Privacy Policy

FitSplit provides the platform. Each gym that uses FitSplit decides what member data to collect and why, and is the controllerof its members’ data;FitSplit acts as a processoron that gym’s behalf. For data we collect for our own purposes (e.g. account security, platform analytics), FitSplit is the controller.

Questions, or to exercise your rights, contact us at fitsplit.in@gmail.com. Operator: FitSplit, India.

• Account & identity:name, username, mobile number, email, role, gym association, and an authentication secret (a hashed password or PIN — we never store it in plaintext).
• Health & fitness data: workouts, lift logs, body metrics (weight, body-fat), muscle/volume data, macros/nutrition, activity logs, injury notes, and coach notes. Some of this is health-related data, treated as a special category under GDPR Article 9 (see “Legal bases”).
• Attendance & location: gym check-in/out records and, where you enable it, approximate geolocation used solely to verify you are at the gym (geofencing).
• Membership & billing: packages, membership periods, and payment requests. FitSplit records membership status; it does not process card payments itself.
• Device & usage: a session cookie, push-notification token (if you opt in), and limited diagnostic/error data to keep the service secure and working.

We use personal data to:

• provide the workout, training, progress, and membership features you request — legal basis: performance of a contract;
• process and store health & fitness data, including injury notes — legal basis: your explicit consent (GDPR Art. 9(2)(a)), which you may withdraw at any time;
• secure accounts, prevent abuse, and operate the platform — legal basis: our legitimate interests;
• send service and (if you opt in) push notifications — legal basis: consent / legitimate interests;
• comply with legal obligations and resolve disputes — legal basis: legal obligation.

We do not use your data for automated decisions producing legal effects, and we do not sell your personal information.

We use a small number of strictly-necessary cookies to keep you signed in and route you to the correct workspace (e.g. fitsplit-session and role-routing cookies). These are essential to the service and are not used for advertising. If you opt in to push notifications, a device token is stored to deliver them.

• Your gym’s staff: owners and trainers at the gym you belong to can see the data needed to coach you (programs, logs, progress, attendance, membership).
• Infrastructure sub-processor:Google Firebase (Cloud Firestore, Authentication, Storage, Cloud Functions, Cloud Messaging, App Hosting) stores and processes data on our behalf under Google’s data-processing terms.
• Error monitoring: diagnostic data may be sent to our error-monitoring provider to keep the service reliable.
• Legal: we may disclose data where required by law or to protect rights and safety.

We do not sell or “share” your personal information as those terms are defined under the CCPA/CPRA.

FitSplit is operated from India and uses Google Cloud regions (primary region asia-south1). Where data is transferred across borders, our providers rely on recognised safeguards such as the EU Standard Contractual Clauses. We take steps to ensure your data remains protected wherever it is processed.

We keep personal data for as long as your account is active and as needed to provide the service. Deleted records are moved to a soft-delete archive and permanently purged after 60 days, unless a longer period is required by law. You can ask us to delete your data sooner (see your rights below).

We apply industry-standard safeguards: encrypted transport (HTTPS/HSTS), a strict Content Security Policy and security headers, role-based access controls enforced by Firestore and Storage security rules, multi-tenant isolation between gyms, hashed credentials, and login rate-limiting/lockout. No system is perfectly secure, but we work to protect your data and to respond promptly to any incident.

If the GDPR applies to you, you have the right to:

• access a copy of your data, and rectify inaccurate data;
• erase your data (“right to be forgotten”) and restrict processing;
• data portability — receive your data in a machine-readable format;
• object to processing based on legitimate interests;
• withdraw consent at any time (this does not affect prior processing);
• lodge a complaint with your local data-protection supervisory authority.

If you are a California resident, you have the right to:

• know what personal information we collect and how it is used and disclosed;
• delete personal information we hold about you;
• correct inaccurate personal information;
• opt out of the “sale” or “sharing” of personal information — note we do not sell or share it;
• not be discriminated against for exercising your rights.

You may use an authorised agent to make a request on your behalf; we will verify the request before acting on it.

Email fitsplit.in@gmail.com with your request. Members can also ask their gym’s owner to action many requests directly. We will respond within the timeframe required by applicable law (generally 30 days under the GDPR; 45 days under the CCPA), and may need to verify your identity first.

FitSplit is not directed to children. We do not knowingly collect data from anyone under 16 (or the minimum age in your jurisdiction) without verifiable parental/guardian consent. If you believe a child has provided us data, contact us and we will delete it.

We may update this policy from time to time. We will revise the “Last updated” date above and, for material changes, provide a more prominent notice. Continued use of FitSplit after an update means you accept the revised policy.

For any privacy question or request, write to fitsplit.in@gmail.com. See also our Terms of Service and About page.