Privacy Policy

Last updated: 21 August 2026.

This policy explains what data MyFitTrack collects, why, how it is protected, and the rights you have under the EU/UK GDPR.

Who we are

MyFitTrack ("we", "us") is the data controller for the personal data described here. Questions or requests: [email protected].

What we collect

Account — your email address (for sign-in) and an optional display name and emoji.
Fitness activity you log — workouts, runs/walks/hikes (including GPS route coordinates), steps, water, food and calories, body weight, goals and achievements.
Device sensors (with your permission) — location (GPS) during an activity, motion/pedometer for step counting, and Apple Health data you choose to sync (steps, workouts, weight).
AI feature inputs — when you use an AI feature, the relevant context (e.g. your recent stats, a chat message, or a meal photo) is processed to generate a response.
Payments — handled by Apple, Google and RevenueCat. We receive your subscription status, never your card details.
Technical — a randomly generated app identifier and basic, aggregated usage analytics to keep the app working and secure.

Why we use it & legal bases

To provide the app (tracking, history, sync) — performance of our contract with you.
Location, motion, Health and AI features — your explicit consent, given via the permission prompts and by choosing to use the feature. You can withdraw it any time in your device Settings or by not using the feature.
Leaderboard — your consent; your display name and aggregate stats are shown to other users. You can hide yourself any time in Settings.
Security, abuse prevention and product analytics — our legitimate interests.

Sharing & processors

We do not sell your data. We share it only with service providers who process it on our behalf under contract:

Supabase — database, authentication and hosting of your account data.
Anthropic — powers the AI features; receives the input for a request to generate the response. It is not used to train their models.
OpenAI — converts the coach's written reply into a spoken voice when you enable voice mode; receives only that reply text. It is not used to train their models.
Apple, Google & RevenueCat — subscriptions and purchase validation. Apple handles billing on iOS and Google Play on Android; RevenueCat validates the purchase.
Google (AdMob & Firebase Analytics) — serves the ads shown to free users and provides anonymous usage analytics (Firebase). Receives a device identifier, app context and usage events such as screens viewed — never your health, activity, weight, meal or location data. Ad personalisation is disabled for analytics, and you can switch analytics off in Settings. Pro subscribers see no ads and no ad data is sent.
Cloudflare — hosting for our public web pages (this policy, support and account-deletion pages) and aggregate analytics.
Mapbox — map rendering.

International transfers

Some providers (e.g. Anthropic, OpenAI, Cloudflare) are based outside the EEA. Where data is transferred internationally, it is protected by appropriate safeguards such as the EU Standard Contractual Clauses.

How long we keep it

We keep your data while your account is active. When you delete your account we erase your personal data, except anything we must retain for legal reasons. Older run/usage records may be pruned automatically over time.

Your rights

Under the GDPR you can: access your data; correct it; erase it; restrict or object to processing; port it (use Export Data in the app); and withdraw consent at any time. You also have the right to complain to your local data-protection authority.

To export your data, use Settings → Export Data. To delete your account and all associated data, use Settings → Delete Account — this permanently erases your account and personal data from our servers immediately and cannot be undone. If you prefer, you can also email [email protected] and we will action it. See the account deletion page for details.

Security

Access to your data is protected by authentication and database row-level security so you can only read and write your own records. Connections are encrypted in transit.

Children

MyFitTrack is not directed to children under 16. We do not knowingly collect data from them.

Changes

We may update this policy; we will revise the date above and, for significant changes, notify you in the app.

Contact

MyFitTrack (eenmanszaak, KVK 72366095) · [email protected]