Privacy policy

This privacy policy explains how Brightpath Labs LLC (we, us) collects and uses personal data in the FitTune app for iPhone, iPad, and Android and on this website, https://fittune.app. Brightpath Labs LLC is responsible for your data. For any privacy question or request, write to support@fittune.app.

Summary

• We collect the data the app needs to plan and record your training, and none for advertising.
• We do not sell your personal data or share it for advertising, and the app shows no ads.
• The app uses no advertising identifier and does not track you across other companies’ apps or websites.
• The app writes to and reads from Apple Health or Health Connect only if you turn that on, and that data serves only your own training records.
• This website sets no cookies.
• You can ask for a copy of your data, correct it, and delete your account at any time.

Your account and settings

What we collect

• Sign-in identity: the email address of your account or, if you use Sign in with Apple and hide your email, the private relay address that Apple gives us; how you sign in (Apple, Google, or an email code); and, if you sign in with Apple or Google, the identifier that company uses for you and the profile details it sends us at sign-in, which are your email address and, from Google, also your name and a link to your profile picture.
• Sign-in sessions: one for each device you are signed in on, with its refresh token, the times it started and was last refreshed, and the IP address and user agent of the device.
• Stored sign-in on your device: the access and refresh tokens of that device’s session, when they expire, and the account details that come with them (your user ID, your email address or relay address, how you sign in, and the profile details Apple or Google sent us), kept only on the device. On iPhone and iPad it is in the Keychain, for that device only, and it can also hold a one-time security code for a sign-in with an email code, which signing out deletes. On Android it is encrypted with a key in the Android Keystore and kept in storage that backups do not include, and it can also hold a one-time security code for a sign-in with Apple or an email code that is still in progress, kept until it is used or you sign out.
• Sign-in checks on your device: on iPhone and iPad, after you sign in with Apple, the identifier Apple gives us for you, kept in the Keychain for that device only, so the app can check whether you stopped using Sign in with Apple for it. It is deleted when you sign out, when you sign in another way, and when the app clears a sign-in that an earlier install left.
• Install records on your device: the user IDs of the people who finished setup on this install, so the app opens at once for them; whether setup finished here before, which the usage statistics of setup report; and, on iPhone and iPad, whether the app has cleared a sign-in that an earlier install left. They stay until you delete the app.
• Profile and settings: an optional display name of up to 80 characters, your language (one of the seven languages of the app), your unit system (metric or imperial), and a workout reminder setting that is off and that the app does not use, because the app keeps your notification settings on each device (see Notifications on your device).
• Devices: for each device you use, its platform and a random identifier that the app creates, never a hardware serial number or an advertising ID.

How we use it and where it is kept

• Why: to create your account and sign you in, to keep you signed in until you sign out, to address you by name, to show the app in your language and units, and to address each of your devices for sync and push notifications.
• Where: your sign-in identity and sessions in Supabase Auth, and your profile, settings, and devices in our Supabase database, both in the United States. The stored sign-in, the sign-in checks, and the install records stay on your device.
• How long: until you delete your account. A sign-in session lasts until you sign out on that device and, under our current settings, does not expire on its own. The stored sign-in on your device stays until you sign out, and it stops working once your account is deleted. Deleting the app deletes it on Android. On iPhone and iPad it can outlast the app, so the app deletes one left by an earlier install the first time it opens. Supabase’s sign-in logs show your email address in sign-in events and expire after 7 days.
• Linked to you: yes, to your account.
• Processed by: Supabase.

Your setup answers and goals

What we collect

• Setup progress: the step you reached, and when you started and finished setup.
• Setup answers: your goal; your experience level and any recent lifts you enter, each with the exercise, the load, its unit, and the reps; your training history; your schedule; the place you train, with its type and the name you give it; your equipment; the movements you avoid and the cardio activities you do; your units; the plan preview you saw; and how you chose to sign in.
• Training goals: each goal with its priority.
• Setup draft on your device: during setup, the app keeps your answers, the setup mode, whether setup finished on this install before, the current step, and the IDs it creates for your setup in one file on the device, excluded from backups. Your answers leave the device only when you sign in or create your account during setup or, if you set up a plan while signed in, after the plan preview.

If you tell us about a limitation, we store it only as a type of movement to leave out of your plan, never as a diagnosis.

How we use it and where it is kept

• Why: to build your first plan and its preview, to choose what your program emphasizes, and to let you continue setup where you left off.
• Where: our Supabase database in the United States. The draft stays on your device.
• How long: until you delete your account. A goal is deleted earlier if you remove it. The app deletes the draft when setup is complete or when you sign out, and the draft is deleted with the app.
• Linked to you: yes, to your account.
• Processed by: Supabase.

