Privacy Policy

FITKIND PRIVACY POLICY

Last modified: 5 September 2026

Effective date: 22 August 2026

APPAYA LTD ("fitkind", "we", "us") provides the fitkind mobile apps, the Apple Watch and Wear OS companion apps, fitkind.app, and the services behind them (together, the "Service"). This policy explains what personal data the Service collects, why, where it goes, how long it stays, and what you can do about it.

It describes what the software actually does today. Where a feature is built but switched off, or built but incomplete, this policy says so rather than describing an intention. If you want to check a statement here against the product, contact [email protected].

fitkind is a personal training log with optional community features. Direct messaging, photo or video sharing between members, a professional marketplace, and organisation portals are not part of the Service.

Contact and controller. APPAYA LTD (company number 16078943, registered office: Flat 15 Alina Court, 58 Lomond Grove, London SE5 7LE) is the data controller. Privacy questions and rights requests: [email protected].

1. Features that are switched off

Several features described below are behind switches that are off in the current release: the community and Pulse features, squad pacts, Kit AI, progress photos, GPS route tracking, nutrition and pacts, training plans, credentials, and the notifications inbox.

Be careful with what "off" means here, because it is narrower than it sounds. The switches govern the feeds, presence, counts and the AI assistant. They do not seal the app off:

A Community tab is present on both platforms regardless of the switches — it contains the social surface — and the community-features setting does not remove it.
Following works. The follow graph is reachable in both apps and the server accepts follow, unfollow and follow-request calls with no feature check, so follow relationships can be created and stored while community features are described as off.

So treat the switches as controlling what the product does with community data — whether you appear in feeds, presence and counts — rather than as a guarantee that no community data exists.

Two honest qualifications. Our servers do not enforce every one of those switches — the underlying interfaces would still accept data if something other than the app sent it, so the switch is an app-level control rather than a server-level block. And the short training summaries described under Kit AI are generated whenever you record a workout, body measurement, daily readiness entry or goal, whether or not Kit is switched on or you have ever opened it. Those summaries are stored with your account and are erased with it.

We describe the switched-off features here so this policy is complete when they are turned on, and so you can see in advance what each one would collect.

2. Data we collect

2.1 Account

Email address. This is how you sign in. We send you a one-time sign-in link or code; there is no password.
Display name and profile picture, if you add them.
Date of birth. We check it at sign-up, and we keep it: your age is also used to set the age-appropriate sleep target behind your readiness figures. It is not shown to other members and appears on no public surface; it is included in your own data export.
Height, weight and a training goal, collected during onboarding. The app asks for all three to finish setting up, and the goal is chosen from a fixed list rather than typed.
Apple or Google sign-in link, if you use one: the provider name, the identifier that provider gives us, and the email address it returns.
Sign-in tokens. A sign-in link token is marked as used once you use it — it cannot be used again — but the row stays in our database until a cleanup job removes it after it expires. Session refresh tokens are stored only as a SHA-256 hash, so reading our database does not yield a usable session credential.

2.2 Your training data

Once you finish a workout it is sent to our servers and stored there, linked to your account. Two qualifications: a workout still in progress lives only on your device until you complete it, and a completed one waits in a local outbox if you are offline or the upload fails, so it can sit on the device for a while — or indefinitely, if the upload never succeeds. Section 7 covers what that means when you sign out. What reaches our servers is:

Workouts: name, free-text notes, start and end time, duration, how the session felt, and every exercise, set, weight and rep you log.
Templates, training plans, custom exercises and equipment setups you create.
Personal records, streaks, momentum scores and the daily reason each momentum change was recorded.
Body measurements, including weight, body-fat percentage, circumference measurements and any notes you attach.
Goals, badges, challenges, credentials, hydration entries and wellness sessions.
A sync queue that holds a copy of records created offline until they are processed on our servers. On both iPhone and Android, a completed workout is also kept in a local outbox on the device, and it stays there after it has synced — it is not cleared when you sign out, and it is not tied to the account that created it, so a workout logged by one account can still appear in the app after a different account signs in on the same phone. Delete the app to clear it.

