Privacy Policy

1. About this policy

1.1 Who we are

Mr Buff (mrbuff.ca) is published by TNAADO Inc., a corporation organized under the laws of Ontario, Canada, at 1050 King Street West, Toronto, Ontario, Canada M6K 0C7 ("TNAADO", "we", "us"). This policy covers mrbuff.ca only. It was last updated on 27 October 2026.

1.2 What this policy covers

It explains what information is collected when you read mrbuff.ca (the United States edition and the Canada edition under /canada/), how it is used, who receives it and what choices you have. Cookies and browser storage are described in more detail in the separate Cookies and advertising notice.

1.3 Privacy contact

Privacy Officer, TNAADO Inc., 1050 King Street West, Toronto, Ontario, Canada M6K 0C7. Email: contact@tnaado.ca.

2. Summary

• mrbuff.ca has no accounts, comments, newsletters or forms that send information to us.
• The filters, calculators, estimators and journey tools run in your browser. What you type into them is not sent to us, is not put in the page address and is not sent to Analytics.
• Mr Buff sets no cookies itself. It stores your cookie-notice choice in your browser's local storage.
• Cloudflare Web Analytics counts visits without cookies, unless your browser sends a Global Privacy Control or Do Not Track signal. Google Analytics 4 loads only if you press Accept.
• The site loads no advertising code today and shows no ads.
• Our hosting provider (Vercel) keeps standard server logs.
• We do not sell personal information for money.
• You can contact us about your information at contact@tnaado.ca.
• We disclose information to authorities only as the law requires or in narrow emergencies, and we can only produce what we hold. See Legal requests and disclosures.

3. Information collected

3.1 Information you give us

The site has no sign-up, comment or contact form. If you choose to email us, we receive your email address, the content of your message and anything else you include. We use it to reply and keep a record of the correspondence.

3.2 Tools and calculators

The filters, the first-year gym cost estimator, the meal builder, the compare tray, the protein calculator and the journey tools run entirely in your browser. The values you enter, such as a body weight or a search, are not transmitted to us, are not written into the page address and are not sent to Analytics. The only thing the site itself keeps in your browser is your cookie-notice choice; see Cookies and browser storage. When a page needs its data tables, your browser loads them from the site's own address; no information about you is added to those requests beyond what a browser sends by default.

3.3 Information collected automatically by our hosting provider

The site is served by Vercel. Like most web hosts, Vercel receives your IP address, the page you request, the date and time, your browser's user-agent string and the referring address, and keeps standard server logs to deliver and protect the site. We do not operate our own analytics database or visitor database for this site. We have not verified whether Cloudflare also proxies the site's traffic.

3.4 Information collected by Cloudflare Web Analytics

Unless your browser sends a Global Privacy Control or Do Not Track signal, each page loads the Cloudflare Web Analytics script from static.cloudflareinsights.com, even before you answer the cookie notice. We use it to count visits in aggregate: pages viewed, referrers, country, browser and device type and page speed. The script is intended to be cookieless: it sets no cookie and writes no storage item that we found in the site's code or a test load of its pages. Cloudflare receives your IP address and browser details with the request and processes the data, including in the United States. We have not independently tested what Cloudflare retains.

3.5 Information collected by Google Analytics 4

Only if you press Accept in the cookie notice, we load Google Analytics 4 (measurement ID G-6CT1YR5CP2) to count visits and see which pages are read. Google Analytics receives page views and interactions, the page address (path only, with no query string or fragment), browser, device and operating system details, language, and an approximate location derived from your IP address. We do not pass your browser's referrer on to it. It sets the cookies _ga and _ga_6CT1YR5CP2 (see Cookies and browser storage). Google states that Google Analytics 4 does not log or store IP addresses. We do not send names, email addresses or other directly identifying information to Google Analytics. If you decline, or do nothing, no Google Analytics code is requested from Google. If you press Decline after accepting, Analytics is switched off for the rest of the visit and its cookies are deleted. Your browser's Global Privacy Control signal is treated as a decline.

3.6 Advertising

The site loads no advertising code and sets no advertising cookies today. Its pages carry the AdSense publisher meta tag for TNAADO's account (ca-pub-3228722733199849), and the site publishes an ads.txt file, but neither shows an ad. If ads start, this policy and the cookie notice will be updated first. See Cookies and browser storage.

