Privacy Policy
Last updated: October 23, 2026 • Version 1.1
With your permission, FitFlow reads health data from Apple Health (sleep, steps, active energy). These are classified as sensitive health data under GDPR Article 9. We only process this telemetry with your explicit consent. We never sell, lease, or monetize your health data, and we never share it with third-party advertising or marketing trackers.
1. Data Controller
The data controller for the FitFlow mobile application and website is FitFlow Studio (company in formation / Sole Proprietorship Thibaut, registered with the Paris Trade and Companies Register - RCS Paris, headquartered in Paris, France — hereinafter referred to as "FitFlow Studio", "we", "us").
Data Protection Contact: privacy@fitflow.studio or dpo@fitflow.studio.
2. Data We Process
The app requires no account and no email address, and has no server or database: the data below is stored only on your device unless stated otherwise.
- Profile: optional first name or nickname, age, sex, weight, height, goal, available equipment.
- Training: workouts, exercises, weights, reps, sets and personal records.
- Apple Health Data (with your permission): read: sleep duration and phases (deep, REM, awakenings), step count and active energy; written: your completed strength workouts and calories burned. Data read from Apple Health is used only on your iPhone to adapt your workouts: FitFlow does not store it, copy it to iCloud or share it with any third party.
- Manual health entries: sleep and steps you enter yourself, kept on the device.
- Nutrition: logged meals and foods, scanned barcodes, water intake; meal photos only if you use the photo scan (see section 5).
3. Legal Basis for Processing
- Contract performance (Art. 6.1.b GDPR): workout plans, progressive overload, nutrition targets and checking your FitFlow Pro access.
- Explicit consent (Art. 6.1.a & Art. 9.2.a GDPR): connecting Apple Health (sleep, steps, active energy) to adapt workout volume and load, and sending meal photos to a third-party AI.
4. Data Retention
- On your device: data is kept while the app is installed. It is included in your device backup if iCloud Backup is on (except data read from Apple Health, which FitFlow never stores).
- Deletion: Profile → Erase all personal data immediately and permanently deletes all app data from the device. Older device backups are replaced at the next iCloud backup. Uninstalling the app also removes its data from the device.
- Apple Health: workouts written to Apple Health stay in the Health app, where you can delete them.
5. Storage, Security & Third-Party Services
FitFlow Studio runs no server and does not receive your data. It is stored in the app's protected space on your device. We never sell or share data with advertisers and use no advertising or behavioral tracking tools. Only the following services receive data, and only when you use the related feature (over HTTPS):
- AI Meal Photo Analysis (third-party AI): Google LLC, through the Gemini API. A meal photo is only sent after you give explicit consent in the app, before the first scan, and you can withdraw it at any time in Profile. Only the resized photo is sent, with no profile or health data. FitFlow does not keep it on any server; Google processes it under the Gemini API terms. Transfers are covered by the EU Standard Contractual Clauses and the EU-U.S. Data Privacy Framework.
- Food search and barcodes: Open Food Facts (open database). The barcode or search text is sent to look up nutrition values, with no other data.
- Subscriptions: Apple (App Store) processes payment; RevenueCat receives an anonymous app user ID and the subscription status to check Pro access. No health data is sent to them.
6. Your Privacy Rights
Under GDPR Articles 15 to 22, you have the following rights:
- Erasure: Profile → Erase all personal data, at any time, immediately and permanently.
- Portability: export your data in JSON format from Profile.
- Withdrawing consent: disconnect Apple Health in Profile or in the Health app; turn off AI photo analysis in Profile. Core features remain available.
7. Minimum Age & Minor Protection
Due to the collection and processing of physiological and athletic health data (GDPR Article 9), FitFlow is strictly intended for individuals aged 15 years or older (digital consent majority under French Law no. 2018-493 for personal data processing). Any use by individuals under 15 requires express prior consent from a parent or legal guardian.
8. Contact & Regulatory Authorities
For any inquiries regarding this policy or to exercise your privacy rights, contact privacy@fitflow.studio.
You also retain the right to lodge a complaint with your local supervisory authority (in France, the CNIL at cnil.fr).