Privacy Policy

1. Who is responsible for your data

The controller is Brand Palace GmbH, Ludwig-Erhard-Straße 1a, 65760 Eschborn, Germany. Registered at the Amtsgericht Frankfurt am Main under HRB 143699. VAT identification number DE463767470. Managing directors: Frederic von Borries and Jonas Müller.

For anything about your data, write to hello@fitivapro.com.

2. What we collect

Account and profile. Email address, name, the role you chose, and optionally a username, phone number, photo and biography.

Health and fitness. Age, height, weight, body fat percentage and activity level. Workouts, exercises, sets, repetitions and personal records. Meals with calories and macros. Drinks you log, entry by entry: what it was (for example tea, juice or beer), the amount, a name of your own if you give one, and for drinks with calories the calories and macros, plus your daily drink goal. Daily check ins covering mood, sleep, stress and energy. Body progress photos. Goals and targets, your step goal included. Health notes you choose to add, such as pain, an injury, a condition, an operation, medication, an allergy or a pregnancy, with an optional body area, severity and since when. Your supplement plan (name, dose, time of day, days and a note) and a tick for each day you took a supplement.

Health data from Apple Health. If you connect Apple Health in the iPhone app, we read steps, distance, active calories, exercise minutes, workouts, weight, height, body fat, sleep duration and resting heart rate. What we keep of it, who sees it and what we never do with it is in section 4.

Settings and consent records. Your reminder settings, for example whether water reminders are on, how often they come and between which hours. Whether your Premium badge shows to others. Whether you share your health notes with your coaches, and a history of each time you switched that on or off, with the time and where the change was made, for example in your profile or through Ava. Your AI consent: whether you agreed or withdrew, to which version of the text, when and where, for example on the consent sheet, in settings or through Ava. For Apple Health, the version of the consent you agreed to, when you connected, the switch for your coach and every change to it, every disconnect and every deletion.

Coaching content. Messages between you and your coach, including any images you send. Coach notes about a client. Check in answers, plans and reviews. When you end a coaching yourself, the time you did.

Bookings and payments. Sessions, packages, events, amounts, currency, dates and status. We never see or store your card details. Payment pages are hosted by Stripe, and we only receive a reference and the outcome. When you buy a paid course we also record your express consent that your access starts before the withdrawal period ends: your name and email, the course and its price, the time, the language and the version of the text you agreed to.

Purchases through Apple. When you buy Premium in the iPhone app, Apple gives us a signed confirmation: the transaction id, the product, the status, until when the subscription runs, whether it renews and whether it was a test purchase. When the subscription renews, you cancel it or Apple refunds it, Apple tells us the new state. We do not receive your Apple ID, your payment method or your billing address.

Sign in with Apple. When you sign in with Apple, Apple gives us an identifier it creates for Fitiva only, and an email address: your real one or, if you hide it with Apple, a forwarding address from Apple. Apple passes on your name only at the very first sign in, and only if you share it. We also keep a token from Apple that lets us end Sign in with Apple for Fitiva when you delete your account. More in section 12.

Another email address you confirm. If your account has a forwarding address from Apple and a coach invited you at your real address, or you booked there as a guest, you can confirm the real address with a six digit code. We never store the code itself, only a check value calculated from it, and it is valid for 15 minutes. We keep the confirmed address with your account, so invitations, guest bookings, courses and tickets sent to it find your account.

Notifications. If you allow the app to send notifications, we keep with your account the device token Apple or Google issues for your device, along with the system (iOS or Android), the app version, the language, when the device was last seen and the last delivery error. For notifications in the browser we keep your browser's push subscription. Also which kinds of notifications you switched off, and when you switched on "Offers".

Addresses you type. A coach studio address or an event venue, including its coordinates. This is a place you enter, not your device location. Who sees a studio address: before a booking, others only see an area of about 500 m around a randomly shifted point and the district or city, never the street. Distances in Find a coach are measured from that point. The exact address is seen by the coach, by athletes with a confirmed session with that coach that is upcoming or at most 90 days ago, by athletes the coach has accepted as regular clients, by a coach who has accepted this coach as their own client, and by our administrators for support. If a coach turns on "Show my exact address publicly", everyone sees it. A booking keeps the place it was confirmed with, also if it is later cancelled or refunded; a coach who moves is not copied into old bookings. From photos a coach uploads to posts, courses or exercises we remove the metadata that holds where they were taken; videos are uploaded as they are.