3.7 Fonts

The site serves its fonts itself. Your browser does not request fonts from Google.

4. How we use information

We use information to operate, secure and maintain the site, to understand which pages are read and improve them, to answer messages sent to us and to meet legal obligations. We do not make automated decisions about you. We do not sell personal information for money.

5. Who receives information

5.1 Service providers

• Vercel Inc. hosts and delivers the site.
• Cloudflare, Inc. receives Web Analytics requests, as described above.
• Google LLC receives Google Analytics requests, but only if you pressed Accept. Google's own privacy policy and the page "How Google uses information from sites or apps that use our services" describe what Google does with data it receives.
• Email sent to us is handled by our email provider.
• Retailer, gym, restaurant and government sites that you open from a link on a page receive your request when you follow the link and control their own privacy practices.

5.2 Disclosure required by law

We disclose information to authorities where the law requires it and in narrow emergencies. See Legal requests and disclosures and the section of this policy with that name.

6. Your choices

Your choices include:

• Press Decline in the cookie notice, or use the "Cookie settings" button in the page footer to change your choice at any time. Declining stops Google Analytics.
• Turn on Global Privacy Control or Do Not Track in your browser. Either one stops the Cloudflare Web Analytics script from loading, and Global Privacy Control also keeps Google Analytics off.
• Install the Google Analytics opt-out browser add-on, which stops Google Analytics measurement on all sites you visit.
• Turn off personalised advertising in Google Ads Settings, or use the opt-out pages of the Digital Advertising Alliance (US) or Your Ad Choices (Canada). The site shows no ads today, but these controls apply to Google ads you see elsewhere.
• Block or delete cookies in your browser settings. The site works without them.

7. Language

The site is published in English only, for a United States edition and a Canada edition. These documents apply to every page of mrbuff.ca, and are published in English only.

8. Legal requests and disclosures

8.1 In short

We disclose information to authorities when the law requires it, we disclose without a court order only in the narrow emergencies below, and we can only produce what we actually hold. We do not promise that we will never disclose information. The separate Legal requests and disclosures document sets out the process and how to send us a request.

8.2 When the law requires us to disclose

We comply with valid legal process, for example a court order, search warrant, production order or subpoena from a court or authority with jurisdiction over us, and with a lawful demand or order to preserve data. Some statutes require reports without any request. In Canada, the Act respecting the mandatory reporting of Internet child sexual abuse and exploitation material requires a person who provides an Internet service to the public to report, and to notify police, when it has reasonable grounds to believe its service is being used to commit such an offence. In the United States, 18 U.S.C. 2258A requires providers to report apparent child sexual exploitation to the National Center for Missing and Exploited Children once they have actual knowledge. We say "to the extent the law applies to us" because no lawyer has told us whether this site is a provider under those statutes. Neither statute requires us to search for such material, and we do not. Canada's privacy law (PIPEDA, s. 7(3)) also lists situations where an organization may disclose personal information without consent, including to comply with a subpoena, warrant or court order. Requests may also arrive through mutual legal assistance treaties between Canada and the United States. Because our hosting and delivery providers are United States companies, United States legal process can reach data they hold even though TNAADO is an Ontario company, and Canadian process can reach data we hold.

8.3 When we may disclose without a court order

We may disclose limited information without a court order only where we reasonably believe, in good faith, that (a) there is an imminent risk of death or serious physical harm to a person and disclosure could help prevent it, (b) child sexual abuse or exploitation material is involved and the law requires or permits a report, or (c) disclosure of the minimum necessary is needed to detect or stop fraud or abuse aimed at our systems or to protect our legal rights, and then only to a party with a real need. We do not volunteer information about lawful activity to authorities, and we do not treat an informal request, email or letter from police as enough, on its own, to hand over personal information outside those cases.

