FitCraft is a fitness app made by FitCraft Studios Inc. This policy explains what information we collect when you use the FitCraft app, our websites and our emails, why we collect it, who we share it with, how long we keep it, and the choices and rights you have.
We have tried to write it in plain language. If anything is unclear, email us at [email protected].
The short version
- We collect the information you give us (such as your email, name, fitness and body answers, support messages and feedback), information about how you use FitCraft (such as workouts completed and screens viewed), and technical information from your device.
- We work out your approximate location (country and city) from your internet address. We never ask for, and the app cannot access, your device's GPS location.
- Your body measurements and fitness answers are used to build your workouts and are kept inside FitCraft and the service providers that run FitCraft for us. We do not sell them and we do not give them to advertisers.
- We use device and account identifiers and selected conversion events to measure which advertising works. Our attribution provider also processes app events and web-assessment activity for our attribution and measurement, but we do not configure it to send workout-completion events, body measurements or fitness-assessment answers to Meta or Google. Under some US state laws, the advertising-measurement disclosures may count as "sharing". See section 8.
- We use a small number of outside AI services for limited functions such as name screening and text-to-speech. We do not send those services your FitCraft profile or workout history. See section 6.
- You can delete your account at any time from Settings in the app. This permanently deletes your profile and the personal information linked to it from our systems. Sections 12 and 14 describe the limited records that remain and how to have service-provider records deleted as well.
Contents
- Who we are and how to contact us
- What this policy covers
- Information we collect
- Body and fitness information (Consumer Health Data)
- How we use your information
- Artificial intelligence features
- Who we share information with
- Advertising, attribution and your opt-out
- Location
- Cookies and similar technologies on our websites
- Emails and push notifications
- How long we keep information
- How we protect information
- Your choices: account, deletion, marketing
- Your privacy rights
- Additional information for US state residents
- Additional information for the EEA, UK and Switzerland
- International transfers
- Children
- Changes to this policy
1. Who we are and how to contact us
FitCraft is operated by FitCraft Studios Inc, a company registered in the United States.
Postal address: 224 W 35th St Ste 500 #928, New York, NY 10001, USA
Email: [email protected]
For the purposes of the EU and UK General Data Protection Regulation, FitCraft Studios Inc is the "controller" of your personal information.
2. What this policy covers
This policy covers:
- the FitCraft mobile app for Android and iOS, including in-app purchases;
- our websites at getfitcraft.com (information and articles) and lets.getfitcraft.com (the web assessment and web checkout), and short links at links.getfitcraft.com;
- emails and push notifications we send you;
- support conversations with us.
It does not cover the Apple App Store, Google Play, or the websites of other companies we link to. Those have their own privacy policies.
3. Information we collect
3.1 Information you give us
Account information. When you create an account we collect your email address and, if you choose an email and password sign-in, a password. We store only a one-way hash of your password, never the password itself. If you sign in with Google or Apple, we receive the account identifier and the name and email address that provider shares with us under the permissions you grant. Apple may provide a relay email address instead of your usual address.
Profile information. Your first name, the username you choose, and the trainer you select.
Onboarding and assessment answers. When you set up the app, and if you take our web assessment, we ask questions so we can build a plan for you. Depending on the version of the assessment, these include your fitness goal, how you prefer to train, how long you want workouts to be, your current fitness level, the equipment you own, your preferred workout style and intensity, your gender, your age, your height, your weight and your target weight. From your height and weight we calculate a body mass index (BMI) and a BMI category. The web assessment also asks about your motivation, habits, schedule, energy, what usually gets in the way of exercising, how you feel about exercise and your body, and whether you enjoy games and rewards.
Section 4 explains how we treat the body and health-related part of this information.
