Privacy Policy
Last updated: 2 June 2026
Nachtwerk Labs Pty Ltd (ACN 698 574 720, ABN 23 698 574 720) ("we", "us", "our") operates the FitFor mobile app and the fitfor.app website (together, the "Service"). This policy explains how we handle your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). By using the Service you agree to this policy.
Who this policy applies to
The Service is intended for users aged 13 and over. If you are under 16 you should review this policy with a parent or guardian. We do not knowingly collect personal information from anyone under 13; if you believe a child has provided us information, please contact us so we can delete it.
What we collect
You provide directly:
- Account: email address, password (hashed), display name, optional profile photo (avatar)
- Profile / onboarding: date of birth, gender, height, weight, fitness goals, training preferences, equipment access
- Workout data: programs, exercises, sets, reps, weights, completion history, notes
- Social / accountability: streaks, buddy invites, accountability partner connections
- Support: messages you send via our contact form or email
Collected automatically:
- Device & technical: device model, OS version, app version, language, time zone, crash and performance data
- Usage analytics: screens viewed, taps, feature usage, session length
- Session replays: anonymised reconstructions of in-app sessions (text inputs are masked) used to diagnose bugs and improve UX
- Identifiers: a randomly generated FitFor user ID; on Android, the advertising ID (
AD_ID) is requested by Google Play Services. We do not currently use it for advertising; if that changes, we will update this policy and notify you in-app before any advertising use begins.
From third parties (only if you choose to use them):
- Apple Sign-In: name and email (or a private-relay email if you select that)
- Google Sign-In: name, email, profile picture
- RevenueCat / Apple / Google: subscription status, purchase events, anonymised purchase identifiers (we do not receive your full card number)
When you choose to upload an avatar, FitFor uses your photo library (and, if you tap "take photo", your camera) to capture or select the image. The captured/selected image is uploaded only when you confirm. FitFor also writes to your photo library when you save a shareable program-summary card.
We do not access your location, microphone, contacts, health records (Apple Health / Google Fit), or any biometric data.
Sensitive information
Your date of birth, gender, height and weight are collected only to generate appropriate training programs and to display progress. We treat them as sensitive and only use them for that purpose. You can leave gender as "prefer not to say".
Why we collect it (purposes)
- Provide the Service: generate personalised programs, sync workouts across devices, deliver push notifications you opt into, process subscriptions
- Improve the Service: analytics, crash diagnosis, A/B testing of features, bug reproduction via session replay
- Communicate with you: transactional emails (account, receipts, important updates), and — with your opt-in — product news and tips
- Comply with law and protect users: fraud prevention, security incidents, enforcement of our Terms
Direct marketing
We will only send marketing email if you opt in. Every marketing message includes an unsubscribe link, in line with the Spam Act 2003 (Cth). You can withdraw consent at any time.
Who we share it with
We don't sell your personal information. We share it only with the following service providers, who process it on our instructions:
| Provider | Purpose | Location of processing |
|---|---|---|
| Supabase | Auth, database, cloud sync, avatar storage | Global (region chosen based on user location; currently primarily Australia, expanding) |
| PostHog | Product analytics, session replay, error tracking | United States |
| RevenueCat | Subscription management | United States |
| Apple (App Store / Sign in with Apple / APNs) | Distribution, sign-in, push notifications | United States |
| Google (Play / Sign-In / FCM) | Distribution, sign-in, push notifications | United States |
| Expo (EAS) | App build and over-the-air updates | United States |
| Netlify | Website hosting, waitlist sign-ups and contact-form submissions | United States |
Overseas disclosure (APP 8)
Because of the providers listed above, your personal information may be stored or accessed in jurisdictions outside Australia, including the United States and other regions where Supabase operates. By using the Service you consent to that disclosure. We require all providers to maintain protections at least equivalent to the APPs.
How long we keep your information
- Account and profile: while your account exists, plus up to 30 days after deletion
- Workout history: while your account exists; deleted within 30 days of an account-deletion request
- Backups & logs: rolling backups are overwritten within 90 days
- Anonymised analytics: may be retained indefinitely as it no longer identifies you
- Tax & transaction records: 7 years, as required by Australian tax law
Security
We use HTTPS in transit, encryption at rest on Supabase, and access controls so that only we and you can see your data. No system is perfectly secure; if a breach occurs that is likely to cause serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme.
Your rights
You can:
- Access the personal information we hold about you (most is visible in the app)
- Correct anything inaccurate, directly in the app or by emailing us
- Delete your account and data — either from inside the app (Settings → Delete account) or via our contact page
- Withdraw consent for marketing or analytics at any time
- Complain to us first; if unresolved, to the OAIC at oaic.gov.au
We respond to requests within 30 days. There is no fee unless your request is manifestly unreasonable.
Information you provide through our website
If you join our waitlist or contact us through the fitfor.app website, we collect the information you submit — typically your name (if provided), email address, and the contents of your message. These forms are hosted and processed by Netlify on servers in the United States. We use this information only to respond to you, to notify you about the app's launch if you asked us to, and to keep a record of your enquiry. You can ask us to delete a waitlist or contact submission at any time by emailing hello@fitfor.app.
Cookies & analytics on fitfor.app
The website uses PostHog analytics to count visits and understand which pages people read. PostHog sets a small first-party cookie; no advertising cookies are set. You can disable cookies in your browser without losing any website functionality. Our website pages load the "Alata" font from Google Fonts, which means Google's servers (in the United States) receive your IP address when a page loads; Google does not receive any other information from us in that request.
Children
The Service is rated for users 13 and over. Anyone under 13 should not create an account. Parents who believe their child has used the Service should email us and we will delete the account.
Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top of this page will change. Material changes will be notified to you in the app or by email before they take effect.
Contact
Nachtwerk Labs Pty Ltd (ACN 698 574 720, ABN 23 698 574 720) — privacy enquiries: hello@fitfor.app — or via our contact page.