Privacy Policy

Datfit ("we", "us") operates the Datfit mobile app and the website at datfit.app. This policy describes what information we collect, why we collect it, and how we handle it.

1. Information we collect

Account information

• Your name, email address, and sign-in method, supplied when you create an account.
• If you sign up with email and password, we collect your email address, account name, and authentication credentials needed to operate your account.
• If you sign in with Google or Apple, we receive a provider-issued account identifier and your email. For Apple sign-in, we may also receive your name if you choose to share it. We do not receive your Google or Apple password.

Profile information

• Gender, age, height, weight, training goal (hypertrophy / strength / recomp), training experience (beginner / intermediate / advanced), and target training frequency — supplied during onboarding.

Training data

• Workout templates you create or accept, session logs (exercises, sets, reps, weights, rest periods, timestamps), and AI trainer interactions that occur during a session.

Security and session metadata

• Session records associated with your account, which may include login and security metadata such as IP address and user agent.

Diagnostic data

• Crash reports, performance traces, error events, and session replay or debugging data from the mobile app, backend, and website. These may include device model, operating system version, IP address, user agent, app navigation, visible screen content at the time of an issue, and stack traces. We do not intentionally send passwords or authentication tokens in these events.

2. How we use it

• To create and secure your account and authenticate sign-in.
• To provide onboarding, training plans, workout logging, and sync across devices.
• To run the in-app AI trainer on-device and support AI model download and setup.
• To monitor reliability, investigate crashes, and improve app performance.
• To protect against abuse, fraud, and unauthorized access.
• To send Datfit product updates by email. You can unsubscribe at any time from the email itself or by writing to hello@datfit.app.

3. How we store it

• On your device: training data is kept in a local SQLite database on your phone. Authentication tokens are kept in your operating system's secure keystore (iOS Keychain / Android Keystore) via expo-secure-store.
• On our servers: account data, profile data, training data, and session metadata are stored in a managed Postgres database.
• Sync: training data synchronizes between your device and our servers via ElectricSQL over HTTPS.

4. Third parties we use

We use the following processors. Each only receives the data necessary to perform its function.

• Google Sign-In (authentication) — receives the sign-in challenge and returns an account identifier and email.
• Apple Authentication (authentication) — same as above for iOS.
• Sentry (error, crash reporting, and replay diagnostics) — receives diagnostic events from the mobile app, backend, and website.
• ElectricSQL (sync transport) — receives training data in transit between your device and our Postgres database.
• Cloudflare (hosting and edge) — serves the website.
• Resend (email) — receives your email address when you create an account or join the waitlist, and sends Datfit product update emails.
• PostHog (product analytics) — receives app usage events, such as screens and taps, linked to your account identifier, name, and email, including the choices you make in onboarding, such as your training goal and experience.
• RevenueCat (subscriptions) — receives your account identifier, your email, and your App Store or Google Play purchase and subscription status.
• AI apps you connect — receive only the data you approve, when you use them with Datfit. See §6.
• Cloudflare R2 (object storage) — stores downloadable on-device AI model files.

5. AI companion

The in-app AI trainer runs on your device. The app may download an AI model file from Datfit-hosted infrastructure before you use the feature. After the model is present on your device, workout and session data used for inference stays on your device and is not sent to Datfit or a third party for inference.

6. Connected AI apps

You can choose to connect Datfit to an AI app, such as ChatGPT or another assistant that supports the Model Context Protocol. Nothing is shared until you connect one yourself.

• How you connect: you sign in to Datfit and approve the access the app asks for, or you create an agent key in Settings → Agent access and give it to the app.
• Creating an account while you connect: if you don't have a Datfit account, you can create one on the Datfit sign-in page the app opens. It is a regular Datfit account: you can use it in the Datfit app, and everything in this policy applies to it. The AI app never sees your password.
• What a connected app can do: only what you approved. Depending on that access, it can read or change your workout templates, training sessions, and home screen widgets, read your training load statistics, and search the exercise catalog. An app that connects through Datfit sign-in can also receive your name and email address when it asks for them and you approve. It cannot see your password, passkey, or payment details.
• Where the data goes: when you ask the app for something, the data it reads from Datfit is sent to that app's provider and handled under that provider's privacy policy. Changes the app makes are saved to your Datfit account, and template and session changes are marked as made by a connected app.
• Connection and activity records: we keep a record of each app you connect and the access you approved, for as long as the connection is active. We also record each request a connected app makes (which action, when, and whether it succeeded) for security and support, and delete those request records after about 90 days.
• Disconnecting: revoke an agent key in Settings → Agent access, or write to hello@datfit.app and we will revoke an app's access. A revoked key or connection stops working on its next request. Removing Datfit in the AI app's own settings stops that app from using the connection, but to revoke it on Datfit's side, use one of the options above.

7. How long we keep it

We retain account and training data for as long as your account is active. When you delete your account, we delete the associated account, profile, training records, and related active-system records within 30 days. Backup copies and some diagnostic logs may persist for up to 90 days before expiring through normal backup or log-rotation processes. Your email stays on the product-update list until you unsubscribe or ask us to remove it. Deleting your account does not remove it from that list automatically. Waitlist emails are removed on request; see §9.

8. Your rights

You may request access to, correction of, export of, or deletion of your data by writing to hello@datfit.app. We respond within 30 days.

9. Contact

Questions about this policy: hello@datfit.app.