Privacy Policy

Nothing beyond the categories below. Each one serves a function you asked for by using the app.

• Account identity — your email address, and your password as an irreversible hash, through Supabase authentication.
• Profile — age, weight, sex, height, goal, level, training and nutrition preferences — entered by you, editable and erasable at any time.
• Session history — exercise, reps, duration, form score, estimated calories, date.
• Per-rep biomechanical detail — range of motion, speed, safety and form indicators, computed from skeleton key points — never the image itself. Used to sync your history across your devices and to improve counting accuracy in aggregate.
• Subscription and payment — plan, status, period dates, your customer id at the payment provider, and invoice history. We never receive or store your card number: it is entered directly with the provider.
• Support requests — category, subject and the messages you send to support, kept in your account so your request can be followed up.
• Partner programme — if you take part: your code, attributed clicks, conversions and payout requests. See the cookie policy for how attribution works.
• Notifications — a device identifier, only if you turn notifications on, and only for as long as they stay on.

The GDPR requires every processing operation to rest on a legal basis. Here is ours, purpose by purpose.

Where the basis is consent, withdrawing it takes effect immediately and costs you nothing else in the service. Where the basis is legitimate interest, you may object: write to us.

We do not sell your data. We do not share it with anyone for advertising. There is no ad network, no social media pixel and no data broker in FitForm — and the cookie policy confirms the same on the website side: not one advertising cookie is set.

These providers process data on our behalf, on our instructions, under contract. The list is exhaustive.

• Supabase, Inc. — database, authentication and storage. Holds your account, your profile and your history.
• Amazon Web Services — web server for fitform.fit, in the eu-north-1 region (Stockholm, Sweden).
• Paddle.com Market Ltd — official reseller and card payment processing. Receives your email and billing details — we never receive your card number.
• TokiPay — mobile money aggregator (MVola, Orange Money, Airtel Money) for payments in Madagascar.
• Google Play Billing — if you subscribe from the Android app through the Play Store.
• Mailtrap — delivery of transactional email: confirmation, password reset, support replies.
• AI model providers — generating coaching and nutrition plans and session analysis, from text derived from your sessions — never an image, never the camera feed.

FitForm's publisher is established in Madagascar, and the processors above are spread across Sweden, Singapore, the United Kingdom and the United States. Your data therefore crosses borders whatever country you are in: that is the direct consequence of a service sold internationally and hosted with specialist providers. Those transfers are limited to the data each provider strictly needs to do its job, and rely on the European Commission's standard contractual clauses wherever the recipient sits in a country with no adequacy decision.

Two bodies of law apply to this processing. Madagascar's, where the publisher is established, with its national data protection authority. And the GDPR, which applies in its own right as soon as a service addresses people located in the European Union — it adds to the first rather than replacing it. Rather than making your rights depend on where you live, we apply the more protective of the two to everyone: the baseline described on this page is the GDPR's.

Deletion is immediate, permanent and not deferred: account, profile, session history, biomechanical detail and support requests all cascade away. Only accounting records remain, because the law requires it. We keep no just-in-case copy.

Wherever you live, we apply the GDPR baseline to everyone — it is simpler to honour than a per-country regime, and more protective.

• Access: obtain a copy of the data we hold about you.
• Rectification: correct anything inaccurate, straight from your profile.
• Erasure: delete your account and everything attached to it.
• Portability: get your data back in a machine-readable format.
• Restriction and objection: freeze a processing operation, or object to those based on legitimate interest.
• Withdrawal of consent: at any time, for notifications, without retroactive effect.
• Complaint: lodge one with the data protection authority of your country of residence.

Access, correction and erasure need no email at all — they happen from the My Account page. For an export, a restriction, an objection or anything else, write to us: we answer within 30 days at the latest.

The CCPA/CPRA gives you the right to know which categories of data are collected, to have them deleted, to correct them, and to opt out of their “sale” or “sharing”. FitForm neither sells nor shares personal information within the meaning of that law, and therefore offers no opt-out mechanism — there is nothing to opt out of. Access, deletion and correction rights are exercised as described above.

FitForm is not aimed at anyone under 16, and the Nutrition module is restricted to adults (see the terms of use). We do not knowingly collect data from a child below that age; if you find that an account was created by a minor, report it and we will delete it.

Coaching and nutrition plans are generated automatically, but they produce no legal effect and nothing comparably significant for you: they are training and meal suggestions you remain free to ignore. No profiling determines your access to the service, your price or your rights.

Traffic is encrypted end to end (HTTPS, HSTS). Data access is partitioned row by row at the database level: an account can technically read only its own rows. Administrative keys are never exposed to the browser, and payment webhooks verify their signature before any write.

We may update it as the product changes. The last-updated date at the top of this page governs. A change that would reduce your rights or widen the purposes will be announced by email or in the app before it takes effect.

• Cookie Policy — every cookie this site sets, and how to refuse them.
• Terms of Service — the rules for using the service.
• Legal Notice — who publishes and who hosts FitForm.

For any question about this policy or your data: the help centre, reachable from your account. hello@fitform.fit