FitStreak - Privacy Policy

Last updated: 16 October 2026

1. Who We Are

FitStreak is made and run by an independent developer, the seller shown on the App Store listing (“we”, “us”). We decide how the personal data described here is used, which makes us its controller under data protection law. You can reach us about anything in this policy at fitstreak.app@outlook.com.

2. Information We Collect

FitStreak stores your workout data, preferences, and profile information locally on your device. If you sign in, we also store your data on our cloud servers to enable cross-device sync. The leg strength check is an exception: its results, the age range and the comparison group you choose stay only on this device, are never synced or sent to us or anyone else, and are cleared when you sign out. The safety questions before it are never stored. If you share your result, the image goes only where you send it, and a retest reminder you ask for is a notification scheduled on this device.

The information we handle includes:

• Your display name and avatar selection
• Workout completion history
• Fitness goals, level, and the movements or body areas you ask us to avoid
• App settings (reminders, sound, haptics)
• Achievement progress and XP
• Food and nutrition entries you log (item names, calories, and macros)
• Body weight readings you enter or import from Apple Health, and the daily water count you log
• Progress photos you choose to add. These never leave your device: they are not uploaded, not included in cloud sync, and not visible to anyone else. Deleting the app, resetting your progress, or deleting your account removes them permanently
• Your account ID (a random identifier our system creates), and your Apple Sign-In user ID (if signed in)
• Your email address, or the private relay address Apple provides if you choose Hide My Email (if signed in)
• Messages you send to support, and the rating and optional comment you give if you answer our in-app “how likely are you to recommend” question
• Reports and blocks you make, and referral or trainer codes you enter
• If you are signed in and have allowed notifications: a push token for your device, the time zone set on your device, the app version and the app language, as described under Expo in section 5
• App usage events, a record of how you move through the app, crash reports, and basic device information, as described in section 5

3. AI Features

AI workouts, programs, and meal photo scans require you to sign in. When you use them, the photo or the workout request you submit is sent through FitStreak’s server to Google Gemini to generate a result. A workout request contains the duration or program length, focus, difficulty, equipment and language you pick, plus any movements or body areas you asked us to avoid. FitStreak does not save the photo or the request. Your account ID and the request type are used by our server to check your Premium access, enforce usage limits, and record AI usage and cost; they are not sent to Google. The resulting meal item names and nutrition estimates are saved to your food log only if you choose to save them.

4. How We Use Your Information

We use your information only to run FitStreak and make it better. Under the GDPR and UK GDPR, each use has a legal basis:

• To provide the app you asked for (contract): streaks, XP and achievements from your workout history, cloud sync if you sign in, AI features, purchases and restoring them, Strava import, friends and leaderboards if you turn them on, notifications you have allowed, and answering support messages.
• Health information (your explicit consent): body weight, workouts imported from Apple Health, and the Gentle days check are only used because you entered them or turned the feature on. You can withdraw that consent by deleting the entries or turning the feature off.
• To keep the app working and safe (our legitimate interests): crash reports, usage limits on AI features, and reviewing reports about display names.
• To understand and improve the app, and to measure our ads (our legitimate interests, and your consent where the law requires it): the usage analytics, session recordings and install attribution described in section 5. You can turn all of them off at any time in Profile > Share usage data. Collecting your advertising identifier and sharing data with an ad network only happens if you tap Allow on the App Tracking Transparency prompt.
• To email you about FitStreak (see section 13).

We do not sell your personal data, and we never use health or fitness information for advertising.

5. Third-Party Services

We use the following third-party services. They process data for us under their own terms and data protection agreements.