Purchases. When you subscribe through the Apple App Store or Google Play, payment is handled by Apple or Google and we never receive your card number, bank details or billing address. When you subscribe through our web checkout at lets.getfitcraft.com, payment is processed by our payment processor through our subscription-management service: you enter your card details on the hosted checkout page and they go to the payment processor, not to our servers. The processor holds your name, card and billing details in our merchant account so we can confirm payments and issue refunds; there we can see your name, the card type and the last digits of your card, but never the full card number. In every case we receive confirmation of the purchase, the product you bought, the price and currency, and the start and renewal dates.
Support and feedback. If you contact us or submit app or workout feedback, we collect your message, any information you choose to include, and our reply. Free-text messages may contain fitness, body or health information if you choose to include it.
3.2 Information we collect automatically
Activity in the app. Which workouts and programs you start and complete, how much of a workout you finished, your streaks, game level, achievements, the screens and features you use, when you open the app, paywalls you see, and similar events. This is how we keep your progress, give you rewards, and understand which parts of the app work.
Device and technical information. Device model, operating system and version, app version, language, time zone, network type (wifi or cellular), a session identifier, and a random identifier we create for analytics. On Android, if advertising identifiers are enabled on your device, our measurement partners receive your Android advertising ID (see section 8).
Internet address and approximate location. Our servers receive the internet address (IP address) your device uses to connect. We and our content delivery provider use it to estimate your country, region and city. Section 9 explains this in detail. We do not collect precise location and the app does not ask for location permission.
Crash and error reports. If the app or website crashes or hits an error, we collect a technical report so we can investigate it. Depending on where the error occurs, this may include the error, diagnostic logs and breadcrumbs, the steps taken before it, account id or email attached to the session, attribution or deep-link information, device or browser information, operating system, app version and a replay of relevant website state around an error.
Push-notification data. If you enable push notifications, we process a push token, permission status, device and app identifiers, campaign or journey identifiers, delivery and open events, and any deep link used to open the app.
Email and notification engagement. When we send you email we can see whether it was delivered, opened or clicked, and whether it bounced. When we send a push notification we can see whether the device accepted it.
Web analytics. On our websites we use analytics cookies to count visits and understand which pages are read. Section 10 explains this.
3.3 Information from other sources
Sign-in providers. Google and Apple, as described above.
App stores and our subscription service. Apple, Google and our subscription-management service tell us about purchases, renewals, cancellations, refunds and billing problems so your subscription works.
Install attribution. When you install FitCraft after tapping a link or an ad, our mobile attribution provider tells us which campaign, link or ad led to the install. See section 8.
Email validation. On our web assessment, the email address you type is checked by an email validation service to filter out mistyped and disposable addresses.
4. Body and fitness information (Consumer Health Data)
This section provides factual information about FitCraft's body, fitness and consumer health data practices for everyone. The specific consent requirements and legal rights described here apply where the law provides them, including under the Washington My Health My Data Act and similar laws in Nevada and Connecticut.
4.1 What we collect
The following information could reveal something about your physical health and is treated as consumer health data:
- height, weight and target weight;
- body mass index (BMI) and BMI category, which we calculate from your height and weight;
- age and gender, when combined with the above;
- your stated fitness level, fitness goal, and activity level;
- which workouts and programs you do, how much of each you complete, and when;
- estimated calories burned and other inferences we create about fitness or physical health;
- any answers you give about physical limitations in the web assessment, where that question is asked; and
- fitness, body or health information you choose to include in support messages or free-text feedback.
We do not ask for heart rate, steps, sleep, menstrual or nutrition data in the app, connect to Apple Health, Google Fit or a wearable, or collect biometric identifiers. A support message or free-text response may nevertheless contain health information that you choose to provide.
4.2 Where it comes from
From you when you answer questions, contact us or submit feedback; from your use of the app when you do workouts; and from inferences FitCraft creates from that information.
4.3 Why we collect it
- to build and adapt your workout plan, pick suitable exercises and set intensity;
- to estimate calories burned and show you progress, streaks and achievements;
- to decide which in-app messages, offers and coaching prompts to show you (for example a reminder based on your chosen training days, or a plan suited to your level);
- to measure whether campaigns lead to completed assessments and active FitCraft users, using our mobile attribution provider as described below; and
- to understand, in aggregate, how people with different starting points use the app, so we can improve it.
