Privacy — LifeMax

I am the data controller for everything described here. There are no staff. If you write to reodannathan@gmail.com, I read it.

There is one way into LifeMax: a free account. It takes no card and holds the Foundation, the first chapters of HealthMax and FocusMax, two tools and one 30-minute call with me. LifeMax Club, the paid membership, is opened on that same account, from inside it. It is from $9.99 a month, priced by the account's number — the first 10 accounts pay $9.99, the next 40 $14.99, the next 50 $19.99, and from account 101 it is $42, for good (the terms, section 06). This page describes every part of the system, including the parts only LifeMax Club members reach.

Paying — joining or upgrading to LifeMax Club — happens on a Stripe Checkout page the site opens for you, and payments are processed for me by Stripe. Stripe handles card data on its own pages under its own privacy policy — card numbers never reach this site, the member service, or me.

00The short version

The site sets no cookies, runs no analytics, and carries no tracking pixel, tag manager, session recorder or heatmap. There is no advertising script on any page.
The public pages make two off-site requests: Google Fonts, and my own service on Cloudflare — the front page asks it where the price ladder stands, and the sign-up, log-in, reset and contact pages, and the weekly email's form, send it what you type. Pressing Upgrade inside the club sends you on to Stripe's own checkout page. "Continue with Google", where it is offered, sends you to Google's own sign-in page. All of it is named and explained below.
Everything I store about you sits with Cloudflare: one Workers KV store holds your record and nearly everything else; what you log in the club's tools sits in one Cloudflare D1 database, in the United States; and the messages from the old chat, which closed on 15 October 2026, are kept in Cloudflare Durable Objects, one per channel — as are the emailed sign-in codes and their counters, one per email address, where codes are switched on.
Every account, free or paid, is an email address and a password — or, where it is offered, your Google account instead of a password, and in the iPhone app your Apple ID or a code emailed to you — and a nickname. The password is stored only as a hash. An earlier version of this page said there were no accounts and no passwords. That is no longer true, and section 4 says exactly what changed.
A free account is shown to nobody. For a LifeMax Club member, some of it is shown to other members by default: your nickname and avatar (or your own profile picture, if you upload one) wherever you appear; your level and XP on the leaderboard and on your profile; and a line in the room when you complete a pillar or reach a milestone level. One switch in Settings takes you off the leaderboard and cuts your profile down to your nickname, avatar and join month; another stops the wins. Section 5 is the whole list.
Nothing is graded, and only two tools ever send a photo. A chapter is complete when you have watched it to the end and set up the tool it asks for, or when we cover it on a call; there is no proof box. The face score measures your photo on your own phone and never uploads it. The hairstyle try-on — a LifeMax Club tool you have to press — sends the one photo you choose to Google's Gemini image model for one edit. The club keeps neither the photo nor the result, but Google keeps what it is sent for up to 55 days, to check for abuse. The try-on uses Google's paid service, so Google does not use any of it to improve its products. And the Food log's "Snap a meal", another LifeMax Club tool you have to press, sends the one meal photo you choose to Anthropic for LifeMax AI to read once; the club never stores it. Section 3b.
The AI is Claude, made by Anthropic. When you use the coach or any AI feature, what that feature needs from your account is sent to Anthropic to write the answer — never your email, your password, your payment details or your full name — and it is not used to train its models. The coach is sent a summary of what you log in the tools, and while it answers it can look up more of your own history, read-only. In the iPhone app, LifeMax AI asks your permission before it first sends anything, and can send a LifeMax Club member up to two short check-ins a day, which he can switch off. Section 3b says exactly what goes.
What your chapters have you set up is saved to your account. Almost every chapter asks you to set up one of the club's tools. What you log in them is kept in the club, so it is on every device, it fills your daily To do, and the AI can read it when you use an AI feature. I do not open it to read it, no other member sees it, and you can export it or erase it in Settings at any time. Before a call I can ask the AI for a short brief written from it, and a habit you mark private is left out of that brief. The club stores only the photos you choose to upload as your profile picture or a pillar's cover. Section 3a says what that means, and section 3b is all of it.
Home asks you a few short questions a day — how you slept, what you ate, whether you moved. You can pick an answer, type one, or press Don't know. What you answer is kept and logged into the right tool — a picked answer as it is, a typed one after LifeMax AI (Claude) reads it — and it never writes over anything you logged yourself. Your three scores are worked out from what you log and are not stored. Section 3b.
A device can fill in your trackers, if you connect one. Apple Health (through the LifeMax iPhone app, a Shortcut or the Health Auto Export app on your iPhone), WHOOP or a Withings scale can send sleep, steps, heart rate, HRV, workouts and weight. Nothing is connected until you do it, what a device sends never overwrites what you typed, and Disconnect in Settings stops it and deletes its keys at once. Section 3b.
There is an iPhone app, and it is the same account. It carries no analytics, no advertising and no tracking code — no code from any company but Apple. What it adds is section 3c: signing in with Apple, notifications delivered by Apple, buying LifeMax Club from Apple, and, only if you connect it, Apple Health. What the app reads from Apple Health is never used for advertising or marketing, never sold, and never shared with anyone but Cloudflare, which stores it for me, and Anthropic, which reads it only to answer you.
There is a weekly email, and you choose. One short email every Tuesday, 9am your time, from me, sent by Kit. A new account gets it unless you untick the box, ticked for you, when you sign up; the public form sends nothing until you confirm your address; accounts made before 16 October 2026 are not added, and are asked once. Every email has an unsubscribe link, and Settings has a switch. Section 11.
You can delete your account yourself. Settings → Delete my account, in the app or on the site, erases it at once. Section 10 says exactly what goes, and the little it cannot reach.
Almost nothing expires on its own. These do: login, sign-up and code-sending counters (within an hour); an emailed code (15 minutes); a reset link I send you (an hour); a Google sign-in in progress (10 minutes); a WHOOP or Withings sign-in you start and don't finish (15 minutes); a half-finished sign-up and the count of wrong code tries (a day); an upgrade reference (two hours); Stripe's last answer about your subscription (six hours); the payment reference from signup (seven days); a barcode's answer from Open Food Facts (a week, or a day if it found nothing); a payment I could not check with Stripe yet (30 days); the record of which app notifications you were sent (30 days); and your notifications (90 days). Everything else stays until you delete it — one thing at a time, or your whole account in Settings — or ask me to. I say so rather than pretend a cron job exists.
Where Malaysia's PDPA and the UK/EU rules disagree, I hold myself to the stricter one.

01What happens when you just open the site

Opening a page does not create a record with me. A few things do happen, and you should know about each of them.

Server logs. The site and the member service both run on Cloudflare Workers, and the iPhone app talks to the same member service. Cloudflare keeps its own request logs for both — your IP address, the page or endpoint requested, the time, and your browser's user-agent string. These are Cloudflare's logs, on its retention schedule, and I use them for nothing except working out why something broke.

Google Fonts. The public pages load two typefaces from fonts.googleapis.com and fonts.gstatic.com. That request tells Google your IP address and your browser. I get nothing from it and I do not ask Google for anything about you — but the request is real, it leaves your device, and pretending otherwise would be a lie by omission.

The price ladder. Opening the front page asks my service where the price ladder stands: how many accounts there are, and each rung's price and places left. Nothing about you is sent with the question or stored because of it, beyond the request log above. The count is every account, free or paid, and never mine.

Very little is stored on your device, and none of it is a cookie. Your browser keeps, in its own storage: your appearance (dark or light); on the free Five Honest Numbers page, what you type into its card, so closing the tab halfway does not lose it; on the Life Map score page, your twelve answers; and in the member area, a focus session that is running and the length you last picked, your shopping-list ticks, whether you have read the face score's explanation or seen the club's tour, and how you last sorted the feed and the Progress charts; while you set up your account, your answers to the joining questions so far, so a reload picks up where you left off; a message to me you have not sent yet, in that tab only; and, on the public pages once the app is out, whether you told the "LifeMax for iPhone" line that you already have it, or "Not now" and until when. None of that leaves your device and I never see it, apart from the joining answers, which are also saved to your account as you go. The member area also keeps your private link (section 4) on the device, so the club opens signed in from your Home Screen or from a reminder; it is only ever sent to my service, and Log out deletes it. And once you have opened the member area, a small service worker is installed: a script that shows a plain page when you are offline and delivers reminders. It keeps a copy of that page and the club's icon, and nothing else. Two things live only in one tab and are deleted once used: your private link, while you are on Stripe's checkout or billing page after pressing Upgrade or Billing, so the tab can bring you back signed in; and the Google sign-in value described below. My own control page holds my admin key in session storage while I am signed in — that is my device, not yours. And if you press "Continue with Google", that tab keeps one random value in its session storage for the minute or so the sign-in takes, so the sign-in can only finish in the tab that started it — nobody can send you a finished sign-in of their own. It is deleted the moment it is used, it never leaves your device except to be checked, and it says nothing about you.

Stripe's checkout. Pressing Upgrade sends you to a checkout page on Stripe's own site. Whatever Stripe stores in your browser there is under Stripe's privacy policy, not this one.

The App Store. Pressing Download on the "LifeMax for iPhone" line or card opens Apple's App Store, under Apple's privacy policy. On a computer it shows a QR code instead, drawn by the page itself: nothing is fetched to make it.

02What I collect when you book a call

Calls are booked from inside the club. Since 25 September 2026 there is no public booking form: the free call comes with a free account, and LifeMax Club members book from the same diary. A booking holds the slot, your nickname (your name, if you have no nickname yet), your account email, whether it is your free call or which pillar you picked, a reference to your account, and when you booked. The call is also added to the list on your record (section 3), with whether it is booked, held, done or cancelled — which is how the one free call is counted.

The calendar shows that a slot is taken. It never shows who took it. Booked slots are drawn struck through so the diary does not make a busy week look like a quiet one, but the only thing sent to your browser is a timestamp.

Booking a call sends you no email. When you book a call, I get an email — your nickname, your name if it is different, your email, your country if you set one, and the time — with a calendar invite, so the call lands in my own calendar. When you cancel one, I get a shorter one: your nickname and the time. That email is sent for me by Resend (section 7) and goes to my inbox only. I contact you personally before your call. If I cannot make a call, you get one email from the club saying so, with a link to pick another time.

The public booking form, before 25 September 2026. It asked for a name, the country you would call from, how to reach you and that contact's value — an email address, a phone number or a handle — and an optional note. If you booked through it, that booking is still held exactly as it was, and it is deleted on the same schedule as every booking: 90 days after the call, or 30 days if the call did not happen (section 8). Ask and it goes sooner. Nothing more is collected that way: the form is gone from the site and my service refuses it.

The waiting list is closed. There is no waiting-list form anywhere on the site any more. If you left your email on it before it closed, I still hold that address, the date you left it, and which part of the site you left it on. Nothing else. It is not added to the weekly email (section 11), it is not passed to anyone, and it is deleted the moment you ask.

If you wrote about your health in the old form's note box — or about your sexuality, religion, or anything else the law treats as special-category data — I hold it only because you chose to write it, and it is deleted the moment you ask.

