Privacy Policy

On-device use at every age

FoFit’s free on-device journal is available without an account at every age. Workout drafts, completed workouts and meal notes stay in this app’s device storage. FoFit does not send this journal to its servers, AI providers or analytics, and never automatically imports it into an account. System device backups may include app data according to your settings.

The journal does not request camera, microphone, location or notifications. View a complete local export or erase entries in its Privacy tab. People who can unlock your device may be able to read it, and uninstalling the app may remove it.

Who operates FoFit

FoFit is operated by Kenan Larry in St. Louis, Missouri, United States. Contact support@fofit.app for privacy, support, account, or deletion requests.

Information you provide

• Account information such as email, sign-in provider, display name, profile role, avatar, handle, sport, school, and onboarding answers.
• For connected accounts, a self-reported birth date establishes age eligibility. FoFit stores the account age record and its receipt separately from chat. Corrections go through support. Guardian AI approvals record the adult and teen account identifiers, disclosure version, approval or withdrawal, and dates. A teen-shared request code lets a separate adult account review the teen’s email and AI disclosure; it grants no access to the teen’s messages or journals.
• Your Terms acceptance and Privacy Policy acknowledgment, including document version, content fingerprint, and saved date. AI-sharing choices and device permissions remain separate; accepting the Terms does not enable them.
• Workout data such as exercises, sets, reps, weight, RPE, notes, personal records, training plans, sessions, streaks, body metrics, and goals.
• Nutrition data such as meals, macros, hydration, logged foods, saved foods, recipe choices, barcode searches, product results, and meal-photo analysis results.
• Community data such as posts, comments, reactions, follows, blocks, mutes, reports, group memberships, reels, and media you choose to upload.
• Cypher AI content such as chat messages, approved or declined plan actions, structured coach-memory notes, and context needed to answer your request.

Device permissions and media

• Apple Health / HealthKit: with permission, FoFit reads active energy, steps, and workout summaries on your device. Raw HealthKit queries stay on device. If you choose to import a workout, its normalized summary may be saved to your FoFit account for workout history and cross-device sync. Health data is not sold, used for ads, or shared for marketing.
• Camera and photo library: FoFit asks only when you use features such as meal photos, barcode scanning, profile photos, progress photos, reels, Performance Lab capture, or Future You. Ordinary uploaded media is stored when you choose to save or publish it. For Future You, the source photo is saved privately when you continue with that photo, before scenario setup; the generated scenario is saved privately after generation so background processing, reopening, comparison, and deletion work.
• Microphone: if you use voice input for Cypher, the audio is sent through FoFit's server proxy to OpenAI Whisper for transcription. FoFit uses the transcript as your message and does not keep the raw audio after transcription.
• Notifications: if you enable reminders or community notifications, FoFit stores your notification preferences and may use device notification tokens where push delivery is supported.
• Location: FoFit may use approximate location for nearby gyms, events, or food spots and rounds it before transmission. If you start an outdoor run or walk recording, FoFit can use precise/background location to record the route. When you are signed in, exact route points are uploaded to FoFit's Supabase backend for private history and cross-device sync; any public route representation is separately sanitized before sharing.

How we use information

• Operate FoFit, keep you signed in, sync account data, and render workouts, nutrition, progress, community, and profile features.
• Personalize coaching, training, nutrition, and Cypher recommendations using the context you give FoFit.
• Moderate community safety, process reports, enforce blocks/mutes, prevent abuse, and preserve App Review demo account integrity.
• Debug crashes, measure reliability, and improve the product without selling your data or using it for cross-app advertising.
• Respond to support, deletion, privacy, export, and legal requests.

AI and Cypher

Cypher is a general fitness assistant, not a medical provider. After you agree to the AI-sharing disclosure, messages and selected context are processed through FoFit's server-side proxy before reaching the named AI providers. Your choice is recorded for your account and disclosure version; it is not implied by creating an account or opening the app.

• Anthropic processes Cypher chat responses using your message and relevant training goals, age, body measurements, workout and nutrition records, check-ins, preferences and coaching memories. Its standard API retention is generally up to 30 days, with safety, legal and contractual exceptions.
• Google processes Google Places searches separately from AI. Google Gemini AI routing and fallback are disabled in this release.
• OpenAI may process coaching fallback responses, selected photos and video frames, workout-import documents, voice transcription, read-aloud text, and separately consented Future You source/generated images for eligibility, generation, and fidelity review. OpenAI says API data is not used to train its models by default; default abuse-monitoring logs may retain content for up to 30 days, with separate safety retention in limited cases.
• Tavily (AlphaAI Technologies) processes closed general research topics, such as knee recovery, to retrieve supporting sources. FoFit does not send your name, account identifiers, personal story or measurements in those search queries. Tavily may use search-index providers and may use query data to improve its services unless a separate agreement provides otherwise.
• Decline to continue using manual workout, plan and food logging. In Settings > Privacy & safety > AI sharing you can review or withdraw your choice. Withdrawal stops future requests; it cannot recall information already dispatched or override providers' lawful retention. If withdrawal cannot reach the server, FoFit pauses AI on that device and asks you to retry for other devices.
• Do not send payment data, regulated medical records, other people's personal information or information you are not comfortable processing through third-party AI services. Identified Apple Health imports are excluded from AI context while provider handling remains unverified.

