FitCraft Studios Inc ("FitCraft", "we") provides the FitCraft app and websites. This policy explains what personal information we collect, how we use it and your choices. Our Consumer Health Data Privacy Policy explains our health-data practices.
The short version
- We collect account details, fitness answers, workout activity, messages you send us and device information to provide and improve FitCraft.
- We use service providers to run FitCraft and advertising partners to measure our marketing. We do not sell your personal information for money or give your body measurements or fitness answers to advertisers.
- You can request access, corrections or deletion, and opt out of marketing.
- When you delete your account in the app, we delete your account and associated personal information from our systems and request deletion of related information held by our service providers. Limited retention exceptions are explained in section 12.
Contents
- Who we are
- What this policy covers
- Information we collect
- Consumer health data
- How we use information
- Automated and AI features
- Who receives information
- Advertising and opt-out
- Location
- Cookies and website storage
- Emails and notifications
- Retention and deletion
- Security
- Your choices
- Privacy rights
- US state information
- EEA, UK and Switzerland
- International transfers
- Children
- Policy changes
1. Who we are and how to contact us
FitCraft Studios Inc is the controller of your personal information.
Email: [email protected]
Address: 224 W 35th St Ste 500 #928, New York, NY 10001, USA
2. What this policy covers
This policy covers our Android and iOS app, getfitcraft.com, lets.getfitcraft.com, links.getfitcraft.com, our emails and notifications, and support communications. It does not cover app stores or other companies' websites, which have their own policies.
3. Information we collect
3.1 Information you give us
- Account and profile: email address, sign-in credentials, name, username and preferences. Google or Apple sign-in provides the details you authorise them to share; Apple may provide a relay email address.
- Fitness and assessment answers: goals, fitness level, training preferences, equipment, age, gender, height, weight, target weight and physical limitations where asked. Web assessments may also ask about your motivation, habits, schedule, energy and feelings about exercise.
- Purchases: subscription, transaction and billing information. App stores or payment providers handle payment details. We do not receive your full card number; for web purchases, we can access limited billing information to manage payments and refunds.
- Support and feedback: your contact details, messages, information you choose to include and our replies. Messages may contain health information if you provide it.
Information needed to create an account, complete a purchase or provide a requested feature is required for that purpose. Other information is optional. If you decline information needed for personalisation, we may be unable to provide the assessment or personalised feature. You can browse our public website without creating an account.
3.2 Information collected automatically
We collect workout and program activity, progress, app and website interactions, purchase activity, email and notification engagement, and device and online identifiers. Technical information includes your internet address, approximate location, browser, device, operating system and app version.
Error reports may include account/contact details, recent activity, diagnostic information and relevant website state or session replay. Push notifications use device tokens and delivery information. Section 10 explains website tracking.
3.3 Other sources
We receive sign-in information from Apple or Google, purchase updates from app stores and payment/subscription providers, and campaign information from attribution providers. We use an email-validation provider for the web assessment. We also derive fitness information, such as BMI and estimated calories burned, from your answers and activity.
4. Body and fitness information (consumer health data)
Body measurements, fitness answers, workout activity, related inferences and health information voluntarily included in messages may be consumer health data. We use it to provide personalised fitness features, show progress, communicate with you, handle support and improve and measure our service.
Our Consumer Health Data Privacy Policy lists the categories, sources, purposes, recipients and ways to access, correct, delete or withdraw consent for this information. We offer the request options described there regardless of where you live. Additional statutory rights depend on the law that applies.
We do not sell consumer health data or share it with advertisers, ad networks or data brokers for targeted advertising. Service providers process it for FitCraft as described in the health-data policy.
