Privacy Policy

Last updated: [Effective date]

Draft — legal review required. This document is a working template. Replace every [bracketed] placeholder with your real company details and have it reviewed by qualified legal counsel before launch.

This Privacy Policy explains how [Company Legal Name] (“fit.gg”, “we”, “us”) collects, uses and shares personal data when you use fit.gg and related services (the “Service”). We are the controller of your personal data.

1. Data we collect

Account data: name, email address and password (stored hashed) when you create an account.
Onboarding & health inputs: the answers you give during the quiz — fitness level, goals, available time, injuries or limitations. Some of this may be health-related data, which we process only to build and adapt your training plan, based on your consent.
Usage data: sessions completed, streaks, progress, and interactions with the Service.
Technical data: device, browser, IP address, and cookie identifiers.

2. How we use your data

To create, personalize and adapt your training plan.
To operate, secure and improve the Service.
To communicate with you about your account and the Service.
To measure performance and understand how the Service is used (analytics).

3. Legal bases (GDPR)

Where the GDPR applies, we rely on: performance of a contract (providing the Service), your explicit consent (for health-related inputs and non-essential cookies), our legitimate interests (securing and improving the Service), and legal obligations.

4. Cookies

We use essential cookies to run the site and, with your consent, analytics cookies to understand usage. You can change your choice at any time via the cookie banner or your browser settings.

5. Sharing & processors

We share data with service providers acting on our behalf (e.g. hosting, analytics, email, payment). Current processors include [list processors, e.g. Vercel, analytics, payment provider]. We do not sell your personal data.

6. International transfers

Where data is transferred outside your region, we use appropriate safeguards such as the EU Standard Contractual Clauses. Details available on request.

7. Retention

We keep personal data for as long as your account is active and as required to provide the Service, then delete or anonymize it, subject to legal retention obligations.

8. Your rights

Depending on your location you may have the right to access, correct, delete, restrict or port your data, to object to certain processing, and to withdraw consent. To exercise these rights, contact us at [privacy email]. You may also lodge a complaint with your local data protection authority.

9. Security

We use technical and organizational measures to protect your data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Children

The Service is not directed to children under [16]. We do not knowingly collect data from children under that age.

11. Changes

We may update this policy. Material changes will be notified via the Service or by email. The “last updated” date reflects the latest version.

12. Contact

[Company Legal Name], [Address], [City, Country]. Email: [privacy email].