle School records:

• Lesson completion status for each of the 106 lessons
• Module and Act completion status
• Your current position in the curriculum (last-accessed lesson)
• Enrollment status and enrollment date
• The date and version of Terms of Use, Privacy Policy, and Educational Use & Health Policy you accepted at registration

Your reflection and journal entries are stored privately and associated with your account. These entries may contain information you consider personal or health-related. You should avoid submitting information more sensitive than you would be comfortable storing on a third-party server.

The Muscle School is not a health-care provider. See Section 15 for the health-information disclosure.

Information collected is used only for the following purposes:

• Creating and maintaining your learner account
• Authenticating your identity to protect your account
• Saving and displaying your lesson progress and reflections
• Delivering the curriculum and learner experience
• Diagnosing technical errors and maintaining service reliability
• Detecting and preventing security threats and fraud
• Responding to support requests and account inquiries
• Monitoring aggregate usage patterns to improve the service
• Complying with applicable legal obligations
• Enforcing the Terms of Use

Endure Beyond Media LLC does not use your information for targeted advertising, to build commercial profiles for third-party use, or to train any artificial-intelligence system.

Local storage: The Muscle School uses browser localStorage to store your authentication token (ms.auth.token). This is strictly necessary for session continuity. No advertising cookies are used by Endure Beyond Media LLC directly.

Analytics: The Muscle School uses PostHog, an analytics service. PostHog is configured here with person_profiles: "identified_only", meaning personal profiles are created only for users who have signed in. PostHog captures:

• Page views and navigation events
• Interaction events within the application
• Session recordings (visual playback of browser activity) for authenticated sessions
• Device and browser metadata

The PostHog instance used by The Muscle School is hosted at ap.emergent.sh (Emergent platform infrastructure). Data is processed by PostHog BV under their terms and privacy policy. PostHog may use cookies or localStorage to persist its own analytics identifiers.

If you prefer not to be tracked by PostHog, you may use a browser extension that blocks analytics scripts, or contact us to discuss your options. Blocking PostHog does not affect curriculum access.

Information is not sold. It is shared only as described below:

• Hosting infrastructure: {LEGAL_BRAND} is hosted on the Emergent platform. The hosting provider may process server-level data including logs and network traffic as part of operating the infrastructure.
• Database: Learner account data, progress, and reflections are stored in a MongoDB database provided through the platform infrastructure.
• Analytics: PostHog (as described in Section 6) processes usage events and session data.
• Payment processing: Stripe processes payment information for curriculum purchases. See Section 8 for full details.
• Legal: If required by law, court order, or valid government request, information may be disclosed to law-enforcement or regulatory authorities.
• Security: Information may be shared with security services where necessary to investigate or respond to a credible security threat.

No personal data is shared with advertising networks, data brokers, or AI-training platforms.

Purchases of the The Muscle School curriculum are processed by Stripe (Stripe, Inc.), a third-party payment processor. Stripe handles all payment-card transactions. Endure Beyond Media LLC does not receive or store your full payment-card number, card verification value (CVV/CVC), or complete billing street address.

When you make a purchase, the following transaction data is received from Stripe and stored by Endure Beyond Media LLC for fulfillment, reconciliation, and commerce record-keeping:

• Checkout Session ID and Payment Intent ID (Stripe transaction references)
• Transaction amount and currency
• Payment status (e.g., paid, pending) and refund status
• Billing-jurisdiction data: country, state or region, and postal code
• Curriculum entitlement status

Full street billing addresses are not stored by the Endure Beyond Media LLCcommerce ledger. The postal code, country, and state or region are retained for tax telemetry and jurisdiction monitoring purposes only.

Stripe may collect and process additional personal and payment information subject to Stripe's own Privacy Policy and Terms of Service.Endure Beyond Media LLC does not control Stripe's data practices.

For commercial terms governing a purchase, see the Terms of Sale.

Endure Beyond Media LLC does not sell personal information to third parties.

Endure Beyond Media LLC does not share personal information for cross-context behavioural advertising or targeted advertising.

Endure Beyond Media LLC does not use personal information to profile users for consequential automated decisions.

The PostHog analytics service collects usage data as described in Section 6. This data is used for service improvement, not for advertising.