8.4 What we do first

When we receive a request we (a) check that it is genuine and comes from an authority with jurisdiction; (b) read what it actually requires, and ask the authority to narrow it if it is too broad, vague or unrelated to what we hold; (c) tell the person affected before disclosing, where the law allows and where we can reach them (for most visitors we hold no contact details); (d) where we believe an order is unlawful, overbroad or would reveal protected information, ask the court or authority to vary or cancel it within the time the law allows (a Canadian production order, for example, gives a short window to give notice that we will apply); (e) disclose only what is required; and (f) keep a record of the request and of what we gave and when.

8.5 What we can produce

• Email you send us and our replies, held in our email system.
• Nothing else about individual visitors. The site is static: it has no accounts, no comments, no forms that send data to us, no uploads, no server functions and no analytics database or visitor database of our own.
• Held by others, not by us: Request logs at Vercel, which hosts the site (IP address, address requested, user agent, time). Cloudflare holds what its Web Analytics script receives. Google holds what Google Analytics receives, only if you pressed Accept. Those providers may receive legal process directly, and their policies, not ours, govern what they do.

8.6 Material you generate with this site

The filters, calculators, estimators and journey tools run in your browser. What you type is processed on your device and is not sent to us, so we do not receive it and cannot produce it.

8.7 What we do not promise

We do not promise that we will never disclose information to authorities. A court may order us not to tell you that we received a request or what it asked for, in which case we cannot notify you. Deleting something on our side does not guarantee it is gone from backups, caches, provider logs or a copy already preserved under a legal order.

9. Where information is processed

We are based in Canada. Vercel, Cloudflare and Google operate internationally, and information they receive may be processed outside your province, state or country, including in the United States, where privacy laws may differ from those where you live. We have not verified the region in which Vercel serves or stores this site's data.

10. Retention

Server logs are kept by Vercel under its own policies, and we have not verified how long. We have not verified how long Cloudflare keeps Web Analytics data. Google Analytics keeps event data for the retention period set in our Google Analytics property; Google offers 2 months or 14 months for this setting, and we have not verified which is set. Your cookie-notice choice stays in your browser until you clear site data, and the notice asks again after twelve months. Email correspondence is kept for as long as needed to deal with your message and for our records. We specify no other retention period.

11. Your rights

11.1 Canada

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) you may ask what personal information we hold about you, ask to correct it, challenge our compliance, and withdraw consent subject to legal and contractual limits. You may complain to the Office of the Privacy Commissioner of Canada.

11.2 United States

Depending on the state where you live, you may have the right to know or access personal information, to delete or correct it, and to opt out of targeted advertising or the sale or sharing of personal information. We include this section so that visitors in any state know how to reach us, whether or not a particular state's law applies to us. We do not discriminate against anyone for making a request.

11.3 How to make a request

Email contact@tnaado.ca and say what you want. We may ask you to confirm that the request is yours, and we will respond within the time required by the law that applies. We hold little identifiable information about visitors: mainly email correspondence. Information held in Google Analytics, Cloudflare Web Analytics or Vercel logs is controlled through those providers' own tools, and we will help where we can. If you disagree with how we handled a request, tell us and we will review it.

12. Browser signals and email

Do Not Track: there is no agreed standard for responding to "do not track" browser signals. If your browser sends one, the site does not load the Cloudflare Web Analytics script. If your browser sends a Global Privacy Control signal, the site treats it as a decline of Google Analytics and also does not load the Cloudflare script. Neither signal changes how a third-party site you open from a link behaves. Email: we send no marketing email and no commercial electronic messages from this site, and we have no mailing list. If that changes we will ask for your consent first and include an unsubscribe route, as Canada's anti-spam law (CASL) and the United States CAN-SPAM Act require.

13. Children

Mr Buff is not directed to children under 13 and we do not knowingly collect personal information from them. If you believe a child has sent us personal information, contact us at contact@tnaado.ca and we will delete it.

14. Visitors outside the United States and Canada

The site is directed to visitors in the United States and Canada. It is not designed for people in the European Economic Area, the United Kingdom or Switzerland, where separate laws apply. The site asks for consent before Google Analytics in every region, but the Cloudflare Web Analytics script loads without a consent step unless your browser sends a Global Privacy Control or Do Not Track signal. We do not claim to meet European requirements.

15. Security

The site is delivered over HTTPS. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

16. Changes to this policy

We will post changes on this page and update the date at the top. Material changes take effect when posted.