Privacy policy

1. What data we process and why

Account: email and login data. To create your account and sign you in.

Profile: name (optional), date of birth, biological sex, height, weight, goal, activity level, training history and days, equipment, restrictions and foods you don't eat, profile photo (optional). To calculate plans suited to your age and level.

Health data (special category): health screening answers, weight and measurements from check-ins. Processed only with your explicit consent, to generate and adjust plans safely.

Check-in photos (optional): front, back and side, to track your progress. Only with specific consent, which you can withdraw at any time (the photos are then deleted).

Movement-correction camera (optional): the analysis runs on your phone; the video is neither sent nor stored.

Location (optional): during outdoor cardio, GPS calculates distance and draws your route; the route is kept in a private space, is not sent to the AI or shared, and is deleted if you withdraw consent.

Training journal, custom plans and feedback you write. If you agree to be contacted in the feedback form, we also store your email.

Subscription: trial and subscription status, dates and amount. Card details are handled by Stripe, never by us.

2. Legal bases

Performance of a contract (providing the service and the subscription); explicit consent (health data, photos, camera, location); legal obligation (invoicing); legitimate interest (service security, abuse prevention).

3. Who we share data with

Supabase (database, authentication and private files).

Mistral AI, with servers in the EU: receives parts of your data (age, measurements, goal, level, check-in photos when you authorise them) to generate plans and feedback. We do not sell data or use it for advertising.

Stripe (payments) and Vercel (hosting), which may process data outside the EU with appropriate legal safeguards (standard contractual clauses).

YouTube: technique videos only load when you press to watch them (enhanced privacy mode).

4. How long we keep it

Account data, plans, journal, photos and feedback are kept until you delete your account or withdraw the corresponding consent. When you delete your account, we remove your data and files and cancel the subscription. Payment and invoicing records may be kept for the period required by law.

5. Your rights

You can access, correct, export (portability) and delete your data, withdraw consents and object to certain processing. Under Privacy, inside the app, you can download everything and delete your account with one tap. For other requests, write to us.

You can complain to a data protection authority: CNPD (Portugal, cnpd.pt), AEPD (Spain, aepd.es), ANPD (Brazil, gov.br/anpd) or the authority of your country of residence. Contact: contacto@pocketfitapp.com.

6. Automated decisions

Plans are generated by AI, but within safety limits set by fixed rules (age, screening, level). You can ask for a human review and choose not to use photos or the camera without losing the rest of the service.

7. Security and minors

Data is stored with per-user restricted access, encrypted connections and private files. No system is infallible; we will notify you as required by law in the event of an incident. The service is only for people aged 18 or over; we do not collect data from minors and delete it if we detect it.

8. Changes

If we change this policy in a relevant way, we will notify you in the app and, where required, ask for your consent again.