Website Privacy Policy

saturday.fit — Last updated March 2026

Our Commitment to Your Privacy

Saturday Inc. ("Saturday," "we," "us," or "our") operates the saturday.fit website to help athletes discover and subscribe to our fueling and hydration service. We collect only the data necessary to operate this website, process purchases, and communicate with you.

We do not sell your data. We do not serve ads. We do not share your data with advertisers.

This Privacy Policy covers information collected when you visit saturday.fit and its subdomains ("the Website"). For information about our mobile app, see our App Privacy Policy. If you are a Washington State resident or the site processes your health data, see our Health Data Privacy Policy.

Nevada residents, California residents, residents of other US states with privacy laws, and European data subjects should see the additional disclosure sections below.

Legal Bases for Processing

We process your data under the following legal bases:

Contract performance: processing your purchase and delivering the service you bought
Consent: sending marketing emails (you can unsubscribe at any time) and setting analytics cookies
Legitimate interest: operating and securing the website, understanding aggregate usage patterns, and preventing abuse
Legal obligation: retaining purchase records as required by tax and accounting law

Information We Collect

Information You Provide

When you make a purchase or subscribe, you provide your name and email address. If you subscribe to our email list, you provide your email address. Payment card details are collected directly by Stripe and are never seen or stored by us.

Information Collected Automatically

When you visit the website, we automatically collect:

Device and browser information: browser type, operating system, screen resolution
Network information: IP address (anonymized where possible)
Usage data: pages visited, clicks, scrolling, time on page, timestamps
Referral data: the website or link that brought you to saturday.fit

We collect this data so we can understand how visitors use the site, identify and fix problems, and improve the experience.

What We Do NOT Collect

We do not collect or store credit card numbers (Stripe handles all payment data)
We do not collect advertising identifiers
We do not sell data to any third party
We do not share data with advertisers
We do not serve ads of any kind

Third-Party Services

We use the following third-party services to operate the website. Each receives only the data necessary for its function.

Cloudflare (Cloudflare, Inc.)

Our website is hosted on Cloudflare Workers and served through Cloudflare's CDN and DNS. Cloudflare processes request data (IP address, URL, headers) to deliver pages and protect the site from attacks. Cloudflare also powers our link shortener (link.saturday.fit) and app redirect service (get.saturday.fit, app.saturday.fit) via Workers and KV storage.

Stripe (Stripe, Inc.)

Stripe processes all website purchases. When you check out, your payment information goes directly to Stripe. We receive only a confirmation of your purchase — never your card number. Stripe may collect device and browser data for fraud prevention.

Klaviyo (Klaviyo, Inc.)

We use Klaviyo for email marketing communications. If you subscribe to our email list or make a purchase, your name and email address are shared with Klaviyo so we can send you relevant messages. You can unsubscribe from any email at any time using the link at the bottom of every message.

Google Fonts (Google LLC)

The website serves font files from Google Fonts. When fonts are loaded, Google may receive your IP address and browser information.

Cookies and Tracking

We use cookies and similar technologies as follows:

Essential cookies: always active, required for the site to function (e.g., Cloudflare security, Stripe checkout). No consent needed.
Analytics cookies: used only when you consent via the cookie banner, to understand site usage and improve the experience.

You can manage cookie preferences through your browser settings. Most browsers allow you to block or delete cookies. Browsing without analytics cookies is fully supported.

Data Retention

Purchase records: 7 years (tax and legal requirements)
Analytics data: 26 months
Email marketing data: until you unsubscribe, plus 30 days for processing
Server logs: 90 days

Data Security

We implement reasonable and appropriate technical and organizational safeguards to protect your information, including encryption in transit (TLS/HTTPS for all pages), Cloudflare's DDoS protection and Web Application Firewall, and access controls limiting who can access personal data. No method of transmission over the internet is perfectly secure, but we take reasonable steps to protect your information.

Data Breach Notification

In the event of a data breach that poses a risk to your rights, we will notify affected users without undue delay and no later than 72 hours after becoming aware (as required by GDPR), or within the timeframe required by applicable state law. We will also notify relevant supervisory authorities as required.

Children's Data

This website is not directed at children under the age of 16. We do not knowingly collect personal information from anyone under 16. If we learn we have collected data from a child under 16, we will delete it promptly. Parents who believe their child has provided personal information should contact [email protected].