Location. Find a coach sorts coaches by distance from you. For that, our host Vercel estimates your city and its rough coordinates from your IP address when the page loads, and the country from the same estimate picks the language on your first visit. On the sign up page and in coach setup, that country and the time zone your device is set to tell us whether new accounts are open where you are and which country to suggest. Only when you tap "Use my exact location" in Find a coach does your browser or device ask for your location. We use it only to work out how far each coach is from you, and we do not store it. The estimate from your IP address is not stored either.

Technical. Product usage events, error reports, and an approximate region derived from your IP address by our analytics provider. For error reports from the app, also the device model, system version and app version.

Sign up steps before there is an account. While you have no account yet, we only count how often each step of the sign up is reached: one number per day, step, entry (for example an invitation or a link from the website) and system (browser, iOS or Android). No identifier, no IP address, no device, nothing that points to you.

Referrals. Your personal invite code, the clicks on your invite link without any personal data attached (surface, channel, device class and path, deleted after 90 days if nobody registers), who invited whom, and a hash of your email address that lets us spot duplicate accounts. When you open an invite link we derive a short value from your IP address and the current date, used only to prevent abuse and deleted within 24 hours. We do not store the address itself.

Cancellations and withdrawals. When you use "Cancel contracts here" or "Withdraw from contract here", we store what you enter: the kind of declaration, for an extraordinary cancellation its reason, your name, the email address or addresses you give, the contract you name and the time you ask for, with the time we received it, the account and contracts we matched it to, what we did with it and which emails we sent. If the contract is with a coach, we pass your name, email, the contract and your declaration on to that coach. To prevent abuse we count requests per IP address and per email address in counters that store only a keyed hash, never the address, and keep a keyed hash of your IP address with the declaration.

3. Why we process it, and on what legal basis

To provide the service, Article 6(1)(b), performance of a contract: your account, plans, bookings, messages, payments, the reminders you switch on and the emails that go with them. That includes Sign in with Apple, confirming another email address, the notifications you switched on, and Premium you bought through Apple. Ending Sign in with Apple when you delete your account is something Apple requires of us; we base it on Article 6(1)(b) and (f).

To keep the service working and safe, Article 6(1)(f), legitimate interests: error monitoring, abuse and fraud prevention, rate limiting, and aggregate product analytics. Our interest is running a reliable platform, balanced against your privacy by keeping this data minimal and never selling it.

To show coaches near you, Article 6(1)(f), legitimate interests: the city estimated from your IP address. Your exact location only when you ask for it with the button and allow it in your browser or on your device, Article 6(1)(a).

Badges, Article 6(1)(f), legitimate interests. If you have Premium, your coach, the people in your challenges and coaches whose events you join see a Premium badge next to your name. Our interest is that a membership shows where people already see you by name, balanced against your privacy by showing only yes or no, never a price, term or payment details, and only to these people. The badge is on by default. You can object at any time (Article 21) by switching off "Show Premium badge" under Settings, Privacy; after that nobody but you sees it. We also base the Pro or Elite badge on a coach's public profile on Article 6(1)(f): people looking for a coach should be able to tell which coaches are on a paid plan, because that also shapes the order of the coach search. As a coach you can object under Article 21 by writing to hello@fitivapro.com.

Notifications in the "Offers" group, hints about Premium and about events a coach promotes, only with your consent, Article 6(1)(a). You give it by switching the group on and withdraw it by switching it off.

Friends and challenges with friends, Article 6(1)(b), performance of a contract: your @name, friendships, requests, invite links and workout challenges are part of the feature you choose to use. Steps and active energy from Apple Health in a challenge, and your steps on your profile for friends, only with your explicit consent, Article 9(2)(a) (section 6). Blocking, reports and the checks on @names and titles, Article 6(1)(f), to keep the feature safe for everyone in it.

To meet legal duties, Article 6(1)(c): retaining invoices and payment records for tax and commercial law, and the history of your consents (the health notes sharing switch, Apple Health and the AI features), because Article 7(1) requires us to be able to show your consent.

To be able to show what you agreed to when you bought a course, Article 6(1)(b) and (f): the record of your consent to access before the withdrawal period ends.

