Privacy Policy

Fullcourt, LLC, doing business as Wildcard Wellness ("Wildcard Wellness," "we," "us," or "our"), respects your privacy. This Privacy Policy explains what personal information we collect through wildcardwellness.co and its subdomains (the "Site"), the emails we send, and the products we offer (together, the "Services"); why we collect it; who we disclose it to; how long we keep it; and the rights and choices you have.

By using the Services you agree to this Privacy Policy. If you do not agree, please do not use the Services. This Policy is incorporated into our Terms of Service.

Summary

This summary is for orientation only and does not replace the detail below.

• There are no accounts, no logins, no passwords, and no comment sections. There is nothing for you to post.
• The only personal information we ask you for is an email address.
• We do not collect health information of any kind. Where the Site asks an optional question about your pain level or your weight goal in order to personalise a page for you, your answer is processed entirely inside your own browser and is never transmitted to us or to anyone else.
• We use Google Analytics, which sets cookies. That is the only analytics or tracking technology on the Site. There are no advertising or retargeting pixels.
• We do not sell personal information. Google Analytics may constitute "sharing" under California law; you can opt out, and we honour Global Privacy Control signals.
• You can have your information deleted by emailing us. There is no process to navigate.

1. Information we collect

1.1 Information you provide to us

• Email address. Collected when you sign up for the free Starter Kit, the newsletter, or the community waitlist.
• Signup source. The page from which you signed up, recorded alongside your email so that we send you the material you actually asked for.
• Correspondence. If you email us, we receive your email address and whatever you choose to include in the message.

That is the complete list. We do not collect your name, your postal address, your telephone number, your date of birth, or any government identifier through the Services.

1.2 Information collected automatically

• Usage data. Through Google Analytics 4: pages viewed, approximate geographic region derived from IP address, device type, operating system, browser, referring source, and session duration. We also record a single analytics event when a signup succeeds, so that we can see which pages convert. Google Analytics is configured to collect data at this level of generality and we do not use it to build a profile of any identified individual.
• Server and network logs. The Site is hosted on Cloudflare, whose systems log the ordinary technical details of each request — IP address, user agent, requested URL, timestamp, and response status — for delivery, caching, performance, and security. When a signup is submitted, our own server-side log briefly records the email address and originating page for the purpose of diagnosing failed signups. These logs are short-lived and are not used for any other purpose.
• Campaign attribution. If you arrive via a link carrying campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content), the Site stores the first such set it sees in your browser's local storage and transmits it if you later sign up. This tells us which post or advertisement produced a signup. It is campaign-level information and is not used to profile you.

1.3 Email engagement

Our emails are sent through beehiiv. Like most email platforms, beehiiv records whether a message was opened — using a small tracking image embedded in the email — and which links in it were clicked, and associates that activity with your subscriber record. We use this to understand which emails are useful and to stop sending to addresses that never engage. You can prevent open tracking by configuring your email client to block remote images, and you can end all of it by unsubscribing.

1.4 Information we deliberately do not collect

Health information. We do not collect, receive, store, or process any health information about you. We hold no record of your pain, your symptoms, your diagnosis, your imaging, your medications, your weight, or your medical history, and no signup form or email we send asks for any of it.

On-device personalisation. Where the Site offers an optional personalisation question — for example, on the Starter Kit page, how much weight you would like to lose and where your back pain sits on a scale of 0 to 10, together with an optional first name — your answers never leave your browser. They are written to your own device's local storage and are read back only by that same page, running on your own device, to adapt the words you see. They are not transmitted to our servers, not to our email platform, not to any analytics provider, and not to any other third party. Nothing about them is logged.

When you give us your email address on that page, the address alone is sent to us so that we can deliver the Starter Kit. Your personalisation answers are not sent with it and are never associated with your email address in any record we hold. The two are joined only inside your own browser, where the pairing stays.

The practical consequence is that we could not produce your answers if you asked us for them, could not disclose them if we were compelled to, and could not lose them in a breach — because we have never held them. They exist only on your device, and clearing your browser's site data erases them permanently. Answering is always optional, and the Site works identically if you skip it.

This boundary is a deliberate design constraint rather than an accident of scale, and we undertake to maintain it. Because this information never reaches us, we do not process consumer health data within the meaning of Washington's My Health My Data Act or Nevada SB 370; we do not process sensitive data requiring opt-in consent under the privacy laws of Colorado, Connecticut, Texas, or other states; we do not collect sensitive personal information as defined by the CCPA; and we do not process special category data within the meaning of Article 9 of the GDPR.

