Privacy Policy – Fitness Copilot

Effective date: 17 October 2025

This Privacy Policy explains how Fitness Copilot (“Fitness Copilot”, “we”, “us”, or “our”) collects, uses, discloses, and protects information when you use our mobile application, website, and related services (collectively, the “Service”).

By installing, accessing, or using the Service, you agree to this Privacy Policy. If you do not agree, please do not use the Service.

1. Who we are and how to contact us

Fitness Copilot provides AI‑assisted training and nutrition guidance, workout logging, and subscription services.

Email (support & data requests): fitnesscopilot@gmail.com

Grievance officer (India):
Name: Dharmik S Shetty, Compliance Officer
State: Karnataka, India
Email: fitnesscopilot@gmail.com

2. Information we collect

2.1 Account and identity data

When you create or use an account, we may collect:

• Name and display name
• Email address and email verification status
• Country / region
• Authentication identifiers (such as Firebase UID, provider IDs, tokens)
• Password hashes if you register with email/password (we never store your plain password)
• Third‑party sign‑in information (e.g., Google account basic profile, as provided by the identity provider)

2.2 Subscription and payment data

We use Razorpay or other payment processors to handle payments. We may process:

• Subscription plan, status, and renewal dates
• Purchase history, order ID, amount, currency, and timestamps
• Limited billing metadata returned by the payment processor

We do not store full payment instrument details such as full card numbers, CVV, or full UPI details. Those are collected and processed by Razorpay or the relevant payment provider under their own privacy policies.

2.3 Workout, nutrition, and app content data

To provide coaching features, we store data you enter or generate in the app, including:

• Workout plans, exercises, sets, reps, weights, rest times, and logs
• Diet plans, meal logs, food items, quantities, macros, preferences, and exclusions
• Progressive overload settings, consistency scores, and habit metrics
• AI conversations and prompts you exchange with the in‑app coach
• Notes you add, custom foods or exercises you create, and other content you voluntarily provide

Some of this content may reveal information about your health, habits, and lifestyle. We treat it as sensitive and use it only to provide the Service and improve your experience, not for advertising based on health profiles.

2.4 Device and technical data

When you use the Service, we automatically collect certain technical information, such as:

• Device identifiers (for example, device model, OS version, language, app version)
• IP address and approximate location (city/region) derived from IP
• Device settings and configuration (such as time zone)
• Log data about how you interact with the app (screens viewed, features used, taps and navigation events)
• Crash logs, performance data, and diagnostics

2.5 Cookies and local storage

We may use:

• Cookies, where applicable (for example if you use a web version)
• Local storage on your device (for example, secure storage, AsyncStorage)

These are used for:

• Authentication and session management
• Caching and performance
• Security protections (for example, detecting abuse)
• Remembering preferences (theme, hints, onboarding state)
• Measuring anonymous usage metrics and in‑app events

2.6 Support and communication data

If you contact us, we may collect:

• Your email address and other contact details
• Support requests and content of your communications
• Technical information related to the issue (logs, device info)

3. How we obtain your information

We collect information:

• Directly from you when you sign up, log workouts, interact with the coach, or contact support
• Automatically when you use the Service, through SDKs and analytics tools
• From third parties when you authorize them (e.g., Google sign‑in, payment providers)

You may choose not to provide certain information, but it may limit your ability to use some features.

4. Legal bases for processing (where applicable)

Where data protection law (such as the GDPR) applies, we rely on the following legal bases:

• Performance of a contract: To create and manage your account, provide coaching, sync your data, and deliver subscriptions.
• Legitimate interests: To maintain security, fix bugs, prevent abuse, understand app usage, and improve features in a way that respects your privacy.
• Consent: For optional analytics, certain notifications, and marketing communications, where required by law.
• Legal obligations: To comply with tax, accounting, fraud prevention, and other legal requirements.