4.4 Who receives it
We do not sell consumer health data or disclose it to Meta, Google, data brokers, or ad networks. The service providers listed below process some consumer health data on our behalf for the specific purposes shown in the table:
| Service provider | What it receives | Why |
|---|---|---|
| Our cloud hosting, database and data warehouse providers | All of the above | Storing your profile and running our analytics |
| Our analytics provider | Your answers, workout activity and app or workout feedback, linked to analytics or account identifiers | Product analytics |
| Our subscription-management service | Your answers (as "subscriber attributes") and workout counts | Deciding which subscription offer to show you and linking purchases to your account |
| Our mobile attribution provider | Mobile workout-completion information, such as timing, program or workout name, completion, score and difficulty, and website assessment answers and completion information, linked to attribution identifiers | Measuring whether campaigns lead to people who complete the assessment and actively use FitCraft. We do not configure it to forward workout-completion events, body measurements or fitness-assessment answers to Meta or Google |
| Our email delivery provider | Streak and workout counts used inside emails we send you | Sending you email |
| Our crash-reporting service | Technical context and, when an error occurs during a workout, limited workout state | Crash reporting |
4.5 Your rights over this information
You can see and change available profile answers in the app. Where applicable law provides these rights, you may ask us to confirm and provide a copy of the consumer health data we hold about you, withdraw consent from future collection or sharing, delete the data, or identify the third parties or affiliates that received it and provide their active contact information. Email [email protected] to make a request or withdraw consent. When required, we notify processors and other recipients of a deletion request. We will respond within the time the law requires, and you may appeal our decision by replying to our response.
5. How we use your information
| What we do | Information used | Legal basis (EEA and UK users) |
|---|---|---|
| Create and run your account, sign you in, recover your password | Account information | Performance of our contract with you |
| Build, adapt and deliver your workout plan and coaching | Onboarding answers, body and fitness information, activity | Performance of our contract; for body and health data in the EEA and UK, explicit consent where required |
| Track progress, streaks, levels and achievements | Activity | Performance of our contract |
| Process subscriptions and purchases, and handle refunds and billing problems | Purchase information, account id | Performance of our contract; legal obligation (tax and accounting) |
| Send service messages (verification, password reset, receipts, subscription changes) | Email address, push token | Performance of our contract |
| Send marketing and coaching email or push notifications about FitCraft | Email address, push token, subscription status and activity used to personalise the message | Consent where required; otherwise our legitimate interest in communicating with existing users. Where activity is consumer health or special-category data, affirmative or explicit consent where required. You can opt out at any time |
| Fix crashes and errors, keep the service secure | Crash reports, device information, internet address | Legitimate interest in a working, secure service |
| Understand how the app is used and improve it, run experiments and feature tests | Activity, device information and onboarding answers | Legitimate interest for non-health product analytics; affirmative or explicit consent where required for consumer health or special-category data and tracking technologies |
| Measure which ads and links bring people to FitCraft and whether campaigns lead to completed assessments and active users | Advertising identifier, attribution identifier, FitCraft account identifier, internet address, install and selected conversion events, web-assessment answers and workout-completion information processed by our attribution provider | Affirmative or explicit consent where required for consumer health or special-category data and tracking technologies; otherwise legitimate interest for non-sensitive attribution and measurement |
| Estimate country, region and city and localise the service | Internet address and approximate location | Legitimate interest in localising, understanding and protecting the service |
| Validate an email address entered in the web assessment | Email address | Legitimate interest in data accuracy and preventing abuse |
| Screen usernames and names for offensive content | The text you type | Legitimate interest in keeping the service safe |
| Generate a personalised spoken line | A sentence containing your first name | Performance of our contract; legitimate interest in providing the requested voice feature |
| Answer your support requests | Your email and its contents | Legitimate interest in supporting you |
| Comply with law, enforce our terms, protect rights and safety | Any | Legal obligation; legitimate interest |
We do not use your information to make decisions with legal or similarly significant effects on you.
