Privacy Policy

Effective 6 October 2026. This policy applies to strength-potential.com and to the Strength Potential mobile app.

Strength Potential Ltd ("we", "us"), a company registered in England and Wales, company no. 17429437, registered office 56 Thomas Street, Nelson, Lancashire BB9 9AY, operates strength-potential.com and the Strength Potential mobile app. This policy explains what personal data we collect through either of those and what we do with it.

When you place an order: your name, delivery address, email and payment details (handled directly by Stripe, our payment provider — we never see or store full card numbers). When you contact us, sign up for updates or apply as an ambassador: your name and email address, plus whatever else you choose to tell us in a message — for example a training background or a social handle on the app's Community screen. If you join the mailing list or apply as an ambassador, we also record the box you tick to confirm you are old enough (16 or over for the list, 18 or over for ambassadors), so that we have a record of what you told us.

We use a small number of processors to provide parts of this service on our behalf: Stripe to take payment, and Netlify to host this website, the app's checkout and order functions, and the Contact, Community, mailing-list and review forms. Netlify acts only on our instructions and does not use your data for its own purposes. Stripe also processes payment data as an independent controller in its own right, for its own fraud prevention and legal checks such as anti-money-laundering, under its own privacy policy at stripe.com/gb/privacy.

When we post your order, Royal Mail receives your name, delivery address and email address, so that we can print the delivery label and so that they can email you the tracking number.

Where your data is handled: Stripe and Netlify may process your data outside the UK, mainly in the United States. Stripe may also use service providers in the EU and India. Stripe, LLC and Netlify, Inc. are both certified under the UK Extension to the EU-U.S. Data Privacy Framework. Where that does not cover a transfer, Stripe uses standard contractual clauses with the UK International Data Transfer Addendum, and Netlify uses standard contractual clauses. To ask for a copy of these safeguards, email info@strength-potential.com.

Email you send us is handled by Namecheap, Inc., which hosts our mailbox on servers in the United States under its own privacy policy at namecheap.com/legal/general/privacy-policy. We read and answer it in Microsoft Outlook, so Microsoft also holds a copy on its servers, which may be outside the UK, under its privacy statement at privacy.microsoft.com.

Your shopping bag: what you put in the bag is kept in your own browser's session storage, so it survives moving between pages, and it is cleared when you close the tab. It never leaves your device, we cannot read it, and it is not used to track you. No advertising or analytics cookies are set anywhere on this site.

Health Connect (Strength Potential app for Android only). Writing: if you turn on the Health Connect option in More → What this app keeps, the app writes each workout you finish (its start, end and name) and, if you choose, each drink you log to Android's Health Connect on your phone, where other health apps you have allowed can read it. Google's Health Connect terms then apply to that copy. Reading your steps: if you connect Steps, the app reads your daily step totals from Health Connect, and nothing else, to show your progress, your goal, your streak, your achievements and the SP points you earn. It never reads your heart rate, sleep, location or any other health data, and it never writes steps. Your steps are worked out on your phone and are never sent to us. The app keeps your goal, your achievements and a record of each SP point (the day, that day's steps and your goal) on your phone, and the "Clear the Steps data" button in More → What this app keeps removes them. Both options are off unless you turn them on. Our use of information received from Health Connect follows the Health Connect Permissions policy, including its Limited Use requirements. You can remove the app's access, or delete what it wrote, at any time in Health Connect (App permissions → Strength Potential), and the app stops reading straight away.

Meal photos. If you add a photo of a meal in the app's Food tab, the app saves a copy in its own storage on your phone, without the location or other details your camera records. We never receive it, and it is not shared with anyone. The app uses your camera only when you tap "Take a photo"; if you choose a photo instead, Android's photo picker gives the app only the photo you choose. Photos are deleted with their day after 14 days, and you can delete one at any time, or all of them with "Delete log".

Reviews. If you send us a review, we keep what you write, your name, your email address and your order number. We use them to check the review against your order, to keep fake reviews off our website, and to reply to you. We do this because we have a legitimate interest in publishing only genuine reviews, which the law also expects of us. We publish your review on strength-potential.com only if you agree, using the name you choose (first name and town, first name only, or no name). You can withdraw that agreement at any time by emailing info@strength-potential.com, and we will take your review down within 7 days. We never publish your email address or order number. The review form is handled by Netlify, as set out above. We keep the private record of each review for two years after we decide on it, then delete it, with the form submission.

Processing and delivering your order, replying to enquiries, and — only if you sign up for it — sending occasional news about new drops, restocks and training content. We never sell your data to third parties.

Our lawful bases are: performing our contract with you (orders and delivery); our legal obligations (keeping order and accounting records for tax); our legitimate interests (replying to enquiries, considering ambassador applications, checking reviews against orders, and protecting against fraud); and your consent (marketing emails, and publishing a review you send us, which you can withdraw at any time). If a buyer is under 18 and the contract basis does not apply, we rely on our legitimate interests to process their order. Order and accounting records are kept for six years after the end of the tax year they relate to, as UK tax law requires; enquiry emails are kept for two years; ambassador applications are kept for two years from the date of the application; marketing contacts are kept until you unsubscribe. You can ask us to delete your contact details at any time by emailing info@strength-potential.com.

Your IP address: like any website, our hosting provider, Netlify, receives the IP address of the device that opens this site or uses the app's checkout, forms or order lookup. We use it only for security, to limit repeated requests such as order lookups from one connection. Netlify also stores it with each Contact, Community, mailing-list and review form message, which we keep for as long as the message itself (see above).

How we keep your data safe: everything the app and this website send to us travels over an encrypted connection (HTTPS), and card numbers never reach us. The accounts that hold your data (Netlify, Stripe, our mailbox and Royal Mail Click & Drop) are used only by Strength Potential Ltd and are protected with two-step sign-in.

Young people. There is no account, and the app never asks your age. The only two places we ask are the mailing list, which is for people aged 16 and over, and ambassador applications, which are for people aged 18 and over — in both, you tell us yourself by ticking a box. Otherwise the app works the same for everyone: nothing you log is sent to us, and Health Connect starts switched off. If you are under 18, you can ask us what we hold about you, ask us to delete it, or tell us about a concern, by emailing info@strength-potential.com. A parent or carer can help you do that.

Under UK GDPR (and, if you are in the EU, the EU GDPR) you can ask what data we hold about you, ask us to correct or delete it, or withdraw consent to marketing emails at any time — every newsletter email includes an unsubscribe link. If you think we have handled your data badly, you can complain to us by emailing info@strength-potential.com or by writing to us at our registered office above. We will acknowledge your complaint within 30 days, look into it without undue delay, keep you updated and tell you the outcome. You can also complain to the Information Commission (the ICO) at ico.org.uk or on 0303 123 1113, though it will usually expect you to have raised the complaint with us first.

For any question about this policy, or to make a data request, email info@strength-potential.com directly — we handle these ourselves, no call centre in between.