Privacy Policy

Last updated 15 October 2026

This policy explains what MyFitsy does with your personal data, why, and what you can do about it. It covers the MyFitsy app for clients, the MyFitsy Coach app for trainers, and this website.

Who is responsible for your data

The data controller is:

Hoovus Kinnisvara OÜ
Registry code 16775200 · VAT EE102736764
Viru väljak 6, Kesklinna linnaosa, Tallinn, Harju maakond, 10153, Estonia
support@myfitsy.com

Write to that address for anything in this policy, including to exercise your rights. A person reads it.

What we collect, and why

1. Account data

Your name, email address, whether you use MyFitsy as a coach, a client or both, @handle, profile photo if you add one, unit preference, and a securely hashed password. We never store your password itself.

If you sign in with Apple or Google, we receive an account identifier and your email address from them — never your password. If you use Apple's Hide My Email, we only ever receive the relay address.

Why: to create and run your account. Legal basis: performance of our contract with you.

2. Health and fitness data — a special category

Body measurements (neck, shoulders, chest, waist, hips, arms, forearms, thighs, calves), weight, estimated body fat, height, date of birth, sex, training goals, logged workouts including weights lifted, reps completed, cardio time and distance, skipped sessions, and the programmes assigned to you or written by you.

Under the GDPR this is data concerning health, a special category needing stronger protection. Why: it is the service — recording it and charting it is what the app is for, and sharing it with your coach is what coaching requires. Legal basis: your explicit consent (Article 9(2)(a)), given when you create an account and confirm you have read this policy, and withdrawable at any time — see Your rights.

Who sees it. You, and a coach while they are coaching you: your measurements, charts and logged workouts, your height, sex, date of birth and training goal, and the programmes you write yourself, which they can read but not change. When coaching ends, that coach keeps your measurements and workouts up to the day it ended, sees nothing recorded after it, and nothing else of yours. A coach whose request is waiting, or was declined, sees none of it, and blocking a coach removes even what they had. Your goals are yours alone unless you share one; a coach sees only the one training goal on your profile.

3. Coach profile data — public by design

For coaches only: biography, years of experience, certifications, specialisations, languages, gyms, city and country, contact email and phone if you add them, social links, listed prices, portfolio photos with their titles and descriptions, and the ratings and reviews clients leave you.

This is published. It appears in the in-app coach directory, on your page at myfitsy.com/@yourhandle, and can be read and indexed by anyone, including search engines and AI crawlers. Your page also shows your average rating, review count, years of experience and how many active clients you have. It is removed from public view if you clear your biography.

Legal basis: performance of our contract, and your consent for the parts you choose to publish.

4. Messages and attachments

The text of messages between a coach and a connected client, and the photos and videos sent in them.

Attachments are held in private storage. There is no public link to them: the app requests a short-lived signed address each time it needs to display one, and that address expires. Nobody outside the two people in the conversation can retrieve them, and a leaked address stops working.

A group room is the same thing with more people in it. A coach can put several of their clients into one room. We hold the room's name, who is in it, what each person writes and the photos and videos they send. Everyone in the room can read all of it and sees each other's names and profile pictures — including clients who are not each other's coach, which is the one place in MyFitsy where clients learn about each other. Attachments sit in the same private storage behind the same expiring addresses; what changes is only who may ask for one. The coach who made the room decides who is in it, and you can leave it at any time.

Taking a message back does not erase it here. When you withdraw a message the other people stop seeing it, and what it said moves somewhere no app user can read — not the person you sent it to, not a coach, not you. We keep it for one reason: a report names a person rather than a message, so without it somebody could send something abusive, withdraw it, and leave nothing to act on. It is erased when the message itself would have been — see how long we keep it.

Clearing a conversation clears it for you. Putting a conversation away, or emptying it, changes your own view of it and nothing else. The other person keeps their copy and nothing is deleted from our side. Deleting your account is what erases your messages.