Sign-in code emails

When you sign up or sign in with your email address, we email you a 6-digit code.

• What we collect: your email address, the code, the subject and text of the email, the time it was sent, and its delivery events.
• Why: to prove that you own the address.
• Where: Resend, our email delivery provider, sends the email from auth.fittune.app and stores message content, delivery logs, and account records in the United States.
• How long: Resend keeps these emails and their logs for 30 days. The code works once and stops working 10 minutes after it is sent. If we close our Resend account, Resend deletes the remaining data within 90 days, and its backups last 7 days.
• Linked to you: yes, to your email address.
• Processed by: Resend, under the data processing addendum of Article 28 of the GDPR that comes with every Resend account. Transfers to the United States rely on the Standard Contractual Clauses in that addendum and on the EU-U.S. Data Privacy Framework. Open and click tracking are off, so Resend records no opens or clicks.

Your exercises, training locations, and equipment

What we collect

• Custom exercises: the name and, if you add them, the movement pattern, muscles, equipment, and notes, and the time you archive one.
• Training locations: each location’s name, type, and whether it is your default, with its equipment and the smallest load step and heaviest load of each item.
• Exercise preferences: whether you marked an exercise as a favorite, disliked, or excluded.
• Movement exclusions: a type of movement to keep out of your plan, such as overhead loading.

A movement exclusion stores only that type of movement, never a reason, symptom, body part, or free text. It is a training preference, not injury or health data, and we do not diagnose. Custom exercise notes are text you write, and the app never asks for health details there. The shared exercise catalog itself holds no personal data.

How we use it and where it is kept

• Why: to log exercises the shared catalog does not have, to plan only with equipment you have and progress by loads it can make, and to rank exercises and alternatives for you.
• Where: our Supabase database in the United States.
• How long: until you delete your account. You can delete a training location, clear an exercise preference, or remove a movement exclusion earlier. A custom exercise you remove is archived, and your history keeps its name.
• Linked to you: yes, to your account.
• Processed by: Supabase.

Your training plan

What we collect

• Training profile: your experience level, training history, days per week, preferred weekdays, session length, how much variety you want, and the cardio activities you do. You can change it in Plan settings, and it is deleted with your account.
• Body weight entries, if you add them or import them from Apple Health or Health Connect: the date, the weight, and its unit.
• Focus exercises: up to three exercises you want to keep in your plan, in your order.
• Equipment for one day: equipment you added or removed at a location for one date.
• Load profiles: the loads each piece of your equipment can make, such as plates, fixed steps, a list of weights, a weight stack, or band levels, with its unit.
• Plans: your plans with their versions, blocks, workouts, exercises, and sets, the settings and inputs each was built from, and the reason codes that explain each target.
• Plan changes and progression steps: each change to your planned workouts, and each progression step with its inputs, its result, and its reason codes. The first step for a lift can hold a recent lift you entered during setup: the exercise, the load, its unit, and the reps.

Body weight is optional. Only the rules for bodyweight and assisted exercises, the calorie estimate of a cardio entry, your body weight trend, and your weekly report use it, and the app computes the trend and the report on your device. The stored inputs of your plan can hold the body weight that a rule for bodyweight or assisted exercises used. No record in this section stores a reason, symptom, or diagnosis. A reason code names the training rule that produced a target, never a reason you gave.

How we use it and where it is kept

• Why: to build your plan, adapt it to what you log, round each target to a load you can make, and explain every target and change. On your device, the app also uses your plans and plan changes for your weekly report, your training calendar, your consistency streak and milestones, the week’s changes, your coach notes, and your list of plan changes, and none of this reaches analytics or logs. The cardio activities in your training profile only set the order of the cardio activities the app shows you, and your plan never uses them.
• Where: our Supabase database in the United States, with a copy on your device so the app works offline.
• How long: until you delete your account. You can remove a body weight entry, a focus exercise, a day’s equipment change, or a piece of equipment earlier. When you change your settings, earlier plan versions stay, so every past target can still be explained. Your device records plan changes and progression steps as a history it cannot change or delete, and a progression step stays when its exercise leaves your plan.
• Linked to you: yes, to your account.
• Processed by: Supabase.

