Data Flows
This is the honest map: every kind of data, exactly where it goes, why, the legal basis, and how long it's kept. The rule underneath it all — your progress photos never leave your device, we never sell your data, and no AI provider trains on it. A stays on device tag means it is never sent anywhere.
1. Data that powers the product
| What | Leaves your device to | Why | Legal basis (GDPR) | Kept |
|---|---|---|---|---|
| Account — email, name, Google ID | Supabase (auth) | Sign-in & account security | Contract — Art. 6(1)(b) | While your account exists |
| Health & habit logs — weight, meals, workouts, sleep, tape, mood, habits | Supabase Postgres (EU — Ireland) with per-user row-level security: the database itself refuses to serve one account’s rows to another. Plus a private encrypted backup and a localStorage cache on your device | The whole product: coaching, trends, the game | Explicit consent — Art. 9(2)(a) | While your account exists; deleting your account deletes the database rows in one cascade |
| Wearable feed — heart rate, HRV, steps (optional) | Same store as your logs (Supabase EU) — pushed by your phone with a bearer token | Readiness & health trends | Explicit consent — Art. 9(2)(a) | While your account exists |
| Progress photos & body-scan videos | stays on device — browser IndexedDB, never uploaded | Your own progress visualisation; measurements derived on-device | — | Until you clear the browser / delete them |
2. What reaches an AI provider — and only these
| What | Goes to | Why | Legal basis | Kept |
|---|---|---|---|---|
| Chat message + the relevant slices of your own data | Google Gemini | Generating the coach's reply | Explicit consent — Art. 9(2)(a) | Not retained by the provider for training (API terms) |
| Meal photo | Google Gemini | Estimating calories & protein | Explicit consent | Used for the estimate, not stored by the provider |
| A symptom / self-experiment topic (not your identity) | Google Gemini + live web search | Grounding the answer in real sources | Explicit consent | Transient |
Progress photos are sent to none of these — measurements are derived on your own device. A non-owner account must accept the AI-processing consent before any of these run; without it the request is refused, not silently sent.
3. Analytics, crashes & connections your device makes
| What | Goes to | Why | Legal basis | Kept |
|---|---|---|---|---|
| Page views (cookieless, aggregate) | Vercel Web Analytics | Traffic counts | Legitimate interest — Art. 6(1)(f) | Aggregate |
| First-party product analytics — semantic events (e.g. "a tab was opened") + a random device ID | Our own endpoint → Supabase or the private repo (no third-party analytics company) | Seeing which features help | Legitimate interest (opt-out) | Aggregate; no PII, no message text |
| Crash reports — error name + code location (file:line), never the message or your content | Same first-party endpoint | Catching bugs | Legitimate interest (opt-out) | Aggregate |
| Marketing attribution — a channel slug like "tiktok" (from a utm link) | Same first-party endpoint | Which campaign brought you | Legitimate interest | Aggregate, never joined to health data |
| Approximate location — coordinates rounded to ~1 km, on your explicit tap | BigDataCloud (keyless) | Auto-filling your city during setup | Consent — your tap | Not stored by us |
| Approximate coordinates | Open-Meteo | Your weather / UV / air-quality card | Consent — using the feature | Not stored by us |
| Push subscription token + notification payload | Your browser's push service (Apple / Google / Mozilla) | Delivering the coach nudges you enable | Consent — enabling alerts | Until you turn alerts off |
| Marketing/ad measurement (GA4, Google Ads, Meta, TikTok) | Those platforms — only if you press Accept on the consent bar | Telling which campaigns work | Consent — Art. 6(1)(a) | Per their terms; cookieless or off before consent |
Your health logs are never sent to any analytics or ad platform — only anonymous usage events. The app's static assets (fonts, the sign-in SDK, 3D libraries) load from Google Fonts, esm.sh and jsDelivr, which see the request (including your IP) purely to deliver the file — no tracking.
4. Where it's stored, and for how long
- Your data is kept while your account exists. Delete your account (Account → Delete my account) and personal data is erased within 30 days; backups roll off within 90.
- AI usage counters are kept in aggregate, de-identified form.
- Your data is a plain-text, per-account store — a full export is trivially real. Ask at hello@fitmito.com, or just delete it yourself in one tap.
5. The honest limits
Your account data is not end-to-end encrypted. FitMito is run by a small team, and to keep the service running and to help you when you write in, the operator can technically access the account data on our systems. We treat that as support-only, never as a data source to mine. One thing stays off our servers entirely: your progress photos (device-only).
Full detail, your rights and how to exercise them: Privacy Policy · Terms.