Privacy Policy

Last updated: July 21, 2026

This Privacy Policy applies to the website phallushape.com, including the member area at /app. It explains what personal data we process, for what purposes, and what rights you have. It also contains the disclosures required for consumer health data and for US state privacy rights.

1. Who is responsible

For visitors in the European Economic Area (EEA) or the United Kingdom, Brinvolt LLC is the controller within the meaning of the GDPR.

2. Our approach: minimal data, no names

PhalluShape is deliberately built to collect as little data as possible. An email address is all you need to use the platform; we do not ask for your name and never display one. There is no public profile and there are no community features through which other users could see your data. We do not sell personal data, and we do not share it for third-party advertising beyond the opt-in measurement services described in Section 6 — which never run without your explicit consent.

3. What we collect

Account data. Your email address, a password (stored only as a cryptographic hash), and the time and version of your acceptance of the Terms and this Privacy Policy.

Training and measurement data (consumer health data). The core of the platform is your progress journal: body measurements (e.g. length and girth), self-assessments of erection quality, training logs, and any side effects you report. See Section 8 for the specific protections that apply to this data.

Technical data. When you visit the site, our web server processes data that is technically required (IP address, date and time, page requested, browser identifier) in server logs, to deliver the site, detect faults, and fend off attacks. Logs are deleted or anonymized within 14 days.

Purchase data. Purchases are handled by ClickBank (Section 7). After a purchase, ClickBank sends us only what we need to unlock your access: email address, product purchased, order and transaction number, and payment status. We never receive your card or bank details.

Support communications. If you email us, we process your email address and the content of your message to answer you.

4. Cookies and consent management

Strictly necessary cookies and local storage (your member-area session and the record of your cookie choice itself, stored for up to six months in the cookie ps_cc) are used without consent. All non-essential cookies and similar technologies — currently the usage analytics of Microsoft Clarity (Section 5) and the ad-measurement services of Reddit and Google (Section 6) — are set only after you opt in via the cookie banner. Analytics and marketing can be chosen separately.

Consent is managed by a self-hosted open-source tool (vanilla-cookieconsent); no data is transmitted to third parties for this. You can change or withdraw your choice at any time via the "Cookie settings" link in the footer; withdrawal takes effect going forward.

5. Web analytics (Umami, Microsoft Clarity)

We measure site usage with Umami, running on our own server. Umami works without cookies and without persistent identifiers: it produces aggregate statistics (pages viewed, country of origin, browser type) from which individual visitors cannot be re-identified, and it does not store IP addresses.

Only with your consent do we also use Microsoft Clarity (Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, USA; for visitors in the EEA, Microsoft Ireland Operations Limited, Dublin, Ireland). Clarity records how this site is used — clicks, mouse movement, scrolling, and pages viewed — and turns that into heatmaps and session replays so we can find where the site gets in your way. Without your consent, Clarity is not loaded.

This processes details of your visit (pages viewed, time on page, interactions), a truncated IP address, browser, device and screen details, approximate location at the country/region level, and a cookie identifier (_clck, _clsk, CLID) that recognizes you across page views. Anything you type into a form (for example your email address in the sign-up dialog) is masked and not transmitted. Microsoft acts as an independent controller for this processing; see the Microsoft privacy statement. The member area (account, training and measurement data) is excluded from Clarity — nothing is recorded there. You can withdraw your consent at any time via "Cookie settings" in the footer, with effect going forward.

6. Ad measurement (Reddit Ads, Google Ads) — opt-in only

Only with your consent do we use ad-measurement services to understand whether our ads lead to visits, sign-ups, or purchases, and to make our advertising more efficient. Without your opt-in, none of these services is loaded.

Reddit Ads (Reddit, Inc., 1455 Market Street, San Francisco, CA 94103, USA): the Reddit Pixel sets a cookie (_rdt_uuid) and processes information about your visit (pages viewed, events such as sign-up, browser identifier, IP address, and a click ID from the ad, if any). We also send the same events server-side via the Reddit Conversions API; there, the IP address is transmitted only as a SHA-256 hash, and both channels are deduplicated via a random event ID. If you purchase after signing up with marketing consent, we send a server-side purchase event (hashed order number, order value, click ID) together with your SHA-256-hashed email address so Reddit can attribute the conversion. We never send plain names or readable email addresses to Reddit. Reddit may link this data to a visitor's Reddit account and is independently responsible for that processing; see the Reddit privacy policy.

Google Ads conversion tracking (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company Google LLC, USA): after you opt in, the Google tag (gtag.js) loads, sets conversion cookies (_gcl_*), and processes information about your visit (pages viewed, events such as sign-up or purchase, browser identifier, IP address, and a click ID from the ad, if any) to attribute conversions to ad interactions. We pass your consent status to Google (Consent Mode); without consent, nothing is transmitted to Google. See the Google privacy policy.

You can withdraw your consent at any time via "Cookie settings" in the footer, with effect for the future.

7. Service providers and other recipients

We use a small number of service providers that process data on our behalf under data processing agreements:

• Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA) — content delivery network in front of the site; processes IP address and technical connection data to deliver content and block attacks.
• Supabase, Inc. (970 Toa Payoh North #07-04, Singapore) — database and authentication. Your account and application data are stored in the region eu-central-1 (Frankfurt, Germany) on Amazon Web Services infrastructure.
• Amazon Web Services EMEA SARL (38 Avenue John F. Kennedy, L-1855 Luxembourg) — transactional email (Amazon SES, sent from the Frankfurt region): sign-up confirmation, password reset, and important account or contract notices.
• BunnyWay d.o.o. (Cesta komandanta Staneta 4A, 1215 Medvode, Slovenia, EU) — video delivery ("bunny.net") for the exercise videos; processes IP address and technical connection data to stream the videos. Video URLs are signed and time-limited; bunny.net cannot infer anything about your journal data.