If you choose to describe your health to us in an email, that message sits in our email records like any other correspondence. You may ask us to delete it at any time and we will.

Financial information. We do not collect payment card details, bank details, or any other financial information. Purchases are completed entirely on Stan's platform; see Section 4.

Other categories. We do not collect precise geolocation, biometric information, government identifiers, or the contents of your device. We do not purchase or obtain personal information about you from data brokers.

2. Cookies, local storage, and tracking technologies

2.1 Cookies. Google Analytics sets cookies in the _ga family to distinguish new visitors from returning ones and to measure sessions. These are the only cookies set in connection with the Site. There are no advertising, retargeting, social, or cross-site tracking pixels on the Site.

2.2 Local storage. The Site uses your browser's local storage, which remains on your device and is not readable by us or by any third party, for the following:

• ww-utm — the campaign parameters from the link you first arrived on.
• ww-subscribed — a flag recording that you have already signed up, so that the Site stops prompting you.
• ww-slidein-hide — a flag recording that you closed the signup bar, so that it stays closed.
• wildcard-wellness-user — your answers to the Starter Kit's optional personalisation questions, the first name you gave it, and the email address you entered on that page, kept so that the guide stays personalised when you return to it. This entry is written and read only by your own browser. Its contents are never read by us or transmitted anywhere. See Section 1.4.
• ww-theme — your light, dark, or system appearance preference.

Clearing your browser's site data removes all of these.

2.3 Do Not Track and Global Privacy Control. There is no consistent industry standard for responding to "Do Not Track" browser signals, and the Site does not respond to them. The Site does, however, honour Global Privacy Control (GPC) signals as a valid request to opt out of any sale or sharing of personal information, as described in Section 7.3.

3. How and why we use information

We use the information described above to:

• Deliver the Starter Kit, the newsletter, or the waitlist confirmation you requested;
• Send you subsequent emails about the routine, the guides, and our work, until you unsubscribe;
• Determine which welcome sequence you should receive, based on the page you signed up from;
• Understand which pages and campaigns are effective, in aggregate, and improve the Site accordingly;
• Operate, maintain, secure, and troubleshoot the Site, and to detect and prevent abuse, fraud, and automated signup attacks;
• Respond to your correspondence and to any privacy request you make; and
• Comply with applicable law and enforce our Terms of Service.

We do not use your personal information for automated decision-making that produces legal or similarly significant effects, and we do not use it to train machine learning models.

3.1 Legal bases (EEA and UK)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases under the GDPR and UK GDPR:

• Consent (Art. 6(1)(a)) — for sending you marketing emails. You may withdraw consent at any time by unsubscribing, without affecting the lawfulness of processing before withdrawal.
• Contract (Art. 6(1)(b)) — for delivering a product you have purchased and providing related support.
• Legitimate interests (Art. 6(1)(f)) — for analytics, campaign attribution, security, abuse prevention, and the ordinary operation of a small publication. We have assessed that these interests are not overridden by your rights, in part because the data involved is limited and is not used to profile individuals. You may object to this processing at any time; see Section 8.
• Legal obligation (Art. 6(1)(c)) — where we must retain or disclose information to comply with law.

We do not process special category data under Article 9. See Section 1.4.

4. Who we disclose information to

We do not sell personal information, and we have never sold personal information. We disclose personal information only as described here.

4.1 Service providers. We use a small number of providers, each of which receives only what it needs to perform its function and none of which is permitted to use your information for its own marketing:

• beehiiv — our email platform. Holds your email address, the page you signed up from, your campaign parameters, and your email engagement history, and sends our emails.
• Cloudflare — hosting, CDN, DNS, and the server-side code that handles signups. Processes traffic to the Site and its associated logs.
• Google Analytics — site measurement, as described in Sections 1.2 and 2.1.
• Sanity — the content platform where our blog posts and blog images are stored and served from.

4.2 Independent third parties. The following are not our service providers. When you interact with them you leave the Site and their own policies govern:

• Stan (stan.store) — checkout for the paid guides. When you click a purchase button you leave the Site entirely. Your name, email address, and payment details are provided to Stan and its payment processor and never reach our servers. Stan's privacy policy governs that transaction. Note that Fullcourt, LLC remains the merchant of record and seller for the purposes of our Terms.
• YouTube — the exercise demonstration videos. Videos are embedded via youtube-nocookie.com and nothing is loaded from YouTube until you press play, so YouTube is not contacted unless you choose to watch. Some video thumbnails are served from Google's image servers.
• Affiliate merchants and social platforms — if you follow a link to Instagram, TikTok, YouTube, Facebook, or a product listed on our "What I Use" page, you are on their site under their policy. Our affiliate links are plain product URLs to which we add no tracking parameters.