6. Artificial intelligence features
FitCraft uses automated rules and a limited number of outside AI services.
Your workout plan is personalised inside FitCraft's own systems. The choice of program, exercises, intensity and coaching messages is driven by rules that read your profile, answers and activity. We do not send your FitCraft profile, body measurements, fitness answers or workout history to an outside AI service to build your plan. The support-message exception below applies to information you choose to write to us.
Outside AI services may process limited information for these functions:
- Name and username screening. When you choose a username or display name, the text you type is sent to a content-moderation service to check that it is not offensive. We do not intentionally include your account identifier, device information, body information or workout history with that text.
- Spoken welcome and coaching lines. When your trainer says your name out loud, the sentence containing your first name is sent to a text-to-speech provider to generate the audio. Only the sentence to be spoken is sent.
7. Who we share information with
We do not sell your personal information for money. We share it in the ways below.
7.1 Service providers acting for us
These providers help us run FitCraft. Contracts and data-protection terms limit how they may use information as appropriate to their role; some providers may also process information independently where required by law, payment-network rules or their own security obligations. Providers are described by their role; we will tell you who any of them are if you ask at [email protected].
| Provider | What it does for us | Information it receives | Its privacy policy |
|---|---|---|---|
| Cloud hosting, database, content delivery and data warehouse providers | Run our servers, store our data, protect and deliver our websites, and hold our analytics warehouse | All information in section 3, as it passes through and is stored in our systems | Names available on request |
| An analytics provider | Product analytics | Account id, random analytics id, email, first and last name, username, onboarding and web-assessment answers, app or workout feedback, activity, device information and internet address | Name and privacy policy available on request |
| A feature-testing service | Feature flags and experiments (deciding which version of a feature you see) | Account id, random analytics id, device information, internet address | Name and privacy policy available on request |
| A subscription-management service | Subscription management across the App Store, Google Play and web checkout | Account id, purchase history, device identifiers including the advertising identifier where available, internet address, attribution identifier, and profile attributes (email, name, onboarding answers, level, workout counts) used to choose which offer to show you | Name and privacy policy available on request |
| A mobile attribution and measurement provider | Mobile and website attribution and campaign measurement | Android advertising ID where available, attribution install or browser id, FitCraft account identifier, internet address, device and browser information, install information, mobile events such as login, onboarding completion, game level, workout completion, registration (including email) and account deletion, and web-assessment answers and conversion activity described in sections 3 and 4 | Name and privacy policy available on request |
| A crash-reporting service | Crash and error reporting | Account id or email attached to a session, device and browser information, operating system, app version, error details, diagnostic logs and breadcrumbs, attribution or deep-link information, and relevant website state captured around an error | Name and privacy policy available on request |
| Google (Firebase Cloud Messaging) | Delivering push notifications to Android and iOS | Push token, device and app identifiers | https://firebase.google.com/support/privacy |
| Google (Google Analytics for Firebase) | On Android, the Firebase messaging library includes Google's analytics component, which records basic app events such as app open and screen view and may access the Android advertising ID | App events, device information, Android advertising ID | https://firebase.google.com/support/privacy |
| An email delivery provider | Sending our email | Email address, first name, username, and the workout and subscription details that appear in the email; delivery, open and click events | Name available on request |
| An AI content-moderation service | Screening usernames and names (section 6) | The text you typed | Name available on request |
| An AI assistant service | Automated sorting of incoming support email | The text of emails sent to our support address | Name available on request |
| Text-to-speech providers | Generating trainer voice audio (section 6) | The sentence to be spoken, including your first name | Names available on request |
| An email validation service | Checking email addresses typed on the web assessment | The email address you typed | Name available on request |
| A payment processor | Payment processing for the web checkout, through our subscription-management service | The name, card details and billing information you enter at checkout, and your transaction history. Card details go directly to the payment processor; in our merchant account we can see your name, card type and last digits, and we use that access to confirm payments and issue refunds | Name and privacy policy available on request |
7.2 Advertising and attribution partners
Meta and Google receive selected identifiers and conversion events so we can measure our advertising. For the mobile app, our attribution provider sends only the events that we map in its partner settings; workout-completion events, body measurements and fitness-assessment answers are not mapped to either company. Website measurement uses the tags described below. These companies may use information they receive for their own measurement and advertising purposes. Section 8 explains this and how to opt out.
