Privacy Policy

Who we are

This is the privacy policy of Be Hard Ventures, Inc., a Delaware corporation ("the company," "we," "us"). Loaded Carry is a product of Be Hard Ventures, Inc. The company operates the Loaded Carry rucking app and the website at loadedcarry.co, and is the entity responsible for the data described on this page.

Business address: 1032 E. Brandon Blvd, Suite #1902, Brandon, FL 33511, USA

Contact: support@loadedcarry.co

This policy is effective July 31, 2026 and was last updated on October 24, 2026.

The short version

We collect what the app needs to work: your account, your rucks, and — only if you grant it — health data from Apple Health or Health Connect. We do not sell your data. We do not run advertising. There is no advertising or behavioral-analytics SDK anywhere in this app. Your health data is never used for advertising or data mining, and it is never shared with any third party.

The rest of this page is the detail behind those sentences.

What we collect

Account and authentication

Your email address and a hashed password, or — if you sign in with Google or Apple — the identifier that provider returns to us. We never see or store your Google or Apple password.

Your profile: display name, first and last name if you give them, profile photo, bio, timezone, and a free-text location if you choose to enter one.

Physical details used to calculate your work accurately: body weight, gender, and date of birth. Rucking calorie estimates depend on your body weight plus the weight you carry — without these the numbers would be guesses.

We also hold short-lived security tokens tied to your account: an active session token, a password-reset token if you request one, and an email-verification token when you sign up.

Ruck, route, and training data

When you record a ruck, we capture your GPS position at high precision for the duration of the session, and store the route as a simplified polyline along with your start and end points, distance, pace, elevation, and the weight you carried.

Your start and end points are stored at full precision. For most people these are home and work. Consider that before making a ruck public.

We also store achievements, personal records, speed and time-trial PRs, Ruck PT session logs, and workouts the app generates from parameters you set — all tied to your account so your history survives changing phones.

Health data (Apple Health and Health Connect)

On iOS, and only after you explicitly grant permission, we read from Apple Health. On Android, and only after you explicitly grant permission through Health Connect, we read the equivalent categories there. On both platforms this covers:

• Heart rate
• Step count
• Walking and running distance
• Active energy burned (calories)
• Workouts

The Apple Watch app reads a narrower set: heart rate, active energy, and distance. We also write your completed ruck back to Apple Health or Health Connect as a workout, including the weight you carried and your average heart rate, so your rucks appear alongside the rest of your activity on whichever platform you use.

Heart-rate samples, heart-rate zones, step count and cadence from a ruck are stored on our servers so your history and achievements survive changing phones.

We do not use health data for advertising or marketing. We do not use it for data mining. We do not sell it, and we do not share it with any third party. It is used solely to show you your own activity and to calculate your results. You can revoke Health or Health Connect access at any time in your device's settings; the app keeps working without it.

Garmin Connect (not yet available)

We are applying to connect Loaded Carry to Garmin Connect, so that a ruck recorded on your Garmin watch can appear in Loaded Carry. This is not available yet, and nothing in this section applies to you until it is. We will tell you in the app before it is offered.

When it is available, it will only work if you choose to link your Garmin account:

• We would receive the activities you record on your Garmin device after you link, such as route, distance, time, elevation and heart rate. We would not receive your history from before you linked.
• Imported activities are stored and treated like rucks you record in the app: the same retention, and the same deletion when you delete a ruck or your account.
• If you send a saved route to your watch, we would send that route to Garmin so your device can navigate it.
• We would never use Garmin data for advertising, sell it, or use it to train machine-learning models. The people who can see an activity are the same as for any other ruck, set by your privacy settings.
• You can unlink at any time in settings. Unlinking stops new activities arriving and deletes the Garmin connection details we hold.

Garmin is a separate company with its own privacy policy, which governs what it does with your data on its side.

Photos

Photos you attach to a ruck or set as a profile picture are uploaded to our image host. Photos can carry embedded metadata, including the location where they were taken — we strip it from every photo on upload.