03What I hold once you have an account

You make an account with an email address, a password and a nickname (or with Google, where that is offered, and in the iPhone app with Apple or a code emailed to you), and answer six questions. If you pay, by upgrading, you do it on Stripe's checkout, or in the iPhone app, where Apple sells it. Your member record, and the few records kept beside it, hold this, free or paid alike unless a line says otherwise:

Your name: From you — at a free sign-up it is your nickname unless you give another — or from checkout, or from Google
Your nickname: What you choose to be called in the room. This is the only name other members ever see.
Your email: Used to log in, and how I reach you
Your weekly-email choice: Whether you want the weekly email, when you said so, when its welcome email was sent to you, and the time zone it follows, so it arrives on Tuesday at 9am your time (section 11)
Your password: Stored as a hash only — see section 4
How you sign in: Whether the account was made with a password, with Google, with Apple or with an emailed code, and whether in the iPhone app; when; and when your email address was confirmed — by a code I emailed you, by Google or by Apple. If you use Google, also the ID number Google gives your Google account; if you use Apple, the identifier Apple gives you and, where it is set up, Apple's sign-in key, encrypted — see section 4
Your access token: 22 random characters, generated for you
Your six answers: The onboarding questions, listed below
The date you joined: Set automatically
How you signed up: A free sign-up, a checkout, or the iPhone app
Your plan: Free or LifeMax Club; when it last changed and why, as a short log of the last twenty changes; whether you have ever been a paying member; when a paid membership ended and what Stripe or Apple said about it; and when it came back, or when you upgraded
Your account's number: Its place in the order accounts were made — every account, free or paid, never mine. It sets what LifeMax Club costs you (the terms, section 06). Kept beside your record, and shown to you, never to another member
Your Stripe references: If you have paid: your Stripe customer, subscription and checkout references — never your card — so the member service can ask Stripe whether your membership is still running, and so coming back uses the same billing record
Your App Store references: If you bought LifeMax Club in the iPhone app: the references Apple sends about that subscription, and the random reference that ties it to your account — never your card or your Apple account. Section 3c lists them
Your country and time zone: Asked when you join, filled in from your device for you to confirm, and changeable in Settings. They show call times on your own clock, and they decide when your day starts and ends, for your To do and your streak — UTC if you have not set one
How far you have watched: For each chapter's video: the furthest point you have reached, the video's length, when the player last reported, and when you reached the end. Any tick you made yourself on the old briefings, marking one watched, is kept as it was and counts for nothing
Your 18+ confirmation: If your account has no age I can read and you confirm you are 18 or over to open an 18+ chapter, the date you confirmed it
Your completed chapters: Which chapters are complete, when, and how — by you, watched and set up, or marked by me after a call — and, if I ever correct a call mark I made by mistake, the date of that correction. Also the date you first opened each pillar's scorecard, which a pillar's last chapter asks for
Your XP ledger: Which chapter was completed and when, the XP it paid, the bonus for each pillar you complete, and each full day on your To do and each streak that paid XP. Your level and your rank are worked out from this every time they are shown; neither is stored on its own
Your trophies: Which trophies you have earned, and when. Once earned, a trophy is kept, even if you later erase the tools data that earned it
Your connected devices: If you connect one: which (Apple Health from the iPhone app or a Shortcut, Health Auto Export, WHOOP, Withings), when, when it last sent anything, and the key it uses — the secret in your Apple Health sync link; a one-way fingerprint of your Health Auto Export key (never the key itself); for WHOOP and Withings, their user number for you and their access keys, encrypted. If you said you don't use a wearable, or asked for a direct connection to another brand, that too — section 3b
Your avatar: The mark, colour and frame you choose in Settings, stored as three choices from a fixed list. A profile picture, if you upload one, is kept separately (section 3)
Your leaderboard setting: Shown or hidden. You are shown unless you hide yourself
Your wins setting: On or off. It is on unless you turn it off
Your answer about the app: If you answer the "LifeMax for iPhone" card on the club's Home: "I've already got it" or "Not now", when, and when "Not now" runs out, 14 days later, so it is not shown again before then
The tour: When you finished the club's tour, so it is not shown again unless you ask for it
Your notifications: Each one's type, its text — for a reply or a mention, a short quote of what was written — who it came from (nickname and avatar), a link, when, and whether you have read it. Each is deleted automatically 90 days after it is made. Alongside them, a small record of what you have read, which call reminders and new-video notices you have already had, and which wins have already been posted, so nothing is sent twice
My note: A short private note I can keep on your record, up to 500 characters. It is part of your own record, so it is not hidden from you; it is never shown to another member
Your to-do items: Kept with the tools since 27 September 2026 — section 3b
Your posts and comments: Everything you put in the room, including wins posted for you
Your likes, reactions and votes: Which posts and comments in the room you liked; and on my announcements, your comments, your reactions, your poll votes, the ones you saved, and the newest one you have opened, so the club knows what is unread
A testimonial, if you send one: What you wrote at the end of a chapter and, if you recorded or uploaded one, the video (up to 90 seconds and 20 MB), with the chapter, the day, your nickname and first name and which of the two you chose to be quoted under, whether you ticked "LifeMax may quote this on the site", and whether I have chosen it. Only I see it
Your chat messages: The chat closed on 15 October 2026, so nothing new is added. What you wrote there before, in which channel, when, and the nickname you had at the time, is kept in that channel's own storage, not in your member record
Your messages with me: What you send me in Messages and what I send back: the text, when it was sent, and when it was read. Only you and I can see them. Kept in the same database as the tools, not in your member record
Your booked calls: Which slots you took, when, which pillar if you picked one, and whether each is booked, held, done or cancelled

The six questions. When you join I ask your age; which pillars you want to work on (or all six, in order); what you have already tried that did not stick; how much time a week you can give it; your dream outcome; and anything else I should know or you would like to tell me. Only your age and the pillars are required: you can skip the rest. Only I read these. They are never shown to another member and never shown in the room. Answer them for me, not for an audience.

Watching is recorded, and only as far as you have really got. While a chapter's video plays, the player tells my service where it is; the furthest point you have reached is kept, and it can only move forward about as fast as the video plays. That is how "no skipping ahead" works. Watching to the end is part of completing a chapter; almost every chapter also asks you to set up a tool.

Watched and set up, not proof. A chapter is complete when you have watched it to the end and set up the tool it asks for, or when we cover it on a call and I mark it done. Nothing is uploaded and nothing is graded: whether a tool is set up is read from what is in it (an entry, a plan, a rule), never from what the numbers say. The quizzes are retired, so no quiz record is made any more.

Completed chapters stay completed. A completed chapter is stored against your record with its date and the XP it paid, and it stays yours even if you leave. The same goes for a completed pillar. A chapter you completed yourself is never undone. A call mark is undone only if I made it by mistake, and the record keeps the date of that correction rather than quietly editing it away.

Why the game data is held. The XP ledger is how your level, your rank and your pillars are shown to you, and it is what the leaderboard, your profile and your wins are drawn from. The avatar, the leaderboard setting and the wins setting exist so you decide how you appear. Your time zone exists so "today" on your To do means your today.

Checking your subscription. While you are a paying member, the member service asks Stripe whether your subscription is still running: at most once every six hours when you open the member area, and once a day otherwise. It keeps the last answer — the subscription's status and when it asked — for up to six hours. If the subscription has ended, your account becomes a free account and nothing on it is deleted; if Stripe later shows it running again, it goes back. A question Stripe fails to answer is never read as a cancellation. A membership bought in the iPhone app is checked with Apple instead (section 3c).

Your to-do list is private. No other member sees it and I do not open it. It moved into the tools on 27 September 2026 (section 3b), where LifeMax AI reads it when you use it. It is a scratchpad, not a submission.

03aYour chapter records, and your photos

What your chapters have you set up is kept in the club. Almost every chapter asks you to set up one of the club's tools — a row in Five Honest Numbers, your wake-up time in Sleep & wake, a habit in the Habit tracker, a rule in Standards, an entry in the Journal tagged to the chapter. What you log there is saved to your account, in the tools' database, and section 3b lists every field. Until 28 September 2026 the lessons had you keep these records in the notes app on your own phone, and the club never saw them. That has changed: the club now holds what you log in the tools. Nothing is logged for you, except what the Apple Health sync sends if you switch it on, and what LifeMax AI logs from your answers to Home's questions (section 3b). It is your record, not a submission.

I do not open it to read it. No other member sees it. Before a call I can ask the AI for a short brief written from your account, which leaves out any habit you mark private (section 3b). On the call, you choose what else to show me, I do not copy it, and a one-to-one call is not recorded unless we both agree (section 6).
The club stores only two kinds of photo, and only if you upload them. Since 1 October 2026 a LifeMax Club member can upload a profile picture, and any member can upload his own cover photo for a pillar. Your phone shrinks each one before it is sent, and it is kept in the club's store on Cloudflare under a random address that says nothing about whose it is. Your profile picture is shown wherever your avatar would be (section 5); a cover is shown only to you. Remove or replace either in Settings and the old file is deleted at once. The pillars' other covers — my photos, stock photos or the drawn System covers — are the site's own pictures, not yours: which set you chose is kept on your record as a setting, and choosing one uploads nothing. No chapter asks you to upload a photo: the screenshot behind a number you log, such as a sleep summary, a scale or a lab report, stays on your phone; the tool records the number and the date. The face score measures its photo on your phone, the hairstyle try-on sends the one photo you choose to Google, and the Food log's "Snap a meal" sends the one meal photo you choose to Anthropic for a single reading; the club keeps none of them (section 3b).
Where your photos are backed up is between you and your phone. They can stay on your phone only, or be backed up to a cloud account of your own — iCloud, Google Photos or another. Those are your accounts, under their own terms, and the club has no access to any of them. If you made an album called LifeMax for the lessons, it is still on your phone. Lock your phone.
Notes you kept before are still yours. They are in the notes app on your phone, where they always were, and the club never had them. Nothing is moved into the tools for you.
Take it or erase it whenever you like. Settings → Your data exports everything you logged, or erases it. If you leave, it stays on your account until you erase it or delete the account (section 10); the photos on your phone stay there, because they were never on my side.
The Journal is not where a crisis goes. Nobody is watching what you write in the tools, me included. The help page has the numbers.

03bThe tools, and the AI

Since 27 September 2026 the club has tools, and what you log in them is saved to your account — in a database of its own, Cloudflare D1 in the United States, beside your member record — so it is there on every device and so LifeMax AI can read it. Since 28 September 2026 almost every chapter has you set one up (section 3a). Nothing is logged for you except what a device you connect sends, if you connect one, and what LifeMax AI logs from your answers to Home's questions (both below): every other row is something you typed, pressed or chose to save. The free account has two of them, Five Honest Numbers and the focus timer with its goal, beside the daily check-in and three coach messages a day; LifeMax Club members have all of them. What you saved in a tool a free account does not hold is kept, and opens again when you join. Your daily To do, and each pillar's scorecard, are worked out from these rows when you open them and are not stored on their own.