2.3 Health-platform data

If you grant permission, fitkind reads nine types of data and no others:

Apple Health / HealthKit: step count, resting heart rate, heart-rate variability (SDNN), body weight, active energy burned, sleep analysis, respiratory rate, oxygen saturation, and body temperature.
Health Connect on Android: steps, resting heart rate, heart-rate variability (RMSSD), sleep sessions, weight, active calories burned, respiratory rate, oxygen saturation, and body temperature.

The last three on each list feed the vitals card on your phone. They are read and displayed on the device only, and are not sent to our servers today. What is sent remains the six measures described below.

The integration is read-only in both directions of the word: we request no write permission at all, so fitkind cannot add, change or delete anything in Apple Health or Health Connect.

This data does leave your device. What is sent is one figure per measure per day, not the individual readings behind it — a total for steps and active energy, a daily average for resting heart rate and heart-rate variability, and the most recent reading of the day for body weight. From iPhone that is total sleep and its REM, deep and light split, sleep interruptions, resting heart rate, HRV, body weight, steps and active energy. From Android it is total sleep duration, resting heart rate, HRV, body weight, steps and active energy. Those figures are stored on our servers, along with the readiness, sleep, stress and training-load scores we calculate from them.

One use you would not guess from the list above: the daily readiness, sleep, steps and active-energy figures derived from this data are summarised into the training context Kit uses. If Kit runs on our servers for you (section 2.6), that summary is sent to our AI provider along with your message. If Kit runs on your device, or you never use Kit, it is not sent anywhere.

Health data is special-category data under UK and EU data protection law. We rely on your explicit consent for it, and the place that consent is given and withdrawn is the permission prompt and permission screen on your own device — Apple's or Google's, not ours. Our servers hold no separate record of when you granted or revoked it, so if you need that history it is in your device's settings rather than with us. Revoking permission stops further imports; it does not delete what has already been imported, and there is currently no in-app control that deletes only your imported health data. Deleting your account removes it (see section 6). We use health data for the tracking and readiness features you asked for, and for Kit's training context as described just above. We do not use it for advertising, we do not sell it, and it is never visible to another member.

The Apple Watch app mirrors an in-progress session from your phone — exercise name, set information, elapsed time and rep count. The mirrored session has fields for heart rate and active calories, but nothing fills them in the current build, so no heart-rate or calorie data moves between phone and watch. The watch app does not read Apple Health itself.

Motion sensors on the watch. During a workout, both the Apple Watch app and the Wear OS app read the watch's own motion sensors — acceleration and rotation, sampled several times a second — to count your reps. This happens on the watch while a set is running, and it is not covered by the Apple Health or Health Connect permission screens, because it is the device's motion hardware rather than a health record. The readings are used on the watch to infer rep counts; what leaves the watch is the resulting count, not the raw sensor stream.

2.4 Community data

A word on what "switched on" governs here, because it is not all-or-nothing and this catches people out. Following other members, member search, your public profile and follower counts work regardless of the community switches. The switches govern the feed, live presence, Moments, cheers and squad pacts. So some of the data below exists for your account whatever your settings say; the rest only once the relevant feature is on.

With that established, the community data we hold is:

Your member card: display name, profile picture, join date, current streak and total workout count.
Follows, including pending follow requests if your account is private.
Moments you choose to share. A Moment is generated from a completed workout's own recorded numbers — duration, total volume, sets, reps, your top sets, streak and PR count. Each top set names the exercise and shows the weight and reps you lifted, so sharing a Moment does show those numbers to whoever can see it. It is frozen when created and never changes. It carries no photo, video, or note you wrote — but if you lifted a custom exercise you named yourself, that name is text you typed and it appears on the card.
Cheers: who cheered whom, and on which workout or Moment.
Squad pacts: membership, the weekly workout target, each member's weekly compliance, the shared streak, and which member broke a week.
Blocks you create, and reports you submit.

What other members can see. People who follow you can see, for each completed workout: your display name and picture, the workout name you typed, the number of exercises, the duration and the cheer count. A workout entry on its own does not show your individual sets, weights, notes, health data or location.

A Moment is different, and it is the one to think about before you tap share: it shows your top sets, with exercise names and the weights and reps you lifted. Nothing forces you to share one. Squad pact members see each other's weekly compliance and the pact streak.

