Privacy policy

Last updated: September 2, 2026

Overview

This policy explains what personal data STOIK Innovations, LLC ("STOIK," "we," "us," "our") collects when you visit korboard.com, use the KORBOARD mobile app, buy a KORBOARD, KORBANDS, or other STOIK product, sign up for our newsletter, post to our #KORBOARD community, or contact customer support. It also covers how we use that data, who we share it with, how long we keep it, and the rights you have to control it.

We wrote this in plain English. We don't hide behind legalese, and we don't rely on dark patterns. If anything here is unclear, email us at privacy@stoikinnovations.com and a real person — not a bot — will reply within two business days.

By using the site or the app or buying a product, you agree to the practices described here. For a summary: we collect only what we need to process orders and run the business, we don't sell your data, we use a short list of reputable vendors, and you can always ask us what we have and tell us to delete it.

Information We Collect

We collect information in three ways: information you give us directly, information collected automatically when you use the site or app, and information from the third parties that help us run the business.

Personal information you provide: name, email address, shipping and billing addresses, phone number (optional), and payment details. Payment details are entered directly into our payment processors (Stripe and Shopify Payments) — we never see or store your full card number, CVV, or bank account number on our servers.

Usage information: IP address, device and browser type, operating system, pages viewed, referring URL, time spent on pages, and click paths. This is standard web analytics data.

Cookies and similar tech: session cookies to keep you logged in and keep items in your cart, analytics cookies (Google Analytics 4), and — if you opt in — advertising cookies that help us measure ad performance. You can clear cookies at any time through your browser settings, and we honor the Global Privacy Control signal.

Community and review content: when you submit a product review, tag #KORBOARD on social media, or post to a KORSQUAT leaderboard, we record the content you submit along with the handle or display name you use. Only the public parts are shown on our site and in our app.

The KORBOARD app: you can use the entire app — the exercise library, workouts, the leaderboard, and the shop — without creating an account. If you choose to create one, we collect your email address, your name (optional), and a password. The password is never stored in readable form; our authentication provider keeps only a secure cryptographic hash. If you use Sign in with Apple instead, Apple shares your name and email with us — and you can pick Apple's Hide My Email option, in which case we only ever see the private relay address Apple creates for you.

If you save content to your account — favorite workouts, personal records — we store that too, tied to your account, so it can follow you across devices. Like any online service, our servers record standard technical logs when the app talks to them: IP address, device model, operating system version, and timestamps.

Just as important is what the app does not do. It contains no advertising and no third-party analytics or tracking SDKs. It does not access your contacts, photos, location, or Apple Health data. We do not track you across other companies' apps or websites, so you will never see an App Tracking Transparency prompt from us. Physical gear is never sold in the app — those purchases happen on korboard.com and are covered by the website sections of this policy.

KORBOARD Pro: if you upgrade to KORBOARD Pro, the purchase is processed entirely by Apple through your Apple ID. We never see or store your card number or billing details — Apple tells us only that your account has an active Pro subscription (or a one-time Pro unlock) and its renewal status, so we can turn Pro features on for you across your devices.

How We Use Information

  • Fulfill your orders — process payment, ship product, send tracking and receipts.
  • Run the account, including order history, saved addresses, and wishlist.
  • Operate your KORBOARD app account — sign you in, keep your saved workouts and records in sync across devices, and provide member benefits.
  • Provide customer support and respond to warranty claims.
  • Improve the product, site, and app based on aggregated usage patterns.
  • Send marketing email about new gear, restocks, and training content — only if you opt in, and every message has a one-click unsubscribe.
  • Detect, prevent, and investigate fraud or abuse.
  • Comply with tax, accounting, and legal obligations.

We do not use your data for automated decisions that produce legal or similarly significant effects without a human in the loop. We do not train AI models on your personal data, and we do not sell or rent it for that purpose.

Our legal bases for processing, where GDPR applies, are: contract performance (to deliver what you ordered), legitimate interests (running a small business, preventing fraud, improving the site and app), consent (marketing email, optional cookies), and legal obligation (tax records, responding to subpoenas).

Sharing

We do not sell your personal information. We do not trade it, license it, or "share it for cross-context behavioral advertising" as the CCPA defines that term.

We do share data with vendors we rely on to operate, all of whom are bound by a data processing agreement (DPA) that limits them to using your data only to serve us:

  • Shopify — ecommerce platform and order database.
  • Stripe — payment processing.
  • UPS, FedEx, USPS — shipping carriers and address validation.
  • Klaviyo — transactional and marketing email.
  • Google Analytics 4 — aggregated site analytics.
  • Supabase — authentication and database for KORBOARD app accounts.
  • Apple — App Store distribution, Sign in with Apple, and in-app purchase processing.
  • Google — the service that publishes our public #KORSQUAT leaderboard standings.
  • Sentry — error monitoring.

We will disclose information when required by valid legal process, to protect our rights or someone's safety, or in connection with a business transaction such as a merger or acquisition — in which case we will notify you before your data moves.

Your Rights

Regardless of where you live, you can ask us to:

  • Tell you what personal data we hold about you.
  • Correct data that's wrong.
  • Delete your data (subject to records we're legally required to keep, like invoices).
  • Opt out of marketing email at any time.
  • Receive a portable copy of your data in a common format.

If you have a KORBOARD app account, you can delete it yourself, right in the app: Settings → Delete Account. Deletion is immediate and permanent — it removes your account and everything saved to it. You can also email privacy@stoikinnovations.com from your account address and we will do it for you.

If you're in the EEA, UK, or Switzerland, GDPR applies and you may also object to processing, restrict processing, and lodge a complaint with your local supervisory authority. If you're a California resident, CCPA/CPRA gives you these same rights plus the right to non-discrimination for exercising them.

To exercise any right, email privacy@stoikinnovations.com from the address on your account. We'll verify your identity and respond within 30 days. There's no cost to you.

Data Retention

  • Order and invoice records — 7 years, to meet US tax and accounting requirements.
  • Account profile — until you ask us to delete it.
  • KORBOARD app account — until you delete it (in the app or by email). Deleted accounts are removed from our systems immediately, except records we are legally required to keep.
  • Pro subscription status — while your account exists. Payment records themselves live with Apple, not us.
  • Marketing subscriptions — until you unsubscribe or are inactive for 24 months.
  • Analytics data — 26 months, then automatically purged.
  • Support tickets — 3 years after resolution.

Children

KORBOARD is not intended for children under 13, and we do not knowingly collect personal data from anyone under 13. The KORBOARD app is likewise not directed at children under 13, and app accounts may not be created by anyone under 13. If you are a parent or guardian and believe your child has given us information, contact privacy@stoikinnovations.com and we will delete it promptly. Purchases and accounts must be made by an adult.

International Transfers

Our servers and operations are based in the United States. If you shop from outside the US, your data will be transferred to and processed in the US, which may have different data protection laws than your country. Where required, we rely on Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum (IDTA) to cover those transfers and to keep your data protected to the same standard as if it had stayed with you.

We also take reasonable technical and organizational measures to secure your data — encrypted connections (TLS 1.2+), encrypted data at rest for payment and account systems, strict access controls, and vendor security reviews. No system is perfectly secure, so if we ever experience a breach that affects your data, we will notify you and the appropriate authorities as required by law.

Changes to This Policy

When we make material changes to this policy, we will update the "Last updated" date at the top and notify you by email (if you have an account or are on our list) and by a banner on the site for at least 14 days before the changes take effect.

Contact Us

Questions, requests, or concerns? Reach out:

STOIK Innovations, LLC
Attn: Privacy
Charlotte, NC
United States
privacy@stoikinnovations.com