Your to-do list: Each task, its due date, the chapter it belongs to if you chose one, when you made it and when you ticked it. Your old list moved here on its own
Focus sessions: The goal you wrote, the length you planned, the minutes the timer counted, whether you finished or stopped early, when, and the debrief if you asked for one
Trackers: What you enter in each: bed and wake times; the five rows of Five Honest Numbers; blood markers (testosterone and SHBG among them), the lab, the draw time and what your GP said; your training sets; your morning weight and tape measurements, with a note; the initials, times, kind and source of the time you spend with people; your five claims with their hours and money; which steps of your grooming routine you did or missed each day; each activity session, with what, how long and which zone; your steps and your resting heart rate, typed or synced; each reset you do, with your stress before and after; and each habit's count for the day
The tools' settings: What you set up once, each with the date you last changed it: your wake-up time and bedtime; your guess, your Training Charter and your routine's steps; your height and weight-trend target; your activities and weekly targets; your go-to resets; your habits, with the route you chose for each, and whether you marked it private; your North Star, with its rules and affirmations; your environment checklist and if-then plans; your training plan; and your focus goal
Standards: Each rule a chapter has you set, an identity statement or a conduct page among them: its words, its kind, its minimum if it has one, the chapter it belongs to, the date you set it and whether you have retired it — and, for each day, which you kept, kept at their minimum, or missed
The Journal: Each entry you write — today's line, a chapter's record tagged with that chapter, or the Sunday review — with its date, and the daily prompts you chose
Face-score numbers: The score, the four part-scores, what to work on, when, and the AI's tips if you asked for them. Never the photo — see below
Daily check-ins: Sleep, energy, mood and stress out of five, and the one line you write
Reminders: Each one's text, time, days and time zone, and when it last went off. For each device where you turned notifications on: the address its browser gave for delivering them, its two encryption keys, the kind of device, and when a reminder last reached it
The diet planner: The details you gave it — goal, age, height, weight, activity, training days, meals, diet and any note on it, allergies, likes, budget, currency, country — and the plan it wrote
The Food log: A LifeMax Club tool, since 16 October 2026. Each food or drink you log: its name, calories, protein, carbs and fat, how much, which meal, whether you typed it, scanned its barcode or took it from a photo, and the barcode's number if you scanned one; and whether you asked for it on your To do. Each day's totals, set against your diet plan's targets, are worked out when you open it and are not stored. Never the meal photo — see below
The coach: Your conversations with it, each kept as its own chat with a short title, and with each practice scene; the goals you give it; a short summary it keeps of what matters, rewritten every dozen or so messages; and each change it suggests to your tools or goals, with what it would change and whether you applied it. Nothing it suggests is changed until you press Apply
Your day plan: The latest one, if you asked for it
AI use: How many AI requests you made each day, meal photos each day, and try-ons each month, so the limits work. Counts only
LifeMax AI's check-ins: If you get them (below): each check-in, kept as a message in your "Check-ins" chat with LifeMax AI; and a short log of each day's morning and evening one — whether it was written by the AI, in plain words, or skipped — so none is ever sent twice

The face score's photo never leaves your phone. The score is measured in your browser by an open-source face model the site serves itself: 478 points on your face, and the photo's own pixels. The photo is not uploaded — not to the club, not to anyone — and it is gone when you close the page. Only if you press Save are the numbers sent, and never a picture. On the public face page nothing is saved at all.

Home's questions, and your three scores (1 October 2026). Through the day Home asks you one short question at a time — how you slept, how you feel, what you ate (when you have a diet plan), whether you moved, your habits, a win, what you have put into practice from your last chapter. Most have their answers to pick — wheels for your height, weight and sleep times, options for the rest — and a picked answer is logged as it is, without being sent to Anthropic. Each answer is kept with the question, in the tools' database. A typed answer is read by LifeMax AI — the question, your answer, the time, and, where it needs them, your diet plan's targets and rules, your habit names, or your last chapter's title — and logs what it finds into the tool it belongs to: your sleep and wake times, a check-in, a meal with a rough estimate of calories, protein and quality, water, an activity, your habit counts, or a Journal line. Those rows are marked as logged by the AI, and it never writes over anything you logged yourself that day. With the AI off or used up for the day, a plain reading of times and minutes does the same without Anthropic. "Don't know" logs nothing: it is kept only as that, with the question, and for your height, weight, goal and food answers the question then waits two weeks before it asks again. LifeMax AI sees your answers from the last seven days when you talk to it. Your three scores — Consistency, Improvement and Optimized — and the Progress charts are worked out from your rows each time you open them, and are not stored. LifeMax AI's insights for the day are kept until it writes the next day's.

About you (4 October 2026). One page in the club holds what the advice is fitted to, if you fill it in: your height, age, goals, training experience, where you train, how many days and how long, injuries, diet, allergies, your food budget, how much you cook and how often you eat out, your wake time and your work or school hours, and the units you use. LifeMax AI and Home's questions can ask for any of it and save your answer there; a weight you give anywhere is saved as that day's weigh-in in Body measurements. It is kept in the tools' database, beside your other logs, and you can change or clear it any time.

The AI is Claude, made by Anthropic. When you use an AI feature — the coach (LifeMax AI), a practice scene, a focus debrief, a tracker read, face-score tips, a day plan, a diet plan, a training plan, reading your answer to one of Home's questions, reading a meal photo for the Food log, LifeMax AI's check-ins, or your insights on the LifeMax AI page — my service sends Anthropic what that feature needs to answer you: your message and the conversation so far; for a tracker read, that one tool's recent entries and its settings; for the diet plan and the training plan, your About you answers and the details you gave it; and, for the coach and the day plan, a summary of your account and of what you log in the tools, About you included. That summary is your nickname, whether you have a free account or are a LifeMax Club member and when you joined, your answers to the joining questions, your chapters, level, XP, rank and full days on your To do, and your next call; your open to-dos; the last seven days of focus sessions, and your focus goal; your last seven wake times, and your sleep targets; your latest Five Honest Numbers, face score (the numbers, never the photo) and blood panel; your last three check-ins; your diet plan's targets; the Standards you hold and your grooming routine, with how the last seven days went; your latest Journal entries; your first and latest body measurements; the last seven days of your training, Contact log, activity, steps, resets and habits; your latest time and money audit; your North Star and the rules you think by; your training plan; and your goals, with the coach's own summary of you. While it answers, the coach can also look things up: up to 90 days of your history in most of those tools, read-only and only yours, when a question needs more than the summary. What it looks up goes to Anthropic with your question; the club keeps only the answer, in your conversation. Never your email, your password, your payment details or your full name — and never your private link, any photo but a meal photo you send for reading, or anything of another member's. Under Anthropic's commercial terms, what is sent through its service is not used to train its models, and Anthropic keeps it only for the limited period its own policy sets. The requests leave from the United States, through a relay in Cloudflare there, because Anthropic does not serve every country.

In the iPhone app, LifeMax AI asks first. Before you use LifeMax AI in the app for the first time, the app asks your permission to send your chats and what you log to Anthropic, as this section describes. Nothing about that changes what is sent, or that Anthropic does not train on it.

The Food log's photo and barcode (16 October 2026). Both only fill in the form: nothing is saved until you have checked it and logged it. Snap a meal sends the one photo you take or choose — with a line of your own, if you add one — to Anthropic, for LifeMax AI to list what it sees with rough numbers. It goes for that one reading and is never stored by the club; Anthropic keeps it only as its policy says, and does not train on it. A barcode you type, or the app reads with your phone's camera, goes to my service, which asks Open Food Facts, an open database of food products, what that number is. Only the number goes: the question comes from my service, so Open Food Facts never learns your name, your account or your IP address. Its answer is kept in Cloudflare's cache, keyed by the barcode alone, for a week — a number it does not know, for a day — so the next scan of the same product does not ask again.

LifeMax AI's check-ins (16 October 2026). A LifeMax Club member with the iPhone app and its notifications on can get up to two short messages a day from LifeMax AI: a plan in the morning, and in the evening a nudge, only if his To do is not done. Each is written by Anthropic's Claude from a few facts and nothing else: the time on your clock, the names of today's items and which are done, the chapter you are on, your three scores this week against last, and the time of a call today, if there is one. Never your name or your email. It is saved in your "Check-ins" chat, where you can answer it like any other, and sent to your phone, and to any browser you allowed reminders on. With the AI off, or your day's AI used up, it is written in plain words from the same facts, without Anthropic. Change their times, or turn them off, in the app's notification settings. A free account gets none.

The hairstyle try-on is the one tool that sends a photo to Google. When you press a style, the photo you chose — shrunk on your phone first — goes to Google's Gemini image model with an instruction to change the hair, and the edited image comes straight back to you. The club stores neither image. Google does keep what it is sent: under the Gemini API's terms, the photo, the instruction and the result, for up to 55 days, to check for abuse and for any disclosure the law requires, and a flagged request can be looked at by a person at Google. The try-on runs on a paid Google key, so Google does not use any of it to improve its products. Only use a photo of yourself.

Connected devices are optional, and nothing is connected until you connect it (Settings → Connected devices). Each one only adds readings to your own trackers, as entries marked with where they came from ("from WHOOP"), and never overwrites an entry you typed for the same day. Only these are kept:

Apple Health, from the LifeMax iPhone app: Only after you tap Connect in the app and allow it on Apple's own Health screen. The app reads Apple Health on your phone and sends whole days: steps and active energy; resting heart rate and HRV; last night's bed time, wake time and minutes asleep; your weight; and each workout's type, when it started and how long it lasted. Anything else that arrives is thrown away unread. Settings → Connected devices then shows "iPhone app (Apple Health)" and when it last sent anything. If you allow it on the same screen, the app can also save the weigh-ins you log in it to Apple Health on your phone
Apple Health, by Shortcut: A personal sync link, with its own secret, separate from your private link. A Shortcut on your iPhone sends last night's bed time, wake time and minutes asleep, the day before's steps, and your resting heart rate (and, if you add them, HRV and weight). It runs when you open an app you choose, and the first complete send each day is kept. The link can add entries, never read anything; making a new one retires the old one
Apple Health, by Health Auto Export: An iPhone app made by another company, which you install and pay for yourself. It sends, with a key you paste into it: sleep (bed, wake, minutes asleep), steps, active energy, exercise minutes, resting heart rate, HRV, weight and each workout's type and length. Anything else it sends is thrown away unread. I keep only a one-way fingerprint of the key
WHOOP: You sign in on WHOOP's own page and choose to share. I keep: last night's bed and wake times and minutes asleep, resting heart rate, HRV, each workout's sport, length and effort zone, and the weight on your WHOOP profile when it changes. I never keep your recovery or strain scores, SpO2, skin temperature, or your WHOOP name or email. WHOOP tells me when a record changes and I fetch it, and once a day I check the last three days in case something was missed
Withings: You sign in on Withings' own page. I keep your weight, one reading a day (the latest), when you step on the scale. Body fat and the rest are never fetched

What it is for. To fill in your trackers so you don't have to, to show it back to you, to work out your To do and scores, and so LifeMax AI can answer you about your own sleep, training and weight when you ask it something. When it does, those entries go to Anthropic with the rest of the summary it reads (above), to answer you and nothing else. No data from any device is used to train an AI model — not by me, and not by Anthropic, which does not train on what the club sends it; WHOOP's terms forbid it too. It is never sold, never used for ads, and never shown to another member.

Apple Health from the iPhone app, in particular. What the app reads from Apple Health is used for one thing: to fill in your own trackers and scores, and so LifeMax AI can answer you about them (and write your check-ins). It is never used for advertising or marketing, never sold, and never shared with anyone but the two companies that run the club for me: Cloudflare, which stores it, and Anthropic, which reads it only to answer you. Neither the app nor the club stores it in iCloud. No other member sees it, and I do not open it to read it; the short brief I can ask for before a call you booked (below) is written from the same summary LifeMax AI reads.

