Privacy Policy

Information you provide directly

• Enrollment information — email address, jurisdiction (US state), time zone.
• Payment information — legal name and billing address, collected and stored by Stripe. We receive from Stripe a customer identifier, subscription state, and payment status; we do not receive or store your full card number.
• Consent records — the exact acknowledgments you check during enrollment, the version and cryptographic hash of each legal document at the moment of consent, the date and time, your user agent, and a truncated IP address (last octet zeroed).
• Onboarding responses — your answers to the 11-step onboarding process, including reflections, Ten Questions responses, Personal Tenets, coaching priorities, and any other structured or free-text content you submit.
• Portal messages — messages you send to and receive from your coach.
• Account activity — sessions attended, cancellations, rescheduling, magic-link sign-in events.

Information we generate about you

• Coaching notes — notes the coach writes about coaching topics, priorities, and follow-ups.
• Scheduling records — the times, dates, and status of your coaching sessions.
• Security logs — sign-in events, IP addresses, user agent, and administrative actions taken on your account.

Information we do not collect

• We do not collect analytics data about your browsing at launch.
• We do not use third-party advertising or marketing pixels.
• We do not record coaching sessions by default. See Section 3.

We use your information to:

• Provide the coaching service, including operating the Portal, scheduling sessions, and processing payments.
• Communicate with you about your account, upcoming sessions, and material changes to the service.
• Comply with legal, tax, and accounting obligations.
• Investigate and respond to security incidents.
• Improve the service (in aggregate, without using individual member content for training or marketing).

We do not:

• Sell your personal information.
• Share your personal information with advertisers or data brokers.
• Use your coaching content, onboarding responses, or Portal messages to train artificial-intelligence models — ours or anyone else’s.
• Use your coaching content in marketing, testimonials, or public materials without your separate, explicit written permission for that specific use.

Coaching calls are not recorded by default. Any recording of audio, video, or transcript requires separate, informed consent from every participant for that specific session.

Your Portal messages, onboarding responses, coaching notes, and any recordings or transcripts (if separately consented) will not be submitted to any third-party generative-AI, transcription, summarization, embedding, sentiment-analysis, or model-training service without your specific informed consent and a documented privacy and security review.

If we ever change this policy, we will provide advance notice and, where appropriate, seek re-consent before the change takes effect.

Normal access

• You can access your own Portal content at any time.
• Your coach (currently Jack Johnson, sole coach at launch) can access the Portal content of members assigned to them, for the purpose of coaching.
• Vendors we use (see Section 6) may process your data as necessary to operate the service.

Administrator access

At launch, Jack Johnson is both the founder and the sole coach. As founder, Jack does not use administrator privileges to read coaching content of members assigned to him — that reading happens in the coaching role, subject to normal coaching confidentiality.

We operate a break-glass procedure for genuine emergencies (security incidents, legal compulsion, credible risk to a member or third party) that require administrator access to coaching content beyond the coaching role. Because at launch there is only one internal authorized person, the break-glass procedure uses a single-administrator emergency alternative:

• A documented reason must be recorded before access.
• Access is time-boxed to no more than 24 hours per grant.
• Every break-glass access creates an immutable audit-log entry.
• A retrospective self-review is recorded within 7 days of every break-glass access.

When Jack Johnson Coaching adds a second qualified operator, the break-glass procedure will upgrade to dual approval and this policy will be updated accordingly.

Other rules

• Billing providers (Stripe) do not receive coaching content.
• Email and SMS notifications do not contain substantive coaching content — only account, scheduling, and administrative messages.
• No member ever sees another member’s information.

We retain information for as long as it is needed to provide the service, comply with legal obligations, resolve disputes, and enforce our agreements.

After a retention period ends, data is deleted from active systems and, on the next rolling backup cycle, from backups.

If a member requests earlier deletion (see Section 7), we honor that request within 30 days for data we control, subject to legal obligations that require longer retention (e.g., tax records).

We use the following vendors to operate the service. Each is bound by contractual data-protection commitments through their standard data-processing terms.

We will update this list when vendors change. Material changes to the vendor list will be communicated per Section 19 of the Terms of Service.

You have the following rights regarding your information:

• Access — Request a copy of the personal information we hold about you.
• Correction — Ask us to correct information that is inaccurate or incomplete.
• Deletion — Ask us to delete your personal information, subject to legal retention obligations (e.g., we must retain billing records for tax purposes).
• Export — Receive a portable copy of your Portal content in a common structured format.

To exercise any of these rights, email jack@jackjohnsoncoaching.com. We respond within 30 days.

California residents

In addition to the above, California residents have specific rights under the California Consumer Privacy Act (CCPA/CPRA), including the right to know what personal information we collect, the right to delete, the right to correct, the right to opt out of sale or sharing (we do not sell or share for cross-context advertising), and the right not to be discriminated against for exercising any of these rights. To exercise these rights, email the address above and identify yourself as a California resident.

We do not use “sensitive personal information” as defined by CPRA for any purpose other than providing the service you requested.

We take reasonable security measures to protect your information, including:

• Encryption in transit (TLS) for all Portal traffic.
• Encryption at rest for database contents (via Supabase).
• Magic-link authentication (no member passwords are stored).
• Row-level security policies enforcing that members can only access their own content.
• Immutable audit logging for administrative and break-glass actions.
• Restricted vendor access, using least-privilege principles.

No system is perfectly secure. If we experience a security incident that affects your personal information, we will notify you as required by applicable law.

Jack Johnson Coaching is for adults only. We do not knowingly collect information from anyone under 18. If we discover that we have collected information from a person under 18, we will delete it.

We may update this Privacy Policy from time to time. Each version is labeled with a version number and an effective date in the header.

Material changes will be communicated by email at least 30 days before they take effect and, where required, we will ask you to re-consent when you next sign in to the Portal. Non-material changes will be noted in the Portal with 7 days’ notice.

For privacy questions, rights requests, or complaints:

Stoneveil Holdings LLC
30 N Gould St #51730
Sheridan, WY 82801
jack@jackjohnsoncoaching.com

If you believe we have not adequately addressed a privacy concern, you may have the right to lodge a complaint with a data-protection authority in your jurisdiction.