5. How we use your information

We use your information to:

1. Provide and operate the Service
   Authenticate you and manage sessions; store and sync your workouts, diet plans, and logs across devices; render personalized suggestions, plans, and educational content; maintain progressive overload tracking and consistency metrics.
2. Process payments and manage subscriptions
   Verify purchases and entitlements; handle free trials, renewals, upgrades, and cancellations; detect and prevent fraudulent transactions.
3. Maintain security and prevent abuse
   Monitor authentication activity and misuse; detect spam, abuse, or unauthorized access attempts; protect the integrity of our systems and other users.
4. Improve and develop the Service
   Diagnose crashes and performance problems; analyze aggregate usage trends; test new features and UX changes.
5. Communicate with you
   Send service messages; respond to support requests; send optional tips or product updates where permitted (you may opt out at any time).
6. Comply with legal obligations and enforce our rights
   Maintain records for accounting and tax; respond to lawful requests; enforce our Terms & Conditions and protect our rights and those of our users.

We do not sell your personal data.

6. Sharing and disclosure

6.1 Service providers and processors

We may share information with:

• Google Firebase (Authentication, Firestore, Storage, Cloud Functions, analytics, crash reporting)
• Razorpay and other payment processors
• Analytics and error reporting vendors configured in a privacy‑respecting way

These providers process data on our behalf and under data protection agreements. They are not allowed to use your personal data for their own marketing.

6.2 Legal and compliance

We may disclose information if we reasonably believe it is necessary to:

• Comply with applicable law, regulation, legal process, or enforceable governmental request
• Protect our rights, property, or safety, or that of our users or the public
• Detect, investigate, and prevent fraud, security issues, or technical issues

6.3 Business transfers

If we are involved in a merger, acquisition, asset sale, or similar transaction, your data may be transferred as part of that transaction, subject to confidentiality and applicable law. We will take steps to ensure your rights continue to be protected.

We do not share your personal workout or nutrition logs with other users without your explicit action.

7. International data transfers

Our servers and service providers may be located in different countries, including countries that may have different data protection laws than your country of residence. When we transfer your personal data internationally, we take appropriate safeguards under applicable law and aim to handle it consistently with this Privacy Policy.

8. Data retention

We retain your data only as long as reasonably necessary for the purposes described in this Policy, including:

• While your account is active, to provide you with the Service
• For a limited period after account deletion, to allow for recovery in case of accidental deletion, subject to settings and applicable law
• For longer periods where needed to comply with legal obligations, resolve disputes, or enforce agreements

When data is no longer needed, we will delete or anonymize it in line with our retention practices and legal requirements.

9. Your rights and choices

Depending on your jurisdiction, you may have the following rights:

• Access, correction, deletion, and restriction of your personal data
• Portability of certain data you provided
• Objection to certain types of processing, such as direct marketing
• Withdrawal of consent where we rely on consent

To exercise these rights, please email fitnesscopilot@gmail.com. We may need to verify your identity before responding.

10. Children’s privacy

The Service is not directed to children under 13 years of age (or the minimum age in your region where higher). We do not knowingly collect personal data from children under that age. If you believe that a child has provided us with personal data in violation of this Policy, please contact us at fitnesscopilot@gmail.com, and we will take reasonable steps to delete such data.

11. Data security

We take appropriate technical and organizational measures to protect your personal data, including encryption in transit, access controls, least‑privilege access, monitoring, and regular security updates. However, no system is completely secure, and we cannot guarantee absolute security. If you believe your account or data has been compromised, please contact us immediately.

12. Third‑party links and services

The Service may contain links to third‑party websites, services, or content that we do not operate or control. We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing them with your information.

13. Do‑Not‑Track, ads, and marketing

We do not currently respond to Do‑Not‑Track browser signals. We also do not use your health or workout data to serve interest‑based third‑party ads.

We may send you in‑app messages or emails about new features or educational content. You can opt out of non‑essential marketing communications by following the unsubscribe link in emails or updating your preferences in the app, where available.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Effective date” at the top and, where appropriate, notify you through the app or by email.

Your continued use of the Service after the updated Policy becomes effective means you accept the changes. If you do not agree, you should stop using the Service and may request deletion of your data.

15. Contact, complaints, and grievance

If you have questions, concerns, or complaints about privacy or this Policy, or if you wish to exercise your rights, please contact us at:

Email: fitnesscopilot@gmail.com

For users in India, you may also contact our grievance officer:

Name: Dharmik S Shetty, Compliance Officer
State: Karnataka, India
Email: fitnesscopilot@gmail.com