5. How we use your information
For EEA and UK users, the following legal bases apply. The additional requirements for health information in section 17 apply to every purpose involving that information, including support and analytics.
| Purpose | Information used | Legal basis |
|---|---|---|
| Provide your account, workouts, progress and personalised audio | Account, profile, fitness and activity information | Contract; explicit consent for health information where required |
| Manage purchases and service messages | Account, transaction and contact information | Contract; legal obligations |
| Answer support requests and feedback | Contact details and message contents | Contract or legitimate interest in assisting you; section 17 applies to health information |
| Improve FitCraft and test features | Activity, assessment answers and technical information | Legitimate interest in improving the service; consent where required for health information or tracking |
| Diagnose errors and protect the service | Error reports, activity and technical information | Legitimate interest in a reliable, secure service; section 17 applies to health information |
| Estimate approximate location and localise FitCraft | Internet address and approximate location | Legitimate interest in localising, understanding and protecting the service |
| Validate email addresses entered in the web assessment | Email address | Legitimate interest in accurate contact details and preventing abuse |
| Send marketing, coaching messages and offers | Contact details, preferences and activity | Consent where required; otherwise legitimate interests in communicating with existing users |
| Measure advertising and campaign performance | Online identifiers, conversion activity and assessment/workout information used by our attribution provider | Consent where required; otherwise legitimate interests in non-sensitive measurement |
| Meet legal duties, prevent abuse and resolve disputes | Relevant account, transaction and other records | Legal obligations; legitimate interests in preventing misuse and protecting legal rights |
We do not make solely automated decisions that produce legal or similarly significant effects on you.
6. Automated and AI features
We do not collect, use or sell your personal information to train large language models.
FitCraft personalises workouts using your answers and activity. We do not send your FitCraft profile or workout history to an outside AI service to generate your plan.
Text-to-speech providers receive short text, including your first name, to generate personalised audio. Automated support tools, including an outside AI service, help sort messages, send acknowledgements and notify our team, using the information in your support message.
7. Who we share information with
7.1 Service providers
Providers receive the information needed for their role. Contracts and data-protection terms limit their use of it, and we require providers to protect it to a standard at least equal to this policy; some also have independent legal, payment or security obligations. Contact us for provider names and privacy information.
| Provider category | Purpose and information involved |
|---|---|
| Hosting, storage and website delivery | Operate FitCraft and store the information described in section 3 |
| Analytics and feature testing | Analyse and improve FitCraft using account/contact details, assessment answers, feedback, activity, device information and online identifiers |
| Subscription management | Manage purchases using account, contact, purchase, device and attribution information; previously supplied profile attributes may remain while retained |
| Attribution and campaign measurement | Measure mobile and website campaigns using contact, account, device and online identifiers, assessment answers, app/workout activity and conversion information |
| Error reporting | Diagnose problems using account/contact details, technical information and relevant app or website activity |
| Email, notifications and support | Deliver messages and handle requests using contact details, notification tokens, message contents and engagement information |
| Voice generation and email validation | Generate personalised audio from short text containing your name; check email addresses supplied in the web assessment |
| Payment processing | Process web payments using billing, payment and transaction information |
Google's Firebase services deliver push notifications. Google Analytics for Firebase on Android records app activity and device information and may access the advertising identifier where available. See Google's Firebase privacy information.
7.2 Advertising partners
Meta and Google receive selected identifiers and conversion activity to measure FitCraft advertising. Depending on the platform, this includes device, cookie and click identifiers, internet address, browser information and registration or purchase events. Meta's web measurement also uses a hash of your email address. We do not send these advertising partners body measurements, fitness-assessment answers or workout-completion details.
These partners may combine information from our services with information collected over time across other websites and apps for their measurement and advertising purposes. Their policies are available from Meta and Google.
7.3 Other recipients
Information may also be disclosed to Apple or Google for sign-in and app-store purchases; professional advisers; authorities where legally required or necessary to protect rights and safety; or a successor in a business transaction. We will notify you before a successor uses your information under a different policy.
7.4 Aggregated and de-identified information
We may retain or share information that cannot reasonably be linked to you, such as aggregate usage statistics. We do not attempt to re-identify it.
8. Advertising, attribution and your opt-out
8.1 Our advertising practices
We advertise FitCraft on other platforms and measure results. We do not show third-party ads inside the app. Some advertising disclosures described in section 7 may count as "sharing" or targeted advertising under US privacy laws, even when no money changes hands.
8.2 Identifiers
Android measurement may use the advertising identifier where available. We do not collect Apple's advertising identifier (IDFA). Website measurement uses the identifiers described in sections 7 and 10. Practices differ between the app and websites.
8.3 Your advertising choices
Email [email protected] with the subject "Do Not Sell or Share" to request an opt-out of advertising disclosures associated with you. You do not need an account to make a request. We may need information about the browser or device involved to locate the relevant records.