Click Sales, Inc. (operating as “ClickBank”, 1444 S. Entertainment Ave., Ste. 410, Boise, Idaho 83709, USA) sells paid access as retailer (merchant of record) and is independently responsible for the data collected during checkout (name, billing address, payment details); see the ClickBank privacy policy.

Beyond that, we disclose personal data only if required by law (for example, a lawful request by public authorities) or, should Brinvolt ever be part of a merger, acquisition, or asset sale, to the parties involved — in which case this Privacy Policy continues to apply to the transferred data. Marketing emails are sent only if you have separately opted in; you can unsubscribe at any time via the link in each message.

8. Consumer health data

This section supplements the rest of this Privacy Policy and serves as our consumer health data privacy policy under laws such as the Washington My Health My Data Act and Nevada SB 370. It applies to the training and measurement data described in Section 3.

Categories collected: body measurements (e.g. length and girth), self-assessments of erection quality, training logs, and side effects or complaints you choose to report.

Source: exclusively you — everything in this category is data you enter yourself. We do not collect health data from third parties, do not infer it from your browsing, and do not use geofencing.

Purpose: solely to provide the product to you — your progress journal, your forecast, and the adaptation of your training plan.

Consent: we collect this data only after your explicit consent, which we request before the first entry. You can withdraw consent at any time; if you do, we delete the collected training and measurement data.

Sharing: we do not sell consumer health data and do not share it with third parties for marketing or any other purpose. It is stored with our hosting processor (Supabase, Frankfurt — Section 7), which may not use it for its own purposes. It is linked only to your email address, never to a name.

Your rights: you can access the data (it is visible in your journal at any time), export it, correct it, withdraw consent, and delete it — either entry by entry, or completely by deleting your account, or by emailing support@phallushape.com. We do not discriminate against you for exercising these rights.

Appeals: if we decline a request relating to your health data, you may appeal by replying to our decision with the subject "Appeal"; a person not involved in the original decision will review it and respond within 45 days. Washington residents may also contact the Washington State Attorney General at atg.wa.gov/file-complaint.

9. Your US state privacy rights

Depending on your state of residence (for example California, Colorado, Connecticut, Virginia, or Texas), you may have the right to know what personal data we hold about you, to access it in a portable format, to correct it, to delete it, and to opt out of the sale of personal data, of sharing for cross-context behavioral advertising, and of targeted advertising.

Our practices make most opt-outs unnecessary: we do not sell personal data, and both the cookie-based analytics (Microsoft Clarity, Section 5) and the ad-related processing (Section 6) are off by default and run only after you opt in — declining or withdrawing cookie consent is the opt-out. Clarity data is used to improve the site, never for cross-context behavioral advertising. We treat every visitor who has not opted in as opted out, which also covers browsers that send an opt-out preference signal such as Global Privacy Control.

To exercise access, correction, deletion, or portability rights, email support@phallushape.com from the address your account is registered under — that is also how we verify your request. We respond within 45 days and do not discriminate against you for exercising your rights. If we decline a request, you may appeal as described in Section 8.

10. Visitors in the EEA and UK (GDPR)

We process personal data on the following legal bases: performance of the contract (Art. 6(1)(b) GDPR) for account, unlocking of purchases, and transactional email; your consent (Art. 6(1)(a), and Art. 9(2)(a) for health data) for the training journal and for ad measurement; and our legitimate interests (Art. 6(1)(f)) in the secure, stable operation of the site (server logs, CDN) and in cookieless, aggregate analytics.

You have the right to:

• access the data we hold about you (Art. 15),
• rectification of inaccurate data (Art. 16),
• erasure (Art. 17) and restriction of processing (Art. 18),
• data portability (Art. 20),
• object to processing based on legitimate interests (Art. 21),
• withdraw any consent with effect for the future (Art. 7(3)).

An informal email to support@phallushape.com is sufficient. You also have the right to lodge a complaint with a data-protection supervisory authority (Art. 77 GDPR), for example the authority of your habitual residence.

International transfers: the controller is a US company, and some providers (Cloudflare, ClickBank; with consent, Microsoft, Reddit and Google) are based in the USA. Where data is transferred to the USA, we rely on certifications under the EU-U.S. Data Privacy Framework or on EU Standard Contractual Clauses. The actual storage of your account and health data takes place in Frankfurt, Germany (Section 7).

11. Retention and deletion

We keep account data and journal data for as long as your account exists. You can delete your account yourself at any time — via the delete function on your profile page or by emailing support@phallushape.com. Deletion removes all stored data including training and measurement data, except where statutory retention obligations (for example for billing records) require otherwise. Deletion is final: purchased access is irrevocably lost and cannot be restored. Server logs are deleted or anonymized within 14 days.

12. Security

All connections to the site are encrypted (TLS). Passwords are stored only as cryptographic hashes, health data is linked to your email address rather than a name, and access to production systems is restricted. No method of transmission or storage is 100% secure, but we design the platform so that the data we cannot lose is data we never collected.

13. Children

The Service is intended for adults and may only be used by persons 18 or older. We do not knowingly collect personal data from anyone under 18; if we learn that we have, we delete the account and its data.

14. Changes to this policy

We update this Privacy Policy when the legal situation, our services, or our providers change. The current version is always available on this page; the date above shows when it was last revised. For material changes affecting health data, we will ask for your consent again where the law requires it.

15. Contact

Questions about privacy: support@phallushape.com, or by mail to Brinvolt LLC, 30 N Gould St Ste N, Sheridan, WY 82801, United States.