| Partner | What it does | Information it receives | Its privacy policy |
|---|---|---|---|
| Meta (Facebook and Instagram) | Measures selected mobile-app and web conversion events. For the mobile app, the mapped events include app open, registration, onboarding completion, gamification level-up, trial, purchase, renewal and cancellation events; they do not include workout completion. On lets.getfitcraft.com, the Meta Pixel measures assessment and checkout activity | For the mobile app, mapped event types, configured event values and measurement identifiers. For the website, Meta Pixel cookie ids, a hash of your email address, a device identifier we generate, internet address, browser information, and events such as page view, lead, checkout started and purchase. Meta does not receive body measurements, fitness-assessment answers or workout-completion events through our attribution provider | https://www.facebook.com/privacy/policy/ |
| Google Ads | Measures selected mobile-app and web conversion events. For users attributed to Google, the mapped mobile events include app open, registration, login, onboarding completion, trial and purchase events; they do not include workout completion. Website tags measure assessment and checkout conversions | For the mobile app, mapped event types, configured event values and measurement identifiers for Google-attributed users. For the website, Google click and cookie identifiers, conversion events, and a hash of your email address for purchases. Google does not receive body measurements, fitness-assessment answers or workout-completion events through our attribution provider | https://policies.google.com/technologies/partner-sites |
7.3 Other companies in specific situations
- Apple and Google, when you sign in with them or buy through their app stores. They act as independent companies, under their own privacy policies.
- Professional advisers, such as lawyers and accountants, where necessary.
- Authorities, if we are required by law, court order or legal process, or to protect the rights, property or safety of FitCraft, our users or others.
- A buyer or successor, if FitCraft Studios Inc is involved in a merger, acquisition, financing, reorganisation or sale of assets. We would tell you before your information became subject to a different privacy policy.
7.4 Aggregated and de-identified information
We may share or publish information that does not identify you, for example aggregate statistics about how many workouts users complete. We do not attempt to re-identify this information.
8. Advertising, attribution and your opt-out
8.1 What we do and do not do
We do not show third-party ads inside FitCraft, and we do not sell your information to advertisers or data brokers. We do not share your body measurements, health-related answers, or the content of your workouts with advertising partners.
We do advertise FitCraft on other platforms and measure whether those ads work. Our attribution provider processes attribution identifiers and app events for FitCraft as described in section 7.1. We configure it to send Meta and Google only the selected conversion events described in section 7.2, not workout-completion events. Our web assessment and checkout also use the website measurement tags described in section 10.
Some of the disclosures to Meta and Google are "tracking" in the sense used by Apple and "sharing" for cross-context behavioural advertising under California and some other US state laws, even though no money changes hands. We do not send those companies the consumer health information described in section 4.
8.2 Identifiers involved
- Android advertising ID. Available to our partners on Android if you have not turned off ads personalisation or deleted the identifier in your device settings (Settings, Google, Ads).
- Apple advertising identifier (IDFA). The app does not currently request permission to track under Apple's App Tracking Transparency framework, so on iOS our partners do not receive the IDFA.
- Our own identifiers. A random identifier created by the attribution software and your FitCraft account identifier.
- Internet address. Our attribution provider receives your internet address when providing attribution services. Website measurement tags also receive the internet address used to connect to the website.
