Privacy policy

Who operates this service

Am I Jacked? is operated by 10951811 Canada Inc., in Quebec, Canada. For support, refunds, or the person responsible for protecting personal information, contact 10951811canadainc@gmail.com.

Adults and photo choices

The service is for adults 18 and older. You must explicitly confirm adulthood before selecting a photo, confirm that you are the pictured person, and agree to AI processing. A declared age below 18 overrides the checkbox. Our servers reject missing adult declarations and declared under-18 ages before image decoding, repeat-result reuse, or AI work. Self-declaration and appearance screening do not verify identity or legal age. Avoid including other people or identifying background details.

Am I Jacked uses your declared age to enforce adult access. The exact age is not saved with the assessment or included in its AI prompt. We do not request a birth date or identity document for this check.

Information and purposes

We process information you submit to provide assessments, plans, workout tracking, account access, payment verification, and service protection. This can include sign-in email and basic profile, training preferences, exercise selections, performed sets, weights, repetitions or duration, completion marks, notes, and timer events. Do not put sensitive information unrelated to these features in optional answers or notes.

Am I Jacked processes your submitted photo, visible-muscle findings, scores, private Coach and Savage feedback, and a free AI goal illustration generated automatically after an accepted assessment. A separately requested training package uses your equipment, experience, availability, goals, and assessment findings. Optional public profiles and progress challenges collect only the additional content and choices needed for those features.

Photo and AI processing

The browser reduces photo size and re-encodes it, removing embedded metadata; the backend also re-encodes accepted images. Requested AI features send the relevant photo and submitted context to OpenAI through our Google Cloud backend. API credentials remain on the server. Requests use store:false where supported; this does not mean zero provider retention. Providers may retain operational or abuse-monitoring data under their own terms. We do not use your private photos as public examples or sell them.

The photo is screened and assessed for visible muscle development. Coach and Savage feedback can use the original photo context and fixed findings; Coach is the default. After an accepted assessment, we automatically send the photo and assessment for an additional AI image-generation step to create a free 90-day goal illustration, as disclosed beside the submit button. Training-program generation uses training choices and assessment findings without sending the photo again. Recording workouts does not send those entries to OpenAI.

AI outputs and some screening or moderation decisions are automated. Scores are approximate and can be wrong. You can contact us to ask about the information used, correct your submitted information, or raise concerns for human review. The methodology explains the intended scoring rules; model outputs are not medical decisions.

Providers, access, and international processing

We use Supabase for private customer records, Firebase for customer sign-in, Google Cloud for backend processing, OpenAI for requested AI features, Stripe for checkout and subscription billing, and Sites for website hosting. These providers receive the information necessary for their role. Firebase sign-in receives sign-in information, not your assessment photo or workout records through that sign-in flow. Stripe receives payment details; our application stores transaction, customer, and subscription references, payment and access status, and activation and billing periods, not full card numbers. The current private preview also uses Sites' ChatGPT sign-in for hosting access.

Am I Jacked stores private images and documents in Cloudflare R2. Browser access uses a protected session cookie, and signed-in sessions can last up to 14 days. Credentials used for the website session are encrypted on the server. Private results and files have ownership checks; signing in does not automatically publish them.

We operate in Quebec. Our customer database is hosted in Canada, but hosting, authentication, AI, payment, support, and infrastructure processing may occur outside Quebec or Canada, including in the United States. Information can be subject to the laws of those locations. No storage-region promise applies to all providers. We limit application access to the requested features and authorized support or administration; no system can guarantee absolute security.

Retention and deletion

Guest assessments and their photos become inaccessible after 24 hours. Explicitly saved assessments are accessible for 180 days from saving. Expiry ends application access immediately; physical cleanup may occur later in maintenance batches, particularly on a quiet site. Losing the guest browser cookie can prevent access to an unsigned result. Use the result's Delete control to remove it and its associated private images. Provider backups, recovery copies, and required transaction records may have separate retention.

Purchased Am I Jacked programs, training information, and PDFs remain private until you delete them or your account, independently of assessment or photo expiry and premium access. Deleting a free result does not delete a separately purchased document or separately consented progress challenge. Deleting the private training document removes that document, its PDF, and linked journal; you can also contact us for account-related deletion. Restricted purchase and security records can remain, including purchase/result identifiers, account or browser linkage, payment references, amount, currency, status, timestamps, and the original overall score, to prevent payment replay and support transaction records. Stripe retains its own billing records. You can delete your Am I Jacked account from Account > Privacy. This cancels this brand’s monthly premium subscription, removes its private and public content, and revokes its website sessions. Failed file removals stay queued for retry. The shared Firebase sign-in identity and any What Is My Body Fat account remain separate; contact us to request deletion of the shared sign-in identity.

The signed-in workout journal retains routine guides, sets, completion marks, timer events, and notes until you delete the journal, its linked training document, or your account. It excludes photos, body measurements, and assessment snapshots. Ending premium or assessment expiry does not delete it; basic logging and history viewing and export remain available. Clearing workout history removes recorded workouts, timers, and notes while preserving purchased plans and the shared exercise library. Old queued saves cannot restore cleared history. Removing your personal records never deletes the shared exercise catalogue.

