01 ·Introduction
Fitquency, Inc. (“Fitquency,” “we,” “us”) takes your privacy seriously. This policy explains what personal information we collect, why we collect it, how we protect it, and the rights you have over it.
This policy applies to the Fitquency mobile apps, website, and API. It's written to be readable — plain-English summaries sit next to the legal text so you can skim if you want.
Plain English: we collect only what we need to run your account. We never sell it. You can delete your data any time.
02 ·Data we collect
| Category | What | Source |
|---|---|---|
| Identity | Full name, email, profile photo | You provide at signup |
| Account | Password hash, 2FA factors, passkey public keys | You set; stored encrypted |
| Business | Organization name, client roster, workout programs, sessions | You enter |
| Invitation | Your name and the email or phone number your gym or trainer uses to invite you, kept with the invitation so it can be resent. Anything else entered with it (your lead trainer, your country, and an optional team note) moves to your client record when you accept, and is deleted if the invitation is withdrawn or declined. If it expires, the team note is deleted; your lead trainer and country stay so it can still be resent | Your gym or trainer enters |
| Client profile | Date of birth, gender, phone number, height, fitness level, and goals | You, or your gym or trainer after you accept their invitation |
03 ·How we use it
- Deliver the service: run your workouts, schedule, payments, messaging.
- Keep it safe: fraud detection, rate-limiting, security audits.
- Support: respond when you contact us.
- Keep it working: error and crash reports, sync diagnostics and server logs, which we need to run the service whether or not product analytics is on (see §15).
- Improve: fix bugs and design new features, using product analytics tied to a pseudonymous ID: a random account ID that we can link to your account, never your name or email. When you are signed in it is on unless you turn off Settings → Privacy → Product analytics or your browser sends Global Privacy Control; if you are not signed in, it runs only after you accept analytics in the cookie banner (see §15).
- Communicate: transactional emails (never marketing without your opt-in).
We do not use your data to train AI models without explicit, granular opt-in. See §6 for AI specifics.
04 ·Legal bases for processing (GDPR Art. 6)
| Purpose | Basis |
|---|---|
| Running your account | Contract (Art. 6(1)(b)) |
| Fraud / security | Legitimate interest (Art. 6(1)(f)) |
| Marketing emails | Consent (Art. 6(1)(a)) |
| Legal holds / compliance | Legal obligation (Art. 6(1)(c)) |
| Health & fitness metrics | Explicit consent (Art. 9(2)(a)) |
06 ·AI features & your data
Our AI coach uses OpenAI under an enterprise DPA that explicitly forbids OpenAI from training on Fitquency data. Some AI requests are handled by Anthropic instead, under the same rules.legal-draft Your inputs to AI features are:
- Not used to train OpenAI's models (enterprise data-processing agreement, zero-retention API mode).
- Not used to train Fitquency's models without your explicit, revocable opt-in (Settings → Privacy → AI improvement program).
- Not shared beyond the AI provider's per-request processing.
Per the EU AI Act, AI-generated content is labeled as such in the UI. Per the Colorado AI Act (SB 24-205 as amended by SB25B-004; effective no later than 2026-06-30), AI content shown to Colorado residents carries an explicit AI-generated disclosure.
07 ·Retention & deletion
| Data | Retention |
|---|---|
| Active account data | As long as your account is active |
| Deleted-account data | 30 days soft-delete grace, then permanent deletion |
| Financial records (invoices) — US tax requirement | 7 years |
| Audit logs — security and abuse investigation | 1 year |
| The record that you asked us to delete your account | 24 months |
| App and website events we store ourselves for diagnostics (with a shortened IP address, the last part removed) | 90 days, then deleted |
| Short-lived security records with the IP address they came from: sign-in and verification codes, confirmation links and tokens, staff sign-in sessions | 30 days after they expire or end, then deleted. The IP address recorded when a business signs up is removed after 30 days. |
| Activity and security logs with your IP address (for example switching gyms, live workout updates, nutrition activity, device checks, requests to join a gym, referral-link clicks) |
08 ·Your rights & choices
Universal rights — every user
- Access — download a full export from Settings → Privacy → Export my data
- Correction — edit your profile, data, or history any time
- Deletion — delete your account
- Portability — export is JSON + CSV, importable elsewhere
- Opt-out of product analytics — when signed in it is on by default, unless your browser sends Global Privacy Control; turn off Settings → Privacy → Product analytics on the web or in the app. If you are not signed in, it stays off unless you accept it in the cookie banner. Once it is off, nothing more is captured (see §15)
- Marketing emails — off unless you turn them on in Settings → Privacy on the web. Turn them off there at any time
- Do not sell or share — we don't sell your personal information. You can still record a “do not sell” request in Settings → Privacy on the web, and a Global Privacy Control signal records one for you (see §9)
- Opt-out of AI improvement program — Settings → Privacy → AI
Residents of the EEA, UK, and Switzerland additionally have rights to object, restrict processing, and lodge complaints with their national data protection authority.