- Website identifiers. Meta cookie identifiers, Google click and cookie identifiers, a browser or device identifier we generate, browser information, and a hash of your email address where used.
- Conversion information. The selected event types and configured event values described in section 7.2.
8.3 How to opt out
- Email us at [email protected] with the subject "Do Not Sell or Share" to request that we stop future advertising-measurement disclosures associated with your account. This does not automatically control anonymous browser or device identifiers that are not linked to the account, so use the controls below as well.
- On Android, reset or delete your advertising ID and turn off ads personalisation in your device settings.
- In your browser, block third-party cookies or use the Meta and Google ad settings pages.
These choices reduce or stop future advertising-measurement disclosures depending on the identifier and device involved. They do not affect service-provider processing described in section 7.1 or stop us from showing our own content inside the app.
9. Location
FitCraft does not request or use your device's location. There is no location permission in the Android app, and the iOS app does not ask for location access.
Our servers and content-delivery provider use your internet (IP) address to estimate country, region and city. This is approximate and may be wrong. We store the latest estimate on your account and include it in analytics. We use it to choose currency and measurement units, tailor communications by country, understand where users are located, and protect our servers from abusive or repeated requests. It does not come from GPS, wifi or Bluetooth scanning.
10. Cookies and similar technologies on our websites
getfitcraft.com (articles, guides and the homepage) uses Google Analytics 4 to count visits and see which pages are read. The analytics script is served from our own domain, ad personalisation and Google signals are switched off, and requests are relayed through our own server so Google does not receive your internet address directly. A first-party cookie (_ga) holds a random id so repeat visits can be counted. No advertising cookies are set on getfitcraft.com.
lets.getfitcraft.com (the web assessment and checkout) additionally uses the Meta Pixel, Google Ads conversion tags, our attribution provider’s web software and analytics software, as described in sections 7 and 8. These set cookies and read identifiers so that an ad can be connected to an assessment or purchase. Individual question-and-answer events and completed-assessment details are recorded by our analytics and attribution providers, linked to browser or device identifiers; analytics records may later be linked to your account after you create one. Meta and Google receive the conversion events described in section 7.2, not the assessment answers.
The web assessment also uses local and session storage to hold a browser or device identifier, the email address you enter, an account session token and your in-progress quiz state. Quiz and device state may remain for up to seven days so the assessment can be restored; session data normally expires with the browser session.
You can control cookies and other browser storage through your browser settings. Blocking cookies alone may not block or clear local or session storage; use your browser's site-data controls to clear those items.
Do Not Track. Our websites do not respond to browser "Do Not Track" signals, because no common standard exists for how to interpret them.
11. Emails and push notifications
Service emails. We send emails needed to run your account: verification codes, password resets, receipts, subscription and billing notices, and replies to your requests. You cannot opt out of these while you have an account.
Marketing and coaching emails. We also send tips, reminders, offers and messages from your trainer. Each marketing message has an unsubscribe link, and you can also unsubscribe by emailing us. We use an email delivery provider to send email and record whether messages are delivered, opened or clicked, using a small invisible image and rewritten links; you can prevent open tracking by turning off image loading in your email app.
Push notifications. With your device's permission we send reminders, streak and achievement notices, and coaching prompts. Turn them off in your device settings at any time. We deliver notifications through Google's Firebase Cloud Messaging on both Android and iOS (on iOS, via Apple's push service).
12. How long we keep information
We keep personal information only for as long as reasonably necessary for the purposes in this policy, to provide your account, comply with law, resolve disputes, prevent fraud and abuse, and enforce our agreements. The principal retention criteria are:
- Account, profile, body, fitness and workout information is kept while your account exists. Using Delete Account permanently deletes your profile, sign-in credentials and the personal information linked to your account from our systems, including your body and fitness answers, workout and program history, messages and chat history, inventory and analytics records. We keep a minimal deletion record (an account identifier, the date, the platform and the age of the account) so we can prove the deletion happened; it contains no profile information. To have personal information held by our service providers deleted as well, use the account and data deletion request form in section 14 or email [email protected]; we pass those requests to the providers concerned. What remains is limited to the categories below: purchase and transaction records, support messages, deletion records, temporary backup copies and information already held by the advertising partners described in section 7.2.