You can also adjust your device's advertising settings, browser tracking controls, and Meta or Google ad preferences. These settings have different scopes and may not stop all measurement. Contact us to withdraw consent where our processing relies on it.
9. Location
We estimate country, region and city from your internet address to localise and protect FitCraft and understand usage. We do not collect precise location or request device location permission.
10. Cookies and similar technologies
getfitcraft.com uses Google Analytics to understand visits and page usage, with advertising personalisation disabled. Analytics cookies recognise returning browsers.
lets.getfitcraft.com also uses advertising, attribution and analytics technologies to measure assessments and purchases. Our analytics and attribution providers process assessment answers and activity, which may later be linked to your account. Meta and Google receive the advertising information described in section 7, not those answers.
Website storage also supports sign-in and saves assessment progress. Saved assessment information may remain for up to seven days; session information normally expires with the browser session.
Browser settings can block or clear cookies and other site storage, although this may affect features. Section 8 explains advertising choices, and you can contact us about tracking or consent withdrawal. Our websites do not respond to legacy "Do Not Track" signals.
11. Emails and push notifications
We send account, security, billing and support messages as needed. Marketing and coaching emails include an unsubscribe link; you can also contact us to opt out. We measure email delivery, opens and clicks using tracking images and links. Disabling image loading can limit open tracking. Unsubscribing stops future marketing emails.
Push notifications require your device's permission and can be turned off in its settings.
12. Retention and deletion
We keep personal information only as long as needed to provide FitCraft and fulfil the purposes described here. We consider the information's sensitivity, its purpose, applicable legal duties and your requests.
Our main retention criteria are:
- Account, profile, fitness and workout information: while your account exists, subject to your deletion requests.
- Analytics, error, security and communications records: as needed to understand service performance, investigate problems or abuse, deliver communications and respect your privacy choices.
- Purchase and transaction records: for the applicable tax, accounting, fraud-prevention and payment-dispute periods.
- Support messages: while resolving your request and as needed afterwards for related follow-up or disputes.
- Privacy-request and consent records: as needed to document and continue honouring your choices.
When you delete your account in the app, we delete your account and associated personal information from our systems and request deletion of related information held by our service providers. We also pass requests to other recipients where required.
Limited records may be retained where permitted or required for tax and accounting, payment disputes, security and fraud prevention, resolving support issues, or recording and respecting privacy choices. These exceptions remain subject to applicable deletion requirements.
Temporary backup copies expire through our backup cycle and are not used for ordinary product or marketing activity. Washington law permits up to six months for deletion from archived or backup systems in certain circumstances. Information that can no longer reasonably be linked to you may be retained.
Deletion may take time to complete. We will explain any applicable delay and confirm completion. Section 14 explains how to submit a request.
13. Security
We use technical and organisational measures to protect personal information, including encrypted connections, protected passwords and restricted access. No system is completely secure. We provide breach notifications where required by law.
14. Your choices
- View or correct information: use available profile/settings controls or contact us for other records.
- Delete your account: open Settings > Delete Account in the app. You can also use our account and data deletion form or email [email protected], including to request deletion of particular information.
- Marketing: unsubscribe from emails, change notification permissions, or use the advertising choices in section 8.
- Withdraw consent: contact us. This may limit features that require the information; it does not affect earlier lawful processing.
These contact options are available even if you never created an account. Account deletion does not necessarily cancel an app-store subscription; manage that subscription with the store.
15. Your privacy rights
Depending on applicable law, you may access, correct, delete or obtain a portable copy of your information; restrict or object to processing; opt out of sale, sharing or targeted advertising; limit certain uses of sensitive information; withdraw consent; and complain to a regulator. We will not discriminate against you for exercising your rights.
Where applicable, you may also request a list of third parties to whom we sold personal information.
Right to object: where EEA or UK law applies, you may object to processing based on legitimate interests because of your circumstances. You may object to direct marketing at any time, including related profiling. Contact us to exercise this right.
Contact [email protected]. We may request information needed to verify your identity or locate your records. You do not need to create an account. An authorised agent may act for you with appropriate proof.
We respond within applicable legal time limits and explain any permitted extension. To appeal a refusal, reply to our response. If we deny an appeal, we will explain how to contact the relevant regulator or state attorney general.
