Legal
Privacy policy
In effect October 8, 2026.
The short version
We collect what we need to sell you the program, run your account and answer you: your name, email, payment details (handled by Stripe), and what you do inside the program.
On our public pages we use Meta's pixel and Google Analytics to see which ads and pages work, and our server tells Meta when someone buys. Inside the members area there is no Meta tracking at all.
We never sell your information for money. You can switch off ad tracking on the "Your privacy choices" section below, and we honor the Global Privacy Control signal automatically.
1. Who we are
Hybrid Fit Mom is Mari Grossi's strength training business, based in North Carolina in the United States. This policy covers hybridfitmom.com, the paid program and its members area, the AI coach, and the emails we send.
When this policy says "we" or "us" it means Hybrid Fit Mom. You can reach us about anything here at hello@hybridfitmom.com.
2. Information you give us
Account. Your name, email address and password when you create an account. The password is stored only as a one-way hash, so nobody at Hybrid Fit Mom can read it.
Purchases. When you buy, Stripe collects your name, email, phone number, billing ZIP code and country, and your card or wallet details. Card numbers go to Stripe and never reach us. We keep a record of the purchase: your email, what you bought, the amount, and Stripe's reference numbers.
Waitlist, free workout and product interest. Your email, and anything else you choose to fill in, such as your name, your training experience and your goal.
Training. Which sessions you complete, and the goals and training details you add to your profile.
AI coach. Everything you type to the coach, and its replies. If you mention an injury, a pregnancy or another health detail, that is stored with the conversation. Please only share what you are comfortable with.
Messages. Whatever you send us by email, including refund requests.
3. Information collected automatically
Device and usage data. Your IP address, browser and device type, the pages you visit, the page that sent you here, and any campaign tags in the link (such as utm_source).
Sign-in security. While you are signed in we store your IP address and browser with your session, so suspicious sign-ins can be spotted and sessions can be ended.
Cookies. A small number of cookies, listed in the table below.
Abuse protection. A one-way hash of your IP address for rate limiting signups, not the address itself.
4. How we use your information
To sell you the program and give you access to it, including matching your purchase to your account.
To take payment, send receipts, and handle refunds.
To send account emails, such as password resets and purchase confirmations, and, if you joined a list, emails about the program and new products. Every marketing email has an unsubscribe link.
To run the AI coach, which answers using your messages, your profile and the program.
To understand which pages, versions of the homepage and ads work, and to show our ads to people likely to want the program (see "Advertising and Meta").
To keep the site secure, prevent fraud and abuse, and meet legal, tax and accounting obligations.
5. Advertising and Meta
We advertise on Facebook and Instagram, and we measure those ads with two Meta tools.
The Meta Pixel runs on our public pages, not inside the members area. It tells Meta when you view a page, start checkout or complete a purchase, along with the value of the purchase. It sets the cookies _fbp and _fbc. With Meta's automatic advanced matching, the pixel may also read an email address or phone number you type into a form on those pages, and hash it in your browser before sending it.
The Conversions API sends the same checkout and purchase events from our server to Meta, so they are counted even when a browser blocks the pixel. With each event we send your email, phone number, first and last name, city, state, ZIP code and country, each converted into a one-way hash before it leaves our server. We also send your IP address, browser details, the Meta cookie IDs above, and a random visitor ID of our own.
Meta uses this to tell us which ads led to sales, to build audiences such as "people who started checkout", and to find people similar to our buyers. Meta handles that data under its own privacy policy and may combine it with what it already knows about your Meta account.
We never send Meta your training activity, anything you tell the AI coach, or which pages you visit inside the members area.
Google Analytics measures visits to the site in aggregate. Vercel Web Analytics and Speed Insights measure page views and loading speed without cookies.
8. How long we keep it
Account, profile, training progress and AI coach conversations: while your account exists. Delete the account and they go with it.
Purchase records: as long as tax and accounting law requires, usually seven years, even if you delete your account.
Waitlist and interest signups: until you unsubscribe or ask us to remove you.
Sign-in sessions: 30 days, or until you sign out.
Cookies: the durations in the table above.
9. Your privacy choices
Ad tracking. Use the switch below to turn off Meta tracking in this browser. The pixel stops loading, its cookies are cleared, and if you buy, our server sends nothing to Meta about it either. We treat a Global Privacy Control signal from your browser the same way, without you doing anything.
Meta's own settings. Your ad preferences inside Facebook and Instagram control which ads you are shown there.
Marketing email. Every marketing email has an unsubscribe link.
10. Your rights
Depending on where you live, you may have the right to know what personal information we hold about you, to get a copy of it, to correct it, to delete it, and to opt out of targeted advertising, the "sale" or "sharing" of personal information, and profiling.
We give every customer these rights, wherever you live. Email hello@hybridfitmom.com from the address on your account and say what you want. We may ask you to confirm the request from that address before we act on it, and we answer within 45 days. Someone you authorize can make a request for you if they show us your written permission.
If we turn a request down, you can appeal by replying with "Appeal" in the subject line, and we will explain our decision in writing within 60 days.
Using these rights never changes your price or your access to the program.
11. Health information
Hybrid Fit Mom is a fitness education business, not a healthcare provider, and is not covered by HIPAA. We do not ask for medical information. If you share health details with the AI coach or by email, we use them only to answer you, never for advertising, and we delete them when you ask.
12. Children
The program is for adults. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, email hello@hybridfitmom.com and we will delete it.
13. Security
The site is served only over HTTPS, passwords are hashed, payments are handled by Stripe, and access to our systems is limited to the people who run the business. No system is perfectly secure, so we cannot promise that information will never be exposed, but we will tell you without undue delay if a breach affects you.
14. Where your information is processed
We and our providers process information in the United States. If you visit from another country, your information is transferred to and handled in the US, where privacy laws may differ from yours.
15. Changes to this policy
When this policy changes, the date at the top changes with it. If a change materially affects how we use information we already hold, we will email account holders before it takes effect.