• Supabase - Cloud database and authentication (Supabase, Inc., hosted in the United States). Sign-in is required for cloud sync and for AI workouts, programs, and meal scans. It stores your synced data, friends and leaderboard entries, and, for AI requests, verifies your account and records usage and cost.
• Apple - Sign in with Apple, and all payments, which are handled by Apple through the App Store. We never see your payment details.
• RevenueCat - Subscription management (RevenueCat, Inc.). It receives your purchases from Apple and an anonymous ID, linked to your account ID if you are signed in. Our AI server checks your Premium access with RevenueCat using your account ID.
• Apple HealthKit - If you enable it, we save your completed workouts to Apple Health, and we can read two things at your request: workouts logged by other apps, so you can import them, and your most recent body weight, only when you tap to import it. We write body weight back to Apple Health only if you turn on the separate “Write weight to Health” setting, which is off unless you turn it on, and even then only weights you typed yourself are written, never a value we imported or estimated. Nothing read from Health leaves your device except through the same cloud sync as the rest of your data if you are signed in, and nothing read from Health is ever sent to analytics, advertising or AI services. If you turn on “Gentle days”, we also check whether your period is logged in Apple Health for the current day, so we can offer an easier session. That check happens entirely on your device: we do not store it, we do not sync it, we do not include it in analytics, and it never reaches our servers or anyone else. The setting itself is kept only on this device, and is cleared if you reset your data or sign out.
• Your device calendar - If you turn on “Add to calendar”, we create a calendar named FitStreak on your device and write one repeating event for each of your training days. Granting calendar access on iOS and Android also technically grants the ability to read your calendar, and there is no narrower permission available to us. We do not use it: FitStreak only ever creates, updates and deletes events in the FitStreak calendar it made, and never reads, stores or sends anywhere the events in your other calendars. Nothing about your calendar is sent to us or to anyone else, and turning the setting off deletes the FitStreak calendar.
• Google Gemini - Generates AI workouts, programs, and meal scan results (Google LLC). FitStreak’s server sends the photo or workout request you submit, as described in section 3; Google does not receive your account ID, name or email through this request. Gemini is only contacted when you actively use one of those features.
• Open Food Facts - Powers the barcode scanner. When you scan a product barcode we send that barcode number to Open Food Facts (world.openfoodfacts.org), a free public food database, and it returns the product name and nutrition values. Only the barcode is sent: no photo, no account information, nothing about you, and it is only contacted when you actively scan a code.
• Sentry - Crash and error reporting (Functional Software, Inc.). If the app crashes or hits an error, Sentry receives the error details, a stack trace, and your device model and OS version so we can fix the problem. It is not configured to attach your name, email, or account ID. Crash reports are sent even when Share usage data is off, because we need them to keep the app working.
• Google Analytics for Firebase - Product analytics (Google LLC). We log a small set of app-usage events (for example: sign-up, workout started/completed, streak milestones reached, paywall viewed, purchase completed, a subscription renewing or ending, and whether notifications are turned on for FitStreak) so we can understand how the app is used and improve it. These events include only IDs, counts, and category or plan labels, never your name or email. When you are signed in, they are also linked to your account ID, so we can see how the app is used over time. Google uses your IP address to estimate your country and city. Turning off Share usage data stops it.
• PostHog - Product analytics, feature testing and session replay (PostHog, Inc., data hosted in the United States). PostHog receives the same app-usage events we send to Google Analytics, the names of the screens you open, when the app is opened or closed, and basic device information (such as device model, OS version, app version and language). As with Google Analytics, these events are linked to your account ID when you are signed in; they never include your name or email. PostHog is set not to look up your location from your IP address. We also use PostHog to decide which version of a feature you see when we test two versions. For a sample of sessions, PostHog records how you move through the app (taps and screen changes) so we can find confusing moments. In those recordings everything you type, every image and your name wherever it appears are hidden, and screens that show your body or health information (weight and measurements, progress photos, your food log and meal scanner, and workouts imported from Apple Health) are hidden completely, as are leaderboards that show other people’s names. Network traffic is not recorded. PostHog does not receive your advertising identifier, and we do not use PostHog data for advertising or sell it. Session recordings are deleted after 30 days and usage events are kept for up to one year. Turning off Share usage data stops all of it.
• AppsFlyer - Install attribution and ad-campaign measurement (AppsFlyer Ltd.). It receives your install and three in-app events: finishing onboarding, starting a free trial (the plan and currency), and completing a purchase (the plan, price and currency). If you open a friend’s FitStreak invite link, AppsFlyer also passes the invite code in that link to the app so it can be applied for you. Invite links are AppsFlyer links: opening one always passes through AppsFlyer’s link service, whether or not the app is installed and whatever the Share usage data setting, and AppsFlyer receives the click (IP address, device and browser details) so the code can reach the app, including a fresh install. These events never include your name, email, account ID, fitness goal or any health information. The App Tracking Transparency prompt you see decides what else happens. If you tap Allow, AppsFlyer also collects your device’s advertising identifier (IDFA) and shares install and in-app event data with the ad network whose campaign led to your install (currently AppLovin), which uses it to measure and improve our ad campaigns and may use it to show you more relevant ads. If you tap Ask App Not to Track, no advertising identifier is collected, and AppsFlyer receives the same events tied only to an identifier that is unique to FitStreak on your device and cannot be used to follow you across other companies’ apps. Turning off Share usage data stops everything else AppsFlyer does in the app, and the tracking prompt is then not shown.
• Apple Search Ads - Measuring our App Store ads (Apple Inc., through RevenueCat). If you install FitStreak after tapping one of our ads in the App Store, Apple can tell us which campaign and search keyword led to the install. The app asks iOS for an attribution token (Apple's AdServices), and RevenueCat, which handles our subscriptions, exchanges it with Apple for the campaign details and keeps them with your purchase records. The token contains no advertising identifier, so it does not need the tracking prompt, and it cannot be used to follow you across other companies' apps. Turning off Share usage data stops it.
• Intercom - In-app support chat (Intercom, Inc., hosted in the United States). So that Help & Support is ready when you open it, the app registers with Intercom when it starts, and Intercom receives basic device information (such as device model, OS version, app version and language). If you are not signed in, this is tied only to an anonymous identifier Intercom creates for your install. If you are signed in, we also send your account ID and your email address (or the private relay address Apple provides) so we can answer you and keep your conversations across devices. Intercom stores the messages you send to support and our replies. We do not send Intercom your workouts, food log, body weight or health data.
• Expo push service - Delivers push notifications (650 Industries, Inc., which runs Expo, hosted in the United States). This only happens if you are signed in and have allowed notifications for FitStreak; the app uses a permission you already gave and never asks for it on its own. To set it up, the app sends Expo the push token that Apple Push Notification service gives your device, FitStreak’s app identifier, and a random installation identifier created for FitStreak on your device. Expo returns a push token for FitStreak and keeps the link between the two so it can deliver notifications. We store that push token on our servers (Supabase) with your account ID, the time zone set on your device (such as Europe/Berlin), your device platform, the app version and the app language, so that notifications we may send, such as reminders, coaching messages and a notice that a friend joined with your invite code, arrive at the right local time and in your language. Each notification we send goes from our server through Expo to Apple, which delivers it to your device, so Expo and Apple handle the text of the notification on the way. The registration does not include your name, email, workouts, food log or health information, and we do not use the push token for advertising or analytics. We remove the push token when you sign out on that device, when you turn notifications off for FitStreak (the next time you open the app), when Expo or Apple tell us it no longer works, when the app has not been opened on that device for 60 days, and when you delete your account. If you sign out while offline, the token stays until one of the other cases happens or the next account that signs in on that device takes it over. You can turn notifications off at any time in iOS Settings > Notifications > FitStreak.
• Strava - Only if you connect a Strava account in Profile (you need to be signed in). You approve the connection on Strava’s own page, which lets FitStreak read your activities and nothing else. Strava gives us an access token and your Strava athlete ID, which are stored only on our servers (Supabase), never in the app. When you record a new activity, Strava tells us and we import its type, title, start time, duration, distance and calories into your workout history so it counts toward your streak. We do not send Strava any of your FitStreak data. You can disconnect at any time from Profile, which withdraws our access at Strava and deletes the stored token.

