Privacy Policy

Fitviyo is built privacy-first. Fitviyo and fitviyo.com are operated by Muharremcan Polat (“Fitviyo”, “we”). This policy explains what we collect on this website and in the Fitviyo app, how we use it, who we share it with, and the choices you have. If you have any questions, email us at hello@fitviyo.com.

The short version

• No sign-up required. Fitviyo works from first launch with a private anonymous account, so your data syncs securely from day one without you telling us anything about yourself.
• Signing in is optional. You only sign in (with Apple or Google) if you want to keep your data across devices, publish to the community, or save community workouts.
• We do not sell your data, we do not run ads, and we do not use ad-tracking SDKs.
• Analytics are anonymous and contain no personal identifiers.

Information we collect

Website waitlist

When you join the waitlist, we collect your email address. We use it only to tell you about early access and launch. We store it with our infrastructure provider (Supabase) and send email through Resend. We use Cloudflare Turnstile to block bots, which may process limited technical data such as your IP address to verify that you are human.

Your account

The app creates an anonymous account (a random identifier) on first launch so your data can sync. If you choose to sign in, we use Sign in with Apple or Google. We receive a unique identifier and, depending on the provider and your choices, an email address. Apple's “Hide My Email” is fully supported. We do not use email and password sign-in.

Profile and fitness data

To make the app work, you may provide profile details (such as display name, goal, experience level, training days, equipment, units, birth year, sex, height, starting weight, and activity level) and the data you log: workouts and sets, food entries, water, steps, walks and runs, and weight. Some of this is health and fitness information, which we treat with extra care. It is stored under your account (anonymous or signed-in) with row-level security, so only you can access it.

Apple Health (iOS)

If you grant permission, Fitviyo reads step data from Apple Health to show it alongside your training. We only access what you allow, and you can revoke this at any time in your device settings. Data obtained from Apple Health is never sold, never shared with third parties for advertising, marketing, or data-mining purposes, and is used only to show your own activity in the app.

Health Connect (Android)

If you grant permission, Fitviyo reads three types of data from Health Connect, read-only: your daily step count, your walking and running distance, and the duration of your exercise sessions. Fitviyo never writes any data back to Health Connect.

We read this data for one purpose: to show your daily movement toward your step goal on the Today screen and to calculate your step streak.

What leaves your device: your daily step total is stored under your account on our servers so your progress syncs across your devices and survives reinstalling the app. Distance and exercise duration are shown on your device only and are never sent to our servers. Your step history is read on the device to calculate your streak and is not stored by us.

Data obtained from Health Connect is never used for advertising or marketing, never sold, and never shared or transferred to data brokers, information resellers, or any other third party. It is never used for any purpose other than the features described above.

You can revoke Fitviyo's access at any time in Health Connect → App permissions; revoking stops all reading immediately. Step totals already saved to your account remain until you delete them, and deleting your Fitviyo account removes them along with the rest of your data.

Subscriptions

If you subscribe to Fitviyo Pro, purchases are handled by the App Store on iOS or Google Play on Android, and managed through RevenueCat. We receive your subscription status (for example, whether Pro is active and when it renews), not your full payment details, which stay with Apple or Google.

Push notifications

If you opt in, we use OneSignal to send reminders and updates. This involves a device push token and your account identifier, used only to deliver the notifications you asked for. You can turn notifications off at any time in your device settings.

Analytics and diagnostics

We use privacy-friendly, anonymous analytics (Aptabase for the app and Vercel Analytics for the website) to understand aggregate usage, such as which features are used and whether the waitlist form was submitted. These measurements are not linked to your account, contain no personal identifiers, and are not used to profile you. We use no advertising or cross-app tracking SDKs.

How we use information

• To provide the app: logging, sync, community, and progress views.
• To look up foods you search (see Food data below).
• To power optional AI features (workout import, meal logging, and weekly insight) when you use them (see AI features below).
• To manage your Fitviyo Pro subscription and unlock Pro features.
• To send notifications you have opted into.
• To keep the service secure and to fix and improve it.
• To tell waitlist members about early access and launch.

Food data

Food search and barcode lookups are powered by the FatSecret Platform API. Your searches are sent through our secure server to FatSecret to return nutrition results; your identity is not. Fitviyo displays a “Powered by fatsecret” attribution where required.

AI features

Fitviyo Pro includes optional AI features: turning a training program you paste or describe into structured workouts, estimating calories and macros from a meal you describe in your own words, and a weekly insight that summarizes your own activity. When you use these, the text you provide or a compact summary of your recent training, nutrition, water, and steps is sent through our secure server to Google's Gemini API to generate the result, and is returned to you in the app. This data is processed to produce your result and is handled under Google's API terms; we do not use it to build a profile of you or to serve ads. AI features run only when you choose to use them.

Legal bases (GDPR)

Where the GDPR applies, we rely on: your consent (for waitlist email, push notifications, Apple Health or Health Connect access, and AI features); performance of a contract (to provide your account and subscription); and our legitimate interests (to keep the service secure and to improve it using anonymous analytics).

Who we share data with

We share data only with the service providers that make Fitviyo work, and only as needed to provide the service:

• Supabase: database, authentication, and storage.
• RevenueCat, the App Store, and Google Play: subscription management and billing.
• OneSignal: push notification delivery.
• FatSecret: food and nutrition lookups.
• Apple and Google: sign-in.
• Google (Gemini API): generating results for the optional AI features, only when you use them.
• Aptabase and Vercel: anonymous analytics and website hosting.
• Resend and Cloudflare: email delivery and bot protection for the website.

We do not sell your personal information, and we do not share it for advertising. When you publish a workout to the community, we show only safe details: the workout name, its exercises, your first name, and counts. We never expose your email to other users.

Data retention

We keep your waitlist email until launch and for a reasonable period after, or until you ask us to remove it. Account and fitness data is kept until you delete your account, after which it is removed from our systems. Stale anonymous accounts that were never signed in are periodically deleted automatically.

Security

Every user table is protected by row-level security so that only the owner can read or write their rows. Data is encrypted in transit, authentication tokens are stored in the device's secure storage (iOS Keychain, Android Keystore), and privileged keys are held only on our servers, never in the app. No system is perfectly secure, but we work to protect your data using industry practices.

Your rights and choices

• Access and export: use “Export my data” in the app settings for an instant copy of everything (JSON), or email us.
• Delete: delete your account in the app (You → Settings → Delete account) to permanently erase your account and data, or email us and we will do it.
• Unsubscribe: opt out of waitlist email at any time.
• Withdraw consent: turn off notifications in your device settings, Apple Health access in iOS settings, or Health Connect access in Health Connect → App permissions.

Depending on where you live, you may have additional rights under the GDPR, UK GDPR, or CCPA, including access, correction, deletion, and the right not to be discriminated against for exercising them. To make a request, email hello@fitviyo.com.

Children

Fitviyo is not directed to children under 13 (or the minimum age in your country), and we do not knowingly collect their data. If you believe a child has provided us information, contact us and we will remove it.

International transfers

Fitviyo serves a US audience, and your data may be processed in the United States and other countries where our providers operate. Where required, we use appropriate safeguards for these transfers.

Changes

We may update this policy as Fitviyo evolves. We will revise the “last updated” date above when we do, and we encourage you to review it periodically.