The Credential Standard

Who we are

The Credential Standard is operated by JR Strength and Fitness LLC (“we”, “us”). For anything in this policy, contact jr@jrstrengthandfitness.com or write to JR Strength and Fitness LLC, 5441 South Macadam Ave #6590, Portland, OR 97239.

The short version

You can read the whole public register without an account.
We do not use third-party analytics, advertising trackers or advertising cookies.
We do not sell personal information.
The only cookies we set are the ones that keep you signed in.

What we collect

When you browse the public pages

Our hosting provider records standard request information such as IP address, browser type and the page requested, which we use to keep the site running and secure. We also keep a first-party count of two events: that the pricing page was viewed, and which plan was selected. If you are signed in, that event is linked to your account.

When you create an account

Your email address, which we use to send you a one-time sign-in link (there is no password), and the list of credentials and providers you choose to follow. If you use the renewal tracker, we also store the credentials you tell us you hold, the dates you enter for them, the CEUs you log and any note you add. Only you can see these.

When an organization uses a workspace

An organization’s administrators can enter information about their staff and candidates: names, email addresses, roles, the credentials each person holds, certificate numbers, issue and expiry dates, CPR/AED status, and uploaded proof documents such as certificates or cards. The organization decides what is entered and is responsible for having the right to share it with us. We handle that information on the organization’s behalf, to provide the workspace to it.

If you are a staff member and want to see, correct or remove information an organization holds about you here, ask that organization first. We will help it respond.

When a document is uploaded

An uploaded proof document may be sent to an AI service (Anthropic) to read the credential name, issuing body, dates and certificate number from it. The service is instructed to ignore sensitive details such as Social Security numbers, dates of birth, home addresses and banking information. What it reads is shown to the administrator as a suggestion to confirm; nothing is saved to a staff record automatically.

When you send us a form

The pilot request and data-licensing forms collect your organization’s name, your name, email address and role, and what you tell us about your size and needs.

When you pay

Payments are handled by Stripe. We never see or store your full card number. We receive your subscription status, plan and billing history so we can give you the right access.

How we use it

To provide the account, watchlist, alerts and workspace features you use.
To send sign-in links, staff invitations and service messages.
To email you renewal reminders for credentials on your tracker, 90, 60, 30 and 7 days before the expiry date you entered. Every reminder has a link that turns them off, and you can switch them off from the tracker.
To reply to pilot and licensing requests.
To bill for paid plans and prevent misuse.
To understand, in aggregate, whether people look at pricing and which plans interest them.

We do not use your information for advertising, and we do not build advertising profiles.

Who handles it for us

We share personal information only with the companies that run parts of the service for us:

Supabase — database, sign-in and private file storage.
Vercel — website hosting.
Stripe — payments and subscriptions.
Resend — sending email.
Anthropic — reading credential details from uploaded documents.

These providers process data in the United States and possibly other countries. We may also disclose information if the law requires it, or as part of a sale or reorganization of the business, in which case this policy continues to apply to it.

How long we keep it

Account and watchlist: until you ask us to delete your account.
Workspace data and uploaded documents: for as long as the organization keeps its workspace, and 30 days after it closes.
Pilot and licensing requests: until 30 days after the pilot or the conversation ends.
Billing records: as long as tax and accounting rules require.

Deleted information can remain in our database provider’s routine backups for a limited time, until those backups are replaced. We do not use backup copies for anything other than recovering the service after a failure.

How we protect it

Each organization’s data is isolated at the database level, so one organization cannot read another’s. Uploaded documents sit in a private store and are opened through short-lived links. No system is perfectly secure, and we cannot promise that ours is.

Your choices

You can ask for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it, by emailing jr@jrstrengthandfitness.com. We will answer within 30 days. Depending on where you live you may have further rights under local law; we will honor them.

Children

The service is meant for working professionals and organizations. It is not directed to anyone under 18, and we do not knowingly collect their information.

Changes to this policy

If we change this policy we will update the date at the top. For a significant change we will also tell account holders by email.