Your workouts

What we collect

• Workouts: the type, status, times, date and time zone, the plan and location each belongs to, your readiness answer, how hard the session felt, and your notes.
• Exercises and sets: the exercises you did and any swaps, the targets you were given, and the loads, reps, durations, distances, reps in reserve, completion times, feedback on each exercise, and notes you log.
• Cardio entries: the activity, the times, the distance, the calories and where that number came from, and your notes. The app stores no heart rate, also for a cardio entry imported from Apple Health or Health Connect.
• Saved workouts: the name, notes, and exercises with their targets.
• Personal records: the records each session sets.
• Sync history: each change your devices send, including any change the server rejected, which is kept as your device sent it so it can be repaired; and, for an exercise preference, a day’s equipment, or a date’s body weight, the time, device, and change ID of the last change applied, so the later of two devices’ changes wins.
• Device ID: a random ID that each copy of the app creates on your device, never a hardware serial number or an advertising ID, used to order the changes of your devices and to name the device that made each change.

How we use it and where it is kept

• Why: to record what you trained and when, for your history, your next targets, your records, and the previous values the app shows you; to show your training calendar, your weekly reports and their list, your progress summary, your consistency streak, your milestones, your exercise trends, your records list and record history, and the notice of a new record; and to keep your devices in sync, also when you train offline.
• Where: on your device, so the app works offline, and in our Supabase database in the United States. On iPhone and iPad, the app’s copy of this data, with a copy of the device ID, is part of the device’s iCloud and local backups. On Android, only a file of the changes not yet synced is part of backups. The device ID itself is kept in storage that never moves to another device.
• How long: until you delete your account. When you delete or discard a workout, it disappears at once from every screen. A planned workout then counts as not done and comes back in your plan, and a target that a later workout already built on can stay as it is. The workout’s record stays, marked as deleted with its last values, until you delete your account, so that an older change from another device cannot bring it back. A workout you deleted from your history comes back, marked as restored, only when it again holds a completed set or cardio entry that is not marked as deleted: one that another device logged and the deletion never covered, or one that the deletion covered and that a device which never saw the deletion changed afterwards. You can then delete it again. Changes waiting to sync stay on the device until 30 days after the server accepts or drops them. The device ID stays on the device when you sign out.
• Linked to you: yes, to your account.
• Processed by: Supabase.

Your notes, loads, reps, reps in reserve, heart rate, calories, and body weight never reach analytics, logs, or error reports. Only our backend can read a rejected change.

Apple Health, Health Connect, and Strava

The app writes to and reads from Apple Health or Health Connect only if you turn each feature on. The app shows Strava only while we make it available, and it publishes to Strava only if you connect your Strava account.

What we collect

• Apple Health and Health Connect settings on your device: which of the two the app uses; whether Write workouts is on, when you last turned it on, and whether the app has already offered these features; whether Import cardio and body weight import are on, the start of the period each import reads, the point where each import last stopped reading, and the time of its last run; and the result of the last cardio import (how many entries it imported and skipped, and when).
• Copies this device wrote: for each workout or cardio entry this device wrote to Apple Health or Health Connect, a record of which entry it was, where it went, the identifier the copy has there, the version written, and the time it was written.
• Imported cardio, if you turn on Import cardio: the cardio workouts other apps saved in Apple Health or Health Connect, each with its source, its identifier there, the activity, the start and end times, the distance for an activity that has one, and the calories the recording app saved, when the import keeps them. No heart rate is imported. Each one becomes a cardio entry in your workouts.
• Imported body weight, if you turn on body weight import: for each date that has no body weight entry, the latest reading from Apple Health or Health Connect, stored as a body weight entry (the date, the weight in your current unit, and the unit) with no note of where it came from.
• Strava connection, if you connect Strava: your Strava athlete ID, the access you granted, the access and refresh tokens, encrypted, when the access token expires, and whether new workouts start with Publish to Strava on. We keep no Strava name and no photo.
• Strava connection check: while you connect Strava, a hash of the one-time value that matches Strava’s answer to your request, your user ID, the return address, and an expiry 10 minutes after the connection starts.
• Strava publications, if you connect Strava: for each workout or cardio entry you choose to publish, its type and ID, its publish status, whether it was published, the number of attempts and checks, the kind of any error, the time of the next attempt, the times you asked and it was queued, your language, its title and description, which name the exercises, and the Strava upload ID and activity ID with the times they arrived. Your device keeps a copy of the source, the status, whether it was published, and the activity ID with its time.
• What we send to Strava: for each workout or cardio entry you publish, its title and description, its exercises, its sets, and its cardio values.
• Strava setting on your device: whether Strava is available in the app, whether you are connected, your choice for new workouts, and when the app last checked.