Your controls, and their defaults. Three settings govern this. They are applied on our servers, but not on every path — the limits are set out immediately after the table, and they are significant enough to read before you rely on any of them:

Control	What it does	Default
Workout visibility	`Everyone`, `Followers only`, or `Private`	Everyone
Community features	Removes you from other members' feeds, from community counts and from Pulse presence. It does not remove the Community tab from your own app	On
Private account	New follows become requests you approve	Off

Setting workout visibility to Private also stops you appearing in Pulse at all.

Be aware of the limits of these controls as they work today, because we would rather you knew than assumed. The community-features switch is applied when we build feeds, community counts and Pulse presence, and it is not applied on member search, on the public profile, or on following — so it is not a single switch that turns the community off everywhere. It does not remove you from member search by display name, from follower and following counts shown to signed-in members, or from your public profile link. Setting your account to private does not remove you from search or from those counts either — what private changes is that new follows become requests you approve, and that your public profile link shows the identity card only.

On presence the switch is complete: with it off, your device writes no presence, none is visible to other members, and turning it off clears any presence already stored at the moment you toggle it.

So there is currently no setting that makes you undiscoverable by name. If that is what you need, tell us at [email protected] and we will handle it directly while we build a real control.

Your public profile link. If you share your fitkind profile link (fitkind.app/u/ followed by your account id), anyone with that link can see your display name, picture and join month without signing in. The page shows the month and year; the underlying request returns the exact date and time your account was created, so treat that as public too. If your account is not private it also shows your current streak, total workouts and follower counts. It never shows workout contents, health data or location. Private accounts show the identity card only. A deleted account's link stops working.

The profile link is anonymous by design — it is what a QR share card points at, so it does not know who is looking. That means blocking someone does not stop them opening your profile link if they have it. Blocking works everywhere that knows who the viewer is: feeds, presence, follows and search.

2.5 Location

Two separate things in fitkind are designed to use location. Neither collects anything today: GPS tracking is behind a switch that is off, and Pulse Nearby does not work at all in the current apps, as set out below.

Pulse Nearby. Start with the state of it: Nearby does not work in the current apps. Neither app obtains a location fix or sends one to us — the iOS code asks for permission and stops there — so no location leaves your device today, whatever you have granted. The description below is how it is designed to work and what it would collect when it is finished, and this policy will be updated before it is switched on.

If you open the Nearby view and grant "while using the app" location permission, your device sends its position to our servers. On arrival the server immediately snaps it to the centre of a grid cell roughly 450 metres across and keeps only that cell — the exact coordinate is used in memory and discarded, never written down. That coarse cell lives in short-lived server memory, not our database: live presence expires in about 90 seconds and a just-finished entry in 60 minutes.

What other members actually receive is coarse but not nothing. They never get coordinates. They do get a distance band whose finest step is "same area, within 1 km", and — in the Nearby map view — a position on a schematic grid derived from your rough direction and distance from them. That is enough to know roughly which way you are and roughly how far, and no more. Location updates are rate-limited to one a minute and updates implying travel faster than 100 km/h are rejected, both to make triangulation harder. The map tries not to draw a group smaller than three people — two in the mutual-follows view — by folding small groups into the nearest occupied ring; where there is no such ring to fold into, a single person can still be placed. The mutual-follows list carries no distance or direction at all.

GPS workout tracking. If GPS tracking is switched on in your app and you record an outdoor session, the route is stored with that workout as a list of individual GPS points, along with distance, pace and elevation. That is precise location data. Deleting the workout in the app removes it from your history but does not erase the stored route — the route is removed when your account is deleted and the erasure job runs. There is no route-only delete today. Routes are never shown to other members.

2.6 Kit AI

Kit works in one of two ways, and which one applies to you determines whether anything leaves your phone.

On your device. On an iPhone with Apple Intelligence available, Kit answers using Apple's on-device model. Your messages and Kit's replies never leave your phone — they are not sent to us or to anyone else, are not stored on our servers, and are not used to train any model. Generating an answer needs no connection at all, and Kit searches the exercise and template data already cached on your phone rather than asking us.