- Analytics, crash, security and communications records are kept for as long as needed to understand service performance, investigate errors or abuse, communicate with you and honour privacy choices.
- Purchase and transaction records are kept for as long as tax, accounting, fraud-prevention and payment-dispute requirements apply.
- Support messages are kept while we handle the request and for a reasonable period afterwards to maintain a record of the issue and its resolution.
- Deletion, consent, opt-out and suppression records are kept as needed to prove and continue honouring your request.
- Backups and technical logs may retain information temporarily until they are overwritten or expire under our normal backup and log-management procedures. While retained for those purposes, the information is not used for ordinary product or marketing activity. For consumer health data subject to Washington law, deletion from archived or backup systems may take up to six months where the law permits.
- Aggregated or de-identified information may be retained when it can no longer reasonably be linked to you.
- Information received by the advertising partners in section 7.2 is subject to their retention practices. Where required and technically available, we pass deletion or opt-out requests to them.
13. How we protect information
We use encryption in transit (TLS) between the app, our websites and our servers. Passwords are stored as one-way hashes. Production credentials and data access are restricted to the people who run the service. Our hosting providers maintain physical and network security for their data centres.
No system is perfectly secure. If we learn of a breach that affects your information we will notify you and the relevant authorities as the law requires.
14. Your choices: account, deletion, marketing
See and change your information. Profile fields and available answers can be viewed or changed through the relevant profile and settings screens. You may also contact us about information that is not available there.
Delete your account. In the app, open Settings and choose Delete Account. This permanently deletes your profile and the personal information linked to your account from our systems, subject to the limited records described in section 12. You can also request deletion without the app, ask us to delete specific data, or ask us to pass a deletion request to the service providers that process personal information for us, using our account and data deletion request form or by emailing [email protected]. We will process the request after confirming your identity.
Marketing email. Use the unsubscribe link in any marketing email, or email us.
Push notifications. Turn them off in your device settings.
Advertising measurement. See section 8.3.
Sign-in connections. You can revoke FitCraft's access to your Google or Apple account in your Google or Apple account settings. You will then need another sign-in method to use the app.
15. Your privacy rights
Depending on where you live, you may have the right to:
- know what personal information we have about you and get a copy;
- correct inaccurate information;
- delete your information;
- restrict or object to certain processing, including marketing;
- port your information to another service in a machine-readable form;
- opt out of the sale or sharing of personal information and of targeted advertising;
- withdraw consent at any time where we rely on consent, without affecting processing that already happened;
- not be discriminated against for exercising these rights;
- appeal a decision we make about your request;
- complain to a data protection authority.
To exercise any of these, email [email protected] from the email address on your account, or tell us how to verify that the account is yours. We may ask for enough information to confirm your identity and we will only use it for that. An authorised agent may make a request for you if they show us they are authorised. We respond within the time the applicable law allows and will tell you if a permitted extension is needed.
16. Additional information for US state residents
This section supplements the rest of the policy for residents of US states whose privacy laws apply to FitCraft. Section 4 separately covers consumer health data.
