Privacy policy

What data we process

• account: name, email, account identifier, security sessions and accepted legal-document records;
• service use: workout plans and history, personal records, body weight, goal, favourite gyms and active-workout draft;
• directory: public gym data you publish and contact details you choose to display;
• billing: Paddle customer identifiers, transactions and subscriptions, selected plan, status and validity period. Fitapio does not store full card details;
• technical data required for security, abuse prevention and error diagnosis.

Why and on what basis

We process account data and features to perform the contract; security, abuse prevention and basic billing records are based on legitimate interest and legal obligations. We process body-weight and workout data you enter on the basis of explicit consent. Withdrawal does not affect the lawfulness of earlier processing, but the related features cannot work without those data.

AI coach

The AI coach is an optional Pro feature. Before the first request, we show the exact data categories and provider and ask for separate consent. A request contains only the data needed for the selected feature. You can withdraw consent in settings, which deletes AI coach jobs from Fitapio servers.

Recipients and transfers

Supabase provides the database, authentication and storage. Paddle is the merchant you buy the subscription from (Merchant of Record) and independently processes payment, taxes, invoices and refunds under its privacy policy. The selected AI provider receives data only when you enable the AI coach. Transfers outside Serbia or the EEA use the provider’s appropriate legal mechanism, such as standard contractual clauses.

Retention

We keep account and workout data until you delete it or while the account exists. An active draft stays locally on your device until you sync or delete it. We retain minimal webhook-event identifiers to prevent duplicate processing. Paddle may retain transaction data as required by tax, accounting and other rules, even after you delete your Fitapio account.

Cookies and local storage

We use only necessary cookies for secure sign-in. Local storage remembers the theme, privacy notice and workout draft/sync. We do not use marketing or advertising trackers. Ads on the public site are a plain image and link, clearly marked: they set no cookies and do not track you, and a click takes you to the advertiser's site, where its own rules apply. On the public site we use Google Analytics (Google Ireland Ltd.) only if you accept it in the privacy notice: it measures visited pages and general device data, sets _ga cookies and keeps them for up to 2 years. Google signals and ad personalisation are disabled, and the training app is never measured. Before you choose, nothing is loaded, and refusing is just as easy as accepting. You can change your choice here at any time. The Paddle script loads only when you start checkout.

Your rights

You may request access, correction, deletion, restriction, portability and object, and withdraw consent. In your profile you can withdraw workout-data consent, delete workout data, export your data or permanently delete the account. We will respond within the legal deadline. You may complain to the Serbian Commissioner for Information of Public Importance and Personal Data Protection.

Contact

Privacy: support@fitapio.com · support: support@fitapio.com