4.3 Legal and protective disclosures. We may disclose personal information where we believe in good faith that disclosure is necessary to comply with a law, regulation, subpoena, court order, or other legal process; to respond to a lawful request from a public authority; to establish, exercise, or defend legal claims; or to protect the rights, property, safety, or security of Fullcourt, LLC, our subscribers, or the public, including to prevent fraud or abuse of the Site.

4.4 Business transfers. If Fullcourt, LLC or the Wildcard Wellness business is involved in a merger, acquisition, financing, reorganisation, or sale of assets, personal information may be transferred as part of that transaction. We will notify affected subscribers by email before their information becomes subject to a materially different privacy policy.

5. Categories of personal information (California disclosure)

For the purposes of the California Consumer Privacy Act as amended ("CCPA"), the following table describes the categories of personal information we have collected in the preceding twelve months, the sources, the business purposes, and the categories of recipients.

• Identifiers (email address, IP address, unique analytics identifiers). Source: directly from you; automatically from your device. Purpose: delivering the Services, email communication, analytics, security. Disclosed to: beehiiv, Cloudflare, Google Analytics.
• Internet or network activity (pages viewed, referring source, session data, campaign parameters, email opens and clicks). Source: automatically from your device and from our email platform. Purpose: analytics, attribution, improving the Services, security. Disclosed to: Google Analytics, beehiiv, Cloudflare.
• Approximate geolocation (region-level, derived from IP address; not precise geolocation). Source: automatically. Purpose: analytics and security. Disclosed to: Google Analytics, Cloudflare.
• Commercial information (the fact that you requested a particular free product; correspondence about an order). Source: directly from you. Purpose: delivering the Services and support. Disclosed to: beehiiv.

We do not collect the following CCPA categories: characteristics of protected classifications; biometric information; precise geolocation; sensory data; professional or employment information; education information; financial account information; government identifiers; or inferences drawn to create a profile. We do not collect sensitive personal information as defined by the CCPA, including health information — see Section 1.4 — and accordingly there is nothing for you to limit under the right described in Section 7.1.

We retain each category for the periods described in Section 6.

6. Retention

• Email address and signup source — retained for as long as you remain subscribed. If you unsubscribe, we retain a suppression record so that we cannot inadvertently email you again; if you request deletion, that record is deleted too.
• Email engagement data — retained by beehiiv for as long as your subscriber record exists, and deleted with it.
• Analytics data — retained by Google according to the retention period configured on the property and Google's own schedule, after which it is aggregated or deleted.
• Server and network logs — retained only briefly, for debugging and security, then discarded.
• Starter Kit personalisation answers — never retained by us at all. They exist only in your own browser's local storage, for as long as you leave them there. See Section 1.4.
• Correspondence — retained in our email records unless you ask us to delete it.

We may retain information longer where required to comply with a legal obligation, resolve a dispute, or enforce our agreements.

7. Your rights and choices

Regardless of where you live, you may email contact@wildcardwellness.co and ask us to tell you what personal information we hold about you, provide a copy of it, correct it, or delete it. We will honour the request within the time the applicable law requires, and ordinarily much sooner. We will not discriminate against you for exercising any privacy right, and we will not deny you goods or services, charge you a different price, or provide you a different quality of service because you made a request.

Verification. Because we hold so little information, we ordinarily verify a request by confirming that it comes from the email address the request concerns. If we cannot verify a request to the standard the law requires, we will tell you why. You may use an authorised agent, in which case we may ask for proof of the agent's authority and may ask you to confirm the authorisation directly.

7.1 California residents

Under the CCPA you have the right to: know the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties to whom we disclosed it; delete personal information we collected from you, subject to statutory exceptions; correct inaccurate personal information; opt out of the sale or sharing of personal information; limit the use and disclosure of sensitive personal information; and be free from discrimination for exercising these rights.

We do not sell personal information, and we do not collect sensitive personal information, so the right to limit does not arise. The disclosures required by the "right to know" are set out in Section 5. Requests may be made to contact@wildcardwellness.co.

7.2 Other U.S. states

If you are a resident of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, or another state with a comprehensive consumer privacy law, you have rights that generally include confirming whether we process your personal data, accessing it, correcting it, deleting it, obtaining a portable copy, and opting out of targeted advertising, the sale of personal data, and certain profiling. We do not engage in targeted advertising, do not sell personal data, and do not conduct profiling with legal or similarly significant effects.

