Privacy Policy

Last updated: August 3, 2026

1. Data Controller

The data controller responsible for your personal data is:

Sylwester Kamys
Operating as: FitnessSwipe
Email: support.fitnessswipe@gmail.com
Website: fitnessswipe.app

2. What Data We Collect

We collect the following categories of personal data:

• Account data: email address, password (encrypted)
• Profile data: name, age, gender, country, city, bio, profile photos
• Fitness data: training goals, fitness level, experience, preferred exercises, training schedule
• Workout history: workout dates, types, duration, ratings, notes, and training partners
• Health data (optional): step count, exercise sessions and workout distance from Health Connect (Android) or Apple Health (iOS) — only if you grant permission (see section 9)
• Body measurements (optional): body circumferences, weight, measurement goals and private progress photos you choose to record (see section 10)
• Location data: approximate GPS coordinates (used to find nearby partners), and precise locations you explicitly choose to share in a chat message
• Content you create: chat messages, photos, voice messages, GIF and sticker selections, 24-hour workout stories (photos/videos with interactive stickers such as slider reactions and countdown timers), reactions and comments
• Usage data: swipes, matches, messages, profile views, story views, app activity
• Verification data: verification photo (stored securely, not public)
• Device data: push notification token, device type
• Diagnostic data: crash reports and error logs (device model, OS version, app version, technical error details — see section 4)

3. How We Use Your Data

We use your personal data for the following purposes:

• To create and manage your account (legal basis: contract performance)
• To show you relevant training partner suggestions nearby (legal basis: contract performance)
• To enable messaging between matched users (legal basis: contract performance)
• To verify your identity and ensure platform safety (legal basis: legitimate interest)
• To send push notifications about matches and messages (legal basis: consent)
• To improve the app and fix technical issues (legal basis: legitimate interest)
• To comply with legal obligations (legal basis: legal obligation)

4. Data Sharing

We do not sell your personal data. We share data only with:

• Supabase (supabase.com) — our database provider, servers in EU (Frankfurt). Data Processing Agreement in place.
• OpenAI (openai.com) — for AI bio generation and profile verification. Only the data you explicitly submit for these features is shared.
• Expo (expo.dev) — for push notifications delivery.
• GIPHY (giphy.com) — for GIF and sticker search in chat and workout stories. Only your search query is sent (never linked to your identity by us); GIF and sticker images are loaded from GIPHY's servers.
• Google Maps / Apple Maps — for map previews when you choose to share a location in chat.
• Sentry (sentry.io, Functional Software Inc.) — for crash reporting and error diagnostics, so we can find and fix technical problems. Crash reports contain technical data only (device model, OS and app version, error details); data is processed in Sentry's EU region. Health data, body measurements, messages and photos are never included in crash reports.
• Resend (resend.com) — for delivering transactional emails (account emails, data exports, notifications) from our domain.
• Apple / Google — for app distribution via App Store and Google Play.

All third-party processors are bound by data processing agreements and comply with GDPR.

5. Data Storage and Security

Your data is stored on Supabase servers located in Frankfurt, Germany (EU). We implement appropriate technical and organizational measures to protect your data, including:

• Encrypted passwords (never stored in plain text)
• Encrypted data transmission (HTTPS/TLS)
• Row-level security in our database
• Regular security reviews

6. Data Retention

We retain your personal data for as long as your account is active. When you delete your account:

• Your profile, photos, and messages are permanently deleted within 30 days
• Your location data is deleted immediately
• Anonymized usage statistics may be retained for analytics

In addition, regardless of account deletion: 24-hour workout stories (photos/videos) are automatically and permanently deleted from our servers shortly after they expire, and crash reports are retained by our error-reporting provider for a limited period (currently 30 days) before automatic deletion.