To receive, confirm, carry out and keep cancellations and withdrawals, Article 6(1)(c), legal obligation (sections 312k and 356a BGB, and section 257 HGB for keeping them). The abuse checks on these pages, Article 6(1)(f). If the reason you give for an extraordinary cancellation contains health information, we use it only to handle your cancellation, Article 9(2)(f).

To learn why people delete their account, Article 6(1)(f), legitimate interests: the statistics entry without a name that stays when you delete your account yourself (section 9). Our interest is improving Fitiva, balanced against your privacy by the entry holding only coarse facts without a name, being visible to administrators only, and being deleted after 24 months.

Health data, Apple Health and AI features, Article 9(2)(a) and Article 6(1)(a), your explicit consent. For Apple Health and for the AI features we ask for it with a text of its own each. See sections 4 and 5.

What the app keeps on your device (section 8) is strictly necessary for the service you use, section 25(2) no. 2 TDDDG. The counter of sign up steps holds no personal data.

4. Health data, and what makes it special

Weight, body fat, body photos, mood, sleep, health notes, supplements, data from Apple Health and similar entries are data concerning health under Article 9. That category is prohibited from processing unless a specific exception applies. Ours is your explicit consent, which you give by choosing to enter this information, and for Apple Health on the connect sheet.

You are never required to provide it. You can use Fitiva without logging weight, body fat or photos and without connecting Apple Health, though features that depend on them will not work. You can withdraw consent at any time by deleting the entries or your account, and for Apple Health as described below. Withdrawal does not affect processing that already happened.

Your health data is visible to you and your coaches, as this section and section 6 describe, and to nobody else. Body progress photos and meal photos are stored in a private area and served through short lived links, not public addresses.

Health notes in your profile, such as pain, injuries, conditions or medication, are visible to coaches only when you explicitly switch sharing on in your profile, or ask Ava to. The switch covers all your coaches at once. While it is on, every coach you train with sees your notes, and so does a coach you sent a request to in the last 30 days, or with whom you have a session in the last or next 30 days, so they can train you safely from the first session. Past coaches do not. You can switch sharing off at any time, and we keep a history of each time you switched it on or off (section 2).

Your supplement plan and the days you ticked are visible to the same coaches, whether or not you share your health notes. Besides you, only a coach you train with can add to the plan, and that coach changes or removes only what they added.

Names Fitiva does not know yet. When you add a supplement Fitiva does not know, we count how many different people entered the same name, so we can extend the list of known products where it matters. Our administrators see only names at least 5 people entered, and how many, never who entered them. Names that sound like a medicine or a health detail are not shown even then. No name joins the list by itself: we check it and add it only with a source.

Apple Health

In the Fitiva app for iPhone you can connect Apple Health. Before your iPhone asks you, the app shows what it reads and who sees what, and asks for your explicit consent. We record which version of that text you agreed to, and when.

What we read. Steps, distance, active calories, exercise minutes, workouts (type, start, duration, distance and calories), weight, height, body fat, sleep duration and resting heart rate, and only what you allow in your iPhone's dialog. You can change that at any time in your iPhone's settings under Health, Data Access and Devices, Fitiva. We only read and never write anything to Apple Health. We read only while the app is open: when you open it, come back to it, refresh, and on the Activity page, at most every five minutes, the first time the last 30 days.

What we keep. Per day, steps, distance, active calories, exercise minutes, sleep duration and resting heart rate, with your iPhone's time zone. Workouts go into your workout history, weight and body fat as a weigh in, at most one a day, and your height into your profile if it has none yet. We also note which height came from Apple Health.

Who sees what. You see everything. Your coaches see imported workouts, weight and body fat like your own entries; the connect sheet points this out with a tick of its own. A coach sees steps, sleep, resting heart rate and active calories only if you switch on "My coach sees steps, sleep, resting heart rate and active calories", and only a coach you train with right now. The switch starts off. Your coach sees your active calories only for the current day, and the way you see them: as today's calorie goal, lowered by the everyday movement the goal assumed, and as your movement under Training. Ava uses this data, your active calories too, only after your AI consent and only when you ask, never sleep or resting heart rate (section 5).