The keys are protected. WHOOP and Withings access keys are stored encrypted, with a key that is not kept in the database, and are only used to fetch the readings above. Garmin, Oura, Fitbit and others are not connected directly: you can turn on their own Apple Health sync and use the Apple Health option.

Disconnect, and delete. Disconnect in Settings stops a device at once: the sync link stops working, the Health Auto Export key is refused, and WHOOP and Withings keys are deleted (and WHOOP and Withings are told to stop). The iPhone app's Apple Health is switched off in the app itself, and you can also take LifeMax's access away in your iPhone's own Health settings at any time. What a device already sent stays in your trackers, as your history, until you press Delete beside it — that deletes every entry it filled in and keeps what you typed yourself — or until you delete your account.

Who reads it. No other member sees anything in the tools. I do not open your tools data to read it — the Journal, Standards and your chapter records included. Before a call I can ask the AI for a short brief — who you are, what you have done, what is slipping, three questions to ask you — written from the same summary the coach reads, less any habit you have marked private. The coach still reads a private habit, so it can help you with it. The brief is shown to me once and not stored.

Take it, or erase it, yourself. Settings → Your data → Export gives you one file with everything on your record and in the tools, your messages with me, your place on the weekly email's list, who you have blocked and what you have reported, except my private note and your plan's log of changes (ask me for either), your password hash, and the keys and Google and Stripe references behind your sign-in and billing. Erase deletes every row in the tools at once: tasks, sessions, trackers — the Journal, Standards, your habits, the Food log and everything a connected device sent included — scores, check-ins, reminders and their devices, plans, the coach's conversations and memory (LifeMax AI's check-ins and their log among them), and the usage counts. Your account, chapters, XP and trophies stay, and so do your messages with me, your blocks and reports, your phones' notification settings and your device connections: disconnect those in Settings too if you want nothing more sent. Deleting your whole account is section 10.

None of it is medical advice. The coach, the plans and the tips can be wrong, and none of them is a doctor, a dietitian or a therapist. Neither is a number from Apple Health or a meal photo's reading. The terms say the same.

03cThe iPhone app

The LifeMax app for iPhone is the same account as the website, not a second one. It reads and writes the same record and the same tools through the same member service on Cloudflare, so what you do in one is there in the other, and everything in sections 3 to 3b applies to it. This section is what the app adds. The app carries no analytics, no advertising and no tracking code — no code from any company but Apple.

Sign in with Apple: If you choose it: the identifier Apple makes for you and LifeMax, the email address Apple gives me — a relay address of Apple's if you chose Hide My Email — and your name, if you let Apple share it the first time. Where it is set up, also Apple's sign-in key, encrypted, kept for one use (section 4)
Your phones: For each iPhone where you allow notifications: the address Apple gives for delivering to it (its push token), whether it is a developer's test build, the app's version, the phone's time zone, when it was added, when Apple last accepted a notification for it, and how many in a row have failed. Up to ten phones; a phone that signs in as somebody else moves to him
Your notification settings: Your morning and evening times, and which kinds you want: LifeMax AI, reminders, the community, my messages and calls; and whether you said yes to LifeMax AI in the app (section 3b). Until you change them: 08:00, 21:00, all on except LifeMax AI's check-ins, which stay off until you turn them on and say yes to LifeMax AI
Which notifications you were sent: For the community and calls only: which post, announcement or call a notification was about and when it went, so you are never sent the same one twice. No text, nothing about who caused it
Your App Store subscription: If you buy LifeMax Club in the app: a random reference made for your account and handed to Apple with the purchase, so it can open this account and no other; Apple's transaction numbers for it; the product and its rung; when the current period ends; whether it is set to renew; whether Apple reported a billing problem; whether it was a real purchase or Apple's test system; when it started and when I last heard; and, if it ends, whether it expired or was refunded or revoked. Never your card, your Apple ID or anything else about your Apple account
Apple Health, the Food log and the check-ins: Section 3b

Notifications reach your iPhone through Apple. My service sends each one — its title, its words, and the place in the app it opens — to Apple Push Notification service, which delivers it. The connection to Apple is encrypted, but unlike the reminders your browser gets, a notification to the app is not encrypted end to end: Apple's service carries its text. What goes this way is what you have left on: the reminders you set; my messages to you; my announcements, with their first line; a comment on your post or a reply to your comment in the room, or my answer to your comment on an announcement, with the writer's nickname and the first few words; a reminder before a call you booked, and the Sunday call starting; and LifeMax AI's check-ins. Turn a kind off in the app's settings, or all of them in your iPhone's Settings. Sign out of the app on a phone and that phone's token is deleted; it is deleted too when Apple says it is no longer valid, or when five notifications in a row fail.

Buying LifeMax Club in the app. In the app, Apple sells you LifeMax Club through the App Store, at the price your account's number carries (the terms, section 06b). Apple takes the payment and keeps your card and its own purchase records under its own privacy policy; I never see them. When you buy, my service checks the purchase with Apple's own server, the App Store Server API, before it opens anything. Apple then tells my service when the subscription renews, fails to renew, is switched off, ends or is refunded, and each time my service asks Apple again rather than trusting the message; once a day it also asks about any App Store membership whose period has ended. If you already pay on the website, the app does not sell you a second membership.

On the phone itself. The app keeps your private link (section 4) in the iPhone's keychain, not synced to your other devices; a copy of your account's main page, so it opens straight away; and a small summary for the Home Screen widgets — your nickname, how much of Today is done, your three scores, your streak, level and rank, and when your next calls are. Signing out of the app deletes all three. It also remembers your appearance, a few small choices of yours as the website does (the timer length you last picked, your shopping-list ticks, how you sort the feed), and its push token, so that signing out can remove it from my service.

04Your account, your password, and your private link

This is the part that changed, so read it properly.

Your private link is what actually authenticates you. It carries a 22-character token in its address, and that token is the whole of your authentication. Logging in with your email and password does one thing: it recovers that link and hands it back to you. It is not a second factor and it does not add a second lock. Anyone holding the link is you, as far as the system is concerned.

Someone with your link can read your name, your email, your six answers, your completed chapters and XP, your notifications, your calls, your connected devices and everything in the tools — and can post, comment and use the coach as you.
The link sits in your browser history.
Do not screenshot the address bar and do not paste the link anywhere.
The member area is marked noindex, nofollow and sends no referrer, so the token is not handed to any site you click through to. Neither of those protects you from forwarding it yourself.
The token travels in the web address, which means it can appear in Cloudflare's request logs.
Log out, or reset your password, and the old link stops working everywhere, the iPhone app included — a new one is made and the next log-in hands it to you. Think somebody else has it? Log out, or tell me and I close it the same day.
It never goes to Stripe: when you open Billing or Upgrade, the tab keeps it and Stripe is given an address without it.

Your password is never stored. What is stored is a PBKDF2-SHA256 hash at 100,000 iterations with a random 16-byte salt unique to you. The password you typed is not written to the record, not written to any log, and never sent back to anyone — including me. I cannot look up your password because there is nothing to look up.

Resetting your password. Where the reset page offers it, you can reset it yourself with a six-digit code emailed to your account address — see "Emailed codes" below. Whether or not it does, you can email me at reodannathan@gmail.com and I send you a link that lets you set a new one. It works once and expires after an hour. Either way, setting a new password clears the lockout your failed attempts caused.

Emailed codes. Where it is switched on, making an account needs a six-digit code I email to the address you give, so nobody can make an account on an address that is not theirs; and the reset page can send one to reset your password. The emails are sent for me by Resend (section 7), which receives your email address and the text of that one email — the code — and nothing else about you. The code is stored only as a keyed hash, works once, and expires after 15 minutes; five wrong tries and it is dead, and no address takes more than ten wrong tries in a day, however many codes it is sent. To stop the codes being used to flood an inbox, I count how many are sent to each address and from each IP address, and those counters expire on their own within an hour; the count of wrong tries against an address is kept for a day, and holds only the times, never what was typed. A half-finished sign-up waiting for its code — the name, nickname and address you typed, and a hash of your password, never the password — is deleted when the code arrives, or on its own after a day. Where codes are not switched on yet, a free account is made without checking the address, so somebody could sign up with an address that is not theirs. If you find an account on your address that you did not make, tell me and I delete it. The reset page gives the same answer whether or not an address has an account, so it cannot be used to find out who is a member. These emails, the welcome email when you join the weekly email, the weekly email itself if you get it, and the email if I have to move a call are the only automated emails this site sends, and they are never used for anything else.

Continue with Google. Where it is offered, you can sign in with your Google account instead of a password. If you choose it, Google tells me your email address, whether Google has verified it, your name as it is on your Google account, and the ID number Google uses for that account. I keep the ID number and your email address on your record so the same Google account opens the same membership; I use your name as the account's name only if I do not already have one. If no account uses your Google account or its address yet and you pressed it on the sign-up page, it makes you a free account; on the log-in page it does not. I do not receive your Google password, your contacts, your calendar, your files, your photo, or anything from your inbox, and I cannot post or act as you on Google — the only permission asked for is "openid email profile", which is sign-in and nothing more. While the sign-in is in progress, a one-use record of it sits in the same KV store and expires after 10 minutes; its last step, handing the sign-in back to the tab that started it, is a one-use record that expires after 2 minutes. Google signs you in under its own privacy policy; what it does with the fact that you signed in somewhere is Google's, not mine. You can stop using Google at any time: reset a password by email, or ask me.

Sign in with Apple, in the iPhone app. In the app you can sign in with your Apple ID. Apple tells me an identifier it makes for you and LifeMax, your email address — or, if you chose Hide My Email, a relay address of Apple's that forwards to you — and, the first time only and only if you let it, your name. I keep the identifier and the address on your record, so the same Apple ID opens the same account; the name becomes the account's name only if the account is new. I never receive your Apple ID password. Where Apple's sign-in key is set up, my service also trades the one-use code Apple sends with a sign-in for a longer-lived key, and keeps it encrypted, with a key that is not kept in the database, for one use: when you delete your account, it tells Apple to withdraw LifeMax's sign-in, as Apple requires. A relay address matches nothing on the website, so to open a website account in the app, use "Already have a website account?", which emails you a code.

Google, and emailed codes, in the app. "Continue with Google" works in the app as it does on the site, and Google tells me the same things. The app can also sign you in with a six-digit code emailed to your address, under the same rules and limits as above, instead of a password. In the app, any of the three makes you a free account if none is on that identity or address yet.

The app keeps your private link too. It holds it in the iPhone's keychain rather than in a web address, so it is not in a browser history or a screenshot of the address bar. Signing out of the app deletes it from that phone and forgets that phone's notifications, but it does not retire the link, because the website uses the same one: log out on the website, or set a new password, and it is retired everywhere, the app included.

Sign-ups are counted too. To stop one machine filling the club with accounts, sign-ups are counted by the IP address they came from, in the same KV store, and that counter expires on its own within an hour.

Login attempts are rate-limited. To stop somebody guessing their way into an account, failed logins are counted two ways: by the IP address the attempt came from, and by the email address it was made against. Both counters live in the same Cloudflare KV store as your record, and both expire on their own within an hour. Nothing about a login attempt is kept beyond that, and it is never used to profile you or work out where you are.

