Privacy Policy

1. Information We Collect

We collect information you provide directly to us:

• Account information: Email address and password
• Profile information: Name, weight, height, fitness goals
• Workout data: Exercises, sets, reps, weights, performance history, and notes
• Nutrition data: Food entries, macro estimates, and meal photos
• Body metrics: Weight entries, measurements, BMI we calculate from height and weight, and injection or medication logs you choose to enter
• Assistant chat: Messages you send the in-app assistant
• Preferences: Equipment available, training experience, injury and equipment notes, programs you write, AI provider preferences

2. How We Use Your Information

We use your information to:

• Generate workout recommendations and food estimates
• Track your progress and performance over time
• Operate, debug, and improve generation and estimates
• Review short excerpts of flagged inputs for safety
• Communicate with you about your account
• Provide customer support

3. AI Service Providers

FlexFit uses third-party AI services. When you use these features, we send the minimum data needed for that feature to the provider that powers it:

• Anthropic (Claude): Workout and program generation, the in-app assistant, text-based food logging, and (when enabled) automated safety screening of your messages
• xAI (Grok): The same features, when you choose Grok as your AI provider
• OpenAI: Photo-based food logging (the model that looks at a meal photo to estimate portions). We may substitute a comparable vision model if OpenAI is unavailable

Data we may send, depending on the feature you use: your training profile and preferences (including notes about injuries or movements to avoid), recent workout history and session notes, assistant chat messages, meal descriptions, and meal photos.

We do not use your content to train FlexFit's own models. Third-party providers process data under their own terms and privacy policies. We configure API access so providers are not permitted to use your content to train their general models, to the extent their current API terms allow. We do not sell your data to AI providers or any other third parties.

4. Analytics

We use PostHog and Google Analytics to understand how FlexFit is used and to improve the product. They receive usage events (for example, pages viewed and features used), along with device and browser information. We do not send your workout logs, body metrics, or meal photos to either service.

Analytics data is used only to operate and improve FlexFit — it is never sold or shared for advertising.

5. Health and Fitness Data

Some of the information you give FlexFit is sensitive — body weight and measurements, BMI, training history, injury notes, assistant chat about training, photos of your meals, and injection or medication logs. We treat this data with extra care:

• Meal photos are transmitted to our AI providers transiently to estimate nutritional content; we do not use them for any other purpose.
• Your fitness profile, injury notes, workout history, and assistant messages are shared with AI providers only to generate your workouts, recommendations, and assistant replies.
• Injection and medication logs you enter are stored on our servers and are not sent to AI providers.
• When our automated safety screens flag an input, we retain a short excerpt for safety review.
• We never sell health or fitness data, and we do not share it with advertisers.
• When you delete your account, this data is deleted with it (within 30 days, as described under Data Retention).

6. Data Storage and Retention

Your data is stored securely in our database. We retain your information for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required by law to retain it (including short safety-review excerpts, which we keep only as long as needed for that review).

7. Data Security

We implement appropriate technical and organizational security measures to protect your personal information, including encrypted connections (HTTPS) and secure password storage. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

8. Your Rights

You have the right to:

• Access your personal information
• Correct inaccurate data
• Delete your account and associated data
• Unsubscribe from marketing emails we send you

To exercise these rights, please contact us through the app or use Delete My Account in your profile.

9. Cookies and Tracking

We use essential cookies to keep you logged in and remember your preferences. We also use PostHog and Google Analytics for product and traffic analytics (see "Analytics" above), which set their own cookies. We do not use advertising cookies or sell data to ad networks.

10. Third-Party Services

Beyond AI providers listed above, FlexFit may use third-party services for hosting, payments (Stripe), and infrastructure. These services process data solely to provide the App and do not use your data for their own purposes.

11. Children's Privacy

FlexFit is not directed at children under 13, and we do not knowingly collect personal information from children under 13. Users between 13 and 18 may use FlexFit only with the involvement and consent of a parent or legal guardian, as described in our Terms of Service. If you believe a child under 13 has provided us with personal information, please contact us immediately and we will delete it.

12. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any material changes by posting the new policy in the App. Your continued use after changes are posted constitutes acceptance.

13. Contact

If you have any questions about this Privacy Policy, please contact us through the app.