Legal basis: performance of our contract.

5. Appointments

Session times, notes a coach adds, group membership, attendance. Group here means a training group — a set of clients a coach books or programmes together, which is separate from the chat rooms in section 4 and which clients cannot see the membership of. Legal basis: contract.

6. Where you are — only if you allow it

Both apps can ask your device for your location. Neither needs it, both work fully without it, and nothing is withheld from you for refusing. We ask only when you press something that plainly needs it, never on opening the app, and if you have said no once we do not ask again.

We keep the last reading rather than asking every time so that a search still works when you are underground, on a plane, or have simply switched location services off since. You can clear it by revoking location access in your phone's settings, and it goes when your account does.

Legal basis: your consent, given through your device's permission prompt and withdrawable there at any time.

7. Subscription status and credits

Whether you have an active subscription or trial, which plan, when the current period ends, the price where the store reports one, and a transaction reference from Apple or Google.

For coaches, your credit balance and its history: each pack you bought (with Apple's or Google's transaction reference, and the price where the store reports one), each bonus credit we gave you and why, each credit spent on an import or returned after one failed, any correction we made and why, and any credits the store took back after refunding a purchase. When you buy credits, the app tells the store your MyFitsy account number, so a purchase can only ever be credited to your account. This is what lets us show you an honest balance, answer if a charge is ever questioned, count our own sales, and notice misuse such as repeated refunds.

We never receive your card, bank or PayPal details. Apple and Google are the sellers; we are told only whether you are entitled to the paid features.

Legal basis: contract, and our legitimate interest in noticing misuse.

8. Reports and moderation records

If you report someone: your identity, who you reported, the category, and the written reason you gave. If a decision is taken about an account: what was done, why, and when. The person reported is not told who reported them.

Why: to keep people safe and to stop repeated behaviour being treated as a first offence. Legal basis: our legitimate interest in a safe service, and legal obligation where we must act or report.

9. Some photos are screened automatically

Two kinds of picture are checked by Google Cloud Vision for adult, violent or otherwise unsafe content before they are published: your profile picture and a coach's portfolio photos — the pictures other people see. The image is sent to that service for analysis and a safety rating comes back; the rating is kept, the image is not kept by us for that purpose, and an image the check rejects is deleted rather than published. An image the check is unsure about is published and passed to a person here to look at.

Nothing else is screened, and no other picture is sent to Google. Photos and videos you send in a conversation go to our storage and to the person you sent them to, and no automated system inspects them. We would rather tell you that than let you assume a filter stands between you and what someone sends. If someone sends you something they should not, report it or block them — a person here reads every report.

Legal basis: our legitimate interest, and that of every other user, in not being sent abusive images. See Automated decisions for what this does and does not decide on its own.

10. Website analytics and your choice

This website sets no cookies at all — not for advertising, not for analytics, not for anything else. There are no third-party trackers, no social media pixels, no advertising networks and no cross-site profiling. Nothing on these pages reports your visit to another company.

The one measurement we would like to take is a count of which pages get read. The first time you arrive we ask you, in a banner at the bottom of the page, to choose between allowing that count and allowing only what is strictly necessary. Until you choose, nothing is counted. If you decline, nothing is counted at all, and every part of the site keeps working exactly as it did.

If you do allow it, each page view records the page path, the referring website's domain (never the full referring URL), a coarse device type (mobile, tablet or desktop), and the country the request came from. We do not store your IP address.

What we store on your device: two things, both in your browser's local storage, neither of them a cookie and neither ever sent to another company.

• mf_consent — your answer to the banner: what you agreed to, the date you agreed, and which version of this policy you agreed against. It contains no identifier. It exists so we do not ask you the same question on every page, and so we can show that consent was actually given rather than assumed. If we later change what we would like to measure, the version changes and we ask you again — an old yes does not carry over to a new question.
• mf_vid — only if you allow counting. A random number generated in your browser, meaning nothing by itself. It is what lets us tell a returning visit from a first one, so we can see whether people find the site useful enough to come back. We never see the number itself: it is put through a one-way hash on our server, and only the result is stored.

