Privacy Policy
Fitterson is made by Lean Digital Agency LLC (“we”, “us”) – the company responsible for the data described here. Fitterson helps you bring your training and health data together in one place. This policy explains what we collect, why, and the choices you have. It is written in plain language – it is a summary of our practices, not legal advice.
What we collect
- Account details – your name, email address, date of birth, and authentication data needed to sign you in.
- Training data – workouts, exercises, sets, reps, load, and training records, including workout sheets you upload.
- Health data – with your permission, activity, cardio, and VO2max metrics from Apple Health on iPhone or Health Connect on Android, plus body-composition and lab results (such as DEXA) you choose to add.
- Your conversations with Ask – the questions you type into Ask and the answers you get back. Your conversation is kept until you clear it or delete your account. Only your most recent conversation is kept – older ones are removed when a new one starts.
How we use it
We use your data only to provide the service: to show your trends and progress, to answer your questions about your own data, and to generate personalized, non-medical suggestions to guide your training. We do not sell it, and we do not use it for advertising.
AI features and our AI provider
Four parts of Fitterson use AI. Ask answers questions about your own data. Insights writes automated training suggestions. The Readiness brief gives a short, non-medical read on what’s driving today’s Readiness. And when you upload a workout sheet, AI reads the photo and turns it into structured sets and reps for you to check before anything is saved. All of it runs on our servers – never in your browser or on your phone.
We use a single external AI provider. What reaches them: the photo when you upload a workout sheet, the question you type into Ask, the parts of your training data, health metrics, profile, and goals needed to answer it, and the answer that comes back. They process this on our behalf, under contract, to return that result and for nothing else.
Two points we want to be precise about rather than reassuring:
- Your inputs and the answers are not used to train our AI provider’s models. That is a commitment in our contract with them, not a setting that could be flipped.
- They are deleted within 30 days by default – not instantly, and not never stored at all. Our AI provider can hold them longer in narrow situations, such as a legal hold or an investigation into a suspected breach of their usage rules.
Ask is software, not a person. It can be wrong or incomplete, so check anything that matters before you act on it, and never treat it as medical advice.
Apple Health data
Health data read from Apple HealthKit is handled with extra care. We never use it for advertising, never sell it, never share it with data brokers, and never sync it to iCloud. We request the minimum read access needed, and you can revoke it at any time in the iOS Health app.
Health Connect data (Android)
Fitterson reads these types from Health Connect: workouts, heart rate, resting heart rate, heart rate variability, sleep, active calories, distance, steps, elevation gained, cardio fitness (VO2max), weight and height. It also asks to read your past data, because your scores compare today with the last few months. Fitterson uses this data to show your training and progress and to fill in your profile, and sends it to our AI provider only to answer your Ask questions and write your Insights and your Readiness brief. Fitterson never writes to Health Connect, never uses this data for advertising and never sells it. You can turn off access at any time in Health Connect.
How it is stored and protected
Your data is stored with our hosting and database provider and transmitted over encrypted connections. Access is enforced at the database layer so that only you can read or write your own records.
Sharing
We do not sell your data and we do not send your health or training data to advertising or analytics services. We share it only with the service providers strictly needed to run Fitterson, and only as described above. Each one works for us under contract, on our instructions, for the job it is there to do and nothing else:
- A web hosting provider, which serves Fitterson’s pages to your browser and, like any web host, records the requests it serves, including the addresses of the pages you open.
- A hosting and database provider, which stores your account, training, and health data.
- A sign-in provider, if you choose to sign in with Apple or with another sign-in service instead of a password. It confirms who you are and tells us your name and an email address – with Apple, an address you can keep private, which we then use for account email exactly as we would any other. We keep a token from Apple so that we can disconnect Fitterson from your Apple ID when you delete your account, and that token is deleted with the account. A sign-in provider never receives your training or health data.
- An AI provider, which receives and returns exactly what is described under AI features above.
- A payments provider and its card processor, which run our subscriptions and our web checkout. The payments provider receives an account identifier and your subscription status – never your health or training data. If you subscribe on the web, the checkout runs inside our page in your browser and the card processor’s own script collects the payment details you enter, so we never see your card details. On iPhone the purchase itself is handled by the App Store, and on Android by Google Play.
- An email provider, which sends account emails such as sign-up confirmations and password resets. It receives the address the message goes to and the message itself, including the sign-in or reset link it carries, and keeps a record of whether it was delivered.
- An app-update service, which the mobile app contacts when it starts to check whether a newer version is available. Those checks carry the app’s version, platform and release channel, and an identifier for this installation of the app – never your account, and nothing from your training or health records. If the app closed with an error the last time it ran, the next check also carries a short copy of that error’s technical message.
- A web-analytics provider, on our public marketing and legal pages only – see below. It never runs on a page that shows your data, and never sees your health or training data.
We describe these providers by what they do rather than by company name, so the list stays accurate if we change one. That applies to our suppliers, not to us: the company responsible for your data is Lean Digital Agency LLC, named at the top of this page.
Analytics on our marketing site
Our public marketing and legal pages – the landing page, this privacy page, and our terms of use – use a third-party web-analytics provider to understand how people find and read the site. It sets cookies and collects standard web-analytics data such as the pages visited, the referring site, and coarse device and location information, and it acts as a data processor on our behalf.
This analytics runs only on those three public pages. No page that shows your data carries it, and it collects no health, training, or account data – none of your workouts, Apple Health or Health Connect metrics, or personal records are ever sent to it.
Age
Fitterson is for adults – you need to be 18 or over to use it. We do not knowingly collect data from anyone younger. We ask for your date of birth when you first sign in. If it shows you are under 18 we cannot create an account, and we delete the one you started, along with its data. If you believe someone under 18 has created an account, contact us at the address below and we will delete it.
Your choices
You can delete your account and all of its data at any time, directly in the app – open your Profile and choose Delete account. Deletion is permanent and removes your training records, health data, uploaded sheets, goals, Ask conversations, and profile. A few things outlive the account. Two of them are operator records that hold no health or training data. If your account was disabled when it was deleted – whether you deleted it or we did – we keep a record of your email address, an internal account identifier, the date, and any note we wrote when we disabled it, so an account opened again with the same address starts disabled rather than active. If we deleted the account rather than you, we also keep an operator record of the email address, an internal account identifier, who deleted it, the date, and any note explaining why. Separately, our AI provider holds whatever you sent to Ask, Insights, the Readiness brief, or sheet scanning for up to 30 days by default, and longer in the narrow situations described above – deleting your account does not shorten that window. Write to us at the address below if you want the records we keep about your deleted account removed. You can also request access to or export of your data, and withdraw consent for health-data processing, by contacting us at the address below.
Contact
Questions or requests: privacy@fitterson.com.