If you turn on Write workouts, the app writes each finished workout as one strength workout, and each cardio entry you log on its own or in a finished workout without a completed working set, with its type, its start and end times, and its distance. It writes no sets, reps, loads, calories, heart rate, notes, or body weight. When you edit or delete a workout or cardio entry that this device wrote, the app updates or removes its copy, also after you turn Write workouts off. If you turn on an import, the app reads other apps’ cardio workouts with their distance and active calories, or your body weight readings, only while that import is on. The app asks for each permission only when you take the action that needs it, never when it opens or during a workout, and it never asks for the heart rate, background, history, or clinical records permissions.

Data from Apple Health or Health Connect serves only your own training records. We never use it for advertising or data mining, never sell it or disclose it to a third party, and never use it for a decision about credit, insurance, or employment. It never reaches Strava: imported cardio is never published, and an imported body weight is kept only as your own body weight entry, which syncs to your account like one you type and is never published. If you connect Strava, its data is shown only to you and never used for analytics, product improvement, or an AI system.

How we use it and where it is kept

• Why: to write your workouts to Apple Health or Health Connect and keep the copies this device wrote up to date; to count other apps’ cardio in your history, training calendar, and weekly report, as every cardio entry counts, without importing a workout twice; to use an imported body weight for the calorie estimate and your body weight trend, as an entry you type is used; and, if you connect Strava, to publish the workouts and cardio you choose to your own Strava account once each, show whether each was published, offer View on Strava, and end our access when you disconnect.
• Where: the settings and the records of copies stay only on your device, never synced. On iPhone and iPad they are part of the device’s backups; on Android they are in none. Imported cardio and imported body weight are kept like your other cardio and body weight entries: on your device and in our Supabase database in the United States, and on iPhone and iPad the app’s copy is part of the device’s iCloud and local backups. The Strava connection, the connection check, and the publications are in our Supabase database in the United States. Of the Strava connection, the app can read only whether you are connected and your choice for new workouts, never a token or your athlete ID, and only our backend reads the connection check. What you publish is in your own Strava account.
• How long: the settings until you change them or a later import or check replaces them; turning Import cardio off keeps the start of its period and the point where it stopped reading. A record of a copy stays until the copy is removed from Apple Health or Health Connect, and turning Write workouts off keeps these records, so your edits and deletions still reach the copies. Signing out keeps the settings and the records, and they are deleted with the app’s data for your account. Imported cardio stays as every cardio entry does, until you delete your account: when you delete one, it disappears at once and its record stays, marked as deleted with its identifier, so the import never brings it back, and an imported entry whose workout was removed from Apple Health or Health Connect is deleted at the next import. An imported body weight stays as an entry you type does, until you delete the entry or your account, and an import never deletes an entry or brings one back.
• How long, for Strava: the connection until you disconnect, Strava tells us that you removed our access, or you delete your account, each of which deletes it at once. A connection check is deleted when the connection completes or is refused, and otherwise within about an hour after it expires. A publication keeps the Strava upload ID and activity ID for less than 7 days, because an hourly job removes them before then, and your device hides View on Strava after 7 days. Its title and description stay until it is published, fails, or is dropped, and its record, with whether it was published, stays until you delete your account. A disconnect or a notice from Strava that you removed our access clears every Strava ID, title, and description of your publications at once and drops those still waiting, keeping whether each was published. What you published stays in your Strava account as Strava keeps your activities, also after you disconnect or delete your account.
• Linked to you: yes, to your account; the settings and the records of copies are stored for your account on your device.
• Processed by: Supabase. What the app writes to Apple Health or Health Connect stays there, and what you publish to Strava is kept by Strava in your account.

Logs and error reports hold only the type of error, the operation, and our own IDs, never a value from Apple Health or Health Connect, a body weight, a distance, calories, a token, or a response from Strava.

Workout settings on your device

What we collect

• Workout settings: the sounds with their style and volume, haptics, voice guidance, speaker output, whether the rest timer starts on its own, whether the screen stays on during a workout, and whether upcoming workouts download.
• Workout state: the rest in progress, what the lock screen shows during a workout, the exercises the app asked you about during a session, and which one-time questions it already asked (notifications, voice guidance, and, on Android, Alarms and reminders).
• On Android, a file that notes only whether the app has asked for permission to send notifications since it was installed.

How we use it and where it is kept

• Why: to restore a rest and the lock-screen timer after the app restarts, to alert you once when a rest ends, to log from the lock screen exactly the set it shows, to apply your workout settings, and to ask each one-time question only once.
• Where: only on your device, never synced. On iPhone and iPad it is part of the device’s backups; on Android it is in none.
• How long: a rest until it ends or its workout ends, the lock-screen content until the workout ends, and your settings until you change them. Signing out keeps them, and they are deleted with the app’s data for your account. The Android file stays until the app’s data is removed, also after you delete your account.
• Linked to you: stored for your account on your device; the Android file holds no personal data.
• Processed by: no one; it stays on your device.