New version. Your coach and Ava using your active calories came with the version of the connect sheet of 13 October 2026. If you agreed to an earlier version, we ask you once more. Until you agree everything stays as it was: we keep reading and storing your data to show it to you, but your coach and Ava do not get your active calories.

What we never do with it. We never use data from Apple Health for advertising or marketing, and we never sell it. It never goes to our product analytics (PostHog), never into error reports (Sentry), never into the app's cache on your device and never into iCloud. Values measured by Apple Health, that is steps, distance, active calories, exercise minutes, sleep, resting heart rate, weight, body fat and height, never appear in the text of a notification or an email. An imported workout counts there like one you logged yourself, for example in your weekly recap or when your coach hears about your first workout or a streak.

Withdrawing. In settings under Apple Health you can switch off the switch for your coach, disconnect Apple Health (then we read nothing more; what was already imported stays in your history) or choose "Delete imported data" (then we delete every daily value, imported workout and weigh in from Apple Health and disconnect it). A height taken over from Apple Health stays in your profile, and you can change it there at any time. As long as the height there is the one from Apple Health, it never goes into an AI request of your coach (section 5). If you enter a different height, it counts like any entry of your own, and "Delete imported data" then also deletes the height we noted from Apple Health. We record each of these changes with its time.

5. AI features, your consent, and what they send

Meal photo analysis, "Describe a workout", plan generation, progress narratives, body photo analysis and the Ava assistant, and for coaches also reply drafts in the chat and summaries of check ins, are powered by Claude, an AI model operated by Anthropic. When you use one of them, the relevant content is sent to Anthropic in the US to produce a response.

Only after your consent. Before you use one of these features for the first time, we ask you once, explicitly. The sheet tells you which data goes to whom, namely to Anthropic in the US, safeguarded by the European Commission's Standard Contractual Clauses, and that Anthropic does not use it to train its models. Only with "Agree" does anything go to Anthropic. With "Not now" the AI features stay off, and everything else in Fitiva works as usual. We record whether you agreed or withdrew, to which version of the text, when and where. Our server checks your consent before every request to Anthropic; without it, nothing goes there. You can withdraw it at any time in settings under "Privacy & data", at "AI features and Ava", with "Withdraw", and that takes effect at once. If we change the text materially, we ask you again.

Depending on the feature that can include a meal or body photo, your training and nutrition history, the drinks you log, and the figures a plan needs: age, height, weight, body fat and activity level. If you connected Apple Health, it also includes your steps, imported workouts, weight, body fat and height and, if you agreed to the Apple Health version of 13 October 2026, your active calories of the current day, never sleep or resting heart rate. When you ask Ava for advice on your training or on supplements, or about your health notes, it includes your health notes and your supplement plan, so that Ava can, for example, take a complaint into account or tell that a product needs a doctor's advice first. When you ask Ava about your friends, it includes their first names and @names, those of the people whose friend request waits for you, and your challenges with friends: title, days, how many take part, and your own place and score (for a calorie challenge only your place). A friend's numbers never go there.

When your coach uses AI, only with your own consent. A coach's AI features can use the data of an athlete they train: Ava's answers when the coach asks about the athlete, from the athlete's name, age and sex, body values and goals, logged training, food and drinks, daily check ins, chat messages, the notices about their activity and their supplement plan; a reply draft in the chat, written from the athlete's recent chat messages and first name; a summary of a check in, written from the athlete's check in answers and name; AI training and nutrition plans and the timeline for a goal, written from the athlete's name, age, sex, height, weight, body fat, goals and the training of the last weeks; the progress report, written from their logged training, food and weigh ins of the last 30 days; and the body photo analysis of a photo the coach uploads for them, with their age. This goes to Anthropic in the US like everything in this section. If you have a Fitiva account, it happens only after you agreed yourself to our AI consent in its version of 14 October 2026 or later, which names your coach's AI tools. Without that consent your coach's AI features leave your data out and your coach sees a short note instead; Fitiva checks this before every such request. If you agreed to an earlier version, your own AI features keep working as before, and the app offers you the new version without blocking anything. Your health notes go there only if you share them with your coaches, and your Apple Health data never: that goes to the AI only when you ask yourself, and that includes a height taken over from Apple Health. If your coach entered you without a Fitiva account, what your coach typed in about you is your coach's own record and their AI features can use it; once you join with your own account, your consent decides. Names on your coach's list of athletes, your sessions and payments with your coach, and what your coach writes to you are your coach's own records: Ava sees them so it can find the right person and do what your coach asks, never what you logged, wrote or measured without your consent.

