FitnessMaxxing

Privacy Policy

Last updated: 20 August 2026

FitnessMaxxing ("the app", "we", "us") is a personal fitness and nutrition tracker. This policy explains what data the app collects, why, and what happens to it. We keep it short and plain because there isn't much to hide behind.

Who runs this app

What we collect

We only collect what the app needs to work:

• Account information — your email address, and (if you sign in with Google) your Google account's name and profile picture. We never receive or store your Google password.
• Fitness data you enter — workouts, exercises, sets, reps, weights, personal records, body weight and measurements.
• Nutrition data you enter — meals, foods, recipes, calories and macronutrients, water intake, and your daily targets.
• App preferences — theme, units, and similar settings, so the app looks the same next time you open it.

We do not collect location data, contacts, photos outside what you upload to the app, advertising identifiers, or browsing activity on other sites.

Why we collect it

• To sign you in and keep your account secure.
• To store your logs so they're available across your devices and over time.
• To calculate the things the app shows you — totals, streaks, personal records, macro breakdowns.
• To share data with people you explicitly invite through the family sharing feature.

We do not use your data to build advertising profiles, and we do not run ads.

Google sign-in

If you choose "Continue with Google", Google shares your email address, basic profile information and profile picture with the app so we can create or match your account. We request no other Google scopes — we cannot read your Gmail, Drive, Calendar or Contacts. You can revoke the app's access at any time from your Google Account permissions page.

Family sharing

The app lets you share your tracking data with family members you invite. Anything you share becomes visible to those people until you remove the connection. Only share with people you trust — we cannot un-share information someone has already seen.

Where your data lives

Your data is stored using the following service providers, who process it on our behalf:

• Supabase — database, authentication and file storage.
• Vercel — hosting and delivery of the app itself.

Some data is also cached in your browser's local storage so the app works quickly and offline. You can clear this at any time through your browser settings.

Other services the app talks to

Some features send a small amount of information to services we do not control. None of it identifies you:

• Open Food Facts — when you scan a barcode, that barcode number is sent to their public database to look up the product. Nothing about you is sent with it.
• USDA FoodData Central — used as a fallback when Open Food Facts has no nutrition for a product. The request goes through our own server, so USDA sees our server rather than your device.
• Vercel Web Analytics — counts page views so we know which screens get used. It is cookieless, does not follow you between sites, and does not receive your account details or anything you have logged.

If you never scan a barcode, the first two are never contacted.

The AI features (Pro)

Two optional features — the photo meal estimate and the AI coach — are answered by a language model run by Anthropic. They are switched on per account, and nothing described here happens unless you use them.

• Photo estimate — the photo you take is sent through our own server to Anthropic to produce the nutrition estimate, together with any correction you type. We do not store the photo anywhere; the numbers come back to you to check before anything is logged.
• AI coach — your question is sent with a small snapshot of your own data so the answer can be specific: your calorie and macro targets, what you have logged today, your recent sets, and profile numbers such as age, weight and height. Your name, email address and account id are never part of it.

Anthropic processes these requests as a service provider under its commercial API terms: it does not use them to train its models, and keeps them only for a limited period for abuse prevention. Details are in its own privacy documentation at anthropic.com/legal/privacy. We store none of it ourselves — coach conversations live only on your screen, and closing the chat is the end of them. If you use the microphone button to dictate a correction, the speech-to-text is done by your device’s own dictation service (Apple’s or Google’s, depending on your phone) — we only ever receive the text.

Who we share data with

We do not sell your data. We do not share it with advertisers or data brokers. We share it only with:

• the service providers listed above, strictly to run the app;
• family members you personally invite;
• authorities, if we are legally required to do so.

Photos you upload

Two features accept an image, and they are stored differently on purpose:

• Progress photos are private. They are kept in storage that only your own account can read, and the app reaches them through links that expire after an hour. They are never shared with family members you have linked. You can delete any of them from the app, and deleting one removes the file itself, not just the entry.
• Recipe photos are public. A recipe image is stored at a web address that anyone holding the link can open, because recipes are meant to be shareable. Do not put anything private in a recipe photo.

How long we keep it

We keep your data for as long as your account exists.

You can delete your account from inside the app, under Settings → Danger zone. That removes your profile, every logged day, your plans, custom exercises, shopping list and your progress photos, from our servers as well as from the device you are using. It cannot be undone, so export a backup first if you want to keep a copy. Deleted data falls out of our provider's backups within 30 days. You can also email the address at the top of this page and we will do it for you.

Your rights

Under the GDPR and similar laws, you can ask us to:

• give you a copy of your data;
• correct anything that is wrong;
• delete your account and data;
• stop processing your data.

Email adamhabovstiak@gmail.com and we'll handle it within 30 days. You also have the right to complain to your local data protection authority.

Security

Access to your data is protected by authentication and database-level row security rules, so one account cannot read another's data. No system is perfectly secure, but we don't store payment details or any special-category data beyond the fitness metrics you choose to log.

Children

FitnessMaxxing is not intended for children under 16. We do not knowingly collect data from them. If you believe a child has created an account, contact us and we'll remove it.

Health disclaimer

FitnessMaxxing is a tracking tool, not a medical service. Nothing in the app is medical advice. Talk to a qualified professional before changing your training or diet.

Changes to this policy

If we change this policy, we'll update the date at the top of this page. Significant changes will be announced in the app.