Privacy Policy

Fit is operated by Tobias Schaathun (Norway), acting as an individual rather than through a registered company. For the purposes of the EU/EEA General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act, Tobias Schaathun is the data controller for the personal data described below.

Contact for any privacy question, request, or concern: tobias@schaathun.it.

Depending on how you use Fit, we process:

• Account data — email, display name, password (hashed by our authentication provider, never stored in plain text by us).
• Fitness & nutrition data — workouts, sets, weight entries, meals, and the nutrition/micronutrient values you log. This is health-related information (see below).
• Content you post — forum posts, private messages, and any photos you upload (workout photos, avatars, meal-label photos used for auto-fill).
• Push notification subscriptions — if you opt in, a browser-issued subscription endpoint used solely to deliver notifications you asked for.
• Technical data — standard web server logs (IP address, timestamps) generated by our hosting infrastructure for security and abuse prevention.

Workout and nutrition data qualifies as health-related information under GDPR Article 9 ("special category data"). We only process it on the basis of your explicit consent, which you give by checking the dedicated consent box at registration — separate from simply agreeing to these Terms. You can withdraw this consent at any time by deleting your account (see Settings), which permanently erases this data.

• To provide the core service — storing and displaying the workouts, meals, and messages you log (performance of a contract, i.e. these Terms).
• To operate the forum, people directory, and messaging features you choose to use (contract / legitimate interest in running a functioning social feature).
• To send push notifications you explicitly opted into (consent).
• To keep the service secure and prevent abuse (legitimate interest).
• To process fitness/nutrition data specifically — your explicit consent, as above.

We use a small number of infrastructure and data providers, each only for what's needed to run the feature it supports:

• Supabase — our database, authentication, and file storage provider. Your account data, logs, and uploaded files are stored there.
• DigitalOcean — hosts the server that runs Fit.
• USDA FoodData Central & Open Food Facts — public nutrition databases we query when you search for a food by name or scan a barcode. Only the search term or barcode is sent — never your account or personal details.

We do not sell your data, and we do not share it with advertisers — Fit doesn't run ads or trackers.

Our infrastructure providers may process data outside the country you're in, including outside the EU/EEA. Where that happens, it relies on the provider's own GDPR-compliant transfer mechanism (typically the EU Standard Contractual Clauses). Contact us if you'd like more detail on a specific provider.

We keep your data for as long as your account exists. If you delete your account (Settings → Danger zone), your data is permanently deleted — see that page for the one exception (forum threads you started are removed along with any replies others left in them, since we don't currently support anonymizing them instead).

Under GDPR (and the Norwegian Personal Data Act), you have the right to:

• Access the personal data we hold about you (Settings → Download my data gives you this instantly, in full).
• Correct inaccurate data (edit it directly in the app, or contact us).
• Erase your data (Settings → Delete account).
• Receive your data in a portable format (the same data-export feature).
• Object to or restrict certain processing, and withdraw consent at any time.
• Lodge a complaint with your local data protection authority — in Norway, Datatilsynet.

If you're a resident of Washington State, the Washington My Health My Data Act separately gives you the right to access, delete, and withdraw consent for "consumer health data" (which includes fitness and wellness data like the workouts and meals you log here) — the rights above cover this in the same way. We do not sell consumer health data and do not share it for advertising purposes.

If you're a California resident, similar access/deletion rights apply under the CCPA/CPRA — again, covered by the same rights above. Fit does not sell personal information.

Fit uses one strictly-necessary cookie to keep you signed in — this is required for the service to function and isn't a tracking or advertising cookie, so it doesn't require consent under EU/Norwegian cookie rules. We also use your browser's local storage to remember small UI preferences (like which "add food" tab you used last) — this stays on your device and is never sent anywhere. We do not currently run any usage analytics or tracking tool.

Fit is not directed at, and may not be used by, anyone under 16 years old. We don't knowingly collect data from children under 16 — if you believe a child has created an account, contact us and we'll delete it.

Fit is a personal fitness/nutrition tracker, not a medical or healthcare product — it is not covered by HIPAA (the US health-privacy law that applies to healthcare providers, insurers, and clearinghouses), since we're none of those things. If Fit is ever breached in a way that exposes your data, we'll notify you in line with applicable law, including the FTC Health Breach Notification Rule where relevant.

If we make material changes to this policy, we'll update the date at the top and, where the change is significant, ask you to re-consent.

Questions, requests, or complaints: tobias@schaathun.it.