Website Privacy Policy

saturday.fit
Effective October 10, 2026

Our Commitment to Your Privacy

Saturday Inc. ("Saturday," "we," "us," or "our") operates the saturday.fit website to help athletes discover and subscribe to our fueling and hydration service. We collect only the data necessary to operate this website, process purchases, and communicate with you.

We do not sell your data. We do not serve ads. We do not share your data with advertisers.

This Privacy Policy covers information collected when you visit saturday.fit and its subdomains ("the Website"). For information about our mobile app, see our App Privacy Policy. If you are a Washington State resident or the site processes your health data, see our Health Data Privacy Policy.

Nevada residents, California residents, residents of other US states with privacy laws, and European data subjects should see the additional disclosure sections below.

Legal Bases for Processing

We process your data under the following legal bases:

Contract performance: processing your purchase and delivering the service you bought
Consent: sending marketing email where we ask for your agreement (see Marketing Email below) and, for visitors from the European Economic Area and the United Kingdom and visitors whose country we cannot tell, setting analytics cookies
Legitimate interest: operating and securing the website, understanding aggregate usage patterns, preventing abuse, and sending marketing email to Saturday members where we do not ask first (see Marketing Email below)
Legal obligation: retaining purchase records as required by tax and accounting law

Information We Collect

Information You Provide

When you make a purchase or subscribe, you provide your name and email address. If you buy a gift, you also provide the recipient's email address and any message you write to them. If you cancel a website plan, we keep when you canceled and the reason and any comment Stripe records with the cancellation. Payment card details are collected directly by Stripe and are never seen or stored by us.

When you book a consultation, you provide your name and email address and, if you write one, the topic of the call. We put the call on our Google Calendar, which sends you its invitation with the Google Meet link.

If you sign in, we receive your email address, your name if your Google or Apple account shares it, and how you sign in (for example with a password, a sign-in link we email you, Google, or Apple).

In the Boondock map tools you can post reviews, photos, places, and check-ins, and save places, trips, and your rig details. Reviews, photos, and the places you submit are public; check-ins are visible only to you. When you are signed in, this content is stored with your account; when you are not, your saved places, trips, and rig details stay in your browser. Before we store a JPEG photo, we remove the GPS location recorded in it.

If you review a product in our store, the rating, title, text, photos, and name you enter are published. The email address you enter is kept private: we use it to check for a Verified Buyer badge and never show it.

Device location: the Boondock map asks your browser for your location when you first open it, when you ask it to show where you are, and when you fill in a place you submit from your location. Your browser asks your permission first. Your location is used to move the map or to fill in the place you submit, and a place you submit keeps the location you gave it. The map keeps the position it shows, which can be where you are, in the page address, so you can bookmark or share the view, and in this browser's storage on your device, so the map opens there next time; clearing this site's data in your browser settings removes it. Google Analytics receives the page address without the map position. The map loads map, place, and weather data for the area it shows, from our servers and from the services listed below.

Information Collected Automatically

When you visit the website, we automatically collect:

Device and browser information: browser type, operating system, screen resolution
Network information: IP address (anonymized where possible)
Usage data: pages visited, clicks, scrolling, time on page, timestamps
Referral data: the website or link that brought you to saturday.fit

We collect this data so we can understand how visitors use the site, identify and fix problems, and improve the experience.

Invite links: after you open an invite link, your first tap on that page or on our download page copies a code to your clipboard that identifies the invite and expires after 6 hours, so the Saturday app on iPhone can apply the invite when you first open it. On Android, the Google Play link also carries the invite code.

What We Do NOT Collect

We do not collect or store credit card numbers (Stripe handles all payment data)
We do not collect advertising identifiers
We do not sell data to any third party
We do not share data with advertisers
We do not serve ads of any kind

Third-Party Services

We use the following third-party services to operate the website. Each receives only the data necessary for its function.

Cloudflare (Cloudflare, Inc.)

Our website is hosted on Cloudflare Pages and served through Cloudflare's CDN and DNS. Cloudflare processes request data (IP address, URL, headers) to deliver pages and protect the site from attacks. Our fonts are served from saturday.fit through Cloudflare Fonts, so loading them sends nothing to Google. When you add a photo to a product review or submit one, Cloudflare Turnstile checks that a person is sending it and receives your IP address and browser details. Cloudflare also runs our sign-in service (auth.saturday.fit), our link shortener (link.saturday.fit), our app redirect service (get.saturday.fit), and the services behind our map and route tools (tools-api.saturday.fit), and stores the photos you upload and the crew plans you share.