7. Your Rights Under GDPR

As a data subject, you have the following rights:

• Right of access — request a copy of your personal data
• Right to rectification — correct inaccurate data
• Right to erasure — delete your account and all associated data
• Right to restriction — limit how we process your data
• Right to data portability — export your data in a structured format
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — withdraw consent for push notifications at any time

To exercise any of these rights, contact us at support.fitnessswipe@gmail.com. We will respond within 30 days.

8. Location Data

We request access to your device location to show you training partners nearby. Location is:

• Only collected when you grant permission
• Stored as approximate coordinates (not exact address)
• Updated when you open the app
• Never shared with other users in precise form (only approximate distance is shown)
• Deleted when you delete your account

9. Health & Fitness Data (Health Connect / Apple Health)

FitnessSwipe can optionally connect to Health Connect (Android) or Apple Health (iOS). This is entirely optional — the app is fully functional without it.

• What we access: step count, exercise sessions (activity type and duration) and workout distance. We do not read any other health data types.
• Why: solely to power features you actively use: (a) step-based challenges and 1-on-1 duels that you voluntarily join; (b) pre-filling an activity sticker (e.g. distance and duration of today's run) on a workout story you choose to publish; (c) an optional daily step counter on your own profile — off by default, shown to others only after you enable it with an explicit toggle in settings.
• What is stored: aggregated totals only (e.g. step totals for a challenge, today's step count, the distance you placed on a sticker) — not raw sensor data, not continuous history.
• Who can see it: challenge/duel scores are visible to participants of that challenge or duel; an activity sticker is visible to people who can see the story you published it on; your daily step count is visible on your profile only if you enabled the toggle. Nothing is shared without an action you take.
• Limited use: health data is never used for advertising, marketing, or profiling, is never sold, and is never shared with third parties. Our use complies with Google Play's Health Connect permissions policy and Limited Use requirements.
• Your control: you can revoke access at any time in the Health Connect app (Android) or Health app (iOS) settings, or disconnect in FitnessSwipe. Stored totals are deleted when you delete your account.

10. Body Measurements & Progress Photos

FitnessSwipe includes an optional body tracking feature where you can record body circumferences, weight, measurement goals and progress photos.

• Private by default: your measurements, goals and progress photos are visible only to you. Progress photos are stored in private storage and are accessible only through short-lived signed links generated for your account.
• Sharing with a trainer (optional): you can grant a specific trainer you chat with read-only access to your numeric measurements and goals. This requires your explicit action (a per-trainer toggle), and you can revoke it at any time. Progress photos are never shared with anyone — not even trainers.
• Deletion: you can delete individual photos and measurements in the app at any time; everything is permanently deleted when you delete your account.
• Body measurement data is never used for advertising or profiling and is never sold.

11. Photos and Verification

Profile photos are stored securely and displayed to other users as part of your profile. Verification photos are stored separately and are never visible to other users — they are used only for identity verification purposes.

AI-powered verification is processed by OpenAI. The verification photo is sent to OpenAI's API solely for verification and is not used for training AI models (we use the API with data opt-out enabled).

12. Children's Privacy

FitnessSwipe is not intended for users under 18 years of age. We do not knowingly collect data from minors. If you believe a minor has created an account, please contact us immediately at support.fitnessswipe@gmail.com.

13. Cookies

The FitnessSwipe mobile app does not use cookies. Our website (fitnessswipe.app) may use essential cookies for functionality only.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via the app or email. Continued use of the app after changes constitutes acceptance of the updated policy.

15. Complaints

If you believe we have not handled your data correctly, you have the right to lodge a complaint with your national data protection authority. In the Netherlands: Autoriteit Persoonsgegevens. In Poland: UODO.

16. Originality Statement

FitnessSwipe was developed independently and does not copy or reproduce any other application or platform. Any similarity to other services is purely coincidental. The personal data collected by FitnessSwipe is processed solely for the purposes described in this Privacy Policy and is not shared with or derived from any other application.

17. Contact

For any privacy-related questions or to exercise your rights:
Email: support.fitnessswipe@gmail.com
We aim to respond within 5 business days.