Notifications on your device

What we collect

• Notification settings: whether training reminders are on and your reminder time, whether plan updates are on, and whether quiet hours are on, with their start and end.
• Reminder offer: whether the app has offered training reminders on Today.
• Scheduled notifications: on iPhone and iPad, each training reminder and any plan update held for quiet hours, waiting in the system with its delivery time, its text (the planned workout’s name and how long it takes, or the line that describes the plan change), the screen it opens, and your user ID, and for a plan update also the ID and time of the change. On Android, one alarm for the next notification, and a record of a held plan update with its IDs and times and no text.

No notification text holds your name, your email address, your body weight, a load, a health value, or another number from your log.

How we use it and where it is kept

• Why: to send only the notifications you turned on, at your reminder time, to hold them during quiet hours, also across a restart, and to offer training reminders only once.
• Where: only on your device; nothing of it reaches our servers. On iPhone and iPad, the settings and the offer record are part of the device’s backups, and the scheduled notifications wait in the system’s list of pending notifications. On Android, none of it is in a backup.
• How long: your settings until you change them, and the offer record until the app’s data for your account is deleted; signing out keeps both. A scheduled notification stays until it is delivered or the next scheduling replaces it, and a held plan update until it is sent, you turn plan updates off, or another person signs in. Signing out and deleting your account remove every scheduled notification.
• Linked to you: stored for your account on your device.
• Processed by: no one; it stays on your device.

Logs and error reports never hold a notification’s text, your reminder time, or your quiet hours.

Weekly reports and coach notes on your device

What we collect

• Weekly report choices: the week of the last weekly report card you dismissed, whether the weekly report notification is on, and whether the app has offered it.
• Coach choices: the coach notes you dismissed, each with its key, its kind, its plan blocks, and its last workout day; the last suggestion of a lighter week that you declined, with its reason codes and the date; whether you turned off Coach notes on Today; and the plan change cards the app has shown, each with its screen, its key, its plan blocks, and its kind.

The app computes every report, calendar, trend, record list, explanation, and coach note on your device from the data in the sections above, so these features add nothing to our servers. Your body weight, loads, reps, volumes, durations, distances, record values, and notes never reach analytics, logs, error reports, the weekly report notification, or an image you share from the app.

How we use it and where it is kept

• Why: to keep a weekly report card or a coach note you dismissed from showing again, to schedule the weekly report notification only if you turned it on and to offer it once, to keep a lighter week you declined from coming back before its rule allows, to apply your coach setting, and to show each plan change card once on each screen.
• Where: only on your device, never synced. On iPhone and iPad it is part of the device’s backups; on Android it is in none.
• How long: each value until you change it or a later dismissal replaces it. Signing out keeps them, and they are deleted with the app’s data for your account.
• Linked to you: stored for your account on your device.
• Processed by: no one; it stays on your device.

Subscriptions

If you subscribe to Pro, the App Store or Google Play bills the subscription, and RevenueCat confirms your purchase for us. Deleting your account does not cancel a subscription, so cancel it in the App Store or Google Play first.

What we collect

• Subscription status: whether your Pro access is active and when it expires, the type of period, the store, the product, whether it renews, the time of any billing problem, the RevenueCat environment it came from, and the ID of the event that last changed it. A check can also record that a free account has no Pro access. We keep no price, currency, country, or store account.
• Subscription events: for each notice RevenueCat sends us, its ID, its type, your user ID, the times it happened and arrived, and how we handled it, with no price, currency, country, subscriber details, or content of the notice.
• At RevenueCat: your user ID, your purchase and renewal history, the app version, the platform, and the country RevenueCat derives. The app sets no email address, no name, and no other detail about you at RevenueCat.
• At Apple or Google: the Apple Account or Google account that pays, the payment, and the subscription’s transactions. We keep no copy.
• Subscription status on your device: the RevenueCat software’s copy of your latest subscription status, and the app’s own record of it, with your user ID; the latest status from RevenueCat, with the time RevenueCat sent it, the result of the check of RevenueCat’s signature on it, when your Pro access expires, the type of period, the store, the product, the period, whether it renews, and the time of any billing problem; the time the app last reached RevenueCat, the result of its latest request to RevenueCat, the latest time the app has seen, and the start of any pending check of a purchase transfer. It holds no price, currency, country, or store account.