Stripe (Stripe, LLC)

Stripe processes all website purchases. When you check out, your payment information goes directly to Stripe. We receive only a confirmation of your purchase, never your card number. Stripe may collect device and browser data for fraud prevention.

Klaviyo (Klaviyo, Inc.)

We use Klaviyo to send email. When you buy on the website, Klaviyo receives your email address and the details of your purchase (such as the plan, price, and currency, and any offer or campaign link that brought you to it), and sends you the email with your redemption code when your purchase is not yet linked to an account. If you buy a gift, Klaviyo also receives the recipient's email address, your name, and your message, and sends the recipient their gift. Klaviyo also sends our marketing email, as described under Marketing Email below. You can unsubscribe from marketing email at any time using the link at the bottom of every marketing email.

Brevo (Sendinblue Inc.)

We use Brevo to send the emails our servers send you about your purchases, consultations, and account, such as receipts, consultation reminders, and the sign-in links you request. After a consultation, Brevo also sends our follow-up offer, only if you receive our marketing email. Brevo receives your email address and the content of each email.

Google Firebase and Google Cloud (Google LLC)

Sign-in uses Firebase Authentication. When you sign in, and while you stay signed in, your browser sends your sign-in details and account tokens to Google. If you sign in with Google or Apple, that company also handles the sign-in in a pop-up window. The Boondock map tools, your account page, and the 3D course viewer (for the courses and settings you save) read and store data in Google Cloud Firestore. Purchases, memberships, reviews, sign-in sessions, and our other website features run on Google Cloud servers. Google processes this data for us as our service provider and receives your IP address and browser details with each request it handles.

Sentry (Functional Software, Inc.)

We use Sentry to record errors that happen in your browser while you use the website, so we can find and fix them. When an error occurs, Sentry receives the error message, the technical stack trace, the address of the page you were on, your browser and operating system version, and the IP address the report was sent from. Session recording and performance tracing are switched off, and we do not send Sentry your name, email address, or account details.

Map, Weather, and Route Tools

Our free tools (the Boondock map, the Elevation Calculator with its 3D course viewer, and the Multisport Pace Calculator) load some content straight from other providers. Each of these providers receives your IP address and browser details, and map and weather providers also receive the map area or coordinates you are viewing:

Map tiles and labels (depending on the map style and layers you choose): Esri, OpenStreetMap, OpenTopoMap, CyclOSM, CARTO, NASA GIBS (satellite layers), Amazon Web Services (terrain tiles), and OpenMapTiles (map label fonts)
Weather: the US National Weather Service. Crew Plan forecasts are requested by our servers from the National Weather Service or, outside the US, MET Norway (the Norwegian Meteorological Institute); they receive the spot coordinates but not your IP address. For longer-range Crew Plan forecasts, our servers download NOAA GEFS model grids from AWS Open Data. NOAA and AWS receive no spot coordinates or visitor IP addresses for these downloads.
Code libraries: jsDelivr (Elevation Calculator) and unpkg (Multisport Pace Calculator)
3D terrain and imagery: Esri (satellite imagery, or OpenTopoMap when that imagery is unavailable) and Amazon Web Services (terrain tiles), in the 3D course viewer

Your browser contacts these providers directly, and each handles what it receives, including your IP address and your map requests, under its own privacy policy. They are not service providers that process data for Saturday under a contract with us.

Some tool features send your searches, map coordinates, or a route link you paste to other services from our servers, not from your browser, and we do not pass them your IP address: Photon and Nominatim (place search), Valhalla and openrouteservice (driving routes), MET Norway and the US National Weather Service (weather), RainViewer and the Iowa Environmental Mesonet (radar), Google Maps Platform (drive times in the crew planner), OpenTopoData (elevation), and OpenStreetMap's Overpass service and Recreation.gov (places, land, and water).

When you paste a Ride with GPS route link or a link to a course file, our server fetches it for you; Ride with GPS routes come through Ride with GPS's API. When our server cannot fetch a file link, your browser fetches it directly from that site, which then receives your IP address. Strava and Komoot links are not fetched; you export the file there and upload it.

Marketing Email

Buying on the website does not sign you up for marketing email. After you buy, we email you what you need for your purchase, such as your receipt, your redemption code, and a link to sign in to the Saturday app.