05What other members can see about you

On a free account, nothing. The room, the leaderboard, profiles and wins are for LifeMax Club members, so a free account appears in none of them: it is not on the leaderboard, other members cannot open its profile, nobody can @mention it, and no wins are posted for it. If your LifeMax Club membership ends, what you already posted stays under your nickname — section 8 says how to have it removed — but your profile closes and you leave the leaderboard until you upgrade again.

As a LifeMax Club member, by default: your nickname and your avatar wherever you appear — your own profile picture in its place, if you uploaded one — and your level and your XP. Your pillar covers are never shown to anyone but you. Here is exactly where, and how to turn each part down.

The room. The room is the community feed, where members post, comment, and reply once beneath a comment. Everything you write there is visible to every other member, under your nickname. Write with that in mind — a room is not a private message. The chat — seven channels, General and one per pillar — closed on 15 October 2026; messages already written there are kept as section 8 says.

Likes, and my announcements. Other members can see who liked a post or a comment in the room. A comment you write on one of my announcements is seen by every account, free accounts included, under your nickname. Reactions and poll votes there show to other members only as counts.

The leaderboard, unless you hide yourself. You are on it by default. It shows your nickname, your avatar, your level and your XP. It never shows your real name, and never a breakdown by pillar. Hiding yourself is one switch in Settings; it works at once, and you can switch back whenever you like.

Your profile. Any member can open it by clicking your nickname or avatar. While you are on the leaderboard it shows your nickname, your avatar, the month you joined, your level, your XP, which pillars you have completed, and how many chapters you have completed in all. If you have hidden yourself, it shows only your nickname, your avatar and the month you joined — and the avatar without its frame, because frames are earned by level.

Wins, unless you turn them off. When you complete a pillar or reach a milestone level, a short line saying so — "Completed all 8 HealthMax chapters.", or "Reached level 10." — is posted to the room under your nickname. That is on by default. Turn it off in Settings and nothing more is posted; turning it back on never posts what happened in between. A win already posted is a post like any other of yours, and you can delete it. Wins are their own switch: hiding yourself from the leaderboard does not stop them.

Mentions and replies. When someone replies to you or writes @ and your nickname in the room, you get a notification with a short quote of what they wrote. Nobody else sees your notifications.

Never shown to another member: your real name, your email address, your password or anything derived from it, your private link, your country and time zone, your six onboarding answers, your account's number, your to-do list and anything else you log in the tools, your connected devices and what they send, which individual chapters you have completed and how far you have watched, your XP by pillar, your To do, your streak, your rank and your trophies, your notifications, your booked calls, my note on your record, how you pay, your phones, LifeMax AI's check-ins, who you have blocked and what you have reported.

There is no public wall. Nothing in the room, the old chat, the leaderboard or a profile is visible to the open internet — only to members who are signed in.

I can delete anything in the room, and any old chat message. A post, a comment, a reply, a message — mine or yours. There is no appeal process and I am not going to pretend there is one.

05aReporting, and blocking

Anything another member writes can be reported, and any member can be blocked, from the "…" beside a post, a comment or a reply in the room, or a comment on one of my announcements — in the app and on the site. Since 16 October 2026 the club keeps:

A report: Who made it; what was reported — a post, a comment or reply, or an announcement comment — and who wrote it; the reason picked (spam or selling, bullying or hate, sexual content, violence or self-harm, or something else); a note in the reporter's own words, if he adds one, up to 300 characters; when; and whether I kept the item or removed it, and when. At most 20 reports a day each
A block: Who blocked whom, the nickname he had then (for the Blocked members list in Settings), and when

What a report does. I get a notification in the club and an email, sent for me by Resend, with the reporter's nickname, the nickname of the member who wrote it, the reason, the note, and what it says. I look at every report within 24 hours and keep the item or remove it. The member reported is never told who reported him. Once three members have reported the same thing, it is hidden from everyone but its author and me until I have looked; its author sees that it is hidden.

What a block does. You stop seeing what he writes — his posts, comments, replies and announcement comments — and nothing he does rings your bell. He is not told. Unblock him in Settings → Blocked members whenever you like. My own account cannot be blocked: report what I wrote, or message me.

Your reports and blocks are in your export (section 3b), and erasing your tools leaves them alone. Deleting your account deletes them, and with them the reports about anything you wrote and anyone's blocks on you.

06Live calls and recordings

Calls run on Zoom. Zoom sees your name as you enter it, your audio, your video if you turn it on, and your IP address, under its own privacy policy. There are two kinds: the one-to-one calls you book from the diary — as many as there are free slots for a LifeMax Club member, one for a free account — and the weekly community call open to every LifeMax Club member.

The Sunday call is recorded when everyone on it agrees — I ask at the start of every call, and one "no" means it is not recorded. It runs on Zoom; a recording is made on my own machine and kept by me rather than in Zoom’s cloud, and posted for LifeMax Club members who could not attend.
Consent is per session, not per membership. You are asked each time.
Camera off is always fine and costs you nothing. Attendance is never conditional on being recorded.
Your one-to-one calls are not recorded unless you and I both agree to it, on that call, for that call. The terms say the same thing, deliberately.
If you want to be cut afterwards, you ask and it is done — removed within 7 days, everywhere.

Nothing said in a crisis or a private disclosure is ever recorded, quoted, or repeated anywhere.

07Who else touches your data

Cloudflare, Inc.: Serves the website and runs the booking and member service on Cloudflare Workers, stores every record in Workers KV — including your password hash and the login rate-limit counters — keeps what you log in the tools in a D1 database in the United States, and keeps the old chat's messages, and the emailed codes with their counters, in Durable Objects. Sees everything in sections 2, 3, 3a, 3b, 3c, 4 and 5a, plus request logs: IP, page, time, browser.
Anthropic, PBC: Runs Claude, the AI in the coach and the tools. Sees what section 3b says an AI feature sends, when you use one — a meal photo you send for reading, and the facts LifeMax AI's check-ins are written from, included. Does not train its models on it.
Apple Inc.: Only if you use the iPhone app. Runs Sign in with Apple, if you choose it, and tells me what section 4 lists. Delivers the app's notifications, and so carries their text (section 3c). Sells LifeMax Club in the app through the App Store, takes the payment, and keeps your card and its own purchase records under its own terms; it tells my service what section 3c lists. Apple Health keeps your health data on your phone; what the app reads there comes to my service from the app, not from Apple.
Google LLC: Serves two typefaces on the public pages, and hosts my email. Sees your IP and browser on page load, and whatever you write to me. If you choose "Continue with Google", runs that sign-in and tells me what section 4 lists. If you use the hairstyle try-on, runs the image model that one photo is sent to, and keeps what it is sent for up to 55 days to check for abuse (section 3b).
Your browser's push service: Apple, Google or Mozilla, depending on your browser. Carries a reminder, or another notification you left on, from my service to your device. Each one is encrypted for your browser before it leaves, so the service carries text it cannot read; it sees the delivery address and when.
Resend: Sends the club's emails: the six-digit sign-up, sign-in and password-reset codes where emailed codes are switched on, the one welcome email when you join the weekly email (your address, and your nickname or first name in its greeting), and — to me only — the notices of a call booked or cancelled, a contact-form message, a message you send me in the club (its text and your nickname), or a report (section 5a). Sees the addresses and the text of each email it sends, and nothing else.
Kit: Kit (kit.com, formerly ConvertKit) holds the weekly email's list and sends it, only if you are on it (section 11). Sees your email address, your nickname as the first name, when and where you joined the list, whether you have a free account or LifeMax Club, and a tag for your time zone (so the email arrives on Tuesday at 9am your time). Records whether each email arrives, is opened and which links in it are clicked, as email services do. Nothing else from your account goes to it
Stripe, Inc.: Runs the checkout page the site sends you to and takes the payment. Sees your name, email and card details — on Stripe's pages, not mine. I read back from it whether a payment went through, and, a few times a day, whether your subscription is still running. A free account never reaches Stripe.
WHOOP, Inc.: Only if you connect WHOOP. Runs the sign-in where you agree to share, and sends the readings section 3b lists when I ask for them with your key. Learns that you use the club. I send it nothing about you
Withings: Only if you connect a Withings scale. Runs the sign-in, and sends your weigh-ins when I ask with your key. Learns that you use the club. I send it nothing about you
Health Auto Export: Only if you use it: an app on your iPhone, from another company, that you install yourself. It sends to the club directly; what it does on your phone is between you and it
Open Food Facts: Only when you look up a barcode in the Food log. An open database of food products, run as a non-profit. My service asks it about the barcode's number and nothing else: it never learns who you are or your IP address
Zoom Video Communications: Hosts the live calls. Sees your display name, audio, video and IP.

I do not sell your data. I do not share it for advertising. I have never run an ad pixel, and the weekly email's list is never sold, rented or shared with anyone for their own use.

Your data is held outside the EU, and it leaves your country. I am in Malaysia and that is where I read it. Cloudflare runs a global network, and the tools' database is in the United States. Stripe, Google, Anthropic, Resend, Kit and Zoom are American companies. Each of these providers publishes data-processing terms incorporating the European Commission's Standard Contractual Clauses, and those clauses are what these transfers rest on. If you want the current links, ask and I will send them. Apple, also American, handles Sign in with Apple, the App Store and the app's notifications under its own privacy policy. Open Food Facts is only ever sent a barcode number, which says nothing about you.

08How long I keep things

The things that leave the system on a timer, without me doing it by hand, are the ones section 00 lists: counters, codes and short-lived sign-in records, a few references and caches, the record of which app notifications you were sent, and your notifications after 90 days. Nothing else deletes itself on a timer. Everything else below goes when you delete it — or your whole account, in Settings (section 10) — or when I delete it by hand, and I would rather say that than imply machinery I have not built.