To be precise about the rest of the app: fitkind still talks to our servers for everything around the conversation — your subscription tier, message allowances and any prompts we surface. It is the conversation itself that stays local.

On our servers. On every Android device, and on iPhones without Apple Intelligence, Kit messages are processed by our servers. In that mode we store your message, Kit's reply, and short text summaries of your own recent training — recent workouts, body measurements, daily readiness figures and goals — which are used as context for the answer. We also record which model answered, how many tokens it used and how long it took, to operate quotas and rate limits.

To produce the reply we send your message and those summaries to a third-party inference provider. The summaries are short lines of text, and each carries the underlying figures with it — readiness and Fire Score, sleep minutes, steps, active energy, hydration, measurement values — so treat the numbers as going along with the words. Today those are DeepInfra and Together AI, both in the United States, running Meta Llama models. We send them what is needed to answer you and nothing else, and we require them to process it only for that purpose; what they retain and how they enforce that is governed by their own terms, which we do not restate here as though we had verified them. Which provider answers is an operational setting we can change, including to a different vendor; we will update this policy when the set of vendors changes.

Kit shows you a disclosure before your first conversation, and the apps are meant to hold your first message until you acknowledge it. Treat that as the intent rather than a guarantee: on Android the check can be skipped for a brand-new account whose first conversation has not been created yet, and the message goes through. How often the disclosure comes back depends on your device and which of the two modes above you are in: where Kit runs on your phone, and on Android, your acknowledgement is remembered and you see it once; where an iPhone uses the server path, it reappears each time a new conversation is started on our servers.

One thing to be exact about, since it decides whether your acknowledgement is a real safeguard: the block lives in the apps. Our servers process a message that reaches them whether or not an acknowledgement was recorded first, so the protection is the app's, not the server's.

Please do not put medical details, information about other people, or anything highly sensitive and unrelated to your training into Kit.

2.7 Payments

Apple and Google are the merchants of record for every fitkind subscription. We never see or store card details. When you buy or renew, we check the purchase is genuine — for Google by asking Google Play's servers about it, and for Apple by cryptographically verifying the receipt Apple signed, which reaches Apple's servers only to confirm the signing certificate has not been revoked. We store: your tier, subscription status, product identifier, trial and renewal dates, transaction identifiers, the store environment, and an audit record of the verification. We hash store purchase tokens rather than keeping them in the clear, with one exception we would rather name than gloss: when Google sends us a purchase notification that carries no order identifier, the purchase token itself is stored as the transaction reference. No card number ever reaches us in any case.

2.8 Usage, diagnostics and logs

We collect less here than most apps, and we would rather say so precisely than generally.

No third-party analytics or advertising SDK is present in either mobile app. There is no PostHog, Amplitude, Segment, Firebase Analytics or advertising library in the shipped code.
No crash reports are uploaded. Diagnostic events are written to a small local buffer on your own device and stay there. No crash-reporting service is connected.
First-party product events. The apps and the website report a small, fixed set of events to our own database: opening the app, and the events around a workout share card — viewing one, sharing one, tapping its download link, and being handed off to the App Store or Google Play from one. That last event is called install attribution internally, but what it records is the hand-off to the store, not a confirmed installation; we cannot see whether you went on to install anything. There are no other event types. Each event carries the platform and where in the app it came from, and the share-card events carry the identifier of the workout the card was made from and the card's attribution link, so a workout is referenced in them. Depending on the sender it may also carry an install or session identifier and, where you are signed in, your user id.
Share-card attribution on the website. If you arrive at fitkind.app from a workout share card, we create an identifier in your browser's storage and use it to link that visit to an install if you then download the app. Clearing your browser storage resets the identifier on your side, but the matching record on our servers is not attached to any account, has no expiry and is not removed by deleting a fitkind account — so treat those records as kept indefinitely until we set a schedule for them.
Audit log. We keep an audit trail of administrative and safety actions: what an administrator did, moderation decisions, media review outcomes and the erasure job's own work, each with the actor, the target and a timestamp. Ordinary account actions such as your sign-ins, exports and your own account deletion are not written to that trail today.
Server logs and rate limiting. Our servers keep standard request and error logs, and apply a per-IP request limit. We do not store IP addresses in the product database.
Website. fitkind.app uses Plausible, a cookieless analytics service, to count page views and referrers. It sets no cookies and does not follow you across sites, and it is not loaded at all on this page or the Terms page. The site stores your theme choice in your browser's local storage. It sets no cookies of any kind.
Beta page visits. Opening our beta page records a visit before you fill anything in: a randomly generated visitor identifier held in your browser, the page you landed on, the referring site, and any campaign parameters in the link you followed. It carries no name or email address, and it is how we tell which campaigns bring people to the page. We have not yet set a deletion schedule for these visit records, so treat them as kept until we do — clearing your browser storage for fitkind.app resets the identifier at your end.
Waiting list. If you then sign up, we store your email address, your answers, and — attached to that email address — where the signup came from: the page you were on, the site that referred you, and the campaign parameters from your link. The signup is stored separately from the visit record above; the two are not joined by any identifier, though both carry the same campaign details.