When you open the Saturday app with your account and your email address is verified, we add you to our marketing email (our newsletter, tips on using Saturday, and offers) as follows:

If you are under 18: only if you tick the box that asks.
If your App Store or Google Play country, your phone's region or time zone, or the place you connect from points to the European Economic Area, the United Kingdom, or Switzerland: only if you tick the box that asks. Leaving it unticked is a no. Older versions of the app do not ask website buyers; with them, we do not add you if our records place you in one of these countries.
Otherwise: unless you have unsubscribed from our emails before. We rely on our legitimate interest in telling our members about Saturday.

Where we ask, we rely on your consent. To stop marketing email, use the unsubscribe link at the bottom of any marketing email, or email support@saturdaymorning.fit. We keep a record that you unsubscribed, so we do not add you again unless you subscribe again.

Cookies and Tracking

We use cookies and similar technologies as follows:

Essential: always active and required for the site to work (for example, Cloudflare security and Stripe checkout). Your cookie choice is also kept in your browser's local storage so we do not ask again, and the country we use to decide whether to ask is kept in your browser until you close the tab. If you open an invite link someone sent you, its code is kept for 30 days in a cookie (sat_ref) and in local storage, so the invite still applies when you download the app. No consent is needed for these.
Analytics: Google Analytics (Google LLC) counts visits and shows which pages people use, so we can improve the site. It sets the _ga cookies and receives your IP address, browser and device details, the pages you view, and the page that brought you here.

If you visit from the European Economic Area or the United Kingdom, or we cannot tell which country you are visiting from, Google Analytics does not load and sets no cookies until you choose Accept in the cookie banner. If you choose Reject, it stays off. For these visits, Google's advertising features (Google signals and ad personalization) are switched off. Everywhere else, Google Analytics loads when you visit, with no banner.

We use the country your connection comes from, as reported by Cloudflare, only to decide whether to show the banner.

Wherever you visit from, you can change your choice at any time with Cookie choices at the bottom of the page. Choosing Reject stops Google Analytics and deletes its cookies. We remember an Accept for 12 months and a Reject until you change it. You can also block or delete cookies in your browser settings. Browsing without analytics cookies is fully supported.

Data Retention

Purchase records: 7 years (tax and legal requirements)
Analytics data: Google Analytics keeps event-level data from your visits for 2 months, and user-level data tied to its cookie in your browser for 14 months after your last visit. We keep a copy of these events in our data warehouse on Google Cloud with no deletion date. Website visits are not linked to your Saturday account, so deleting your account does not delete them.
Email marketing data: kept while you are subscribed. After you unsubscribe, we keep your Klaviyo profile marked as unsubscribed, so we do not send you marketing emails again unless you subscribe again.
Server logs: our servers on Google Cloud keep request logs, which include your IP address, for 30 days. Some of our services on Cloudflare keep request logs for 7 days.
Consultation bookings: we keep your name, email address, the call's time and length, the price, any coupon and the payment references as the record of the call. Thirty days after the call we remove the links to the call and to its booking page from that record, and a year after the call the topic. The call's event on our Google Calendar keeps its details. Consultations are a separate service from the Saturday app: deleting an app account does not delete consultation bookings, their calendar events or their notes.

Data Security

We implement reasonable and appropriate technical and organizational safeguards to protect your information, including encryption in transit (TLS/HTTPS for all pages), Cloudflare's DDoS protection and Web Application Firewall, and access controls limiting who can access personal data. No method of transmission over the internet is perfectly secure, but we take reasonable steps to protect your information.

Data Breach Notification

If a data breach affects your personal data, we will notify the relevant supervisory authority within 72 hours of becoming aware of it where the GDPR requires, and we will notify affected users without undue delay where the breach is likely to result in a high risk to them, or within the time applicable state law requires.

Children's Data

This website is not directed at children under the age of 14. We do not knowingly collect personal information from anyone under 14. Where local law sets a higher minimum age of digital consent (up to 16 in some EEA and UK jurisdictions), that higher age applies, and we do not knowingly collect a child’s personal data below that age without verifiable parental consent. If we learn we have collected data from a child under 14, we will delete it promptly. Parents who believe their child has provided personal information should contact support@saturdaymorning.fit.

International Data Transfers

Saturday Inc. is based in the United States. If you use our website from outside the United States, you give your data directly to us there. Our service providers process data for us under contracts that require them to protect it at least as well as this policy does. Cloudflare, Stripe, Klaviyo, Google LLC, and Sentry are certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework, which the European Commission, the UK Government and the Swiss Federal Council recognize as providing adequate protection for data sent to certified US companies. You can ask for a copy of these safeguards at support@saturdaymorning.fit.