Booking records — call happened: 90 days after the call, then deleted — bookings from the old public form included
Booking records — call didn't happen: 30 days, then deleted
Waiting-list email, from before the list closed: Until I have told you the first pillar's briefings are filmed, or until you ask me to remove it — whichever comes first
Your account, free or paid: For as long as you keep it. A free account does not expire on its own
The weekly email's list: Your address (and nickname, if you have an account), where and when you joined, the free or LifeMax Club tag, your time zone, and when the welcome email went: for as long as you want the email. Unsubscribe and it stops at once; the club keeps a note that you said no, so you are not added again, until you delete your account or ask me. Kit keeps an unsubscribed address only as unsubscribed, so it is never emailed again; ask me, or Kit, and Kit erases it completely
Your account, after a paid membership ends: It stays, as a free account, with everything on it, so you can come back to it and so the dates on your completed chapters stay true. Deleted the moment you delete it in Settings, or the day you ask me to, and not before
Your plan and its log, your Stripe and App Store references, and how you signed up: Part of your member record — kept and deleted with it. Stripe and Apple keep their own payment records (below)
Your Apple identifier, the address Apple gave, and Apple's sign-in key: Kept with your record, and deleted with it. The key is used once, as the account goes, to withdraw Apple's sign-in
Your phones and their push tokens: Until you sign out of the app on that phone, Apple says the token is no longer valid, five notifications in a row fail, a newer phone pushes out the oldest of more than ten, or your account is deleted
The app's notification settings: Until your account is deleted
Which notifications you were sent: 30 days, or until your account is deleted. A notification waiting to go out to everyone (a new announcement, the Sunday call) is held only until it is sent, usually seconds
What the app keeps on your phone: Your private link, a copy of your account's main page and the widgets' summary: until you sign out of the app
Your account's number: Kept beside your record for as long as the account exists, and deleted with it
A message from the contact page: Your name, email and message, kept for a year, then deleted on their own. Ask and I delete it sooner.
Your messages with me: Kept for as long as your account exists, and deleted with it. Erasing your tools does not erase them; exporting your data includes them
Your password hash and salt: Deleted with your record
Your completed chapters, how far you have watched, your XP ledger, trophies, avatar, time zone and settings: Part of your member record — kept and deleted with it, as above
My note on your record: Deleted with your record
Your notifications: 90 days each — they expire on their own. The small record of what you have read and been sent is deleted with your record
What you log in the tools, your chapter records and anything a connected device sent included: For as long as you keep it. Delete one device's entries, or erase it all, yourself in Settings at any time, or it goes when your account is deleted
Your device connections: the Apple Health sync link, the Health Auto Export key's fingerprint, WHOOP and Withings keys: Until you disconnect in Settings or make a new link or key, and deleted the moment you do; they go when your account is deleted. A WHOOP or Withings sign-in you start and don't finish is forgotten within 15 minutes
The coach's conversation and memory: Until you start a new conversation, tell it to forget, or erase your tools data
LifeMax AI's check-ins and their log: Like the coach's conversations: until you erase your tools data, or your account is deleted
A meal photo: Never stored by the club — sent to Anthropic for one reading, and kept there only as its policy says
A barcode's answer from Open Food Facts: A week in Cloudflare's cache — a day if it found nothing — keyed by the barcode alone, with nothing about who asked
Devices set to receive reminders: Until you turn notifications off, your browser withdraws the address, or five reminders in a row cannot be delivered
The face score's photo: Never stored — measured on your phone and gone when you close the page
Your profile picture and pillar covers: Until you remove or replace them in Settings (the old file is deleted at once), or your account is closed or deleted. A profile picture you uploaded is kept but not shown while you are a free member
The photos on your phone: Never stored by the club — the screenshots behind your logs stay on your own phone (section 3a)
Your answers to Home's questions: Like everything you log in the tools: until you delete them or erase your tools data
The try-on's photo and image: Not stored by the club. Google keeps what it is sent for up to 55 days, to check for abuse (section 3b)
Your posts and comments in the room, wins included: Deleted on request, by you, or with your account; otherwise they stay in the room
Your likes, reactions, votes and saved announcements: Until you undo them, ask me to delete them with your posts, or delete your account
Reports you made, and reports about what you wrote: Kept with what I decided until the account of the member who made the report, or of the member who wrote what was reported, is deleted
Your blocks: Until you unblock, or either account is deleted
Your answer about the app: Part of your member record — kept and deleted with it
A testimonial and its video: Until you withdraw it (under the chapter you sent it from), ask me to delete it, or your account is removed. A video is deleted, not hidden
Your chat messages: The chat closed on 15 October 2026. Messages already written there stay in their channel until you ask me to remove them, or I do. Removing a message hides it from every member at once, but its text stays in that channel's storage, where only I can reach it. I would rather tell you that than call it deleted
Login rate-limit counters: Under an hour — these expire on their own
An emailed sign-up or reset code: 15 minutes, or the moment it is used
A sign-up waiting for its code: One day, or the moment the code arrives
Code-sending counters: Under an hour — these expire on their own
Wrong code tries against an address: One day — the times only, never what was typed
A Google sign-in in progress: 10 minutes, or the moment it finishes
Your Google account ID: Kept with your record, and deleted with it
Sign-up counters: Under an hour — these expire on their own
An upgrade reference: Two hours, or the moment it is used. It ties a checkout to your account, and holds nothing else
Stripe's last answer about your subscription: Six hours — thirty minutes if Stripe did not answer
Recordings that include you: Removed within 7 days of you asking
Anything you emailed me, and the club's emails to me about you: They are in my own inbox, which Delete my account cannot reach. Ask and I delete them, unless a tax or legal record needs them
Payment records: 7 years — a tax obligation, not a choice. Held by Stripe and by me; for a purchase in the App Store, by Apple.
The date a deleted account was made: Kept on its own, with nothing to say whose it was, so the price ladder's count of accounts does not go backwards for anyone else

Deleting a post, a message, a to-do item or anything in the tools does not rewrite your record. Your completed chapters, their dates and the XP they paid stand and say what they said, and so do your trophies. The system does not make you choose between your privacy and your own record.

09Why I'm allowed to hold it

If the UK GDPR or the EU GDPR applies to you, this is the ground I rely on for each thing:

Your bookings: Contract — the call is part of what your account includes, Art. 6(1)(b). A booking made through the old public form: steps you asked me to take before a contract, Art. 6(1)(b)
Your plan, its log, your account's number, your Stripe and App Store references, and checking your subscription with Stripe or Apple: Contract — knowing what your account includes and what it costs, Art. 6(1)(b)
Member record, account, country and time zone, completed chapters, how far you have watched, your 18+ confirmation, XP ledger and trophies: Contract — I cannot run the school without them, Art. 6(1)(b)
Your avatar: Contract — it is part of how the member area shows you your own record, Art. 6(1)(b)
Your posts, comments and chat messages, and your notifications: Contract — the room and the bell are part of what you join, as the chat was until it closed on 15 October 2026, Art. 6(1)(b)
Your likes, reactions, votes and saved announcements: Contract — they are part of the room and the announcements you join, Art. 6(1)(b)
A testimonial, and quoting it: Consent — you choose to send one, and it is quoted on the site only if you ticked the box. Withdraw it whenever you like, Art. 6(1)(a)
Showing you on the leaderboard and your profile, and posting your wins: Legitimate interests — a room where members can see who is doing the work is part of what you join. The two switches in Settings are your objection, and they take effect at once, Art. 6(1)(f)
Your six onboarding answers: Contract — they are how I make the thing useful to you, Art. 6(1)(b)
The tools, what you log in them — the Food log and its barcode lookups included — and sending it to the AI when you use an AI feature on the website: Contract — the tools are part of what your account includes, and the AI answers the feature you pressed, Art. 6(1)(b)
LifeMax AI in the iPhone app, its check-ins, and a meal photo you send for reading: Consent — the app asks before LifeMax AI first sends anything to Anthropic, the check-ins have their own switch, and a meal photo goes only when you send one, Art. 6(1)(a); and explicit consent, Art. 9(2)(a), for anything about your health in them. Turn the check-ins off whenever you like
Health numbers you choose to log — sleep, weight, blood markers, resting heart rate, stress, what you eat, the habits you are dropping — what a device you connect sends, Apple Health from the iPhone app included, and anything about your health you write in the Journal or tell the coach: Explicit consent, Art. 9(2)(a): you enter them yourself, or connect the device yourself, for this, and delete them or disconnect it whenever you like
The iPhone app's notifications: your phones, their tokens and your notification settings: Contract — delivering the kinds of notification you left on (section 3c), Art. 6(1)(b). Your iPhone asks you first, and you can turn them off there at any time
Reports and blocks, and the email a report sends me: Legitimate interests — keeping the community safe for everyone in it, which an app that carries what members write must do, Art. 6(1)(f)
Your answer about the app: Legitimate interests — not asking you again once you have answered, Art. 6(1)(f)
Saved face-score numbers: Consent — nothing is saved until you press Save, Art. 6(1)(a). The photo is never processed by me at all
The call brief: Legitimate interests — preparing for the call you booked, Art. 6(1)(f)
Payment and billing records: Contract, and legal obligation for the tax records, Art. 6(1)(b) and (c)
Password hash, and rate limiting logins and sign-ups: Legitimate interests — keeping other people out of your account, Art. 6(1)(f)
Emailed codes, and signing in with Google or Apple: Contract — letting you into your account, Art. 6(1)(b); and legitimate interests for confirming an address is really yours, limiting how often codes are sent, and keeping Apple's sign-in key so that it can be withdrawn when you delete your account, as Apple requires, Art. 6(1)(f)
Server and request logs: Legitimate interests — running and defending a working service, Art. 6(1)(f)
Google Fonts: Legitimate interests — serving the page as built, Art. 6(1)(f)
A waiting-list email left before the list closed: Consent — you gave it to be told one thing, Art. 6(1)(a)
The weekly email: For an account made from 16 October 2026: the soft opt-in — you gave your address making an account with the club, the sign-up's box for it (ticked for you) let you say no there and then, and every email lets you stop (the UK's PECR, regulation 22(3)), on the ground of legitimate interests, telling account holders about the club, Art. 6(1)(f). From the public form, the Settings switch or the question on Home: consent, Art. 6(1)(a), and from the public form only once you have confirmed the address. Unsubscribing is your objection or your withdrawal, and it takes effect at once
Recording anything with you in it: Consent, asked per session, withdrawable at any time, Art. 6(1)(a)
Anything sensitive you volunteer: Explicit consent only, Art. 9(2)(a) — withdraw it and I delete it

Withdrawing consent, or objecting, does not undo what was lawful before. It stops everything after.

10Your rights, and how to use them

If you are in the UK or the EU, you can ask me to: give you a copy of everything I hold on you; correct anything wrong; delete it; stop or limit what I do with it; hand it to you in a machine-readable form; or object to anything I do on legitimate-interests grounds. You can withdraw consent to a recording at any moment. You can complain to your national data protection authority — in the UK, the Information Commissioner's Office at ico.org.uk.

If you are in Malaysia, the Personal Data Protection Act 2010 gives you the right to make a data access request and a data correction request. I do not charge a fee for either. You can complain to the Personal Data Protection Department (JPDP) under the Ministry of Digital.

Everyone else: ask me for the same things. I am not going to check your passport before answering a reasonable request.

Where the two regimes differ, I apply the stricter one to everybody. The PDPA does not give a general right to erasure; I give you one anyway.

To ask for something, email reodannathan@gmail.com and say what you want. You do not need a form, a subject line, or a reason.

