Privacy Policy

This Privacy Policy explains how Fit7 PRO (the "Service") collects, uses and protects your personal data. It applies to all users of the Service worldwide, including users in the European Union and Colombia.

1. What data we collect

• Account data: your name and email address, provided when you register.
• Fitness profile data: information you give us voluntarily, such as weight, height, age, fitness goals, dietary restrictions and preferences. This is what the AI uses to personalize your routines and meal plans.
• Usage data: your activity inside the app — completed workouts, tracked progress, plans generated, coaching interactions — so the Service can follow your progress.
• Device identifier: a pseudonymous device ID used to prevent fraud and free-trial abuse. It is stored in your browser's local storage and in a cookie (see section 7).
• Push notification tokens: if you enable notifications, we store the token needed to deliver them (a maximum of 10 devices per account).
• Payment data: we never receive or store your card details. Payments run through Polar, which shares with us only your subscription status and customer identifier.

2. How we use your data

• To create your account, authenticate you and keep your profile (account data — performance of our contract with you).
• To generate your personalized workout routines, calorie targets and nutrition plans (fitness profile data — performance of our contract with you).
• To track your progress and let the virtual coach work (usage data — performance of our contract with you).
• To manage your subscription: knowing whether you are premium, when it renews, and letting you manage or cancel it (payment status from Polar — performance of our contract with you).
• To prevent fraud and free-trial abuse (device identifier — our legitimate interest in protecting the Service).
• To send you service notifications such as payment confirmations or account security notices (performance of our contract with you).

Your health and fitness data (weight, height, age, injuries, training history) is used exclusively by Fit7 PRO's AI engine to generate and adjust your personal plan. We do not sell, rent, license or share your personal data with third parties for marketing, advertising or any commercial purpose outside operating the Service. The only parties that process your data are the infrastructure providers listed in section 7, acting on our instructions.

3. AI-generated content and third-party AI providers

To generate personalized routines and nutrition plans, the Service sends the minimum necessary profile information (your fitness data and the request context) to AI providers: Google Gemini (Google) and OpenRouter, which routes requests to third-party AI models. These providers process the data on our instruction to produce your plans. We do not send your account password or your payment details to AI providers.

AI-generated content may occasionally contain errors; it is informational and not medical advice — see the medical disclaimer in our Terms of Service.

4. Other service providers we share data with

• Google Firebase / Google Cloud — hosts the Service infrastructure: your account, profile and app data are stored in Firestore (Google Cloud, including data centers in the United States). Firebase Authentication manages your login.
• Polar, LLC — our Merchant of Record. It processes your payment, collects applicable taxes, and shares with us your subscription status, subscription plan and a customer identifier so the app can grant you premium access. Polar is the controller of the payment and tax data it collects at checkout; see its own privacy policy at polar.sh/privacy.
• Google Gemini and OpenRouter — AI generation (section 3).

We share personal data only with these providers, and only to the extent needed to run the Service. We may also disclose data if required by law or valid legal process.

5. Data retention

• Your account, profile and usage data are kept while your account is active.
• When you delete your account, your personal data is deleted from our production database. De-identified or aggregated information that can no longer be linked to you may be retained.
• Subscription records (payments, invoices) are retained by Polar for accounting and tax purposes as required by law.
• Device identifiers used for fraud prevention may be retained after account deletion to prevent repeat trial abuse, for a limited period.

6. Your rights

Depending on your country of residence, you have the right to access your personal data, correct it, delete it, object to or restrict its processing, and receive a copy of it (data portability). You can exercise most of these rights directly in the app:

• Edit your data: from your Profile screen inside the app.
• Delete your account and data: from the app — Profile → "Delete Account". This deletes your account and personal data immediately.
• Anything else: write to info@fit7pro.com and we will respond within a reasonable period (and within 30 days where GDPR applies, or 15 business days where Colombian Law 1581 of 2012 applies).

If you are in the EU/EEA and believe we have not handled your request properly, you may lodge a complaint with your national data protection authority.

7. Cookies and local storage

The Service uses a minimal set of browser storage, strictly functional — no advertising or tracking cookies:

• Session storage to keep you logged in (Firebase Authentication).
• Local storage and a device cookie (omnifit_device_local_id) to remember your device for fraud prevention. The cookie intentionally survives logout so trial abuse cannot be reset by clearing the session; it contains a random identifier, not personal data.
• Preferences (such as theme) saved in local storage.

Because these are strictly necessary for the Service you asked for, we do not require a consent banner for them.

8. Security

Your data is protected by Firebase security rules that restrict access to your own records, encrypted transport (HTTPS everywhere), and backend-only fields that the app cannot write (such as your payment status). Access to production infrastructure is restricted to the operator. No system is perfectly secure, but we take reasonable technical and organizational measures proportional to the sensitivity of the data.

9. International compliance

• GDPR (EU users). We rely on contract performance (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f)) as legal bases. Data is hosted on Google Cloud (Firebase), which offers standard contractual clauses for transfers. Where our providers transfer your data internationally, they apply the safeguards required by European law.
• Colombian Law 1581 of 2012. As the operator is established in Colombia, we also comply with the Colombian data protection regime (Ley 1581 de 2012 and Decreto 1377 de 2013): you may access, update, rectify and request deletion of your data, and revoke authorization, by writing to the contact email above. Your data is treated as confidential information.
• Other users. We apply the same standards described in this policy to all users worldwide, regardless of residence.

10. Children

The Service is not directed to children under 18, and we do not knowingly collect data from them. If you believe a minor created an account, contact us and we will remove it.

11. Changes to this policy

We may update this Privacy Policy as the Service evolves. The "Last updated" date shows the current version; material changes will be communicated through the Service or by email.

12. Contact