Privacy Policy — FitnessKing

FitnessKing is operated by Karun George, an individual based in India. This policy describes exactly what the app collects, why, who else processes it, and what control you have. It is written to be accurate about what the software actually does.

Effective 2026-07-22. Questions or requests: support@fitnessking.app.

1. Who we are

Karun George is the data controller for FitnessKing. The service runs at https://fitnessking.app and as a companion mobile app. There is no company, no sales team, and no advertising business behind it.

2. What we collect

You give us all of it directly. Nothing is inferred from third parties, purchased, or scraped.

Account details

Email address and a username you choose
A password, which is hashed and stored by our authentication provider — we never see or store it
An internal account identifier (a random UUID)

Profile and preferences

Full name (optional), sex, date of birth, height, primary goal, and self-reported fitness level
Training and rest days, planned session times and types, dietary restrictions, and the supplements you list

Health and fitness data

Body measurements from your smart scale or entered by hand: weight, body fat percentage, muscle mass, lean body weight, BMR, BMI, visceral fat, bone mass, and related metrics
Photos you upload of your smart-scale display, so the app can read the numbers off them
Daily nutrition logs and the individual meals inside them, including the free text you type
Nutrition targets (calories, macros, water) and weekly workout plans with per-day exercise detail

Service metadata

Records of each AI coaching run: which coach ran, when, token counts, status, and which billing engine was used
Your credit balance and the ledger of grants and spends
If you buy credits, a record of the transaction and the credits it granted. The payment itself is processed by Apple or Google — we never receive or store your card number or bank details
If you connect your own Claude subscription, an encrypted copy of the setup token you paste
Standard server logs and, when enabled, crash, error, and performance reports

3. What we do not collect

No analytics. There is no Google Analytics, Plausible, PostHog, Amplitude, Mixpanel, or any other product-analytics or tracking SDK in the web app or the mobile app.
No advertising. No ad networks, no advertising identifiers (IDFA/AAID), no ad SDKs, no retargeting pixels.
No location data. The apps never request or read your device location.
No contacts, calendar, microphone, or SMS. The Android build explicitly strips the microphone permission that a dependency would otherwise request.
No data sale or sharing for advertising. We do not sell your data and never have.
No third-party data sources. We do not buy, enrich, or import data about you from anyone.

4. Why we process it, and on what legal basis

To deliver the service you asked for — showing your dashboard, generating targets and plans, keeping your history. Legal basis: performance of our contract with you.
To provide AI coaching — sending the relevant slice of your logs to our AI provider so it can generate guidance. Legal basis: performance of our contract, and your explicit consent for the health data involved.
To keep the service working and secure — crash reports, rate limiting, and bot protection on the sign-in forms. Legal basis: our legitimate interest in a service that stays up and is not abused.
To send transactional email — account confirmation and password reset only. We send no marketing email.

We do not use your data to train AI models. We do not profile you for any purpose beyond generating the coaching you requested.

5. Health data is sensitive, and we treat it that way

Body measurements, nutrition logs, and scale photos are special-category personal data under the GDPR and sensitive personal data under India's Digital Personal Data Protection Act. We process them only to deliver the coaching features you use, and only on the basis of your explicit consent — which you give by entering the data, and withdraw by deleting your account. This data is never sold, never shared for advertising, and never used for any purpose you did not ask for.

6. Who else processes your data

We use a small set of infrastructure providers. Each acts as our processor under contract and may only use the data to provide their service to us.

Supabase — database, authentication, and file storage. Your account, all measurements, logs, plans, and uploaded photos live here. Hosted in the European Union (Germany).
Anthropic — the AI models behind the coaching. When you run a coach, the relevant part of your profile, body measurements, and nutrition or training data is sent to Anthropic to generate the response. Processed in the United States.
Vercel — hosting for the web app and its API routes.
Sentry — crash, error, and performance monitoring, on their EU ingest region. Configured not to send your email, name, or IP address: at most your random account UUID is attached to an event.
Cloudflare Turnstile — bot protection on the sign-in and sign-up forms, when enabled.
Expo (EAS) — delivers over-the-air updates to the mobile app. The device requests updates from Expo's servers; no account data is sent.
Upstash — rate limiting, when enabled. Stores only a counter keyed to your account identifier or IP address.
Google Fonts — the web app loads its typefaces from Google's font service, so your browser requests them from Google directly and Google receives your IP address and browser user-agent as part of that request. No account or health data is involved. The mobile app bundles its fonts into the app and makes no such request.
Apple and Google — if you purchase credits, the App Store or Google Play processes the payment and confirms the purchase to us. Your payment details go to them, never to us.

There is no other recipient. We add processors only when a feature requires one, and this list is updated when that happens.

7. International transfers

Your data is stored in the European Union (Germany). AI coaching requests are processed in the United States by Anthropic. Transfers outside the EEA rely on the standard contractual clauses in our agreements with those providers. If you are in India, note that your data is stored and processed abroad as described here.

8. Bring your own Claude subscription

You may optionally connect your own Claude subscription so that AI runs bill to your plan instead of ours. If you do, the setup token you paste is encrypted with AES-256-GCM before it is stored, is readable only by our server (no client, including your own browser or phone, can read it back), and is used for nothing except authenticating your coaching runs. Disconnecting deletes it. Your use of your own Claude plan is additionally governed by Anthropic's terms with you.

9. How long we keep it, and how to delete it

We keep your data for as long as your account exists. There is no separate archive.

You can delete your account at any time from the app — Profile, then the Danger zone — with no email to us and no waiting period. Step-by-step instructions, including what to do if you can no longer sign in, are on the Delete account page. Deletion is immediate and irreversible. It removes:

your uploaded scale photos, AI narrative files, and generated workout PDFs from storage
any stored Claude subscription token
your authentication record, which cascades to every remaining row: profile, measurements, nutrition logs and meals, targets, schedule preferences, workout plans, credit ledger, and run history

After deletion, residual copies may persist briefly in our hosting provider's encrypted backups before those backups roll over. They are not accessible to us as live data.

10. Your rights

Wherever you are, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or export it in a portable form. Most of these you can do yourself in the app; for anything else, email support@fitnessking.app and we will respond within 30 days.

If the GDPR applies to you, those are your rights under Articles 15 to 22, plus the right to withdraw consent at any time and the right to lodge a complaint with your national supervisory authority.

If India's Digital Personal Data Protection Act applies to you, you have the right to access a summary of your data and its processing, to correction and erasure, to nominate someone to exercise your rights, and to grievance redressal. Karun George handles grievances directly at support@fitnessking.app.

11. How we protect it

Every database table enforces row-level security, so a signed-in session can only ever read or write rows belonging to that account. This is enforced by the database, not by application code.
All file storage buckets are private, with per-account folder isolation enforced by the same row-level policies. Files are served only through short-lived signed URLs.
All traffic is encrypted in transit with TLS; our providers encrypt data at rest.
Passwords are hashed by our authentication provider and are never stored by us.
Claude subscription tokens are encrypted at rest with AES-256-GCM under a key held only by the server.
Sign-in and sign-up are rate limited and, when enabled, protected by a captcha.

No system is perfectly secure, but we do not collect anything we do not need, which is the most effective protection available.

12. Age requirement

FitnessKing is not directed to children. You must be 18 or older to create an account. We do not knowingly collect data from anyone under 18; if you believe a minor has an account, email support@fitnessking.app and we will delete it.

13. Changes to this policy

If we change this policy in a way that affects you materially, we will update the effective date above and notify you by email or an in-app notice before the change takes effect. Minor clarifications are published here without notice.

14. Contact

Karun George — support@fitnessking.app