International Data Transfers

Saturday Inc. is based in the United States and our servers are located in the US. If you access the website from outside the US, your data will be transferred to and processed in the US. For transfers from the EEA, UK, and Switzerland, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission. Our service providers (Cloudflare, Stripe, Klaviyo) also maintain appropriate data transfer mechanisms.

Your Rights

Depending on where you live, you may have some or all of the following rights:

Access: request a copy of the personal data we hold about you
Correction: request that inaccurate data be corrected
Deletion: request that we delete your personal data
Portability: receive your data in a structured, machine-readable format
Restrict processing: request limits on how we use your data
Object to processing: object to processing based on legitimate interests or for direct marketing
Withdraw consent: where processing is based on consent, withdraw it at any time

To exercise these rights, email [email protected]. We will respond within 30 days (or sooner if required by applicable law).

Appeal Process

If we deny a privacy rights request, we will explain why. You may appeal by emailing [email protected] with "Appeal" in the subject line. We will respond to appeals within 60 days. If unsatisfied, you may contact your state attorney general or relevant data protection authority.

Information for California Residents (CPRA)

This section applies to California residents under the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CPRA").

Categories of Personal Information Collected

Identifiers: name, email address, IP address
Commercial information: purchase history
Internet or electronic network activity: browsing history on our site, pages visited, interactions
Geolocation data: approximate location derived from IP address
Inferences: preferences derived from browsing behavior

Sale and Sharing

We do not sell your personal information. We do not share your personal information with third parties for cross-context behavioral advertising. We have not sold or shared personal information in the preceding 12 months.

Your California Privacy Rights

Right to know: what personal information we collect, use, disclose, and sell
Right to delete: request deletion of personal information
Right to correct: request correction of inaccurate personal information
Right to opt out of sale/sharing: we do not sell or share, but you may exercise this right at any time
Right to non-discrimination: we will not discriminate against you for exercising your rights

To exercise these rights, email [email protected]. We will confirm receipt within 10 business days and respond within 45 days.

Global Privacy Control

We recognize and honor the Global Privacy Control (GPC) signal. If your browser sends a GPC signal, we treat it as a valid opt-out of the sale or sharing of personal information.

Information for Residents of Other US States

Residents of Colorado, Connecticut, Virginia, Texas, Oregon, Montana, and other states with comprehensive privacy laws have rights similar to those described above, including the rights to access, correct, delete, and port your data, and to opt out of the sale of personal information, targeted advertising, and profiling.

To exercise these rights, email [email protected]. If we deny your request, you have the right to appeal (see Appeal Process above).

Additional Disclosures for Nevada Residents

Nevada law (NRS 603A.340) provides consumers the right to opt out of the sale of personal information. We do not sell your personal information. To submit an opt-out request, contact [email protected].

Additional Disclosures for European Data Subjects (GDPR)

Saturday Inc. acts as a data controller with respect to personal data collected through this website.

Lawful Bases for Processing

See the Legal Bases for Processing section above. In summary: contract performance for purchases, consent for marketing and analytics cookies, legitimate interest for site operation and security, and legal obligation for purchase record retention.

Data Transfers

Data transferred from the EEA, UK, or Switzerland to the US is protected by Standard Contractual Clauses. See International Data Transfers above.

Your Data Subject Rights

European data subjects have the rights described in the Your Rights section above. Additionally, you have the right to lodge a complaint with your local supervisory authority. To exercise rights, email [email protected]. We will respond within 30 days.

Health Data Privacy

If you provide health-related information through the website (for example, during a subscription purchase flow), please see our standalone Health Data Privacy Policy for additional disclosures under the Washington My Health My Data Act (MHMDA) and similar laws.

Global Privacy Control & Do Not Track

We recognize and honor the Global Privacy Control (GPC) signal as a valid opt-out preference. If your browser sends a GPC signal, we treat it as an opt-out of the sale or sharing of personal information.

Regarding the older "Do Not Track" (DNT) browser signal: there is no industry-wide consensus on how to respond to DNT. We do not currently alter our data practices in response to DNT signals, but we do honor GPC as described above.

Changes to This Privacy Policy

We may update this policy from time to time. When we do, we will update the "Last updated" date at the top. For material changes, we will provide notice via email or a prominent notice on the website. Continued use after changes constitutes acceptance.

Contact Us

Questions, concerns, or requests regarding this Privacy Policy should be directed to:

Saturday Inc.
8 The Green, STE A, Dover, DE 19901
[email protected]