How we use it and where it is kept

• Why: to give you Pro in the app and on our servers, which check it before they build a new plan after you change your settings; to show your subscription status in our support tools; to validate and restore your purchases with the stores; to handle each subscription event exactly once and find the ones that failed; and to keep Pro working offline without letting a clock set back extend it.
• Where: the subscription status and the events in our Supabase database in the United States. Only our backend writes your status, from RevenueCat, never from the app, and you can read only your own status; nobody outside our backend reads the events. Your customer record is at RevenueCat, which runs its service on Amazon Web Services in the United States, and the purchase records are at Apple or Google. The status on your device stays there, and on iPhone and iPad the app’s own record is part of the device’s backups; on Android it is in none.
• How long: the status until you delete your account. An event for 90 days, or until you delete your account if that comes first; an event that arrives after the deletion, such as a renewal, for 90 days without your user ID. Your customer record at RevenueCat until you delete your account: before we delete the account, we delete the customer record there, which removes your purchase history at RevenueCat. Apple and Google keep their purchase records under their own policies, and deleting your account neither cancels your subscription nor deletes those records. On your device, the app’s own record until you sign out of that account or delete the app, and the RevenueCat software’s copy until you delete the app, because signing out does not clear it.
• Linked to you: yes, to your account.
• Processed by: Supabase and RevenueCat. Apple and Google bill the subscription under their own policies.

Logs and error reports hold only the type of error, the operation, and IDs, never a key, a token, a receipt, a transaction ID, a price, an email address, or a subscriber detail.

Exercise videos

FitTune’s exercise videos are AI-generated and contain no audio. The videos and their associated records contain no app user data.

What we collect

• Review decisions: who decided on each video, recorded only as a role, such as owner, or as our automatic checks, never as a name or an email address, and the time of the decision.
• Review notes: the reviewer’s note about why a video was not published.
• Generation requests: the request ID and any error text of each request to the generation provider. Only our backend can read them.

How we use it and where it is kept

• Why: to record which role or automatic check decided each video, to explain why a video was not published, and to trace a request to the generation provider.
• Where: our Supabase database in the United States.
• How long: review decisions and notes stay with their video, and a published or replaced video is never deleted. A request ID and its error text stay with the record of their generation job.
• Linked to you: no. These records hold no data about the people who use the app, and reviewers appear only as a role.
• Processed by: Supabase.

People who work on the exercise catalog

This section applies only to people we give a role in our internal admin tool, such as the editors and reviewers of the exercise catalog.

What we collect

• Role grants: your user ID, your role, the language you review if you are a reviewer, the user ID of the person who granted the role, and when.
• Exercise versions: the user ID of the person who saved each version, the time, and an optional note of up to 200 characters.
• Text proposals: the user ID of the person who proposed a change to approved text, and when.
• Audit entries: for each change in the admin tool, the user ID of the person who made it, the time, the action, the exercise or the person whose role changed, and a summary of what changed.

These records store user IDs, never email addresses. The admin tool looks up an email address each time it shows one, so a deleted account shows none. Your own sign-in details for the admin tool (your email address, password hash, and two-step verification factor) are kept in Supabase Auth like those of every account. The audit summary never holds content text, notes, tokens, passwords, or verification secrets.

How we use it and where it is kept

• Why: to decide what each person may do in the admin tool, to show who changed each exercise and why, and to trace a mistake to its source.
• Where: our Supabase database in the United States. Only the admin tool reads these records, for a signed-in person with two-step verification whose role allows it.
• How long: a role until an owner revokes it or your account is deleted. Your user ID stays on the exercise versions you saved, also after your account is deleted. A proposal stays until it is approved, discarded, or replaced. An audit entry stays for at least 24 months and cannot be changed or deleted before then, and nothing deletes audit entries automatically.
• Linked to you: yes, to your user ID.
• Processed by: Supabase.

This website

This website has no accounts and sets no cookies.

• Page views: Cloudflare Web Analytics counts the page, the referring site, the country, and the browser and device type of each visit, without a cookie, without storing your IP address, and without a user ID. We use it to see which pages people read and to improve the site. Cloudflare keeps this data aggregated under its own retention, and it holds no personal data.
• Search performance: Google Search Console and Bing Webmaster Tools show us the searches, impressions, clicks, and positions of our pages, aggregated by each search engine. We use it to check that our pages are indexed and to choose topics. Google and Microsoft keep this data under their own retention, and it holds no personal data.
• Email to support@fittune.app: Cloudflare Email Routing forwards your message to the company mailbox of Brightpath Labs LLC, and its activity log lists the sender, the recipient, and the delivery status. We keep your address, your messages, and our replies for 24 months after the last message of the conversation, and then delete them. We use them only to answer support, privacy, account deletion, and security requests.

