Privacy policy

Overview

This policy explains what BirFit ("we") collects when you use the BirFit mobile app and this website, why we collect it, and the choices you have. Short version: we collect what is needed to build your plan and run the app, we do not sell it, and you can export or delete it at any time from the app.

1. What we collect

Account, profile, activity and technical data, as listed below. We do not collect location, contacts, photos, advertising identifiers or health data from other apps.

• Account: e-mail address, name, password (stored only as a salted hash), or the identifier and e-mail provided by Google or Apple if you sign in with them; preferred language, e-mail verification status, and the date you accepted automated analysis.
• Profile: gender, age, height, weight, fitness goal, training place, equipment, experience level, training days per week and diet preference. These are health-related data and are collected only to build and adjust your plan.
• Activity: generated plans and programs you create; logged workouts (exercises, sets, reps, weight, duration, start and finish time); body weight entries.
• Technical: device language, app version and the IP address of requests, kept in server logs for up to 30 days for security and troubleshooting. Workout reminders are scheduled on your phone and never leave it.

2. Why we use it

Each purpose rests on one legal basis.

3. Automated analysis

Your profile answers are analysed automatically to produce a plan. This is the only automated decision in the app, it has no legal or similarly significant effect on you, and you can regenerate or replace the plan at any time. You must accept this before an account is created, and you can withdraw consent by deleting your account.

4. Who we share it with

We do not sell personal data and we do not show ads.

• Hosting: our servers run in the European Union. Data is stored in a database and media storage we control.
• Plan generation: profile data (never your e-mail or name) is sent to a third-party model provider under a data-processing agreement, for the sole purpose of producing your plan. It is not used to train their models.
• E-mail: a transactional e-mail provider delivers codes and notices.
• Sign-in: Google or Apple, only if you choose them.

5. How long we keep it

• Account, profile and activity data: until you delete your account.
• Password reset and verification codes: 15 minutes.
• Sign-in sessions: 30 days of inactivity.
• Server logs: up to 30 days.
• Backups: up to 14 days after deletion.

6. Your rights

You can see and edit your profile in the app. From Profile you can export everything we hold as a file and delete your account, which removes all data immediately (backups follow within 14 days). If you signed in with Apple, the Apple session is revoked at the same time. Where the GDPR applies you also have the rights of access, rectification, erasure, restriction, portability and objection, and the right to complain to your supervisory authority.

7. Children

BirFit is for people aged 16 and over. We do not knowingly create accounts for anyone younger; if you believe one exists, contact us and we will delete it.

8. Security

All traffic is encrypted in transit. Passwords are hashed. Access tokens are short-lived and refresh tokens are rotated. Uploads are checked before they are stored. Our staff can access production data only for support and operations, and only when needed.

9. This website

The website sets no tracking cookies and uses no analytics that identify you. Fonts and images are served from our own infrastructure or the font provider.

10. Changes and contact

We will announce material changes in the app before they take effect. Questions and requests: [email protected].