Privacy Policy

1. Information We Collect

We collect the following categories of personal data:

• Account information — email address, display name, profile photo, and the details you give during onboarding, such as age, height, weight, fitness goal, available equipment, and any pain points.
• Workout data — exercises, sets, reps, weights, duration, and notes you log while using the app.
• Social data — posts, comments, likes, challenge entries, and follower/following relationships you create.
• Health & fitness data — only if you connect Apple Health or Health Connect. See section 3.
• Photos, videos & audio — only when you use the camera, microphone, or photo library. See section 4.
• Purchase data — your subscription status and purchase history, via RevenueCat and the App Store or Google Play. We never see your payment card details.
• Device & usage data — device model, OS version, crash and performance reports (via Sentry), in-app events such as finishing onboarding or a workout (via Google Firebase Analytics, linked to your account ID), and a push notification token if you allow notifications.

2. How We Use Your Information

• Provide, maintain, and improve the DilFit service.
• Personalise your experience and workout recommendations.
• Display community features such as challenges and social feed.
• Show your stats, health data, and sensor readings on your workout videos when you choose to.
• Send transactional emails (e.g., password resets) and, with your consent, promotional communications.
• Monitor and prevent fraud, abuse, and security incidents.

We do not sell your personal data, and we do not use it to show you ads.

3. Apple Health & Health Connect Data

If you connect Apple Health (iOS) or Health Connect (Android), DilFit reads the data types you allow: steps, distance, active calories, exercise minutes, heart rate, resting heart rate, heart rate variability, sleep, and weight. With your permission, DilFit also saves your completed workouts to Apple Health or Health Connect.

• How it is used — only to provide DilFit's fitness features: showing your stats, building your workout history, tracking challenges, and adding your numbers to your workout videos when you choose to.
• What is stored on our servers — a daily summary of your steps, distance, active calories, active minutes, and average and maximum heart rate, so your stats and challenges work across devices. Sleep and weight are included only if you turn them on in DilFit's sync settings, and you can switch off steps, calories, and heart rate there too. Resting heart rate and heart rate variability are shown in the app but never stored on our servers.
• What we never do — health data is never used for advertising, marketing, or data mining, never sold, and never shared with third parties such as advertising platforms, data brokers, or analytics providers. It is not sent to Firebase Analytics or Sentry, and it is not stored in iCloud.
• Disconnecting — you can disconnect at any time from the Apple Health (or Health Connect) screen in your DilFit profile. When you do, we delete the health data synced to your account from our servers. Turning off DilFit's access in your device's Health or Health Connect settings stops new reads; to delete the copy already synced, disconnect in DilFit or delete your account.

4. Camera, Microphone, Location & Sensors

• Camera & microphone — used only while you record a workout video or take a photo. Recordings and progress photos are saved on your device. A photo or video leaves your device only if you post it to the feed or submit it to a challenge; progress photos are never uploaded.
• Photo library — DilFit only accesses the photos and videos you pick, and saves finished workout videos to your library when you ask it to.
• Location — used only while the app is open and you are filming with location overlays turned on, to show your pace, distance, route, elevation, compass, place name, and weather on the video. We do not store your location on our servers. To find the place name, your position is sent to Apple's (iOS) or Google's (Android) geocoding service; to fetch the weather, your position rounded to about 1 km is sent to Open-Meteo.
• Bluetooth sensors & motion — heart-rate monitors, bike power and cadence sensors, and your phone's motion sensor are read on your device to show on your workout videos. These readings are not uploaded, except as part of a video you choose to post.
• Age range — on iOS 26 and later, DilFit may ask Apple's Declared Age Range feature whether you are 13 or older, only to decide whether social features are available. The answer stays on your device.

5. Data Storage & Security

Your data is stored in Supabase-managed PostgreSQL databases with row-level security (RLS) enforced. All traffic is encrypted in transit via TLS. Profile photos are stored in Supabase Storage and are visible to other users along with your profile. Photos and videos you post to the feed or to challenges are hosted by Cloudinary or Supabase Storage.

6. Third-Party Services

We use the following third-party services that may process your data in accordance with their own privacy policies:

• Supabase — authentication, database, and file storage.
• Cloudinary — hosting for photos and videos you post.
• Google Firebase — push notifications (Cloud Messaging) and app usage analytics (Analytics).
• Sentry — error and crash reporting.
• RevenueCat — subscription management.
• Open-Meteo — local weather for your workout videos (approximate location only).
• Apple / Google — sign-in (Sign in with Apple, Google Sign-In) and place-name lookup for your workout videos.

None of these services receives your Apple Health or Health Connect data, except Supabase, which stores the synced daily summary on our behalf.

7. Data Retention

We retain your personal data for as long as your account is active. Synced health data is deleted as soon as you disconnect Apple Health or Health Connect. If you delete your account, we permanently erase all associated data within 30 days, including workouts, health data, social posts, challenge participation, badges, and profile information. Recordings and progress photos kept only on your device stay there until you delete them or the app.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access and receive a copy of the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Request deletion of your account and all associated data.
• Object to or restrict certain processing activities.
• Data portability — receive your data in a structured, machine-readable format.

To exercise any of these rights, email us at bek.develop@gmail.com.

9. Children's Privacy

DilFit is not directed at children under 13 years of age. We do not knowingly collect personal data — including health and fitness data — from anyone under 13. If we learn that we have collected personal data from a child under 13, we delete it promptly. If someone tells us in the app that they are under 13, we lock their account right away and delete it, along with everything in it, within 14 days; that short window lets us unlock an account whose age was entered by mistake. If you believe a child under 13 has provided us with personal data, please contact us so we can delete it.

If the law where you live requires a higher minimum age to consent to the processing of your personal data without parental consent (up to 16 in some EEA countries under the GDPR), that higher age applies, and users under 18 must have permission from a parent or legal guardian to use DilFit.

10. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of material changes by posting the new policy in the app and updating the "Effective date" above.

11. Contact Us

If you have questions about this privacy policy, contact us at bek.develop@gmail.com.