Other than AppsFlyer and Apple Search Ads measurement as described above, we do not use advertising networks or data brokers, and we do not sell your data.

6. Where Your Data Is Stored

Data is always stored locally on your device. If you sign in, your synced data, AI usage records and, if you allow notifications, your push token are also stored on Supabase in the United States. Data is encrypted in transit (TLS) and at rest. If you do not sign in, your workouts, food log, body weight and other personal data stay on your device; only the limited analytics, crash reports, attribution and support data described in section 5 are sent, and they never include your name or email.

Several of the services above are in the United States, so if you live in the EEA, the UK or Switzerland your data is transferred outside it. Those transfers rely on the safeguards in each provider’s data processing terms, such as the European Commission’s Standard Contractual Clauses or the EU-US Data Privacy Framework.

7. How Long We Keep It

• Your synced data, account, support history and Strava connection: until you delete your account (or disconnect Strava).
• AI usage records (your account ID, request type, time, and token-based cost totals, never your prompt or photo): records older than 12 months are pruned during later AI activity, so they may remain longer while the service is inactive.
• Push token, time zone, app version and app language: until you sign out on that device, turn notifications off for FitStreak, the token stops working, the app has not been opened on that device for 60 days, or you delete your account (see Expo in section 5).
• Coaching message log, if we send you a comeback message (the date, a rough time-away range, whether the text was written by AI, delivery status, and a fingerprint of the text, not the text): 60 days, or until you delete your account.
• PostHog: session recordings 30 days, usage events up to one year.
• Reports and blocks: until either account is deleted.
• Answers to the in-app recommendation question given while signed in: until you delete your account. Answers given while signed out are not linked to anyone and are kept to help us improve the app.
• Crash reports, Google Analytics and AppsFlyer data: for the retention period set in each service, and no longer than we need it for the purposes in section 4.

8. What Other Users Can See

Your profile is private by default. Nothing you do is visible to other users unless you turn on Public Profile in Profile > Settings.