We chose a random number over the more common alternative deliberately. The usual way to recognise a returning visitor without storing anything is to fingerprint their IP address and browser, which takes the decision away from them and is inaccurate as well — one phone changing from wifi to mobile data looks like two people, and an office behind a single address looks like one. A random number you consented to is both more honest and more accurate.

How long: visit-level detail — which pages one visitor read, and in what order — is deleted after 90 days. What remains after that is anonymous daily totals: how many visits, how many visitors, which pages, which countries. Those are kept so we can compare one month or year with another, and they cannot be traced back to anybody.

Changing your mind: select Privacy choices in the footer of any page. The banner reopens, your previous answer is discarded and mf_vid is deleted, so nothing can be joined to visits you made before. Withdrawing is exactly as easy as agreeing, and costs you nothing. Clearing your browser data has the same effect, and we will ask again.

Legal basis: your consent (Article 6(1)(a)) for the page-view count and for the random number that distinguishes a returning visit, neither of which we collect without it. Remembering your answer is strictly necessary to respect the answer itself.

11. Notifications

In-app notifications about your coaching, messages and sessions. If you turn on push notifications, a device push token, and whether the phone is an iPhone or an Android phone, so they can reach it. You can turn them off in Settings or in your phone's settings.

A push notification leaves our servers, and this is worth understanding. To reach a locked phone, a notification has to travel through the companies that own the delivery networks. Ours go to Expo, which passes them to Apple on an iPhone or Google on an Android phone, and each of those sees what the notification says while it is in transit.

For a new message, what it says includes the first 100 characters of the message — because a notification reading only "new message" is not much use, and a preview is what people expect. So the opening of a message can be seen by those three companies, and by anyone looking at your lock screen. The rest of the conversation never leaves our storage.

Turning push off stops this entirely. Notifications still appear inside the app, where nothing is sent to anybody. Do that in Settings, or in your phone's notification settings for MyFitsy — and if you would rather keep push but hide the content, both iOS and Android can be set to hide notification previews on the lock screen.

Legal basis: contract for the notification itself, and your consent for push delivery.

12. Support correspondence

What you write to us, so we can answer and refer back to it. Legal basis: legitimate interest.

13. Programs you import with AI

A coach can bring in a program they already have by photographing it, uploading a PDF, or pasting it as text. Nothing is sent anywhere until you have agreed to it on a screen that explains what follows, and you can withdraw that permission at any time in Settings.

To turn your pages into a program, we send them to Anthropic, the company that makes the Claude AI, which reads them and returns the days, exercises, sets and notes it found. Anthropic processes them only to do that for us. It does not use them to train its AI, and it deletes what it received within 30 days, except where the law or its safety rules require it to keep something longer.

We delete your uploaded files and pasted text ourselves as soon as the import ends, whether it succeeded or not; anything left behind by an import that was abandoned partway through is deleted within two days. What we keep is the program itself — an ordinary program in your account, which you edit and delete like any other — a short record of the import: when it ran, how many pages it had, whether it worked and if not why, what it cost, and a fingerprint of the files (a code computed from them, from which the pages cannot be recreated) so the same file is recognised if you upload it again — and a record of when you gave permission, and to which wording. Photos have their location and other metadata removed before they are sent.

Your pages may contain other people's details — a client's name, for instance. Upload only what you are entitled to share for this purpose.

Legal basis: your consent, for sending your pages to Anthropic; contract, for creating the program and keeping the record of the credit it used.

What we never do

• We do not let any AI company train on your data. The one AI service we use, for importing programs, is contracted not to.
• We do not sell personal data, and we do not share it for anyone else's advertising.
• We do not run adverts or advertising SDKs in the apps.
• We do not build advertising or marketing profiles from your health data.
• We do not make your training data, measurements, chats or photos public. The only public surface is a coach's own profile page.
• We do not read your chats routinely. A message is looked at when it is reported, or where the law requires.