Third-party services

Service providers that process personal data on our behalf are bound by data processing agreements that require them to protect it with the same or equal protection described in this policy. FoFit uses Supabase, Vercel, Resend, Sentry, Anthropic and OpenAI under their applicable business processing agreements. The AI section describes data categories, retention and your choices.

Apple and Google also operate services you choose to use, including sign-in, device permissions, Apple Health and Google Places, under their own privacy terms. Tavily receives only closed general topic terms, with no name, account details, personal story or measurements, and is not included in the personal-data processing statement above.

• Supabase for authentication, database, storage, edge functions, and account deletion.
• Vercel hosts fofit.app and related web services. It processes ordinary web request information, such as IP addresses, requested paths and device/browser information, to deliver and secure the website. The website does not currently use product analytics scripts. Its Google Fonts requests may send ordinary request information to Google when a font loads.
• Resend delivers account and service emails where configured. It receives the recipient address and the message needed for delivery. Community-report alerts to FoFit support contain a count and protected-dashboard link, excluding report contents and reporter identities. Paused marketing campaigns do not send emails.
• Apple and Google for sign-in, device permissions, App Store services, Apple Health, and Google Places.
• Anthropic, OpenAI and Tavily for the AI and research features described above.
• Sentry for crash diagnostics. FoFit projects events into a limited diagnostic format, excluding user identifiers, exception-message contents, request bodies and URLs, screenshots, view hierarchies and breadcrumbs. Basic app/OS/device model and source-code locations support debugging.
• The FoFit app does not currently use product analytics providers. We will update this policy before enabling one. The on-device journal and teen accounts do not enable Sentry crash collection.
• Expo/EAS provides app builds and updates under its service terms and processing safeguards. Remote assignment push delivery is disabled in this release; ordinary device reminders can run locally after your choice.
• RevenueCat and Apple may support purchases if paid features are enabled in a future build; FoFit does not receive full payment card numbers.
• Marketplace merchants and affiliate networks receive the ordinary request and tracking parameters in a link only after you choose to open it.

Marketplace and affiliate links

Marketplace links open merchant-controlled websites or apps only after you tap. Some links are affiliate links, and FoFit may earn a commission at no extra cost to you. The merchant's terms, privacy practices, pricing, availability, checkout, returns, and product claims apply.

• FoFit may keep local click metadata limited to product, merchant, category, source screen, account role, and timestamp so the app can show honest outbound-link activity.
• An outbound URL may identify the product, merchant, category, or FoFit affiliate campaign. FoFit does not add workout, nutrition, Apple Health, Cypher chat, media, or precise-location data to the link.
• FoFit does not process merchant checkout or receive full payment card numbers. You can use FoFit without opening Marketplace links.

Account deletion and your rights

You can initiate account deletion in the app from Settings > Profile & Account > Delete account. You can also email support@fofit.app from the email tied to your FoFit account or visit https://fofit.app/delete-account.

Saved account records and derived media remain until you delete them through the relevant feature or delete your account. Account deletion first confirms removal of your FoFit Storage media, then removes your account and user-scoped cloud data. An interrupted cleanup can be retried. A Future You in-app deletion removes its source and generated objects before removing the saved session; cached signed views may take up to a minute to disappear. OpenAI's provider-controlled safety retention and rolling infrastructure backups may expire separately.

• In Settings > Support, Export cloud account and media downloads supported saved account records and original uploaded/generated files. The archive lists excluded credentials, internal security records, shared organization administration and external provider records. Export device data separately for verified local-only records. You may also ask to access, correct, export, or delete personal information.
• Product analytics providers are disabled in this app release, regardless of any saved analytics choice.
• You can revoke Health, camera, photo, microphone, notification, and location permissions in iOS Settings.

Children and safety

The on-device journal is available at every age. Before collecting sign-in information, FoFit asks for age to determine whether connected features are available. An under-13 answer stays on the device and keeps cloud accounts unavailable on that installation until the eligible date; no child journal or birth date is sent to a server by this flow. For a mistaken answer, contact support with a trusted adult’s help.

Connected accounts are for ages 13 and older. AI use by ages 13–17 needs a parent or legal guardian’s approval from a separate adult account with a confirmed email, followed by the teen’s own AI-sharing choice. Either may stop future AI processing. This is a self-declared guardian relationship, not identity verification or verified parental consent for collecting under-13 data. Some features, including Future You and community, retain their own safeguards. Contact support if a child’s information has been sent to FoFit so we can review and delete it where appropriate.

FoFit and Cypher provide general fitness and nutrition information. They do not provide medical, diagnostic, emergency, or therapeutic advice.

Contact

Questions about privacy, account deletion, support, or data rights: support@fofit.app. FoFit is operated from St. Louis, Missouri, United States.