Anthropic does not use this content to train its models. It is processed to answer the request and retained for a limited period for abuse monitoring, then deleted.

AI output can be wrong and is not medical advice.

6. Who else can see your data inside Fitiva

Your coach sees the data needed to coach you: your profile, plans, logged workouts, meals and drinks, check ins, body progress and your conversation. If you connect to more than one coach, each sees only their own relationship with you. Data from Apple Health they see as section 4 describes.

Two things belong to you as a person rather than to one coaching relationship: your health notes, once you share them, and your supplement plan with the days you ticked. Each coach you train with sees them, and so does a coach you sent a request to in the last 30 days, or with whom you have a session in the last or next 30 days (section 4).

When you end a coaching. You can leave a coach yourself. Everything you logged yourself (workouts and records, meals, drinks, check ins, body photos, points and your own plans) then moves back to your own account, and that coach no longer sees it. What belongs to your relationship stays with the coach: your chat, bookings, payments, packages, answers to their check in questions, reviews and what the coach wrote. The coach is told by a notification that you ended the coaching.

Other users see only what is deliberately public: a coach's public profile, and reviews you choose to leave. Athlete profiles are never public.

Badges. If you have Premium, your coach, the people in your challenges and coaches whose events you join see a Premium badge next to your name, and nothing else about your plan; you switch it off under Settings, Privacy, "Show Premium badge". For coaches, the public profile shows the Pro or Elite plan as a badge.

The person who invited you learns that someone registered through their link, in which month, and later that "an athlete" or "a coach" made first payments. They never see the amount, the coach or what was booked. They see your name only if you are on their athlete list. When you invite someone yourself, your first name appears on your invite page only if you allowed it.

Friends and challenges with friends

Your @name. If you set up friends, you choose an @name and decide whether anyone who knows your exact @name can find you, or only people with your invite link. Under 18, or without a date of birth, nobody can find you through search. Someone who finds you sees your first name and last initial; only friends see your picture.

What friends see. Your name, your picture, your @name, since when you are friends and the challenges you both take part in. Only if you switch it on, one item at a time: how many workouts you logged or imported from Apple Health this week, your workout streak, and the total of your Apple Health steps of the last 7 days. Friends never see your weight, body values, photos, meals, health notes or anything from your coaching. Your coach sees none of this unless they are also your friend (then they see what you show your friends) or take part in the same challenge. If a friend asks Ava about their friends, your first name and @name are part of that request to Anthropic, never your numbers (section 5).

Challenges with friends. Everyone taking part sees the others' names (friends the full name, everyone else the first name and last initial), pictures only among friends, and each place and the current state of each total since the first day of the challenge. The total is updated as data comes in until the last day, so anyone who looks often also sees how much gets added. A workout challenge counts the completed workouts you logged or imported from Apple Health by the next day (by our server's clock), at most 2 a day. A steps or calorie challenge counts only steps or active energy from Apple Health as daily totals, at most 60,000 steps or 3,000 kcal a day; numbers you type, logged calories and meals never count. The totals are worked out when the leaderboard is shown and are not stored as a list of their own. Calorie challenges are for 18 and over, so we use your date of birth to check your age.

Your explicit consent for health data. Steps and active energy are health data (Article 9 GDPR). Before they count in a challenge, or appear on your profile for friends, you agree with a text of its own that names what is shown, to whom and for which days. Nothing is counted or shown before that, also not for the person who started the challenge. We record when you agreed or withdrew and which version of the text you saw, without any numbers. You withdraw by leaving the challenge or by switching the item off; your number disappears from the leaderboard at once. This applies to the person who started the challenge too: they can leave it, and it goes on for the others. Withdrawing does not affect what was shown before.

Invite links and sharing. An invite link carries a random code, not your name. Whoever opens it sees your first name and last initial before deciding. A result picture you share holds the challenge, its days, your place and only your own number. You choose where to send it, and that app's own privacy policy applies there.