Your Rights

Depending on where you live, you may have some or all of the following rights:

Access: request a copy of the personal data we hold about you
Correction: request that inaccurate data be corrected
Deletion: request that we delete your personal data
Portability: receive your data in a structured, machine-readable format
Restrict processing: request limits on how we use your data
Object to processing: object to processing based on legitimate interests or for direct marketing
Withdraw consent: where processing is based on consent, withdraw it at any time

To exercise these rights, email support@saturdaymorning.fit. We will respond within 30 days (or sooner if required by applicable law).

Appeal Process

If we deny a privacy rights request, we will explain why. You may appeal by emailing support@saturdaymorning.fit with "Appeal" in the subject line. We will respond to appeals within 60 days. If unsatisfied, you may contact your state attorney general or relevant data protection authority.

Information for California Residents (CPRA)

This section applies to California residents under the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CPRA").

Categories of Personal Information Collected

Identifiers: name, email address, IP address
Commercial information: purchase history
Internet or electronic network activity: browsing history on our site, pages visited, interactions
Geolocation data: approximate location derived from IP address, and, if you allow it, your device's precise location in the Boondock map tools, used to show the map where you are or to fill in a place you submit, and kept in your browser as the map's last position
Content you post: reviews, photos, places, and check-ins
Inferences: preferences derived from browsing behavior

Sale and Sharing

We do not sell your personal information. We do not share your personal information with third parties for cross-context behavioral advertising. We have not sold or shared personal information in the preceding 12 months.

Your California Privacy Rights

Right to know: what personal information we collect, use, disclose, and sell
Right to delete: request deletion of personal information
Right to correct: request correction of inaccurate personal information
Right to opt out of sale/sharing: we do not sell or share, but you may exercise this right at any time
Right to non-discrimination: we will not discriminate against you for exercising your rights

To exercise these rights, email support@saturdaymorning.fit. We will confirm receipt within 10 business days and respond within 45 days.

Global Privacy Control

We recognize and honor the Global Privacy Control (GPC) signal. If your browser sends a GPC signal, we treat it as a valid opt-out of the sale or sharing of personal information.

Information for Residents of Other US States

Residents of Colorado, Connecticut, Virginia, Texas, Oregon, Montana, Iowa, Indiana, Tennessee, Florida, Minnesota, New Jersey, Delaware, Maryland, New Hampshire, Rhode Island, and other states with comprehensive privacy laws have rights similar to those described above, including the rights to access, correct, delete, and port your data, and to opt out of the sale of personal information, targeted advertising, and profiling.

To exercise these rights, email support@saturdaymorning.fit. If we deny your request, you have the right to appeal (see Appeal Process above).

Additional Disclosures for Nevada Residents

Nevada law (NRS 603A.340) provides consumers the right to opt out of the sale of personal information. We do not sell your personal information. To submit an opt-out request, contact support@saturdaymorning.fit.

Additional Disclosures for European Data Subjects (GDPR)

Saturday Inc. acts as a data controller with respect to personal data collected through this website.

Lawful Bases for Processing

See the Legal Bases for Processing section above. In summary: contract performance for purchases; consent for analytics cookies and for marketing email where we ask for it; legitimate interest for site operation and security and for marketing email to members we do not ask first; and legal obligation for purchase record retention.

Data Transfers

How your data reaches the United States, and the safeguards that apply, are described in International Data Transfers above.

Your Data Subject Rights

European data subjects have the rights described in the Your Rights section above. Additionally, you have the right to lodge a complaint with your local supervisory authority. To exercise rights, email support@saturdaymorning.fit. We will respond within 30 days.

Health Data Privacy

If you provide health-related information through the website (for example, during a subscription purchase flow), please see our standalone Health Data Privacy Policy for additional disclosures under the Washington My Health My Data Act (MHMDA) and similar laws.

Global Privacy Control & Do Not Track

We recognize and honor the Global Privacy Control (GPC) signal as a valid opt-out preference. If your browser sends a GPC signal, we treat it as an opt-out of the sale or sharing of personal information.

Regarding the older "Do Not Track" (DNT) browser signal: there is no industry-wide consensus on how to respond to DNT. We do not currently alter our data practices in response to DNT signals, but we do honor GPC as described above.

Changes to This Privacy Policy

We may update this policy from time to time. When we do, we will update the effective date at the top. For material changes, we will provide notice via email or a prominent notice on the website. Continued use after changes constitutes acceptance.