Safety features: the beacon and safety contacts

If you start the safety beacon, your live position, speed, altitude and device battery level are published to a link you can share. That link is public and unauthenticated. The only thing standing between anyone and your live location is the link itself — there is no password and no login. Anyone who has the link can open it and watch your position update in real time on a map while the beacon is active. Nothing about how the link works requires the viewer to be a Loaded Carry user, or to be someone you meant to share it with. When you end the beacon, the link stops showing your location and says the beacon has ended. If you never end it, the link keeps showing your last known location until about 24 hours after your expected return time, then stops showing any location. The page cannot tell a viewer whether you are back. Once the beacon has ended or expired, the page also shows your display name. Share it only with people you trust, and treat it as public the moment you send it.

If you add an emergency contact, we store that person's name and email address, and their phone number and relationship to you if you add them — information about someone who may not use Loaded Carry at all, and who we did not collect this information from directly. When you add them, you confirm that the person has agreed to receive safety alerts from you, and we record when you confirmed it. We rely on your confirmation: we do not currently ask the contact to confirm separately, so they can receive an alert as soon as you add them. An alert contains your name, how long you are overdue (or how long your device has not moved), and a map link to your last reported position. We send alerts by email only; we do not send text messages. Every alert includes a link for that contact to unsubscribe; once a contact unsubscribes, we stop sending them alerts and stop using their information for this purpose.

We hold a safety contact's information to reach them if you go overdue on a ruck and don't check in. There is one other place it appears: while a club event you have RSVP'd "going" to is in progress, the person who created the event and the club's leaders can see your emergency contact's name, email address, phone number and relationship, so someone at the ruck can reach them if something happens to you. It is not shown to anyone else and not used for anything else. A safety contact who wants their information removed, or who never consented to being added, can reach us at support@loadedcarry.co and we will remove it — they do not need a Loaded Carry account to make that request.

Payment information

Subscriptions are handled by Stripe. We never see or store your card details. We store the Stripe customer identifier, your subscription status, and when the current period ends. Stripe receives your email address to create the checkout session. If you subscribe through Apple's App Store instead, Apple handles that payment and we receive only your subscription status from Apple, not your payment details.

Communications and notifications

If you enable push notifications we store a device token so we can reach your device. If you subscribe to the newsletter we store your email address and first name.

Clubs, events, and social content

Clubs and their membership lists, events and RSVPs, event chat messages, club announcements, after-action reports, who you follow and who blocks whom, feed posts, reactions, and comments are all stored as you create them, and are visible according to the privacy setting on the thing they belong to. Ruck notes, and anything else you type into the app, are stored as written.

If you report another user or their content, we store your report along with a snapshot of the reported material at the time you reported it, so a review has something to look at even if the original is edited or deleted afterward.

Weather

We cache weather conditions by a coarse geographic grid (roughly one kilometer) to attach weather context to a ruck and to avoid hammering the weather provider. This cache is keyed to location, not to you.

What we do not do

• We do not sell your personal data.
• We do not show advertising and we do not share data with advertising networks. The app contains no advertising identifier, no ad SDK, and does not request App Tracking Transparency permission, because there is nothing to track you with.
• We run no advertising or behavioral-analytics SDK. No Google Analytics, no Firebase Analytics, no Mixpanel, Amplitude, PostHog, or Segment. We do use Sentry for error and session diagnostics on the website — see below for exactly what that records.
• We do not use your health data for anything except showing you your own activity.

The legal basis we rely on

If you're in the UK, EU, or EEA, data protection law requires us to have a specific legal basis for each way we use your data. Here is how the categories above map to those bases:

• Account, profile, and ruck data — processed to perform our contract with you (running the app you signed up for).
• Health data from Apple Health or Health Connect — a special category of data under GDPR, processed only with your explicit consent, given through the OS-level permission prompt. You can withdraw that consent at any time in your device settings.
• Safety beacon and safety-contact data — processed on the basis of legitimate interest in your safety while rucking. For a safety contact's details, we rely on your confirmation that the contact agreed to receive alerts; any contact can opt out at any time.
• Payment data — processed to perform our contract with you, and to meet legal obligations around financial records.
• Newsletter and marketing communications — processed only with your consent, which you can withdraw at any time.
• Anti-cheating checks, content moderation, and fraud prevention — processed on the basis of legitimate interest in keeping the service trustworthy and safe.
• Website error and session diagnostics (Sentry) — processed on the basis of legitimate interest in finding and fixing bugs.

Who else receives data

We use the following providers to operate the service. Each receives only what its job requires. Fly.io, Stripe, Cloudinary, Firebase, Mapbox, Resend, and Sentry are named here because they receive the largest categories of your data; the remaining rows cover the rest of what runs the app.

