Fuse
Fuse is a fitness intelligence platform built by Fuse LLC. We collect health data from your wearable devices, interpret it with AI, and deliver personalized guidance through Phil, your AI fitness advisor.
This policy explains what data we collect, how we store and protect it, who can see it, and your rights under California law.
The short version: Your health data belongs to you. We collect only what's needed to make Fuse work. We never sell it. No ads. No third-party sharing for marketing. You can export or delete your data at any time.
Data synced from connected wearable providers via OAuth:
We access only the scopes you explicitly authorize during device connection. You can revoke access at any time from your device provider's app or from Fuse account settings.
All OAuth tokens for connected devices and services are encrypted at rest using AES-256 symmetric encryption (Fernet) before being written to the database. The encryption key is managed separately from the database file.
Passwords are stored using PBKDF2/SHA-256 hashing with per-account salts. They cannot be recovered or read by anyone at Fuse.
Your data is stored in a SQLite database hosted on Render's infrastructure in the United States. We maintain encrypted backups in Backblaze B2 cloud storage.
All data between your device and Fuse is encrypted using TLS 1.2 or higher (HTTPS). HTTPS is enforced on all endpoints.
Session cookies are marked HttpOnly, Secure, and SameSite=Lax to prevent interception and cross-site request forgery.
You have full access to all your data. Export your complete dataset at any time from account settings (JSON or CSV).
Phil processes your health data to generate personalized insights and morning briefs. This processing happens within Fuse LLC's systems. Phil's AI responses are powered by Anthropic's Claude API — your health context may be sent to Anthropic's API for inference. Anthropic does not train on API data per their enterprise data policy.
No human at Fuse reviews your individual health data in the normal course of operations. Your data is processed by software, not read by people.
A small number of authorized Fuse LLC personnel may access data only for:
All such access is logged for accountability.
We do not sell, rent, broker, or share your personal health data with any third party for marketing, advertising, or commercial purposes.
We do not share your data with data brokers, advertisers, insurance companies, employers, or any party not listed in this policy.
We use the following service providers to operate Fuse:
| Provider | Purpose | Data Shared |
|---|---|---|
| Render | Cloud hosting | All app data (hosted on Render servers) |
| Backblaze B2 | Encrypted backups | Encrypted database snapshots |
| Anthropic | AI inference (Phil) | Health context for AI responses |
| OAuth sign-in (optional) | Email address + Google ID only | |
| Stripe | Payments (future) | Payment info only — no health data |
All sub-processors are contractually bound to data protection standards.
As a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):
You may request a list of the categories and specific pieces of personal information we have collected about you in the past 12 months, including sources, purposes, and categories of third parties with whom it was shared.
To exercise: email hello@fuse.fit with subject "CCPA Right to Know Request."
You may request deletion of your personal information. We will delete your data and direct our service providers to do the same, except where required by law or for legitimate security purposes.
To exercise: go to Account Settings → Delete My Data, or email hello@fuse.fit with subject "CCPA Deletion Request."
We do not sell your personal information. There is nothing to opt out of.
Exercising your CCPA rights will not result in denial of service, different pricing, or reduced service quality.
We will respond to verifiable CCPA requests within 45 days. If we need additional time (up to 45 more days), we will notify you in advance.
We recognize that health and fitness data is among the most sensitive categories of personal information. We commit to:
Fuse is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us data, contact us at hello@fuse.fit and we will delete it promptly.
We will notify you of material changes by:
Continued use of Fuse after the effective date constitutes acceptance of the updated policy.
Privacy inquiries & data requests:
Email: hello@fuse.fit
Security vulnerabilities:
Email: security@fuse.fit
Mailing address:
Fuse LLC, Privacy Team
Los Angeles, California
This Privacy Policy is governed by the laws of the State of California. Any disputes arising under this policy shall be resolved in the courts of California.