2.9 Notifications

Two different things are called notifications here, and only one of them involves us at all.

Rest-timer alerts are local to your phone. When a rest timer is running, the app schedules a notification on your own device so it can tell you the rest is over. The first time it does this your phone asks for notification permission. That alert is created and delivered entirely by your phone — it never reaches our servers and we do not know whether it fired.

We send no push notifications, and collect no push token. The apps contain the code for server-sent push, but nothing triggers registration on iPhone and the Android build has no push messaging component at all, so no device token is created or sent to us. If push is ever switched on, a device token will be collected and we will update this policy first.

What we generate for you is recorded for an in-app inbox instead — and the inbox screen is itself behind a switch that is currently off, so nothing is shown to you today. The records are generated and stored all the same, and appear when the inbox is switched on. Most of it is your own — a personal record, a badge, a streak milestone. Where community features are in use it also includes things other members do that involve you, such as someone cheering your workout.

3. Why we process your data, and our lawful basis

Under UK GDPR:

Purpose	Lawful basis
Creating and running your account, storing your training data, syncing it to your devices, providing subscriptions	Performance of a contract
Reading Apple Health or Health Connect, recording GPS routes, and Nearby presence if it is ever switched on	Consent — given at your device's permission prompt and withdrawable in your device settings
Writing items to your in-app inbox	Performance of a contract — it is part of the app. No notification permission is requested, because nothing is pushed to your device
Processing Kit messages on our servers	Consent — you choose to open Kit and send a message, having been shown the AI disclosure
Keeping the Service secure, preventing fraud and abuse, debugging, measuring reliability, moderating the community	Legitimate interests, balanced against your rights
Keeping transaction and tax records, responding to lawful requests	Legal obligation

Health-platform data, and anything else that reveals your physical health, is special-category data. We rely on your explicit consent for it.

4. Who we share data with

Other members, only as described in section 2.4 and only within your visibility settings. Health-platform data, GPS routes, your notes and your body measurements are never shown to another member. Individual sets and weights are not shown either, with one exception you control: a Moment you choose to share shows the top sets of that workout, with the weights and reps.
Our infrastructure providers: database, cache, object storage for uploaded media (Cloudflare R2), search indexing, and email delivery for sign-in links.
Our own internal operations tooling, where connected, which can receive account, subscription and moderation events including your email address, for running the business rather than for any purpose of its own.
Google Firebase Remote Config, which both apps contact at launch to find out the minimum supported app version. That request carries no account data, but it does tell Google's service that a fitkind app started, from your device's network address.
AI inference providers — currently DeepInfra and Together AI — which receive your Kit message and training-context summaries, health-derived figures included, when Kit runs on our servers. We send them that data for the purpose of generating your reply.
Apple and Google, for purchases, subscription status, refunds and fraud prevention — and, on Android, through the operating system's own backup. The Android app allows Google cloud backup and device-to-device transfer, and excludes only your credentials, onboarding state, active workout and the completed-workout outbox from it. Other on-device data — including the GPS outbox, Kit chat and the cached copy of your account data — is not excluded, so a copy can reach your Google account's backup and move to a new phone with it. The iPhone app excludes its GPS outbox from iCloud backup; Android has no equivalent exclusion today.
Professional advisers, regulators, law enforcement or courts, where the law requires it or where it is necessary to protect someone's rights or safety.
A successor, if fitkind is acquired, merged or reorganised.