Appeals. If we decline a request you have made under a state privacy law, you may appeal by replying to our decision or by writing to contact@wildcardwellness.co with the subject line "Privacy Appeal." We will respond in writing within the period your state's law provides, ordinarily forty-five to sixty days, and if we deny the appeal we will explain why and tell you how to contact your state Attorney General.

7.3 Opting out of analytics

We do not sell personal information. However, depending on how a Google Analytics property is configured, transmitting analytics data to Google can constitute "sharing" for cross-context behavioural advertising under California law, even where the operator runs no advertising. Rather than argue the point, we treat it as sharing and give you the opt-out. You may opt out by any of the following, each of which is equally effective and none of which will impair your use of the Site:

• Installing Google's Analytics opt-out browser add-on;
• Enabling Global Privacy Control in your browser or extension, which we honour as an opt-out request;
• Using your browser's tracking protection or any content or script blocker; or
• Emailing contact@wildcardwellness.co and asking us to record your opt-out.

7.4 Email

Every email we send contains a one-click unsubscribe link that takes effect immediately and requires no explanation. You may also reply to any email, or write to contact@wildcardwellness.co, and ask to be removed. Unsubscribing ends marketing email; we may still send a transactional message relating to a purchase you have made.

7.5 Notice of financial incentive (California)

We offer the free Starter Kit, and other free material, in exchange for your email address. Under the CCPA this may be considered a financial incentive program, so we disclose it here. What you receive: the Starter Kit and our newsletter, at no charge. What we collect: your email address and the page you signed up from. How to join: submit a signup form. How to withdraw: unsubscribe at any time using the link in any email, or email us; withdrawal is immediate and free.

Good-faith estimate of value. We estimate the value of the personal information involved to be minimal — on the order of a few U.S. dollars per subscriber at most. We calculate this by reference to the expenses we incur in offering the program, principally the cost of producing the free material and the per-subscriber cost of our email platform, measured against the marginal revenue attributable to newsletter subscribers. The program is reasonably related to that value, and no subscriber is charged a different price or given a different quality of service based on it.

7.6 EEA, UK, and Switzerland

If you are in the EEA, the UK, or Switzerland, you have the right to access your personal data; to rectification; to erasure; to restriction of processing; to data portability; to object to processing based on legitimate interests, including profiling; and to withdraw consent at any time without affecting the lawfulness of prior processing. To exercise any of these, email contact@wildcardwellness.co.

You also have the right to lodge a complaint with your local supervisory authority. We ask that you contact us first so that we have an opportunity to resolve the matter.

8. Children

The Services are intended for adults and are not directed to children. We do not knowingly collect personal information from anyone under 13, and we do not knowingly sell or share the personal information of anyone under 16. If you are a parent or guardian and believe a child under 13 has provided us with personal information, email contact@wildcardwellness.co and we will delete it promptly. In the EEA and UK, where the age of digital consent is 16 in some member states, we do not knowingly collect personal data from anyone below the applicable age.

9. International transfers

Fullcourt, LLC is established in the United States, and our service providers are principally located in the United States. If you access the Services from outside the United States, your personal information will be transferred to, stored in, and processed in the United States, where data protection law differs from that of your own jurisdiction.

Where we transfer personal data from the EEA, the UK, or Switzerland to the United States, we rely on the derogations for specific situations set out in Article 49 of the GDPR — in particular, that the transfer is necessary for the performance of a contract with you, or is made with your explicit consent — and, where our providers offer them, on the European Commission's Standard Contractual Clauses as incorporated into those providers' data processing terms.

10. Security

We maintain administrative and technical safeguards appropriate to the limited nature of the information we hold. The Site is served exclusively over HTTPS; signup submissions are transmitted to our email platform over an encrypted connection; API credentials are held as platform secrets rather than in source code; and we minimise what we collect in the first place, which is the most effective safeguard available to us. We never handle payment card details.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and the relevant authorities as and when applicable law requires.

11. Third-party sites

The Services contain links to websites we do not operate. This Privacy Policy does not apply to those sites, and we are not responsible for their content or their privacy practices. We encourage you to read the privacy policy of any site you visit.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and post the revised version on this page. If a change is material — for example, if we begin collecting a new category of information, engage a new processor, or change the purposes for which information is used — we will notify subscribers by email rather than making the change silently. Your continued use of the Services after a change takes effect constitutes acceptance of the revised Policy.

13. Contact us

To exercise a privacy right, ask a question, or report something on this page that does not match your experience of the Services:

Fullcourt, LLC (d/b/a Wildcard Wellness)
Email: contact@wildcardwellness.co