Page views and search data are not linked to you. An email is linked to your email address. Cloudflare processes the page views and the email for us, and Google and Microsoft provide the search data from their own services.

Usage statistics

When the app measures how its features are used, each event carries a random ID, never your name or email address, and never your notes, loads, reps, reps in reserve, heart rate, calories, or body weight. The events for the setup steps, up to and including the plan preview, carry a random setup ID instead of a user ID, with only a few details of your setup: whether setup finished on this install before, your goal, the type of place you train, the number of equipment items in your setup, your days per week, and the training split of your plan preview. The event for a sign-in during setup, on the first screen or after the plan preview, carries your user ID, the setup ID, and how you chose to sign in, which links the two. Every other event carries a random user ID, and the setup events among them also carry the setup ID. Events from test versions of the app go to separate destinations. Before an analytics provider receives any event, we name it in this policy.

What we never do

• We do not sell your personal data, and we do not share it for advertising.
• The app shows no ads, uses no advertising identifier, and does not track you across apps or websites that other companies own.
• We do not use your training data or your body weight for advertising, or for decisions about insurance or employment.
• We never use data from Apple Health or Health Connect for advertising or data mining, never sell it or disclose it to a third party, never use it for a decision about credit, insurance, or employment, and never send it to Strava.

Who receives your data

These companies process personal data for us, only for the purposes in this policy:

• Supabase runs our database and sign-in.
• Resend sends the sign-in code emails.
• Cloudflare hosts this website and our exercise videos, counts page views, and forwards email sent to support@fittune.app.
• RevenueCat validates and restores subscription purchases with the App Store and Google Play, and tells the app and our servers whether you have Pro.

Other companies take part under their own privacy policies. Apple and Google confirm who you are when you choose to sign in with them, and they send us the sign-in details this policy lists. If you subscribe, Apple or Google bills the subscription and keeps its purchase records. Google and Microsoft show us how our pages perform in search, and we receive no personal data from them.

Apart from these, your data goes only where you send it. If you turn on Write workouts, the app writes your workouts to Apple Health or Health Connect, as the section on Apple Health, Health Connect, and Strava describes, and they stay there. If you connect Strava, we send each workout or cardio entry you choose to publish to your own Strava account, and Strava keeps it there as it keeps your other activities.

Every third party that receives your data, including each of these companies and any parent, subsidiary, or related company of Brightpath Labs LLC, protects it at least as well as this policy states.

We also disclose personal data when the law requires it, for example to answer a valid court order. If Brightpath Labs LLC merges with another company or transfers the app, your data moves only under the protections of this policy.

Where your data is processed

Supabase keeps our database and sign-in data in the United States, and Resend keeps the sign-in code emails there. For the sign-in code emails, transfers to the United States rely on the Standard Contractual Clauses and on the EU-U.S. Data Privacy Framework.

RevenueCat runs its service on Amazon Web Services in the United States, and the companies it uses to process data are in the United States. For transfers from the European Economic Area and the United Kingdom, RevenueCat’s data processing addendum provides the Standard Contractual Clauses, with an addendum for the United Kingdom and one for Switzerland.

How we protect your data

• Every connection between the app, this website, and our servers uses HTTPS.
• In our database, row level security lets each account read only its own data, and nobody can read it without signing in.
• The app keeps your sign-in on the device in protected storage: the Keychain on iPhone and iPad, and encrypted storage on Android.
• The admin tool requires two-step verification, and each person can do only what their role allows.
• If you connect Strava, your Strava tokens are encrypted with AES-256-GCM, and the app can never read them or your athlete ID.
• Only our backend sets your subscription status, from RevenueCat, never from the app.
• Your notes, loads, reps, reps in reserve, heart rate, calories, and body weight never reach analytics, logs, or error reports.
• The logs and error reports of our Apple Health, Health Connect, Strava, notification, and subscription features never hold a value from Apple Health or Health Connect, a distance, a token, a response from Strava, a notification’s text or time, a receipt, a transaction ID, a price, or an email address.

Your rights and choices

Wherever you live, you can ask us to:

• give you a copy of your personal data, also in a format you can move to another service;
• correct data that is wrong;
• delete your account and its data, as the account deletion page describes;
• stop or limit a use of your data that you object to.

To make a request, write to support@fittune.app from the email address of your account, so we know that the request comes from you. We do not charge for a request, and we reply within one month.

