We collect only what is necessary to run the service:

• Account: name, email address, hashed password (or Google ID if you use OAuth)
• Health & fitness: weight, height, age, gender, calorie & macro logs, food diary, exercise logs, step count, water intake, sleep, vitals, supplement and medicine schedules, body measurements, meal photos
• App preferences: timezone, goals, notification settings, coach tone, theme
• Technical: session identifiers, your IP address (stored temporarily in login-verification tokens to rate-limit abuse), push-notification device tokens

Health data is special category personal data under GDPR Art. 9. We process it only with your explicit consent, given at account creation, solely to provide the fitness coaching service.

• Showing you your own nutrition, fitness and progress data
• Generating personalised AI coach feedback (see section 3 below)
• Sending optional daily summary emails and push reminders (only if you enable them)
• Maintaining a pseudonymous leaderboard (only if you opt in)

We do not sell your data, use it for advertising, or share it with third parties except as described in section 3.

Fitos uses AI to power food logging, coaching, and performance reviews. Depending on your Settings, prompts are sent to one of these external AI providers acting as data processors under GDPR Art. 28:

• Claude (Anthropic) — Privacy policy · DPA
  API data not used for training by default (opt-out available in API console)
• Gemini (Google DeepMind) — Privacy policy · DPA
  DPA available via Google Cloud
• Groq (Groq Inc.) — Privacy policy · DPA: contact provider
  Requests deletion of API data on processing; confirm DPA with Groq support

What is sent to AI:

• Food logging: the food description you type, or a compressed photo of your meal
• Coach daily feedback: your goal, calorie/macro targets, and today's aggregate totals (calories, protein, carbs, fat, water, steps) — no name or email
• Motivation plan: the "why" text you write and your goal type
• Weekly & monthly reviews: aggregate statistics only (avg calories, avg protein, workout count, weight start and end values) — no name, email, or exact dates

Your name, email, and account identifiers are never included in AI prompts. If you use your own API key (Settings → AI), you have a direct relationship with that provider and their terms apply to your use.

Your data is kept for as long as your account is active. Login-verification tokens (which include IP) expire after 15 minutes. Remember-me tokens expire after 365 days. You can delete everything at any time using the button below.

• Access & portability: export all your data as JSON at any time (button below)
• Erasure: delete your account and all associated data instantly (button below)
• Correction: update your profile in Settings → Profile
• Withdraw consent: deleting your account withdraws all consent
• Lodge a complaint: you may contact your local data protection authority

For data requests, contact: privacy@studiomagic.in