Who else processes your data

We use a small number of suppliers. Apple and Google also act on their own account — as the stores that sell to you and the sign-in you chose — under their own privacy policies; every other supplier acts only on our instructions, under a contract that says so:

That is the complete list. There is no analytics company, no advertising network, no attribution or crash-reporting service, and no data broker — not because we removed them, but because they were never added. Nothing in either app sends your data to a company that is not in this table.

We may also disclose data where the law requires it — a court order, a lawful request from an authority, or to protect someone from serious harm. Where we are permitted to tell you, we will.

If MyFitsy were ever sold or reorganised, data could transfer to the acquirer, who would remain bound by this policy or give you notice of a replacement before anything changed.

Where your data is stored, and transfers

Your account, training data and file uploads are held in the European Union (Supabase, Stockholm region). Some suppliers above operate globally, so limited data may be processed outside the EEA — where that happens it relies on the European Commission's Standard Contractual Clauses or an adequacy decision.

How long we keep it

Deleting your account is done in Settings or via this page. It takes effect after 30 days, which exists so a deletion by mistake can be undone: sign in during that window and confirm you wish to keep the account. After the 30 days it cannot be recovered.

Your rights

Under the GDPR you can:

• See what we hold about you, and get a copy of all of it;
• Correct anything wrong — most of it you can edit yourself in the app;
• Delete your data. Settings in either app, or this page if you cannot get into the app. Both do the same thing and both remove everything, including your uploaded files — except a review you wrote, which stays on the coach's page without your name or picture;
• Take it elsewhere — the copy we send is a single machine-readable file covering every category in this policy, which you are free to hand to anybody;
• Restrict or object to processing based on legitimate interests;
• Withdraw consent at any time. Because health data is processed on the basis of your explicit consent, withdrawing it means we can no longer run a training account for you — so withdrawing consent and deleting the account are effectively the same act, and we will tell you that before doing it rather than after.

Write to support@myfitsy.com from the address on your account. We answer within one month. We do not charge for this, and we will not make you justify the request.

One practical note: if you want a copy and you want the account gone, ask for the copy first. Deletion removes everything, and once the grace period has passed there is nothing left for us to send you.

If you are unhappy with how we handled it you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee), or to the supervisory authority where you live.

Automated decisions

The image screening in section 9 is automated, and it can block an upload on its own. It cannot suspend or close your account on its own — a warning or a ban is always decided by a person, and you can ask for that decision to be reviewed by writing to us. We do not carry out profiling that produces legal effects, and we do not use your data to make automated decisions about credit, insurance, employment or anything similar.

How we protect it

• Everything travels over encrypted connections.
• Passwords are stored only as salted hashes, never as text.
• Row-level security in the database means one account cannot read another's data even if a request tries to — the rule is enforced by the database, not only by the app.
• Chat photos and videos live in private storage reachable only through short-lived signed addresses.
• Administrative access is limited, password-protected and separate from the apps.

No system is perfectly secure. If a breach ever affects your data and creates a real risk to you, we will tell you and the Data Protection Inspectorate within the time the GDPR requires.

Children

MyFitsy is for people aged 16 and over. We do not knowingly collect data from anyone younger, and we delete such accounts when we find them. If you believe a child has an account, write to support@myfitsy.com.

Changes to this policy

If we change something that matters — a new purpose, a new supplier, a different retention period — we will tell you in the app or by email before it takes effect, not quietly afterwards. The date at the top is always the current version.

Contact

Hoovus Kinnisvara OÜ
Registry code 16775200 · VAT EE102736764
Viru väljak 6, Kesklinna linnaosa, Tallinn, Harju maakond, 10153, Estonia
support@myfitsy.com