Privacy Policy

Effective date: October 2, 2026 · Last reviewed: October 16, 2026

1. What we collect

Account data

• Name and email address, used to create and sign in to your account.
• Your password is never stored in plain text — only a one-way hash.
• App usage counters tied to your account: AI scan/workout-generation quotas, points, streak days, and last-activity date, used to run the app's tier limits and gamification features.

Health & fitness data

If you fill in your profile, we store:

• Gender, date of birth, height, and weight (current and target).
• Fitness level, activity level, workout days/duration preferences, and your stated goals.
• Dietary preferences and allergies.
• Approximate location (latitude/longitude, city, country) if you use gym-finder features — this is only stored when the app requests and you grant location access.
• Your logged workouts, exercises, personal records, streaks, logged meals, and daily nutrition summaries (calories and macros).

On Android, if you choose to connect Health Connect in Settings, the app asks for your permission and then reads your step count and body weight, and writes workouts, hydration, nutrition and calories burned that you log in FitLab. You can turn this off at any time in the app or in Health Connect settings. This data stays on your device or in your own account to power your progress and plans; we do not use it for advertising and do not share it with third parties.

This is health-adjacent information. We treat it as sensitive: it is used only to run the app's core features (personalized plans, tracking, progress charts) and, in aggregate/de-identified form, to improve the accuracy of equipment and food recognition. We do not sell it (see Sharing below).

2. Photos & videos you submit

When you scan gym equipment or a meal, or use the AI form-checker, the photo or video you take is uploaded and stored in our cloud storage (Amazon S3). Form-check videos are processed into still keyframes before analysis. These files are used to run the scan/analysis you asked for and may be cached briefly to avoid re-processing an identical file. They are not made public and are not used to train third-party AI models beyond the single request being served, to the extent the providers named below allow.

3. Third-party AI processing

4. Push notifications

If you enable notifications, we store a Firebase Cloud Messaging (FCM) device token on your account so we can send you reminders and updates (e.g. streak reminders). Message delivery uses Google's Firebase Cloud Messaging infrastructure. You can disable notifications in your device settings at any time.

5. Crash & diagnostic reports

When the app hits an unhandled error, it automatically sends a report containing the error message, stack trace, app version, platform (Android/iOS/web), and, if you were signed in, your account ID. This is used purely to find and fix bugs — it is relayed to a Telegram channel operated by the developer and is also kept in server logs for a limited period. It is not linked to your health/fitness data beyond the account ID.

6. Payments & subscriptions

Paid subscriptions are bought on our website, where they are processed by LemonSqueezy (the merchant of record), or, in the Android app, through Google Play, which handles that payment and its receipts. We receive from Google Play only the purchase token, product, status and renewal dates needed to unlock your plan. LemonSqueezy handles your payment details directly — we never see or store your full card number. We keep only what is needed to manage your subscription: the LemonSqueezy customer/order/subscription IDs, your plan tier, billing status and renewal dates, and (from LemonSqueezy's webhook) the card brand and last four digits, for display purposes like "Visa ···· 4242".

7. Sharing, and we do not sell your data

We do not sell your personal data. We share data only with:

• The AI providers named in section 3, to generate the results you request.
• LemonSqueezy, to process payments you initiate.
• Google (Firebase Cloud Messaging), to deliver push notifications you opted into.
• Infrastructure providers (Amazon Web Services for storage/hosting) that process data on our behalf under contract, not for their own purposes.
• Gyms and advertisers see only aggregated or anonymized signals (e.g. how many scans happened at a piece of equipment) for the marketplace features of the app — never your name, contact details, or raw health data, unless a specific feature says otherwise at the point you use it.
• Law enforcement or regulators, only if we are legally required to.

8. Data retention & deletion

We keep your data for as long as your account is active, plus a limited period afterward for backups, fraud prevention, and legal/accounting requirements (e.g. completed transaction records).

You can delete your account and its associated data in two ways:

• In the app: Settings → Delete Account.
• Without the app: use our account deletion request page, which works without installing the app.

When you delete your account, deletion is immediate and permanent. Your account row and the records keyed to it are erased from our production database in a single operation, and your uploaded scan photos and form-check videos are removed from our file storage. There is no grace period and no recovery window — we cannot restore a deleted account.

Two things deliberately survive, because removing them would damage other users' data:

• Content you shared with others is anonymised, not deleted. A public or template workout program you authored, and any entries you added to the shared food database, remain available with your authorship removed, so other users who saved or rely on them are not affected.
• Records we must retain by law for tax, accounting or fraud-prevention purposes — for example completed order records held by LemonSqueezy as merchant of record, under their own retention rules.

9. Security

We use industry-standard measures (encrypted connections, hashed passwords, access-controlled cloud storage) to protect your data. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

10. Your choices

• You can view and edit most profile data from within the app (Settings).
• You can request a copy of your data or ask us questions about this policy using the contact below.
• You can delete your account at any time (see section 8).
• You can revoke device permissions (camera, location, notifications) at any time in your device's OS settings; doing so will limit the features that depend on them.

We do not currently make region-specific legal guarantees (for example, formal GDPR or CCPA compliance certifications) beyond the practices described in this policy — if you are in a jurisdiction with specific data-protection rights, contact us and we will do our best to accommodate your request.

11. Children

FitLab AI is not directed at children and is not intended for use by anyone under 16. We do not knowingly collect data from children under 16; if you believe a child has provided us data, contact us and we will remove it.

12. Changes to this policy

We may update this policy as the app changes. Material changes will update the "Last reviewed" date above; continued use of the app after a change means you accept the updated policy.

13. Contact

Questions about this policy or your data: [email protected].