"Let me do it myself." Settings → Your data exports one file of everything on your record and in the tools, and erases the tools data in one press. Delete my account, beside them, deletes the lot.
"Send me everything you have on me." You get it, readable and machine-readable.
"Delete me." Do it yourself: Settings → Delete my account, in the iPhone app or on the website (Settings → Your data), and type DELETE. Or ask me, and I do the same. It is immediate, and it cannot be undone. In this order: a subscription you pay on the website is cancelled with Stripe at once — if Stripe cannot be reached, nothing is deleted and you are asked to try again; if you used Sign in with Apple and I hold its key (section 4), Apple is told to withdraw it; WHOOP and Withings are told to stop; and then everything is erased — your member record, your account, your plan and its log, your account's number, your Stripe and App Store references, your completed chapters, XP ledger and trophies, your avatar, settings and photos, your notifications, my note, everything in the tools, your messages with me, your device connections and their keys, your phones and their notification settings, your posts, comments, replies and likes in the room, your comments, votes, reactions and saves on announcements, your testimonials and their videos, the reports and blocks you made and those about you, your bookings and your token, and your place on the weekly email's list (Kit is told to unsubscribe you at once; if Kit cannot be reached, the club keeps only your address, and Kit's number for it, until its next try). What it cannot reach: Kit's own record of an unsubscribed address, which it keeps so it never emails you again — ask and I have Kit erase it; anything you wrote in the old chat before it closed — ask and I remove it from every channel, as section 8 describes; my own inbox — anything you wrote to me, and the club's emails to me about you — ask and I delete those too; payment records, which stay for the tax period; Cloudflare's request logs, on Cloudflare's schedule; and a subscription bought in the App Store, which Apple bills, so only you can cancel it: on your iPhone, Settings → your name → Subscriptions. One thing is kept on purpose: the date your account was made, on its own, with nothing to say whose it was, so the price ladder's count does not go backwards. A free account needs nothing else: there is nothing to cancel.
"Delete this one thing." Fine, and it does not affect anything else.
"Take my posts out of the room." Done. You can also delete your own posts, wins included, yourself.
"Take me off the leaderboard." One switch in Settings does it at once, and cuts your profile down too. Or ask me.
"Cut me out of that recording." Done within 7 days.
"I'm locked out." I reopen it by hand — or, where the reset page offers it, reset it yourself with an emailed code.
"Stop the emails." The unsubscribe link at the bottom of every weekly email, or Settings → Weekly email, does it at once. Or tell me.
"Take me off the old waiting list." Done, and it is the whole record gone.
"Delete the booking I made on the old form." Done, whether or not the call happened.
"There is an account on my address that I did not make." Tell me from that address and it is deleted.

I answer within 30 days, and in practice usually the same week. Cancelling deletes nothing: your account carries on as a free one. Deleting your account cancels a website subscription first, but it cannot cancel one Apple bills — cancel that with Apple too.

11Marketing, and the weekly email

There is one mailing list: the weekly email. One short email every Tuesday, 9am your time, from me, on getting your life in order. Each one ends with one invitation: if you have a free account, to join LifeMax Club or to keep trying the club for free; if you have none, to make a free account. Kit (kit.com, formerly ConvertKit) holds the list and sends the emails for me (section 7).

If you make an account (from 16 October 2026), you get it unless you untick Send me the weekly email under the email field when you sign up, or the same box when you set up the iPhone app. Since 22 October 2026 that box is ticked for you, in plain sight under the email field, and one tap unticks it; unticked, nothing is sent. (From 16 to 21 October it was an unticked "No thanks" box.) That is the soft opt-in the UK's rules allow for people who sign up with a business: you are given the chance to say no when you sign up, and in every email after, and you can stop it at any time.
If you made your account before 16 October 2026, you are not on it. Home asks you once, and nothing is sent unless you say yes.
The form on the front page, About and Help needs no account. Kit first sends you one email asking you to confirm the address is yours (double opt-in), and nothing else is sent until you do.
What goes to Kit: your email address; your nickname as the first name, if you have an account; when and where you joined the list; a tag saying free account or LifeMax Club, so a free account gets the invitation to LifeMax Club and a member does not; and a tag for your time zone, so the email arrives on Tuesday at 9am where you are. The time zone is the one saved on your account (Settings), or, until you save one, the one your browser or phone reports when you sign up or use the form. Nothing else from your account: not your logs, your answers, your messages or your payments.
Stopping it: the unsubscribe link at the bottom of every email, Settings → Weekly email, or a line to me. It stops at once. Switching it back on in Settings makes Kit ask you to confirm again.
Deleting your account unsubscribes you in Kit and deletes the club's record of you on the list. Kit keeps an unsubscribed address only as unsubscribed, so that it is never emailed again; ask me, or Kit, and Kit erases it completely.

That is the only marketing. There is no automated sequence beyond one welcome email when you join the list (the club sends it itself, through Resend, once, with its own one-click unsubscribe: to an account holder when he says yes, and from the public form once you have confirmed your address), no "we may contact you about offers" clause, and I will not pass your data to anyone else for their marketing. The club's other emails are the sign-in codes you ask for, and they carry nothing else. The iPhone app's notifications are the kinds you have left on (section 3c), and never an offer. Nothing from Apple Health is ever used for marketing or advertising. The waiting list, now closed, was only ever for telling you one thing once: that the first pillar's briefings are filmed. Under Malaysia's PDPA you can tell me to stop using your data for direct marketing at any time, and I do.

12Younger members

LifeMax has no age limit. What I hold about a younger member is exactly what I hold about anyone else — the list in section 3, and nothing extra. One of the six onboarding questions asks your age, and that is the only reason I know it.

Two things I ask rather than enforce. If you are under 18, tell a parent or guardian you have joined before your first call. And if a parent or guardian asks me what I hold about you, or asks me to delete it, I will do it — the same way I would if you asked me yourself.

The tools take more care if you tell them you are under 18. The diet planner plans for growth and never for a deficit, whatever the goal. The coach is told not to suggest dieting, fasting or supplements, and to bring a parent or guardian into any change to how you eat or train. LifeMax AI, reading a meal photo, never suggests eating less. The face score's tips keep to skin, sleep, hair and grooming. None of it is a verdict on you.

Two chapters are for members aged 18 and over: LooksMax 6 and 7, on talking to women and asking one out. If the age you gave me is under 18, they stay closed and you complete LooksMax without them. If your account has no age I can read, opening one asks you to confirm you are 18 or over, and I keep the date you did (section 3).

Nothing on this site is written for children, and nothing here is a substitute for the people responsible for you. If you need someone right now, the numbers on the help page are free, staffed, and open to anyone of any age.

13Security, and what I will not claim

What is true:

Everything runs over HTTPS.
Your records live in Cloudflare Workers KV, and what you log in the tools in Cloudflare D1 — both encrypted at rest by Cloudflare.
Reminders are encrypted for your browser before they leave my service (the Web Push standard), so the push service in between cannot read them.
The face score's photo is measured on your device and never sent anywhere.
Your password is stored only as a PBKDF2-SHA256 hash, 100,000 iterations, with a random 16-byte salt unique to you. The plaintext is never stored, never logged, and never returned.
Failed logins are rate-limited by IP and by email, so nobody guesses their way in.
Apple's sign-in key, like WHOOP's and Withings' keys, is stored encrypted, with a key that is not kept in the database.
Every App Store purchase is checked with Apple's own server before it opens anything, and so is every message Apple sends about one.
In the iPhone app, your private link lives in the iPhone's keychain, not in a web address.
Your access token is 22 characters, either from a cryptographic random source or derived by HMAC from a secret only my server holds — more entropy either way than a password you would have chosen.
Nothing you type is ever written into a page as raw HTML.

What I will not claim: this is one person's system. There is no security team, no SOC 2 report, no penetration test and no bug bounty.

Your password protects the recovery of your link. It does not protect the link itself — though logging out or setting a new password retires it. The link is the key, and a key that travels in a web address is a key that can be forwarded, screenshotted, and left in a browser history. I am telling you that plainly instead of calling this "secure login".

Notifications to the iPhone app are not encrypted end to end, as browser reminders are: Apple's push service carries their text, a message from me included.

A set of member records in a key-value store is a small target defended by a small amount of machinery, and the honest summary is that it is competently built rather than institutionally hardened. Do not put anything in the room, the tools or the coach that you could not survive being read.

If something leaks in a way that could hurt you, I tell you and I tell the relevant regulator — within 72 hours where the law requires it. I do not sit on it and I do not wait to see if anyone notices.

14Changes to this page

If I change what I collect, who touches it, or how long I keep it, I update this page, change the date at the top, and tell every current member directly. I will not make a material change quietly and rely on you re-reading a page you have already read.

Version 2.0 is a material change. Version 1.0 described a school with paths, cohorts and no accounts, and it said in two places that there were no passwords. There are now. Sections 3, 4, 5 and 13 are where the difference lives.

Version 3.0 is a material change too. LIFEMAX CLUB is now called Lifemax Club, and four things are added to what I hold: your avatar, your leaderboard setting, your XP ledger, and quest proof with my notes on it. The leaderboard is new, and it is opt-in. One-to-one calls are no longer earned — you book as many as the diary has free slots. The website moved from Netlify to Cloudflare Pages, so Netlify no longer handles anything of yours. Version 2.0 also gave the password hash as 210,000 iterations; the real figure is 100,000, and sections 4 and 13 now say so. Sections 0, 1, 2, 3, 5, 6, 7, 8, 9, 10 and 11 are where the rest of the difference lives.

Version 4.0 is a material change as well. Proof filing, which version 3.0 said would open in January, is gone: a quest is completed by a quiz or on a call, and a quiz keeps your attempts and score, never your answers. The leaderboard is now shown by default instead of opt-in — hide yourself in Settings at any time — and I tell every current member directly, as this section promises. New here: member profiles, wins posted to the room, notifications and their 90-day expiry, invite records, your country and time zone, and my note on your record. Joining now runs through a Stripe Checkout page the site opens rather than a payment link. This page also now says what it should have said before: the chat is kept in Cloudflare Durable Objects, and the free quest page keeps what you type in your own browser. Sections 0, 1, 3, 4, 5, 7, 8, 9, 10, 11 and 13 are where the difference lives.

Version 4.1 adds two ways into your account, each of which works only once I have switched it on: "Continue with Google", and six-digit codes emailed through Resend to confirm your address and to reset a password. It also says that the waiting list is closed. Sections 0, 1, 2, 3, 4, 7, 8, 9, 10 and 11 are where the difference lives.

Version 4.2 adds nothing to what I hold. The lessons now have you keep notes in the notes app on your own phone, and section 3a says plainly that I never see them. The pillars have new names, so the win line in section 5 reads "Completed Healthmaxxing", and the Foundation's briefing is one you can tick. Sections 0, 3, 3a and 5 are where the difference lives.

Version 4.3 is a material change. There is now a free account: anyone can make an account without paying, and it holds the Foundation and one call with me. The public booking form is gone — calls are booked from inside the club — and section 2 says what happens to the bookings already made through it. New on your record: your plan and its log, your Stripe references, how you signed up and the invite code you signed up with. The member service now asks Stripe a few times a day whether a paid membership is still running, and a paid membership that ends becomes a free account instead of closing. Sign-ups are counted by IP address for an hour. The front page asks my service for the member count, and a free account is not shown to other members at all. Sections 0, 1, 2, 3, 4, 5, 7, 8, 9, 10 and 14 are where the difference lives.

Version 4.4 adds nothing to what I hold. It corrects section 1, which said nothing was kept in your browser: your appearance and sound choices, your notes-app choice and the free lesson's card are, and they never leave your device. Logging out, and setting a new password, now retire your private link; the link no longer goes to Stripe when you open Billing; my private note from a call is no longer sent to your browser at all; the site now answers on https only; and the old waiting-list form is gone from the member service. The Sunday call's recording rule is written the same way everywhere: recorded when everyone on it agrees. The site now runs on Cloudflare Workers rather than Pages. Sections 0, 1, 4, 6 and 7 are where the difference lives.

Version 4.5 adds nothing to what I hold. The site no longer makes any sound, so your browser no longer keeps a sound setting. Section 1 is where the difference lives.