We do not sell personal data, and we do not share it with advertising networks or data brokers.

5. International transfers

Our AI inference providers operate from the United States, so Kit messages processed on our servers are transferred there. Where personal data goes outside the UK or EEA, our position is that a transfer must be covered by an adequacy decision or standard contractual clauses, and we will name the mechanism here for each recipient once that paperwork is settled rather than assert it in advance.

6. How long we keep data

While your account is open we keep your data so the Service works: your training history is the product.

Some things are short-lived by design:

Pulse presence expires in about 90 seconds, a just-finished entry in 60 minutes, and neither is written to our database.
Sign-in link tokens expire and are deleted when your account closes.

When you delete your account, in the same moment:

Your email address is replaced with an unusable tombstone address, and your name, picture, date of birth, height, weight and goal are erased.
Every active session is revoked and every pending sign-in link is deleted.
Your Apple or Google sign-in link is deleted, so the account cannot be reopened. Signing up again with the same address creates a brand-new, empty account.
You disappear from other members' feeds, presence views, follower counts and from your public profile link.
Your website waiting-list record for that address is deleted.

After that, a job runs daily and, once 30 days have passed, erases the rest: your uploaded media and the objects behind them, workouts and every set, body measurements, health imports and daily readiness records, goals, hydration, wellness sessions, Kit chat history and context summaries, community records (follows, Moments, cheers and blocks), preferences, badges, challenges, entitlements and device tokens.

Some things are deliberately kept beyond that point:

The account record itself. The row is never deleted; it is emptied of the things that identify you — name, real email address, profile picture, date of birth, height, weight and goal are all cleared. What stays is the rest of the row: your account's internal identifier, a tombstone email address that can never receive mail, your subscription tier, moderation state and history, account flags, administrative and privacy settings, and the created and deleted timestamps. We describe that as emptied rather than anonymous on purpose — the internal identifier still ties the row to the purchase, audit and appeal records kept below, so it is a pseudonymous record, not an anonymous one.
Purchase transactions, for tax, accounting and payment-dispute purposes.
Audit entries, as a compliance record.
Moderation appeals, as safety and legal evidence. The applicant's email address in them is replaced with the tombstone address.
Moderation reports and the actions taken on them, kept as trust-and-safety evidence — including reports you filed and reports about you. The account they refer to is the emptied record above.
Shared squad-pact records. Your own membership row is erased, but the pact itself and its weekly history are shared with the other members and are kept; the references to you in them point at the emptied account.

Two details of how the job handles failure are worth knowing, because they are the difference between a promise and a mechanism. The job is deliberately fail-closed: if any part of an account's erasure fails it does not mark the account erased, and it retries on the next daily run rather than report a deletion that left data behind. And when it erases your uploaded media, our record of a file is removed only after the stored file itself is confirmed deleted — if the storage deletion fails, the record stays so the next run retries the same file rather than losing track of it. The job's coverage is tested against the database schema itself, so a record type added to the product later cannot silently escape it.

If you want to know exactly what the job erased for your own deleted account, email [email protected] and we will check it and tell you.

7. Your rights

If you are in the UK or EEA you have the right to access your data, correct it, have it erased, restrict or object to how we use it, receive it in a portable form, and withdraw consent at any time. You can complain to the Information Commissioner's Office (ico.org.uk). Rights of access, deletion and portability are also available to residents of several US states.

In the app:

Export. Produces a JSON file you can save or share. It contains your profile, your display and notification preferences — but not your privacy settings or your workout-logging preferences — workouts with full exercise and set detail, body measurements, goals, personal records, hydration, badges, challenges, entitlements, progress photos, your daily wellness aggregates (sleep, steps, active energy, and the Fire, sleep and stress scores, though not the readiness score), health import logs and queued sync records. The file is capped and says so: it carries its own limits block naming all three caps — 5,000 records per collection, 100 exercise entries per workout, 1,000 sync records — and flags which collections were cut short. Sync records are listed without their stored payload, and their cap is the one case the file does not flag.