Blocking and reporting. Somebody you block can no longer find, ask or invite you, and you leave each other's challenges; they are not told. If they are your coach or your athlete, your coaching chat is locked too, and they see there that they cannot message you. You can lift a block in your settings under Friends. A reported challenge stays until we have looked at it. A report sends us the reported @name or challenge title and your reason. Our team sees counts, challenge titles and @names, never anybody's scores or health numbers.

We access personal data only where necessary to run the service, respond to a support request, or investigate abuse.

7. Processors and other recipients

Each of these processes data on our instructions under a data processing agreement.

Where a processor operates outside the EU, transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision. We do not sell your personal data and we never have.

Apple is not our processor for some parts of the app but responsible itself, under its own terms and privacy policy: Sign in with Apple and forwarding email to a hidden address, purchases in the App Store, delivering notifications to your iPhone (Apple Push Notification service) and the App Store's rating dialog. For users in the EU that is Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. In the same way, in the browser a notification is delivered by your browser's push service: Google for Chrome, Apple for Safari, Mozilla for Firefox.

Videos from YouTube and Vimeo. If a coach has linked a video on YouTube or Vimeo to an exercise, we load it only when you tap "Load video from YouTube" or "Load video from Vimeo". Only then does your browser or the app connect to YouTube (Google Ireland Limited, Ireland) or Vimeo (Vimeo.com, Inc., USA). The provider receives your IP address and details about your device and may store cookies or similar data on your device, under its own privacy policy. We embed YouTube in its privacy enhanced mode and Vimeo with its setting against tracking. Until you tap, we send them nothing. With "Open on YouTube" or "Open on Vimeo" you watch the video directly on the provider's site instead.

8. Where your data is stored

Your account, content, photos and messages are stored on Supabase infrastructure in the European Union. Encrypted at rest and in transit. Access is restricted at the database level so that one user's rows cannot be read by another. The web app itself, the code your browser loads, is delivered by Vercel (section 7); your account data is not stored there.

On your device

The Fitiva app for iPhone and Android keeps on your device only what it needs to run:

• Your sign in sits in the iPhone's Keychain, and on Android in the system's encrypted storage. It stays on this device, does not go to iCloud and does not move to another device with a backup. After a reinstall you sign in again.
• A cache, so the app shows the last state at once, also without network: plans and exercises, your logged workouts, your coach's posts, events, the list of coaches and the basics of your account, such as name, email, profile picture, role, language, plan and notification settings. Never weight, body fat, body photos, mood, sleep, health notes, supplements, data from Apple Health, meals or water, never chats, notifications or conversations with Ava, and never payments or bookings; of your subscription only which plan applies and until when. It belongs to your account only, is at most 24 hours old and is deleted when you sign out.
• A running workout, after every set, so it is not lost if your device closes the app. It is deleted as soon as you save or leave the workout or sign out, and at the latest 12 hours after the last change.
• Small things such as language, theme, the device token for notifications, which hints you have already seen, and reminders you switch on, such as the end of a rest between sets, which your device shows itself.

In the browser, Fitiva uses your browser's storage for this (section 11).

9. How long we keep it

We keep your data while your account exists. That includes a health note you mark as no longer current: it stays stored, and shared on the same terms, until you delete it or your account. The history of your health sharing switch and the records of your consents for Apple Health and the AI features are kept as long as your account exists. Some things we delete sooner:

• Daily values, imported workouts and weigh ins from Apple Health, as soon as you choose "Delete imported data". A height taken over stays in your profile (section 4).
• A device for notifications, as soon as you sign out on it, switch off notifications for Fitiva in the device's settings, or Apple or Google tells us the token is no longer valid. An account has at most ten devices; when another one is added, the one not seen for longest drops off.
• Challenges with friends, with who took part, 30 days after their last day. Open friend requests after 30 days, declined ones 30 days after the answer, and invite links 30 days after they expired or were reset. The record of your consents for challenges and for steps on your profile is kept as long as your account, like your other consents.
• What the app keeps on your device, as section 8 describes.

When you delete your account we remove your personal data promptly, including everything from Apple Health, your devices for notifications, your confirmed addresses and our record of your purchases through Apple, with seven exceptions.

Invoices and payment records are retained for the periods German tax and commercial law require, up to ten years, because we are legally obliged to keep them.

Messages you sent to another person may remain visible in that person's copy of the conversation, in the same way an email you sent stays in the recipient's inbox.