Browser storage, timers, and calendars

Essential cookies and browser storage support sessions, design and language preferences, workout drafts, and the free workout builder. Recovery drafts and unconfirmed workout saves can remain in this browser for up to seven days; signing out clears this site's recovery copies. Other preferences or builder drafts can remain until you clear them or browser storage. Drafts contain workout entries and notes, not photos or payment credentials. Timers record device event time, time zone, and server receipt time while the visible counter runs locally. Example workout changes remain in page memory and reset on refresh.

A downloaded calendar file contains exercises and a link to your private portal. Importing or sharing it is your choice; we do not connect to your calendar account or add events automatically. PDFs and share cards you download are outside our deletion controls.

If you allow optional usage analytics, we record a random browser journey reference, broad device and traffic-source categories, steps reached and fixed error categories. We do not include photos, measurements, assessment text, email addresses or written answers. Analytics records expire after 90 days and are pruned as new activity arrives. You can decline or change your choice here; withdrawing also deletes the current journey. Do Not Track and Global Privacy Control disable this tracking. Separately, internal experiments and discount codes are linked to a hashed reference for your verified guest or signed-in account. Codes retain their assigned variant, discount amount, activation, expiry and purchase outcomes. These records apply the displayed price and are not marketing-email consent. A code’s deadline begins at its configured event, such as a completed assessment; refreshing does not restart it.

Sharing

Joining the leaderboard requires sign-in and an explicit choice to publish your handle, score, and badges. Detailed breakdowns and private coaching remain private. Photo publication has its own unchecked choice. Publishing a Savage roast on a public profile and including it in a share card have separate unchecked choices. Goal illustrations are not posted to the leaderboard. Public entries remain until withdrawn, replaced, or hidden for review.

Anonymize my picture blurs detected faces using a free, locally bundled face detector and image processing on our backend, without an additional AI provider. You must review the preview and confirm coverage before using the blurred copy. Selected blur uses that reviewed copy for publication or sharing; an unavailable preview blocks it and never falls back to the original. Face detection can miss faces, and blur does not hide hair, tattoos, clothing, or surroundings. It reduces exposure but does not guarantee anonymity. Your private original stays unchanged. Preview copies are deleted with the associated result or challenge.

Making a share card does not post to the leaderboard. You choose whether to include the original photo or a reviewed blurred copy, with optional verdict, build label, and separately selected roast. Anyone who receives or sees shared content can save it. Removing it from our site cannot retrieve copies others made.

Am I Jacked's optional progress challenge

With separate private-storage consent, the free challenge stores a signed-in baseline photo, group keys, score, and dates for up to 180 days from day 0. An original comparison assessment at least 90 days later can complete it. Scores and both photos stay private unless you explicitly consent to publishing both. Face blur requires reviewing both previews. You can remove a public comparison while retaining the private challenge, or delete the challenge and its photos. Deleting a free result or paid portal does not delete this separately consented challenge. Lighting, clothing, pose, and AI variation can affect comparisons.

Service protection and advertising

Temporary counters and secret-salted or hashed network or browser identifiers help limit abuse and expensive processing. Infrastructure providers may keep their own request and security logs. We do not use third-party advertising pixels or sell personal information for advertising. Links to another service can carry referral campaign tags; following them is your choice, and our application does not send your photo or assessment to that service.

Private image fingerprints recognize repeat uploads and discourage duplicate leaderboard entries or reused progress photos. They are not public and are removed with the related result, entry, or challenge. Reports and screening can hide an entry for review. Reviewers see only the photo copy you consented to publish, including the blurred copy when selected, and server-owned public feedback; unshared originals and private coaching are not exposed in the review queue. Hidden entries and submitted moderation evidence can remain restricted until withdrawal or deletion. Withdrawing an entry removes its public content; salted report and review receipts can remain restricted to prevent repeated reports or replay. A person depicted can use the photo privacy form without a Jacked account. Identifiable public entries are temporarily hidden on receipt of a consent complaint, pending owner review. Report text and optional contact details stay private for handling the complaint; limited case and safety records remain after closure.

Your choices and privacy requests

You can omit optional inputs, decline saving or publication, use available deletion and withdrawal controls, or stop using the service. Contact 10951811canadainc@gmail.com to request access, correction, a copy of your personal information, withdrawal of consent, deletion of account-related information, or to make a privacy complaint. We may need to verify that the information belongs to you. Written access and correction requests are handled within applicable legal deadlines, normally 30 days in Quebec. A portability request can seek computerized information you provided in a structured, commonly used format, subject to applicable exceptions. We explain any applicable legal retention or other limit rather than promise every request is unconditional. Withdrawal can prevent features that require the information. You may also contact the privacy authority in your jurisdiction, including Quebec's Commission d'accès à l'information or Canada's privacy commissioner, where applicable.

Changes and contact

We update the date on this page when the policy changes. If a new use requires consent, we ask before that use. For questions or incidents, contact 10951811canadainc@gmail.com. This policy explains the implemented service; it does not waive rights under applicable privacy or consumer law.