Version 5.0 is a material change. The club now has tools — a focus timer, a to-do list, a daily check-in, lesson trackers, a face score, a diet planner, reminders on your phone, conversation practice and a hairstyle try-on — and an AI coach, and what you log in them is saved to your account in a new database (Cloudflare D1, in the United States). The AI is Claude, run by Anthropic, which is new to this page; the try-on sends one photo to Google's image model; reminders pass through your browser's own push service, encrypted. The face score measures your photo on your phone and never uploads it. The member area now keeps your private link on your device so the club opens signed in from your Home Screen, and installs a small service worker. Settings → Your data lets you export everything or erase the tools data yourself. Sections 0, 1, 3, 3b, 4, 7, 8, 9, 10, 12, 13 and 14 are where the difference lives, and every current member is told directly.

Version 5.1 is a material change. On 28 September 2026 the notes app went: every lesson now ends with "In your tools", and what it has you record is saved to your account in the tools, where before it stayed in the notes app on your phone and never reached me. New in the tools: Standards, the Journal, and trackers for body measurements and a grooming routine. Section 3b now also lists where each Contact log record came from, which that tracker has always kept and version 5.0 left out. The coach now reads the tools too, so the summary of your account it is sent (section 3b) includes a short, recent part of each. I still do not open your tools data to read it. The club stores no photos: the ones a lesson asks for go in an album called Lifemax on your own phone. Five Honest Numbers, Standards and the Journal are open to a free account. Full membership is now priced by your account's number — $9.99 a month for accounts 1–50, $19.99 for 51–100, $24.99 from 101 — so I hold that number beside your record, and the front page asks my service where the price ladder stands rather than for the member count. Sections 0, 1, 3, 3a, 3b, 5, 7, 8, 9, 10 and 14 are where the difference lives, and every current member is told directly.

Version 5.2 is a material change. The course is now 40 video chapters, completed by watching each to the end and setting up the tool it asks for, so your record holds how far you have watched, your trophies, the full days and streaks in your XP, and an 18+ confirmation if you give one; the quizzes are gone, so no quiz record is made. The tools hold more (activity, steps, resting heart rate, resets, habits, North Star, your environment checklist and training plan); the coach is sent a summary of what you log and can look up more of your own history; a habit you mark private is left out of my call brief; and an optional Apple Health sync can send your sleep, steps and resting heart rate. This page also corrects what it said about the hairstyle try-on: the club keeps neither image, but Google keeps what it is sent for up to 55 days. Sections 0, 1, 3, 3a, 3b, 4, 5, 7, 8, 9, 10, 12 and 14 are where the difference lives, and every current member is told directly.

Version 5.3, 1 October 2026, adds nothing to what I hold. The price ladder has new rungs: $9.99 a month for accounts 1–10, $14.99 for 11–50, $19.99 for 51–100, and $42 from account 101 on, for good. The opening paragraphs, above section 00, are where the difference lives.

Version 5.4, 1 October 2026, adds three things. Home asks you short questions through the day, keeps your answers, and LifeMax AI (Claude) reads them to log what they say into your tools; your three scores and the Progress charts are worked out from your logs and not stored. A full member can upload a profile picture, shown where your avatar would be, and any member can choose or upload a cover photo for each pillar, shown only to you; both are kept until you remove them. Sections 00, 3a, 3b, 5 and 8 are where the difference lives.

Version 5.5, 4 October 2026, holds less. Invite a friend has ended, so nothing about invites is kept any more: no invite code with your sign-up, no invite record or invite link, and Stripe no longer runs a friend's free month. The pillar covers come as three sets — my photos, stock photos or the drawn System covers — and which one you chose is kept with your settings; your own cover photo for a pillar is kept as before, and picking one of the club's photos for a single pillar is gone. It also adds About you: your height, age, goals, training and food answers, kept so LifeMax AI, the diet planner and the training plan can fit their advice to you (section 3b says exactly what it holds and where it goes). Home's questions now have answers to pick, which are logged without going to Anthropic, and a Don't know button that logs nothing. Sections 00, 3, 3a, 3b, 4, 5, 7, 8, 9, 10 and 11 are where the difference lives.

Version 5.6, 9 October 2026, adds two things. Messages: you can message me inside the club and I reply there, so the messages are kept (section 3), and an email tells me when one arrives (section 7). LifeMax AI now keeps each conversation as its own chat, and when it suggests a change to your tools or goals it keeps the suggestion and whether you applied it; nothing changes until you press Apply (section 3b). The joining questions now save as you go, on your device and to your account, so you can pick up where you left off (section 1). Sections 1, 3, 3b, 7 and 8 are where the difference lives.

Version 5.7, 16 October 2026, is a material change. Connected devices: besides the Apple Health Shortcut, you can now connect the Health Auto Export app, WHOOP or a Withings scale, each only if you choose to. Section 3b lists exactly what each one sends and what is kept; WHOOP and Withings keys are stored encrypted; Disconnect deletes the keys at once, and Delete removes what a device sent. LifeMax AI reads it to answer you, and no device data trains any AI model. WHOOP and Withings join the companies in section 7. Sections 00, 3, 3b, 7, 8 and 9 are where the difference lives.

Version 5.8, 16 October 2026, changes names only. The service is now called LifeMax and the paid membership LifeMax Club, so a full member is now a LifeMax Club member. The chat channels have closed; the community is one feed, the room. Nothing I hold changes; chat messages already written are kept as section 8 says. The names change throughout; the chat lines are in sections 00, 3, 4, 5, 7, 8, 9, 10 and 13.

Version 5.9, 16 October 2026, adds two things the club now keeps (sections 3, 8 and 9). Your likes in the room, and your comments, reactions, poll votes and saves on my announcements. And a testimonial, only if you choose to send one at the end of a chapter: your words, a video if you add one, and whether I may quote it. Only I see a testimonial, and you can withdraw it whenever you like. Your country and time zone are now asked when you join, so call times show on your own clock from the start; nothing new is kept.

Version 6.0, 16 October 2026, is a material change. The LifeMax iPhone app is the same account as the website, and section 3c says what it adds: Sign in with Apple, with Apple's identifier for you, the email Apple gives (perhaps a relay address), your name if you share it, and Apple's sign-in key, encrypted and kept only to withdraw that sign-in when you delete your account; your phones' push tokens and notification settings, with notifications carried by Apple; and, if you buy LifeMax Club in the app, where Apple is the seller, the App Store references Apple sends. Apple Health can now come from the app, only after you connect it, and is never used for advertising or marketing. New in the tools: the Food log, whose meal photo goes to Anthropic for one reading and is never stored, and whose barcodes are looked up in Open Food Facts with nothing about you; and LifeMax AI's check-ins, up to two a day, which you can switch off. The app asks before LifeMax AI first sends anything to Anthropic. Report and Block are new (section 5a), and so is the answer you give the club's "LifeMax for iPhone" card. And you can delete your account yourself, in the app or on the site (section 10). Apple and Open Food Facts join section 7. Sections 00, 1, 3, 3a, 3b, 3c, 4, 5, 5a, 7, 8, 9, 10, 11, 12, 13 and 14 are where the difference lives, and every current member is told directly.

Version 6.1, 16 October 2026, is a material change. The weekly email. One or two short posts a week from me, sent by Kit, which joins section 7 and its paragraph on transfers. A new account gets it unless you tick No thanks at sign-up; the public form sends nothing until you confirm your address; an account made before today is not added, and Home asks once. Section 11 replaces "I do not run a mailing list", and sections 00, 3, 7, 8, 9 and 10 say what is kept, why, for how long and how to stop it. Every current member is told directly.

Version 6.2, 17 October 2026, corrects and fills in. Nothing new is collected: this page now says what was already true. There is one way in, a free account, and LifeMax Club is opened from inside it, so the sign-up page no longer keeps a "member" choice in your browser (the opening paragraphs, sections 00 and 1). Section 00 now lists everything that expires on its own, and section 8 points to it. The app saves only weigh-ins to Apple Health, not workouts (section 3b). The app's notifications are listed in full, the community, announcements and calls included, and your yes to LifeMax AI is kept with your notification settings (sections 3c, 7, 9 and 11). Other members can see who liked a post, and a comment on an announcement is seen by every account (section 5). Also listed now: the tour, both names a testimonial keeps, a few small choices kept on your devices, what the export leaves out, and what happens if Kit cannot be reached when you delete your account (sections 1, 3, 3b, 3c and 10).

Version 6.3, 20 October 2026, adds one thing the club keeps. The weekly email's welcome email is now sent by the club itself, through Resend, instead of by Kit: once, when you join the list (an account holder when he says yes; the public form once you have confirmed your address with Kit). So the club now keeps when that welcome was sent, so it is never sent twice, and Resend sees your address and the name in the greeting when it sends it. The welcome has its own one-click unsubscribe link, which stops the weekly email everywhere, Kit included. Sections 3, 7, 8 and 11 say so.

Version 6.4, 22 October 2026. Two changes to the weekly email. The sign-up's box for it is now ticked for you, "Send me the weekly email", and you untick it if you would rather not have it; until now it was an unticked "No thanks" box. It is still the soft opt-in, for people making an account only: the public form still needs you to confirm your address first. And the email now arrives on Tuesday at 9am in your own time zone, so the club keeps your time zone with your place on the list and gives Kit a tag for it. Sections 00, 3, 7, 8, 9 and 11 say so.

Version 6.5, 22 October 2026. The free account holds a different set of things: the Foundation, the first chapters of Health and Perform, and two tools, Five Honest Numbers and Focus, beside the daily check-in and three LifeMax AI messages a day. The to-do list, the face score in the club, the Journal and Standards are now LifeMax Club's; what you saved in them is kept, not deleted, and opens again when you join. Nothing new is collected. Sections 00 and 3b say so.

Version 6.6, 23 October 2026. Wording only, so this notice says things the way the club does: LifeMax AI by its name, the list on Home as your To do, and the weekly email as one short email every Tuesday, 9am your time. Nothing new is collected, nothing is kept longer, and your rights do not change.

Version 6.7, 23 October 2026. The questions when you join changed. Only your age and the pillars you want are needed now; the rest can be skipped. The twelve-week question is now "What is your dream outcome?", the last one is "Anything else I should know, or you'd like to tell me?", and the pillars question can be answered "All, in order" or "Not sure yet", which the club keeps beside your pillars. LifeMax AI's questions on Home can now be gone back to and answered again, and a new answer replaces what the old one logged. Section 3 says so. Nothing else is collected, and your rights do not change.

Version 6.8, 5 November 2026. Names only. The six pillars are now called HealthMax, MindMax, SocialMax, FocusMax, BodyMax and LooksMax; they were Health, Mind, Social, Perform, Aesthetics and Attraction. A pillar you picked when you joined, or a win already posted, still counts under its new name. Nothing new is collected, nothing is kept longer, and your rights do not change.

Version 6.9, 6 November 2026. Corrections. Section 9's row on health data says "Health numbers" again (the rename had changed it). The avatar line no longer says there is no image upload; a profile picture is separate, as section 3 says. The list of automated emails now names all of them: the codes, the welcome email, the weekly email and the email if I have to move a call. And a message from the contact page is now kept for a year, then deleted on its own. Nothing new is collected, and your rights do not change.

15Contact

Reodan Nathan, sole proprietor · Malaysia
reodannathan@gmail.com

One person. No staff. No ticket queue.