Reward records with a money value are kept for up to ten years after deletion, limited to recipient, date, kind and value of the reward. Reward records that only concern points are deleted after three years.

Your consent to access before the withdrawal period ends, given when you bought a course, is kept as long as the payment records of that purchase, so we can show it if the right of withdrawal is ever in question.

Cancellations and withdrawals you declare through our online functions are kept until the end of the sixth calendar year after we received them, because received business correspondence must be kept that long (section 257 HGB). This also applies after you delete your account. The hash of your IP address is deleted after 7 days, the abuse counters after 2 days, and a copy of a confirmation email that could not be delivered after 30 days.

Safety reports stay when the account of the person who reported or of the person reported is deleted. What stays: what was reported, the reason, the details given and our decision, plus the name of the person who reported and the name, email address and @name of the person reported, as they were when the report was filed. We keep this as long as we need it to handle the report, to protect everyone on Fitiva from repeated abuse (for example when the same person signs up again), and to establish, exercise or defend legal claims. Legal basis: Article 6(1)(f), our interest and that of everyone on Fitiva in a safe platform, and Article 17(3)(e).

A statistics entry about the deletion stays when you delete your account yourself, so we learn why people leave and can improve Fitiva. It holds the calendar week of the deletion, whether you were a coach or an athlete, roughly how long your account existed (in coarse steps, the shortest is under two days), whether you deleted it in the app or on the web, which steps you had reached in Fitiva (finished onboarding, had a coach or athletes, booked or sold something, ever paid for a plan, connected Stripe, used Ava, logged a workout) and, only if you choose to tell us in the delete dialog, your reason and your comment. We remove email addresses, phone numbers, links and @names from the comment before we store it. The entry holds no name, no email address, no account ID and no payment data. While few accounts are deleted on Fitiva it could still be matched to a person, so only our administrators with two factor sign in can see it, and we do not pass it on or combine it with other data. We delete it after 24 months. If we delete your account for you at your request, no such entry stays; so if you do not want one, write to hello@fitivapro.com from your account's email address before you delete. Legal basis: Article 6(1)(f), our legitimate interest in learning from deletions and improving Fitiva.

Apple keeps its own records of your purchases in the App Store and of Sign in with Apple; Apple's privacy policy applies to those.

10. Your rights

Under the GDPR you have the right to:

• Access your data and get a copy (Article 15)
• Correct anything inaccurate (Article 16)
• Delete your data (Article 17)
• Restrict or object to processing based on legitimate interests (Articles 18 and 21)
• Portability, a machine readable export (Article 20)
• Withdraw consent at any time, including for health data, Apple Health and AI features (Article 7(3))

Two of these are built in. Export your data and delete your account from your settings, under "Privacy & data". The export also holds your data from Apple Health, your consents, your devices for notifications and your purchases through Apple. Deleting is permanent and also cancels an active subscription with us. It does not end a subscription through Apple; you cancel that in your iPhone's settings (section 12). If you sign in with Apple, deleting also ends Sign in with Apple for Fitiva. For anything else, write to hello@fitivapro.com and we will respond within one month.

You withdraw your AI consent in settings under "Privacy & data", Apple Health in settings under Apple Health (section 4), and notifications in settings under notifications or in your device's settings.

You can also complain to a supervisory authority. Ours is Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Postfach 3163, 65021 Wiesbaden. You may equally approach the authority where you live.

11. Analytics and cookies

We use cookies and similar storage that are necessary to run the service, such as keeping you signed in and remembering your language and theme.

For product analytics we use PostHog, hosted in the EU, to understand which features get used. Session recording is disabled, so we do not replay your screen. You can opt out of analytics in your settings, and doing so changes nothing else about how Fitiva works for you.

In the app the same applies: PostHog starts only after you sign in, and your opt out in settings applies there too. The app uses no advertising identifier, shows no ads and does not track you across apps and websites of other companies.

Before you sign in we only count how often each step of the sign up is reached (section 2), without an identifier, an IP address or a device, so with no link to you.

Exercise names Fitiva does not know yet. When you enter an exercise in a workout, a routine or a personal record that is not in our exercise list, we count how many different people use the same name. Our team only sees names that at least five people entered and how many there were, never who. We never show names that sound like medicine or health. We store nothing extra for this: the count comes from the entries that are there anyway. It tells us which exercises the list is missing. Article 6(1)(f), legitimate interests.

