Privacy Policy

This Privacy Policy describes how NetFit ("we", "us", "our") processes personal data when you use the NetFit platform (the "Service") on the web, iOS, or Android. NetFit is a software platform for independent Coaches and their Clients.

White-label branding: After sign-in, you may see your Coach's custom app name or logo inside the product. That branding is controlled by the Coach. The mobile app may be distributed under the NetFit store name while displaying Coach branding in the interface.

Data controller: NetFit — privacy inquiries: support@example.com.

Coaches are independent professionals. When a Coach invites you, they may act as a separate controller for coaching-related decisions; we provide the platform that stores and transmits data at their direction. Coaches must comply with applicable privacy laws when handling client data.

We collect the following categories of personal information:

• Identifiers & account data: name, email address, role (coach or client), profile photo, user ID, and authentication tokens via Supabase Auth (email, password, Apple Sign In, or Google Sign In when enabled).
• Fitness & wellness data you enter: workouts, metrics, body measurements, progress photos, nutrition logs, habits, sleep/water entries, onboarding health questionnaires, and related notes. This may include special category data under GDPR (health-related information) that you voluntarily provide.
• Communications: in-app messages, forum posts, form responses, and file attachments you choose to send.
• Payments (if enabled): billing status, plan metadata, and transaction references processed by Stripe; we do not store full payment card numbers.
• Device & technical data: push notification tokens (if you opt in), device type, operating system, app version, IP address, user agent, and server logs for security, fraud prevention, and reliability.
• Mobile permissions: camera and photo library (only when you upload avatars or progress photos), notifications (only if you grant permission). We do not access these without your action in the app.

We do not knowingly collect data from children under 16. We do not buy personal information from data brokers.

• Directly from you when you register, complete onboarding, or use the Service
• From your Coach when they invite you or assign content
• Automatically from your device and browser when you use the Service
• From authentication providers (Apple, Google) when you choose those sign-in methods

• Provide, operate, and improve the Service
• Authenticate users and enforce access controls between coaches and clients
• Deliver assigned workouts, meal plans, tasks, and messages
• Send transactional emails (invitations, password reset, security alerts) via our auth provider
• Send push notifications you opt into (reminders, messages)
• Process payments when coaches use billing features
• Detect abuse, fraud, and security incidents
• Comply with legal obligations and respond to lawful requests

Where GDPR or similar laws apply, we rely on:

• Contract (Art. 6(1)(b)): providing the Service you requested
• Legitimate interests (Art. 6(1)(f)): security, fraud prevention, product improvement, and internal analytics that do not override your rights
• Consent (Art. 6(1)(a)): optional push notifications and, where required, processing of health-related data you voluntarily submit. You may withdraw consent at any time without affecting prior lawful processing.
• Legal obligation (Art. 6(1)(c)): tax, accounting, or regulatory requirements where applicable

For special category health data under GDPR Art. 9, we process only data you voluntarily provide for coaching purposes, based on your explicit consent or as necessary for the coaching relationship you request.

We do not sell your personal information. We do not share personal data for cross-context behavioral advertising. We disclose data only as follows:

• Your Coach — data you share within the coaching relationship (workouts, metrics, messages, photos, etc.)
• Supabase — database, authentication, file storage, and realtime (supabase.com)
• Hosting providers (e.g. Vercel) — application delivery and edge infrastructure
• Stripe — payment processing when billing is enabled (stripe.com)
• Email delivery — transactional email via SMTP configured in Supabase Auth (e.g. Resend, Brevo, SendGrid)
• Apple / Google — only when you choose Sign in with Apple or Google
• Legal & safety — when required by law, court order, or to protect rights, safety, and security

Processors are bound by data processing agreements requiring appropriate technical and organizational safeguards. A list of subprocessors is available on request.

California residents have additional rights. In the preceding 12 months we have collected the categories listed in "Information we collect" for the business purposes described above. We have not sold personal information and not shared it for cross-context behavioral advertising.

Your rights include:

• Right to know what we collect, use, and disclose
• Right to delete personal information (with legal exceptions)
• Right to correct inaccurate information
• Right to opt out of sale/sharing — see our Do Not Sell or Share page (not applicable; we do not sell)
• Right to limit use of sensitive personal information — we use sensitive data only to provide the Service
• Right to non-discrimination for exercising privacy rights

Submit requests via support@example.com or Support. We verify identity before fulfilling requests.

Depending on your location, you may have the right to:

• Access a copy of your personal data
• Correct inaccurate or incomplete data
• Delete your account and associated data (Settings → Account on web or mobile)
• Export data where technically feasible (contact support@example.com)
• Object to or restrict certain processing
• Withdraw consent where processing is consent-based
• Lodge a complaint with your supervisory authority (EEA/UK users)

We respond to verified requests within 30 days (45 days where permitted by law). Account deletion permanently removes your profile and associated content from our systems, subject to backup retention windows and legal holds.

• Account data: retained while your account is active
• Fitness & message data: retained until you delete it or delete your account
• Server logs: typically 30–90 days for security monitoring
• Backups: may persist in encrypted backups for a limited period after deletion
• Legal holds: longer retention where required by law or dispute resolution

We use industry-standard measures including encrypted transport (HTTPS/TLS), access controls, row-level security on profile data, secure session storage on mobile (expo-secure-store), and private storage with signed URLs for sensitive media. No method of transmission is 100% secure; notify us promptly at support@example.com if you suspect unauthorized access.

The web app uses essential cookies and local storage for authentication sessions. We do not use third-party advertising cookies. Push notification tokens are stored to deliver notifications you opt into. You can control cookies in your browser settings; disabling essential cookies may prevent login.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects. AI coaching features generate suggestions only; coaches and clients remain responsible for decisions about exercise and nutrition.

The Service is not directed to children under 16. We do not knowingly collect data from children. Contact us at support@example.com if you believe a child has provided data and we will delete it.

Data may be processed in the United States and other countries where our processors operate (including EU-based Supabase regions if configured). Where required, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) and processor agreements. Contact us for a copy of relevant safeguards.

We may update this policy. Material changes will be reflected by the "Last updated" date and, where required, additional notice in the app or by email. Continued use after changes constitutes acceptance where permitted by law.