FitFlow privacy policy

Effective date: 1 November 2026

FitFlow is a training-plan app for runners, cyclists, swimmers and triathletes. This page says what information the app handles, where it goes and what you can do about it.

The short version

• Your plan, sessions, gear and check-ins live on your phone first. The app works without an account.
• If you sign in, those items are also copied to our server so you can keep them if you change phone.
• We do not sell your data, show ads, or use analytics or tracking tools.
• We never keep a history of where you have been.
• The AI coach only sees a small summary, and only if you switch it on.

What stays on your device

Everything you enter or import is stored on your phone in a local database (SQLite): your profile (sports, goal, units, availability), your training plan and sessions, results you log, gear and its usage, daily check-ins (sleep, soreness, energy, pain, optional note), reminders settings, and the files you import (for example .fit files, read on the phone to create a session result). Without signing in, none of this leaves your phone, except the place search described under Location.

What is sent to our server, and why

Only if you sign in. We use Supabase (a hosted database and sign-in service) to store a copy of:

• your profile settings, plan versions and sessions, including logged results and notes you wrote
• your gear and how much each item has been used
• your daily check-ins, including any note you typed
• your consent choices (location, health and device data, AI coach) and when you changed them
• your email address (for sign-in) and a count of AI coach messages per day (to enforce the limit)

Why: to keep your data if you change or lose your phone, and to run the weather and coach features. Each account can only read and write its own rows (row-level security in the database).

Account and training data is stored on servers in Seoul, South Korea, operated by Supabase. Questions you send to the AI coach are processed by Anthropic, which may process them outside your country.

Sign-in email

You sign in with your email address and a one-time code. Sending the code goes through an email relay service (Brevo SMTP), which therefore sees your email address and the code email. We do not use your email for marketing.

Location

• The app asks for location permission only when you tap "Use my location", and only while the app is open ("when in use"). There is no background location.
• When you are signed in and have switched on the Location consent, the app uses the place of a planned session to get a weather forecast. Coordinates are rounded (about 1 km) and sent to our weather function, which asks Open-Meteo for the forecast. We do not store coordinates on the server, and we do not keep a history of your locations.
• If you search for a place by name, the name you type is sent to Open-Meteo's place search.
• Weather data by Open-Meteo.com (licence CC BY 4.0).

AI coach

The coach is optional and works only after you switch on "Send data to the AI coach" and sign in. When you ask it a question, the app sends your question (up to 500 characters) plus a small summary to Anthropic (the AI provider) through our server: this week's sessions (sport, day, time, duration, status), your units, and your latest check-in scores (soreness, energy, sleep, pain yes/no). Your name, email, location and free-text notes are not included. Anthropic processes the request to produce the reply; Anthropic's own terms apply to that processing; see Anthropic's privacy policy. Each user can send at most 30 coach messages per day. The coach explains and suggests; it changes your plan only when you confirm. You can switch the consent off at any time.

Notifications

The app can send local reminders (for example for sessions and gear). They are scheduled on your phone; no notification service receives your content. You can turn them off in the app or in system settings.

No analytics, no ads, no selling

The app contains no analytics, advertising or tracking software, and we do not sell or rent your data.

How long we keep data

Your data stays on the server while your account exists, so you can restore it on a new phone. When you delete your account, your data is removed from our live database straight away. Copies in the provider's backups, if any, are removed when those backups expire. Local data on your phone stays until you delete it or uninstall the app.

Your choices

• Export: Account > Export my data gives you a copy of your synced data.
• Delete: Account > Delete my account permanently deletes your account and all server data (plans, sessions, gear, check-ins, consents). Data on your phone is not touched; remove it by uninstalling the app.
• Consents: switch location, health and device data, or AI coach off in Account at any time.
• Questions or complaints: write to the contact address below; we aim to reply within 14 days.
• Contact: for any other request, write to fitnesslab821@gmail.com.

Health information

FitFlow handles fitness and wellbeing information, which can be sensitive. It is a training tool, not a medical device, and nothing in it is medical advice. If you have pain, illness or a health concern, rest and talk to a qualified professional. Check your local rules on health data if they apply to you. Do not enter anything in free-text notes that you would not want stored on your phone and, if you sign in, on our server.

Children

FitFlow is intended for people aged 18 and over, and we do not knowingly collect data from people under 18.

Changes

If this policy changes in a way that matters, the effective date at the top will change. Older versions are not kept here.

Who is responsible

Ahmed Isa Alghatam, Dubai, United Arab Emirates. Contact: fitnesslab821@gmail.com.