16.1 Categories of personal information (California)
In the last 12 months we have collected the following categories, as defined in the California Consumer Privacy Act, from the sources and for the purposes described in sections 3 and 5:
| Category | Collected | Examples in FitCraft | Disclosed to service providers | Sold | Shared for cross-context behavioral advertising |
|---|---|---|---|---|---|
| A. Identifiers | Yes | Email, name, username, account id, random analytics id, advertising ID (Android), attribution id, internet address | Yes | No | Yes (advertising ID where available, measurement identifiers, internet address, website cookie and click identifiers, and hashed email where used) |
| B. Customer records (Cal. Civ. Code 1798.80) | Yes | Name, email; for web checkout purchasers, billing name and payment card information held by our payment processor | Yes | No | No |
| C. Protected classifications | Yes | Age, gender | Yes | No | No |
| D. Commercial information | Yes | Subscription and purchase history | Yes | No | Yes (trial and subscription conversion events) |
| E. Biometric information | No | ||||
| F. Internet or other network activity | Yes | In-app activity, screens viewed, email opens and clicks, website browsing on our sites | Yes | No | Yes (selected mobile conversion events and website measurement tags) |
| G. Geolocation data | Yes, approximate only | Country, region and city estimated from internet address; never precise | Yes | No | Yes (advertising and measurement services may infer approximate location from an internet address) |
| H. Sensory data | No | ||||
| I. Professional or employment information | No | ||||
| J. Education information | No | ||||
| K. Inferences | Yes | BMI category, fitness level, which offer or coaching message suits you | Yes | No | No |
| L. Sensitive personal information | Yes | Account sign-in credentials (password hash); payment card details collected by our payment processor during web checkout; information about health to the extent body measurements and BMI are treated as such | Yes | No | No |
We use sensitive personal information for the purposes described in sections 4 and 5, including personalising the fitness service and protecting your account. We do not sell it, disclose it to Meta or Google, or use it for cross-context behavioural advertising.
16.2 Sale and sharing
We do not sell personal information. We do share the identifiers and events listed in section 8 with advertising measurement partners, which California treats as "sharing". We do not knowingly sell or share personal information of consumers under 16.
To opt out, see section 8.3.
16.3 Shine the Light
California residents may ask once a year what personal information, if any, we disclosed to third parties for their own direct marketing. We do not disclose personal information to third parties for their own direct marketing purposes.
16.4 Other states
Residents of states with comprehensive privacy laws have the rights in section 15, including the right to opt out of targeted advertising and the sale of personal data, and the right to appeal. To appeal a decision, reply to our response and say you want to appeal; if we deny the appeal, we will tell you how to contact your state attorney general.
17. Additional information for the EEA, UK and Switzerland
Legal bases. The table in section 5 shows the legal basis for each use. Where we rely on legitimate interests, we have balanced them against your rights. Where we rely on consent, you can withdraw it at any time.
Health data. Your height, weight, BMI and fitness answers may be "special category" data under the GDPR. Where explicit consent is required, we rely on that consent in addition to the legal basis described in section 5. Consent is separate from this privacy policy and can be withdrawn by changing or deleting the relevant information where that control is available, deleting your account, or contacting us. Withdrawal does not affect processing that was lawful before withdrawal.
Your rights. You have the rights in section 15, including access, rectification, erasure, restriction, objection and portability. You can also complain to your local supervisory authority. For the EEA, a list is at https://edpb.europa.eu/about-edpb/about-edpb/members_en. In the UK, the Information Commissioner's Office is at https://ico.org.uk. In Switzerland, the Federal Data Protection and Information Commissioner is at https://www.edoeb.admin.ch.
18. International transfers
FitCraft Studios Inc is in the United States and our servers and service providers are located mainly in the United States. If you use FitCraft from outside the United States, your information will be transferred to, stored and processed in the United States and in any other country where our providers operate.
Where applicable law requires a transfer safeguard, we use a mechanism appropriate to the recipient, such as the European Commission's Standard Contractual Clauses, an applicable UK transfer addendum or agreement, or the EU-US Data Privacy Framework for a recipient certified under it. Contact us for information about safeguards relevant to your information.
19. Children
FitCraft is intended for adults, and you must be at least 18 to create an account. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has given us personal information, email [email protected] and we will investigate and delete it where appropriate.
20. Changes to this policy
We will update this policy when our practices change. The effective date at the top tells you when it was last revised. For significant changes we will provide notice in the app or by email before they take effect. Where law requires consent before we collect, use or share a new category of consumer health data or use it for a new purpose, we will request that consent before the change applies.