Information is retained for as long as your account is active. If you request deletion of your account, Endure Beyond Media LLC will delete or anonymise your personal information subject to the following:

• Security and server logs may be retained for a limited period as required for fraud prevention and security investigation
• Aggregated, non-identifiable analytics data may be retained indefinitely
• Information may be retained where required by applicable legal obligation
• Backup copies may persist for a limited technical retention window following deletion

Endure Beyond Media LLC implements reasonable technical measures to protect information, including:

• Passwords stored exclusively as bcrypt hashes
• Authentication via signed, time-limited JSON Web Tokens (JWTs)
• HTTPS transport for all communications
• Role-based access controls for staff and administrative functions
• Authentication requirements on all learner-data endpoints

No system is completely secure. Endure Beyond Media LLC does not claim absolute security or guarantee that information will never be accessed by unauthorised parties. If you have identified a security concern, please contact us at legal@endurebeyond.com.

If a data breach occurs that is likely to affect your rights, Endure Beyond Media LLC will provide notification as required by applicable law. Notification will be made through the email address associated with your account and/or through a notice on the service.

You may exercise the following rights by contacting Endure Beyond Media LLC at legal@endurebeyond.com:

• Access: request a summary of the personal information associated with your account
• Correction: request correction of inaccurate account information
• Deletion: request deletion of your account and associated personal information
• Data portability: request an export of your reflections and progress data where technically supported
• Opt-out of PostHog analytics: use a script-blocking browser extension, or contact us
• Account closure: request that your account be closed

Requests will be processed within a reasonable time. Identity verification may be required before certain requests can be fulfilled.

If you are a resident of Texas, the Texas Data Privacy and Security Act (TDPSA) may provide you with additional rights, subject to applicability thresholds and operator-specific analysis. Regardless of formal applicability, Endure Beyond Media LLC offers the following to Texas residents on a voluntary basis:

• The right to know what personal data is being processed about you
• The right to correct inaccurate personal data
• The right to delete personal data you have provided
• The right to obtain a portable copy of your personal data
• The right to opt out of the sale of personal data (no sale currently occurs)

To submit a Texas privacy request or to appeal a response, contact Endure Beyond Media LLC at legal@endurebeyond.com. Include "Texas Privacy Request" in the subject line. Appeal responses will be provided within 60 days of the original response.

Residents of certain other jurisdictions — including California, Virginia, Colorado, Connecticut, Utah, and others — may have privacy rights under their applicable state laws. These rights may include access, correction, deletion, portability, and opt-out rights similar to those described in Section 13.

To submit a request based on your state's privacy law, contact Endure Beyond Media LLC at legal@endurebeyond.com. Endure Beyond Media LLC will make reasonable efforts to respond consistent with applicable law.

The Muscle School is an educational service, not a health-care provider, health plan, or medical professional. Endure Beyond Media LLC is not a HIPAA-covered entity.

The learner reflection and journal system allows learners to write freely about their responses to the curriculum. Depending on what you choose to write, your reflections may contain information you consider health-related — such as observations about your own physical responses to exercise, recovery, or age. You should apply judgment about what personal health detail you include in your reflections.

The Muscle School is intended for adults aged 18 and over. The service is not directed to children under the age of 13. Endure Beyond Media LLC does not knowingly collect personal information from children under 13.

If you believe that a child under 13 has provided personal information to The Muscle School, please contact Endure Beyond Media LLC at legal@endurebeyond.com. Endure Beyond Media LLC will take prompt steps to delete the relevant information.

If you access The Muscle School from outside the United States, your information may be transferred to and processed in the United States, where data-protection laws may differ from those in your country.

This Privacy Policy has not been formally reviewed for GDPR compliance. If you are accessing the service from the European Economic Area or the United Kingdom, you acknowledge that cross-border data transfer may occur and that formal GDPR compliance review has not been completed.

When this Privacy Policy is updated, the version number and last-updated date at the top of this page will be revised. For material changes, Endure Beyond Media LLC will make reasonable efforts to notify registered learners via email or in-service notice before the change takes effect.

Continued use of the service after a material change constitutes your acceptance of the updated policy.

To submit a privacy request, report a concern, or ask a question about this policy:

Endure Beyond Media LLC
Privacy Contact
Email: legal@endurebeyond.com

Please include your name, the email address associated with your account, and a description of your request. Endure Beyond Media LLC will verify your identity before processing requests that affect personal data.