16. Additional information for US state residents
This section applies where the relevant state law covers FitCraft and your information. The health-data request options in section 4 are also available.
16.1 California categories
The following categories were collected in the preceding 12 months. The advertising column identifies information disclosed to advertising networks and measurement partners Meta and Google to measure campaigns and conversions; these disclosures may constitute sharing under California law.
| Category | Examples | Disclosed to service providers | Disclosed to advertising partners |
|---|---|---|---|
| Identifiers | Name, email, account, device and online identifiers, internet address | Yes | Selected device, cookie, click and measurement identifiers and internet address; hashed email for Meta web measurement |
| Customer records | Name, email and billing details; payment details handled by our payment processor | Yes | Identifiers only as described above; no payment card details |
| Protected classifications | Age and gender | Yes | No |
| Commercial information | Subscriptions and purchase history | Yes | Selected trial, subscription and purchase events |
| Internet or other electronic network activity | App and website activity, email opens and clicks | Yes | Selected conversion and website measurement events; no workout-completion details |
| Geolocation data | Country, region and city inferred from internet address | Yes | Approximate location inferred from internet address; no precise location |
| Inferences | BMI category, fitness level and relevant coaching or offers | Yes | No |
| Sensitive personal information | Sign-in credentials, health information, and payment details handled by our payment processor | Yes, according to their role | No |
Categories can overlap. We do not collect biometric identifiers or precise location. We do not request professional, educational or sensory information, although support messages may contain information you voluntarily provide.
Sources are you, your use of FitCraft, sign-in, payment/subscription and attribution providers, and inferences we derive (section 3). Service providers receive relevant information for hosting, analytics and testing, subscription management, attribution, error reporting, communications and support, voice generation, email validation and payments, as specified in section 7.1. Sections 5 and 12 explain purposes and retention. Health-data recipients and the categories they receive are also listed in our Consumer Health Data Privacy Policy.
16.2 Sale, sharing and sensitive information
We do not sell personal information for money. Advertising disclosures may constitute sharing for cross-context behavioural advertising. We do not knowingly sell or share information about anyone under 16. We use sensitive information for the stated service purposes and do not provide body measurements or fitness answers to advertisers. To opt out or exercise applicable sensitive-information rights, contact us using section 8 or 15.
16.3 Shine the Light
California residents may contact us to request information about disclosures covered by California's "Shine the Light" law.
16.4 Other states and consumer health data
For Nevada and Connecticut, the categories, sources, purposes and recipients in our Consumer Health Data Privacy Policy also describe our health-data practices. You can use its request and appeal procedures. We do not permit third parties to collect consumer health data through FitCraft for tracking your health-related activity across other websites or services. The advertising practices for other information are described in section 7.
Nevada consumers may also ask us to stop collecting, sharing or selling their consumer health data. Contact us using the request options in section 14.
This notice takes effect on the date above. Changes to these state and health-data disclosures follow section 20.
17. EEA, UK and Switzerland
Section 5 explains our legal bases. Where we rely on legitimate interests, we consider your rights and interests. Where we rely on consent, you may withdraw it at any time.
Fitness information and health details in support messages may be special-category data. Where required, we rely on your explicit consent in addition to the legal basis in section 5. This applies to personalisation, communications, support, analytics and attribution involving such information. This policy itself is not a request for consent.
You can exercise the rights in section 15 and complain to your local authority: EEA authorities, the UK ICO or the Swiss FDPIC.
18. International transfers
FitCraft is based in the United States. Information is processed mainly in the United States and may be processed in other countries where our providers operate. Their laws may differ from yours.
Where required, transfers use applicable safeguards such as standard contractual clauses, with relevant UK or Swiss provisions, or an applicable adequacy framework for eligible recipients. Contact us for information about processing locations and a copy or explanation of the safeguards relevant to your information.
19. Children
FitCraft is intended for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18. Contact us if you believe someone under 18 has provided information so we can investigate and delete it where appropriate.
20. Changes to this policy
We update the date above when we revise this policy. For significant changes, including changes to our health-data disclosures, we provide notice in the app or by email before they take effect. We obtain new consent where required before collecting, using or sharing additional health-data categories or using them for new purposes.