12. The Fitiva app for iPhone and Android

The app is the same Fitiva as in the browser, with your account and the data from section 2. A few things come on top, and Apple and Google take part in them.

Sign in with Apple

When you sign in with Apple, Apple checks your Apple ID and gives us an identifier that holds for Fitiva only, and an email address. If you hide your address, we get a forwarding address from Apple ending in privaterelay.appleid.com or private.icloud.com, and Apple forwards the emails we send you to your real address. Apple passes on your name only at the first sign in, and only if you share it; until you enter a name, we do not make one up from your address.

We keep a token from Apple that only our server can read. When you delete your account we use it to end Sign in with Apple for Fitiva, and Fitiva disappears from your Apple ID under "Sign in with Apple". If the token is missing, the app asks you once to confirm with Apple.

If a coach invited you at your real address, you can confirm it with a code we send to that address (section 2). Invitations, guest bookings, courses and tickets sent to that address then find your account. An address only ever belongs to one account.

Notifications

The app never asks at first start, only when a notification is useful to you, and then through your device's dialog. If you allow them, your device gives us a token that our server sends notifications to: on the iPhone through the Apple Push Notification service, on Android through Google's Firebase Cloud Messaging. The title and short text of a notification, such as a sender's name and the start of a chat message, and the page that opens when you tap it, pass through Apple or Google. A notification never contains values measured by Apple Health, such as steps, sleep, resting heart rate or weight (section 4).

You choose which kinds you get in settings under notifications: appointments, messages, plans and check ins, motivation, events, payments and coach insights. "Offers", hints about Premium and about events a coach promotes, stay off until you switch them on yourself. Quiet hours and your switches apply on every device; if no device can be reached, important things come by email as before. When you sign out, we remove the device, so no notification reaches someone else's account.

Purchases through Apple

You can buy Premium in the iPhone app through Apple. Apple handles the purchase and the payment, under its own terms and privacy policy. We receive no payment details and not your Apple ID, but a confirmation of the purchase signed by Apple (section 2), which our server checks. We pass your Fitiva account's identifier into the purchase, so Apple's messages about renewal, cancellation or refund find the right account. With "Restore purchases" you link a running subscription of your Apple ID to the account you are signed in to.

Deleting your Fitiva account does not end a subscription through Apple. Cancel it first in your iPhone's settings under your name, Subscriptions; the app reminds you before you delete.

Permissions

The app asks for a permission only when you use the feature. You can take each one back in your device's settings.

• Camera and photos, to take or choose a meal photo, a body photo or a profile picture, and as a coach to record a video, such as an exercise demo. Photos you take with the app's camera are uploaded without their metadata, so without where they were taken, and they do not land in your photo library.
• Saving photos, only when you save an image from Fitiva, such as an achievement card or a flyer.
• Microphone, only when you record a video, so an exercise can be heard with sound.
• Location, only while you use the app and only when you tap "Use my exact location" in Find a coach. We do not store it.
• Notifications and Apple Health, as described above and in section 4.

Android

The Android app works the same way. Notifications run there through Google's Firebase Cloud Messaging (section 7). We use no other Firebase service, such as Analytics or Crashlytics. There is no Sign in with Apple on Android; an account you created with Apple signs in there with a code by email.

Ratings and updates

When the app asks you for a rating, that is Apple's or Google's own dialog: what you enter there goes to them, and we do not learn whether or how you rate. At start the app asks which version is the minimum; it needs nothing about you for that.

13. Age

Fitiva is not for children. You must be at least 16 to use it, which is the age of consent for information society services in Germany. If we learn that we hold data about someone younger, we delete it.

14. Changes to this policy

We will update this page when our processing changes, and we will tell you by email or in the app before a material change takes effect. The date at the top always reflects the current version.

This website (fitivapro.com)

The sections above cover the Fitiva app and the web app at app.fitivapro.com. The notes for visiting this website itself (hosting and server logs, what the browser stores, the contact form, the newsletter, the maps and the place search through our own server, Near me on the events page and the pin a coach takes into the app) are published in German: Datenschutz, Zusätzlich für diese Website.