While Public Profile is on, anyone using FitStreak, signed in or not, can see your display name, avatar (including any equipped avatar frame), level, XP and current streak on the leaderboard and in the weekly league. Signed-in users can also find you in friend search, where they see the same details plus any commitment challenge you currently have active, and your friends see them in their friends list. Your workout history, food log, personal details, and settings are never shared. Turning Public Profile back off removes you from the leaderboard and from search.

Once someone becomes your friend (accepted request), they can see those same profile stats even if you later turn Public Profile off. A pending, not-yet-accepted request also shows those stats to the other person, but only while your profile is public.

You can report another person’s display name, or block them, from their row on the leaderboard, in the league, in search or in your friends list. We keep a record of each report (who reported, whose name, the name as it was, the reason and when) and of each block, so we can review reports and keep blocked people apart. A name that breaks our Terms may be hidden from other people. Reports and blocks are deleted when either account is deleted.

If you and a friend agree to be streak buddies, each of you can see whether the other has completed a workout on a given day, and the shared streak that builds from it. Neither of you sees the other’s workouts, food log, or body measurements. Either of you can end it at any time from the Friends tab.

If you joined with a friend’s invite code, you can send a friend request to the person who invited you. We use the code you redeemed to address the request. Once it is sent, you see their display name and avatar in your sent requests, and their stats only once they accept. Friends can also send each other a cheer, a preset emoji with no text. We store who sent it, to whom, which emoji and when, show it on the recipient’s Home screen, and delete it when either account is deleted.

9. Your Choices and Rights

• Share usage data (Profile): turns off Google Analytics, PostHog (including session recordings), AppsFlyer and Apple Search Ads measurement on this device. It stays off until you turn it back on, including after you sign out. If your device is set to a region in the European Economic Area or the United Kingdom, the app asks you after your first workout, and no usage analytics, session recording or ad measurement starts until you choose to share.
• Tracking: you can change your App Tracking Transparency answer at any time in iOS Settings > Privacy & Security > Tracking.
• Permissions: Apple Health, camera, photos, calendar and notifications can each be turned off in iOS Settings. Turning notifications off also removes your push token from our servers the next time you open the app.
• Export: Profile > Export my data gives you a copy of everything the app holds about you, signed in or not. The export is a JSON file built on your device and shared wherever you choose; it is not uploaded anywhere.
• Delete: see section 10.

Depending on where you live, you may also have the right to access, correct, delete or receive a copy of your personal data, to restrict or object to how we use it, and to withdraw consent at any time without affecting what was done before. To use any of these rights, email fitstreak.app@outlook.com; we will answer within one month. If you are in the EEA or the UK you can also complain to your local data protection authority.

If you are a California resident: we do not sell your personal information. When you tap Allow on the tracking prompt, attribution data is shared with an ad network as described in section 5, which California law may treat as “sharing”; you can stop it by changing that answer or turning off Share usage data. We will not treat you differently for using any of these rights.

10. Deleting Your Data

If you are not signed in, you can delete all local data by uninstalling the app. If you are signed in, you can delete your account from Profile > Delete Account. This permanently removes your account and everything stored about it on our servers (Supabase), including your synced data, your friends, buddies and leaderboard entries, reports and blocks, your push tokens, your Strava connection (and our access at Strava), and your answers to the in-app recommendation question. It cannot be undone.

When you delete your account we also ask PostHog to delete the records it holds under your account ID. Your support messages at Intercom and your purchase records at RevenueCat are deleted when you ask: email us after deleting your account and we will have them removed. Google Analytics, AppsFlyer and Sentry data is not tied to your name or email; Google Analytics events linked to your account ID expire under our retention setting, and you can email us to ask for any of it to be deleted sooner.

Deleting your account does not cancel a subscription, which is billed by Apple. Cancel it first in iOS Settings > your name > Subscriptions.

11. Children’s Privacy

FitStreak is not directed at children under 13, and we do not knowingly collect information from children under 13 years of age. If you believe a child under 13 has given us personal data, contact us and we will delete it.

12. Security

We protect your data with encryption in transit and at rest, access rules that keep each account’s data to its owner, and server-side checks on purchases and AI usage. No system is perfectly secure; if a breach affecting your data happens, we will tell you and the authorities as the law requires.

13. Marketing Communications

If you sign in, we may occasionally email you about product updates, new features, or special offers, using the email (or private relay) address you signed in with. You can unsubscribe at any time using the link in any marketing email, or by contacting us at fitstreak.app@outlook.com. This does not affect account-related emails from Apple itself, which we do not control.

14. Changes to This Policy

We may update this privacy policy from time to time. Any changes will be reflected in the app and on our website with an updated revision date.

15. Contact Us

If you have any questions about this privacy policy or your data, please contact us at fitstreak.app@outlook.com.