09 ·US state privacy laws
Fitquency is compliant with CCPA/CPRA (California), VCDPA (Virginia), CTDPA (Connecticut), UCPA (Utah), CPA (Colorado), TDPSA (Texas), ORPA (Oregon), MCDPA (Montana), DPDPA (Delaware), NJ DPA (New Jersey), IN CDPA (Indiana), ICDPA (Iowa), and applicable sector laws. See fitquency.com/legal/state-privacy for the full jurisdiction-by-jurisdiction matrix.legal-draft
We honor the Global Privacy Control (GPC) signal as a valid “do not sell / share” request. We don't sell personal information. Marketing emails are off for everyone unless you turn them on yourself in Settings → Privacy on the web.
Global Privacy Control and analytics: if your browser sends GPC, analytics stays off unless you turn it on yourself. If you're not signed in, or you're on our public pages (home, pricing, legal), that means turning it on in the cookie banner's choices. If you're signed in and using the app, that means switching on Settings → Privacy → Product analytics yourself. The on-by-default setting doesn't override GPC.
10 ·Washington MHMDA & health data
Under the Washington My Health My Data Act (effective 2024), we give additional protections to consumer health data:
- We don't collect or process health data beyond what's necessary for your use of Fitquency.
- We don't sell health data. Full stop.
- We publish a dedicated Consumer Health Data Privacy Policy with detail on collection, processing, and your rights under MHMDA.
11 ·Nevada SB 370 (consumer health data)
Nevada residents have additional rights over consumer health data, including the right to opt-out of its sale (which is moot since we don't sell it). Requests via privacy@fitquency.com.legal-draft
12 ·COPPA & minors
Fitquency is for users 18 and older. We don't knowingly collect personal information from anyone under 18. If you believe a child under 18 has created an account, email us at privacy@fitquency.com and we'll delete the account immediately.
Our age-attestation at signup, combined with the California Age-Appropriate Design Code (AB 2273), means we block minors from creating accounts at the sign-up gate.
13 ·International data transfers
Fitquency stores data in US-based data centers. If you're in the EEA, UK, or Switzerland, transfers to the US rely on the EU-US Data Privacy Framework and Standard Contractual Clauses (SCCs) as fallback.
14 ·Security measures
- Encryption in transit: TLS 1.3 across all endpoints
- Encryption at rest: AES-256 (managed keys)
- Authentication: Argon2id hashed passwords, TOTP 2FA, WebAuthn passkeys, step-up on billing + privacy operations
- Access control: Row-level security, org-scoped isolation, audit logs
- Payments: card details are entered on Stripe's hosted checkout and never reach Fitquency's servers (PCI DSS 4.0.1 SAQ-A)
- Incident response: if we confirm unauthorized access to your personal data, we notify you without unreasonable delay and within the deadlines the applicable US state breach-notification law sets, and we notify state attorneys general where those laws require it. If you use Fitquency as a client of a gym or trainer, we notify that organization as well, since they are the controller for your data. Our clock starts when we discover the incident, not when we finish investigating it.
Report a security vulnerability: security@fitquency.com.
16 ·Changes to this policy
We'll email you at least 30 days before any material change takes effect. Non-material changes (typos, clarifications) go live immediately with a bumped “Last updated” date. Prior versions are available on request — email privacy@fitquency.com.
17 ·Contact & DPO
- Privacy questions: privacy@fitquency.com
- Security issues: security@fitquency.com
- EU Data Protection Officer: dpo@fitquency.comappoint-pre-eu-launch
- UK Representative: appoint-pre-uk-launch
Fitquency, Inc. · 1209 Orange Street, Wilmington, DE 19801, USA
Structural mockup. Final legal prose will be reviewed by counsel before public launch. Items marked legal-draft / appoint-pre-eu-launch need real data or appointments before publication.
See also our Terms of Service.