Privacy Policy

Last updated: July 8, 2026

This privacy policy describes how Fitlas ("we", "our", "the app") collects, uses, and protects your information when you use our mobile application.

Information We Collect

• Account information: Email address, display name, and username when you create an account.
• Workout data: Exercises, sets, reps, weights, and workout duration you log.
• Nutrition data: Meals, food items, and macro totals you log.
• Social data: Friend connections, feed posts, likes, and comments.
• Device information: Push notification tokens for delivering notifications you opt into.

Website Waitlist

If you join the waitlist on our website, we collect your email address only. We use it solely to notify you about early access (TestFlight) and the app's launch, based on your consent. We do not share waitlist emails with anyone, and we do not use them for any other marketing. You can be removed at any time by emailing us at the contact address below, and the waitlist is deleted after launch notifications are complete.

How We Use Your Information

• To provide and personalize the app experience (progress tracking, streaks, insights).
• To enable social features (feed, likes, comments) visible only to your friends.
• To send notifications you've opted into (streak reminders, social activity).
• To improve the app through aggregated, anonymized usage patterns.

Data Storage & Security

Your data is stored securely on Supabase (hosted on AWS) with row-level security policies ensuring you can only access your own data. All data is transmitted over HTTPS. We do not sell your data to third parties.

Data Sharing

• Workout and meal posts you share to the feed are visible to your friends.
• Your profile (display name, username) is visible to other users during friend search.
• We do not share your data with advertisers or third-party data brokers.

Your Rights

• Access: You can view all your data within the app.
• Deletion: You can permanently delete your account and all associated data from Settings → Danger Zone → Delete Account. Deletion is immediate and irreversible. All workout data, nutrition logs, social connections, posts, comments, and profile information are permanently erased from our servers.
• Export: Contact us to request a data export.
• Block & Report: You can block any user to prevent them from seeing your content or contacting you. You can report posts, comments, or users for violating community standards.

Third-Party Services

• Supabase: Database and authentication (their privacy policy).
• Expo: Push notification delivery (their privacy policy).
• Apple Sign In: Authentication (if used).

Children's Privacy

The app is not intended for children under 13. We do not knowingly collect data from children.

Changes to This Policy

We may update this policy from time to time. Changes will be posted in the app and on this page with an updated date.

Data Retention

We retain your data for as long as your account is active. If you delete your account, all personal data is permanently erased within 24 hours. Aggregated, anonymized usage statistics (which cannot identify you) may be retained indefinitely for app improvement purposes.

Legal Basis for Processing (GDPR)

We process your data based on:

• Contract performance: To provide the app services you signed up for (account, tracking, social features).
• Legitimate interest: To improve the app, prevent abuse, and ensure security.
• Consent: For optional features like push notifications and social feed sharing, which you can opt out of at any time.

Contact

If you have questions about this privacy policy, contact us at: lauri.nuva@gmail.com