Two things about progress photos and your picture: the export lists the details of each progress photo — the pose, the date, the measurements you attached — but not the image files themselves, and it does not include your profile picture. Ask us and we will send you the files.

The export also does not currently include Kit chat history, community records (follows, Moments, cheers, blocks), squad pacts, pacts, wellness sessions, training-plan enrolments, notification history, the stress and training-load series, the workout templates, custom exercises, equipment setups and credentials you have created, your purchase transaction records, the product events described in section 2.8, audit entries about your account, any moderation reports and decisions involving you, your streaks, momentum score and the per-day momentum history with its change reasons, the Kit context summaries described in section 2.6, or the AI usage records we keep for quotas and costs. Ask us at [email protected] for any of it and we will supply it.
Delete account. Does everything described in section 6.
Health and location permissions are revoked in your device settings, not in FitKind.
Block and report other members from their profile.

Deleting fitkind data does not delete anything in Apple Health, Health Connect, or your Apple or Google account. On your own device, signing out clears your active credentials and the app's cached copy of your account data. It does not clear everything, on either platform. On Android the app also keeps a short list of your previous access tokens so it can recognise a stale session, and that list sits in a preferences file our backup rules do not exclude, so it is eligible for Google backup along with the data described in section 4. An unfinished workout draft, your recent Kit chat, and the local outbox of completed workouts — including their notes and sets — survive a sign-out on both iPhone and Android, and the outbox entries can surface for the next account that signs in on that device. A second outbox holds outdoor sessions waiting to upload, with their precise GPS routes, and is not cleared either; if it retries after someone else has signed in, an old route can be uploaded under that account.

Deleting the app removes the app's own files from that device, and it is what we would do before handing a phone to anyone else — but it is not a guaranteed wipe on either platform, and we would rather say so than let you assume it is.

On iPhone, credentials are held in the system keychain. Signing out deletes them; deleting the app without signing out first does not reliably remove them, because iOS can keep keychain items through an uninstall and hand them back on reinstall. Sign out before you delete the app.

On Android, as described in section 4, parts of the app's data are eligible for Google's own backup, so a copy can remain in your Google account and be restored onto a new device. Manage that from your Google account's backup settings.

To exercise a right we cannot serve in the app, email [email protected]. UK GDPR gives us one month to respond, extendable in limited circumstances, and we aim to answer well inside it.

8. Security

We would rather list the specific measures than make a general claim. Session refresh tokens are stored only as a hash, so a database read yields no usable credential. Store purchase tokens are hashed, subject to the one exception named in section 2.7. AI provider API keys are stored encrypted. Requests are rate-limited and sign-in links lock out after repeated failed attempts. Administrative and safety actions are written to an audit log — see section 2.8 for what that trail does and does not cover. Media that fails a safety review is made inaccessible.

No system is perfectly secure and we do not claim otherwise. If we discover a breach affecting your personal data we will notify you and the ICO as the law requires.

9. Age

fitkind is for adults. You must be 18 or over to use it, and our Community Guidelines and Child Safety Policy set the same standard.

Be precise about how the check works, because the order matters. Entering your email address creates the account record and signs you in. The date-of-birth question comes next, during onboarding, and a date making you under 18 is refused there — you cannot complete your profile or use the app. The account row and the email address created a moment earlier are not removed at that point.

And the check reads the date you declare. We do not verify it against a document or an age-assurance service, so it stops an honest under-18 signup and not a dishonest one. Reporting and moderation after registration are what address the rest.

We do not want data from anyone under 18, and we do not knowingly keep it. The honest qualification is the one above: because the account is created before the age question is asked, a refused under-18 sign-up leaves an account record and an email address behind. That is not by design and it is being fixed. In the meantime, if you believe someone under 18 has an account or has left a record this way, email [email protected] and we will delete it.

10. Changes

We will update this policy as the Service changes, and we will change it before a new collection or a new recipient goes live, not after. Material changes will be notified in the app or by email. The "last modified" date at the top always reflects the current version.

11. Contact

[email protected] for anything in this policy, including a rights request or a question about what we hold on you.

Questions about this policy? Email [email protected]