You can withdraw a consent at any time. The app sends training reminders, plan updates, and the weekly report notification only if you turn them on, and you can turn each one off in the app, or all of the app’s notifications in your phone’s settings, at any time. On Android 12 and later, you can also turn off Alarms and reminders for the app in your phone’s settings at any time. Write workouts writes new workouts only while it is on, Import cardio and body weight import read only while they are on, and you can turn each one off in the app at any time. If you connect Strava, you choose for each workout whether it is published, and you can disconnect Strava in the app at any time, which deletes your Strava connection with its tokens and clears the Strava IDs, titles, and descriptions of your publications; activities already published stay on Strava.

Deleting your account

To delete your account without the app, write to support@fittune.app from the email address of your account and confirm when we reply. The account deletion page lists every step, also for an account that uses a Sign in with Apple relay address. We delete the account within 30 days of your confirmation, usually within 7 days, and email you when it is done.

Deleting the account deletes your sign-in identity, your sign-in sessions, and every record that the sections above keep until account deletion. If you connected Strava, it also deletes your Strava connection with its tokens and clears the Strava IDs, titles, and descriptions of your publications. Before we delete the account, we also delete your customer record at RevenueCat, which removes your purchase history there. A deletion by email does not delete what the app stored on your device: the app’s copy of your data stays there, also when you sign out, until you delete the app, and its stored sign-in stops working once the account is deleted.

Deleting the account does not cancel a subscription. If you subscribe to Pro, cancel it in the App Store or Google Play before you ask us to delete your account.

Some records outlast the deletion for a limited time:

• our database backups, for up to 7 days;
• Supabase’s sign-in logs, for 7 days;
• the sign-in code emails at Resend, for 30 days after each was sent;
• a subscription event that RevenueCat sends after the deletion, such as a renewal, for 90 days without your user ID;
• the emails of your deletion request, for 24 months, as the record that we completed it;
• your other emails to support@fittune.app and our replies, until 24 months after the last message of each conversation.

Some copies are kept outside FitTune and stay there: workouts and cardio already written to Apple Health or Health Connect, activities already published to Strava, and the purchase records that Apple and Google keep under their own policies.

Once the app sends usage statistics to an analytics provider, they stay there under its retention and carry only random IDs that nothing links to you once the account is deleted. If you held an admin role, your user ID stays on the exercise versions you saved, and your audit entries stay for at least 24 months.

Information by region

European Economic Area and United Kingdom

Where the GDPR or the UK GDPR applies, we use your data on these legal bases:

• Contract: to provide the app you signed up for, which covers your account and sign-in, the sign-in code emails, setup, your plan, your workouts, sync, your weekly reports and coach notes, and, if you subscribe, your subscription with its purchase checks, restores, and events.
• Explicit consent: to write your workouts to Apple Health or Health Connect and to import cardio and body weight from them. You give it when you turn each feature on, and you withdraw it when you turn the feature off.
• Consent: to send training reminders, plan updates, and the weekly report notification, and, if you connect Strava, to publish the workouts and cardio you choose to your Strava account.
• Legitimate interests: to measure and improve this website, to answer your messages and show your subscription status in our support tools, to keep the admin records that explain changes to the exercise catalog, and to keep the service secure.
• Legal obligation: to keep the record of a completed deletion request.

You can also complain to the data protection authority where you live.

Brazil

If you live in Brazil, the General Data Protection Law (Law No. 13,709/2018, the LGPD) gives you the rights above, among them confirmation that we process your data, access, correction, anonymization or deletion, portability, information about the companies we share it with, and withdrawal of consent. You can also complain to the National Data Protection Authority (ANPD). Write to support@fittune.app for any data protection matter.

Japan

If you live in Japan, you can ask us, under the Act on the Protection of Personal Information, to disclose your personal data, to correct, add to, or delete it, and to stop using it or providing it to others. Your data is kept in the United States, as this policy describes.

United States

We do not sell or share personal information as California law defines those terms, and we do not use it for targeted advertising. You can make the requests above wherever you live in the United States.

Children

The app is meant for people aged 16 and older, and we do not knowingly collect data from children under 16. If you believe a child under 16 has given us personal data, write to support@fittune.app, and we will delete it.

Changes to this policy

When we change this policy, we update this page. Before the app collects a new kind of data or uses data for a new purpose, we update this policy, and when a change is significant, we tell you in the app or by email.

Contact

Brightpath Labs LLC is responsible for your personal data in the app and on this website. Write to support@fittune.app with any question or request about privacy.