About Sentry session recording. On the website — not in the mobile app — we record a sample of sessions to diagnose bugs. Text and form inputs are masked, so typed content such as passwords is not captured. These recordings are attached to your account ID and email so we can connect a report to a real problem. Because a recording captures what was on screen, it can incidentally include other information visible on the page at that moment.

About maps. Map tiles load directly from Mapbox in your browser or app, which means Mapbox sees the coordinates being displayed together with your IP address. Where we render a route as a static image, the route itself is part of the request.

Where your data is processed and international transfers

The service is hosted in the United States (Fly.io, US East), and our other providers are primarily US-based. If you use Loaded Carry from the UK, EU, EEA, or elsewhere outside the United States, using the app necessarily involves transferring your data to the United States, where privacy law differs from your home jurisdiction. We rely on the mechanisms required by applicable law to make that transfer lawful.

How long we keep it

Your account and training history are kept for as long as your account exists. We do not currently expire or purge old rucks, routes, or heart-rate data — your history stays complete unless you delete it.

Deleting a ruck removes it and its route, sensor data and photos. Deleting your account removes your personal data, as described below.

Beacon session history — positions, speed, altitude and battery level — is kept until you delete your account. Deleting a ruck does not delete the beacon history recorded during it; if you want it removed sooner, contact us. Safety contact information is kept until you remove the contact or your account, or the contact asks us to remove it directly.

Your rights and choices

Depending on where you live, data protection law may give you additional rights — see the EU/UK and California sections below. Regardless of where you live, you can:

• Delete your account — Settings › Account › Delete Account
• Edit or remove profile details in the app at any time
• Delete individual rucks, photos, comments and other content you created. Deleting an event chat message hides it from everyone; we keep the message itself until your account is deleted.
• Turn off Health or Health Connect access, and notifications, in your device settings
• Cancel a subscription through the billing portal
• Make rucks private, or leave clubs and events
• Remove a safety contact, or ask us to remove one on your behalf

Deleting your account is immediate and permanent. It removes your rucks and their routes, your sensor and heart-rate data, achievements, photos, comments, club memberships and event RSVPs. Any active subscription is cancelled at the same time. There is no recovery period, so export anything you want to keep first.

A few things work differently. If you lead a club, leadership passes to the longest-standing member so the club survives — the club is only removed if you are its last member. Events you created are deleted, together with everyone's RSVPs and chat for them. Reports you filed about other users or content are kept, with the display name you had when you filed them, so that moderation records stay complete; they are no longer linked to an account.

For access to, or an export of, your data, contact us and we will action it.

If you're in the UK, EU, or EEA

Data protection law gives you the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Erase your data ("the right to be forgotten")
• Restrict or object to certain processing
• Receive your data in a portable format
• Withdraw consent at any time, where we rely on consent
• Lodge a complaint with your local data protection supervisory authority

To exercise any of these, contact us. We will need to verify it's really you before acting on the request.

If you're a California resident

Under the CCPA and CPRA, you have the right to know what personal information we collect, to access and delete it, to correct inaccuracies, and not to be discriminated against for exercising these rights. Some of the data described above — health data and precise geolocation — is "sensitive personal information" under California law; we use it only to provide the features you asked for, which the law permits without a separate opt-out.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. There is nothing to opt out of, because we don't do it in the first place.

To exercise your California rights, contact us. You may also designate an authorized agent to make a request on your behalf; we will still need to verify your identity.

Security

Passwords are hashed, never stored in readable form. Data is encrypted in transit. Access to production data is limited to what is needed to run the service. No system is perfectly secure, and we will not pretend otherwise — if a breach affects you, we will tell you.

Age requirement

Loaded Carry is not intended for anyone under 18, and we do not knowingly collect data from anyone under that age. If you believe someone under 18 has created an account, tell us and we will remove it.

Changes to this policy

If we change how we handle your data, we will update this page and move the date at the top. For changes that meaningfully affect you, we will tell you in the app or by email rather than relying on you to notice.

Contact

Be Hard Ventures, Inc.

1032 E. Brandon Blvd, Suite #1902

Brandon, FL 33511, USA

support@loadedcarry.co

Questions about this policy, or a request about your data: get in touch.

To have an intimate image or copyrighted material removed, use the removal request form. Law enforcement: our guidance.