# Product and data policy

This is the implementation boundary for the current 14-day product, not a published privacy notice or a replacement for the parties' commercial agreement.

## Public and private surfaces

| Surface | Allowed content |
| --- | --- |
| Public card | Member-chosen display name and optional portrait, streak, level, concise training/recovery label, creator branding, public creator join link, and earned free-round message. |
| Public join page | Creator identity, plain product rules, minimal signup fields, and price only when paid launch is enabled. |
| Checkout | Purchase description, price, and information needed to fulfill the round. Stripe handles card details. |
| Private check-in | Daily entries, effective schedule, history, personal access, photo controls, and preferences. |
| Screenshot-ready report | Aggregate creator counts; no participant names, contact details, or private entries. |
| Protected operator ledger | Payment and membership records needed to reconcile fees, holds, refunds, disputes, and shares. |

Never print personal access tokens, email addresses, phone numbers, payment details, Scripture, family goals, or other private context on a card or checkout page. There is no private faith/context feature in this release. Do not add one by treating Anthony's architecture language as a requirement to collect more data. A chosen portrait or name becomes public if the member shares the card; neither is a hidden watermark.

## Access and communication

Private check-in links are credentials. Confirmation/recovery responses do not disclose another member's link. The same signed link can be reused until its authorization version or signing secret changes. A public creator link contains no member credential.

Preview stores sample progress, name, and goals but discards submitted email and phone; no charges or messages are sent. Real email signup and optional SMS remain off until configured and tested. SMS requires an email-authenticated member's explicit phone confirmation and opt-in. Email and SMS reminder controls are independent; confirmation and recovery messages remain transactional. Two-way coaching is separately enabled after the member consents and proves control of their phone. Social DM bots and automatic social posting are not included.

Photos are authenticated stored objects; only the member-selected portrait is rendered on their shareable card. Public creator reports expose aggregate counts. Access controls, request rate limits, message retry limits, and bounded job batches apply independently of provider availability. Actual provider billing remains the provider account's responsibility. An application delivery cap does not guarantee a provider's charges.

## Completion and money

Protein, sleep, and movement are daily; strength is a weekly goal and never blocks daily completion. Planned recovery counts when the daily requirements are met. Midnight Eastern is the cutoff. Each 14-day round allows two grace days, which preserve the consistency count but are shown separately from actual completed check-ins. A further miss resets the streak. There is no leaderboard, wager, cash prize, token, or spendable point system.

The first paid round is $29; later rounds are $49 for 14 days, manually purchased. A seven-day streak earns one free next round per person. The free round is access, not revenue or a paid renewal. No automatic billing, automatic payout, or missed-day refund/extension is performed.

The standard creator revenue split is 80% creator and 20% platform after actual processing fees. Protected financial records distinguish pending fees, settlement, holds, refunds, and disputes. A calculated balance or payout request is not a funds transfer. Private compensation agreements are outside the public specifications.

Live payment acceptance and transfers remain off until the operator connects and verifies the relevant services. No upstream influencer referral percentage is implied by the standard creator split.

## Scope and publication

The public library exposes six named, deterministic function specifications: check-in, card, captions, daily guidance, creator report, and regimen. They describe ordinary application rules and templates. They do not claim that an AI model is running.

Following a specification bookmarks its current version in the browser. Forking creates an editable JSON draft that can be downloaded. Neither action sends notifications, deploys code, changes the hosted challenge, or gives access to another creator's data.

The application source repository is private. The public library contains reviewed product documents, regimen information, and editable JSON function specifications. It does not provide application source downloads, private operational records, member data, or credentials. No application reuse license or rights to the brand and artwork are granted by publishing these product documents.

Marketplace, tokens, upstream referral commissions, and Instagram/TikTok inbox automation remain outside this loop. Provider-backed payment, email, and SMS need account configuration and real-service validation before they can be enabled.

## Private coaching

Coaching is optional and separate from check-in completion. After the member consents, their message, selected screenshot, relevant training settings, and conversation context are sent to Claude. The private reflection, member contact details, personal access links, payment details, and other members' data are excluded. Coaching replies cannot automatically save a check-in or change the approved plan.

Only authenticated, email-verified real members with an active round can use live coaching. Preview/demo members do not generate model calls. Screenshots remain private stored objects, never card assets or creator-report attachments. Members can delete their conversation and uploaded screenshots. Creator reports show aggregate usage rather than transcripts. No reuse for public model evaluation or training is authorized by joining the challenge.

AI spending caps and daily message/image quotas are not enabled. Usage is recorded for visibility. Identity and ownership checks, consent, bounded valid image uploads, duplicate-request protection, and provider timeouts still apply. A draft phone number is not proof of ownership; inbound SMS access requires the separate one-time linking flow.