Privacy policy
What we collect, why, who handles it, and how to get it deleted. We do not sell your information and there are no ad trackers on this site.
Last updated October 1, 2026
What we collect, and when
When you grab the free 405 Protocol: your first name and email, the time, your country (worked out by our host from the connection, not your exact location), and what sent you to the site, for example an Instagram link. If you tick "Tell me when Project 405 opens", that too.
When you join a notify list: your name, your email, which program, your country and what sent you.
When you leave feedback: your star rating, what you write, your name and email if they are in the link, and your country.
When you fill out an application: the answers you give, which can include your name, email, phone number, Instagram handle and occupation.
When you buy: Stripe takes the payment. We receive your name, your email, what you paid and a reference to the order. We never see or store your card number.
When you use the training app: your email and name, your password stored only as a scrambled hash we cannot read back, and your training: the weights, reps and sets you log, the days you complete, and any exercise you swap.
When you send a form check: the video you upload and any note with it. Only you and CJ can watch it. The video deletes itself 120 days after you send it, or sooner if you ask.
When we email you: a record of each email sent, whether it was delivered, and whether it was opened, which we learn from a tiny image in the email. Blocking images in your mail app turns that off.
When you click around: a count of clicks per link per day, with nothing about who clicked, and Cloudflare Web Analytics, which counts page views without cookies and without identifying you.
Kept on your phone only
A few things stay in your browser and never reach us: the name and email you typed, so the next form fills itself in; the 2 rep max you enter in the weight chart; your warm up ticks; and cards you chose to hide. Clearing your browser data removes them.
Cookies
Three, all our own. faz_src remembers what first sent you to the site, for 60 days, so a signup can be credited to the right post. faz_fbc is set only when you arrive from one of our Meta ads: it holds the click id Meta put on the link, for 90 days, so a download can be credited to that ad. fzt keeps you signed in to the training app and only works on cjfaz.com/train. It lasts until you sign out. There are no third party cookies and no ad tracking scripts on the site.
Why we use it
To send you what you asked for, run the training app, deliver the emails you signed up for, keep your account secure, and see which posts and ads actually bring people in so the good ones get made more. That is the whole list. We do not sell your information or rent it.
If you arrived from one of our Meta ads (Facebook or Instagram) and download the Protocol, our server tells Meta that the ad led to a download, so Meta shows the ad to more people like you. That report carries the click id from the ad, the time, your IP address and browser type, and your email as a one way hash that cannot be read back. It never carries your name or your plain email, and nothing is sent for people who did not come from an ad. There is no Meta pixel or any other tracking script on the site.
Who else handles it
A small number of companies do the work for us and only see what their job needs:
- Cloudflare hosts the site, the app, the database and form check videos, and provides the cookieless page view counts.
- Stripe takes payments.
- Resend delivers our emails.
- Google hosts our inbox, so it holds any email you send us.
- Meta receives the hashed download report described above, only for downloads that came from a Meta ad.
We will also share information if the law requires it.
How long we keep it
For as long as you are on the email list or have an account, and until you ask us to delete it. Purchase records are kept as long as tax and accounting law requires, even after a deletion request.
Your choices
Stop the emails: tap Unsubscribe at the bottom of any email. It works in one tap, no sign in.
See, fix or delete your data: email faz@cjfaz.com from the address you signed up with. We will send you what we hold, correct it, or delete it everywhere it lives, usually within a few days and always within 30. The only thing kept is the purchase record the law requires.
Wherever you live, you get these same rights, including the rights California and EU residents have by law.
Security
Everything travels over HTTPS. Passwords are stored as salted hashes, sign in codes expire in 20 minutes, and repeated wrong passwords lock the account for a while. Only we can reach the database.
Children
This site is for adults. We do not knowingly collect information from anyone under 13, and if we find we have, we delete it.
Changes
If this policy changes, the new version goes on this page with a new date at the top.
Questions: faz@cjfaz.com. The rules for using the site are in the terms of use.