Privacy Policy

1. Who is responsible

FitMate is run by an individual for friends and family. That person decides how your information is used and is responsible for it. See the contact line at the end.

2. What we collect

From Google when you sign in: your Google account identifier, email address, name and profile photo. We never receive your Google password and we do not store Google tokens.

From Apple when you sign in with Apple: your Apple ID's identifier, the email address you choose to share (it can be an Apple private relay address) and, the first time only, your name. We never receive your Apple ID password and we do not keep Apple tokens.

What you enter: height, sex, birth year and activity level; goals; your weight and body measurements; workouts and sets; exercise you log outside workouts; exercises you mark as hurting, and where; daily check-ins (sleep, energy, sex drive, mood, morning erections); meals, water and supplements you tick; Daily Squeeze sessions; the plans you write; the friends you add and the cheers you send; your reminder times and settings.

In the phone app, only if you turn it on: today's step count from Health Connect (Android) or Apple Health (iPhone). FitMate only reads steps, never writes anything to them, and reads nothing else there.

Progress photos you take stay on your own device. They are never uploaded to FitMate, and signing out deletes them from the phone app.

Technical: two sign-in cookies in the browser (the phone app keeps its sign-in in the phone's secure storage instead), your time zone, and, if you turn on reminders, your browser's push address or your phone's push token (not your location).

3. Why we use it

To run the app: to show your workouts and progress, to work out calorie and protein targets and adjust them from your weight trend, to send the reminders you choose, and to let you share plans. We do not sell your information, show ads, or build advertising profiles. There are no analytics or tracking tools in the app.

4. Health information and your consent

Information about your body, training and eating is health information. We only store it with your clear agreement, which you give separately when you start. You can withdraw it in Settings, and we then stop saving new personal data.

5. Where it is stored

Your information is stored on the server that runs FitMate, and a copy is kept in your own browser, or in the phone app's private storage, so the app works offline. The phone app's copy is not included in phone backups and is deleted when you sign out. It is protected in transit with HTTPS. Sign-in refresh tokens are stored only as hashes. The person running FitMate can technically access the database for maintenance and support, and does not look at your data otherwise.

6. Who else receives anything

Google or Apple, for sign-in. Deleting an account that uses Sign in with Apple also ends FitMate's access to your Apple ID. Your browser's push service (for example Google or Apple), or for the phone app Expo's push service, which passes it to Google or Apple: they receive the notification text you asked for. Step counts read from Health Connect or Apple Health are used only to fill in your steps; they are never sold, shared with anyone else, or used for advertising. People you share a plan with, who see the plan and your name and photo only.

Friends you add. This starts only when you accept a friend's invite or a friend accepts yours, and stops for both of you when either removes the other. A friend sees your first name and photo, the days you completed a workout this week and their names, how many workout days your program plans, your training streak, your last workout, and whether you follow the same program. Friends never see your weights, sets, body measurements, goals, meals, check-ins, pain log, Daily Squeeze or email address. A cheer you send is delivered to your friend as a notification.

7. Cookies

FitMate uses two strictly necessary cookies to keep you signed in. They are not used for tracking.

8. How long we keep it

Until you delete it. Deleting your account removes all your data from the live system straight away. It may remain in short-lived backups for a limited time.

9. Your rights

In Settings you can export all your data in one file, correct what you entered, delete your account, and withdraw your health-data consent. You can also ask the person running FitMate for help. If you are in Zimbabwe you may complain to the Postal and Telecommunications Regulatory Authority of Zimbabwe (POTRAZ), the data protection authority.

10. Children

FitMate is only for people aged 18 and over. If we learn that someone younger has an account we delete it.

11. If something goes wrong

If personal information is lost or exposed in a way that is likely to cause you harm, we will tell the regulator within 24 hours and tell you within 72 hours.

12. Changes

We may update this policy. Each version has a number, and you will be asked to accept it again when it changes.