Fitblast collects some Personal Data from its Users.
Need help with Fitblast? Write to us at dev@fitblast.com.
This document can be printed for reference using your browser's print command.
Fitblast Inc
131 Continental DrContact email: dev@fitblast.com
Complete details on each type of Personal Data collected are given in the sections of this policy that describe the processing, or in specific explanations shown in the app before the Data is collected.
Some Personal Data is required for the Service to work — an account needs an email address, and a safe training plan needs your health answers. Other Data is optional, and the app says so where you enter it. If you choose not to give optional Data, the Service still works.
Some Data, such as Usage Data and crash reports, is collected automatically while you use the app.
If you are unsure which Data is mandatory, contact us.
Fitblast processes data concerning your health, a special category of Personal Data under Article 9 of the GDPR. We process it only with your explicit consent, and only to tailor your training safely.
We take appropriate security measures to prevent unauthorised access, disclosure, modification or destruction of the Data. Data travels between the app and our server only over encrypted connections (HTTPS), passwords are stored only as salted hashes, and access to the database is limited to the people who run the Service.
Besides us, the service providers listed in this policy process the Data on our behalf, as Data Processors, for the purposes described here.
Our server and database run in the European Union (Netherlands). Some of the providers listed below process Data in the United States. Where Data leaves the European Economic Area, the transfer relies on the European Commission’s Standard Contractual Clauses or on the provider’s certification under the EU–U.S. Data Privacy Framework. Contact us to learn which safeguard applies to a given provider.
Personal Data is kept for as long as the purpose it was collected for requires. In practice:
We collect Data about you to:
You register and sign in either with Apple or Google, or with an email address and password. Your Data is used to identify you and to give you access to the Service.
Lets you create an account and sign in with your Apple ID. The app receives a signed identity token, which our server checks against Apple’s public keys. Apple may give us a private relay address instead of your real email if you choose to hide it.
Personal Data processed: email address (possibly a private relay address); name (only on the first sign-in, and only if you share it); Apple user identifier.
Place of processing: United States – Apple Privacy Policy
Lets you create an account and sign in with your Google account. Our server checks the ID token Google issues against Google’s public keys.
Personal Data processed: email address; name; Google user identifier.
Place of processing: United States – Google Privacy Policy
Your account and the tokens that keep you signed in. Access and refresh tokens are stored in your device’s secure storage (iOS Keychain / Android Keystore). Our server keeps only a one-way hash of each refresh token and deletes it seven days after it expires.
Personal Data processed: email address; name; date of birth (the Service is for adults 18 and over, and the server enforces it); sign-in method.
Place of processing: European Union (Netherlands) – Railway, Inc. data centre – Railway Privacy Policy
Stops password guessing. Sign-in attempts are counted per email address together with the network address they come from, and too many failures pause sign-in for that account for a while. The counters live only in the server’s short-term memory and expire on their own within minutes.
Personal Data processed: email address used to sign in; IP address.
Place of processing: European Union (Netherlands) – Railway, Inc. data centre – Railway Privacy Policy
What we need to build and adapt your training plan.
Our own server builds your four-week plan with a fixed, rule-based algorithm (not AI) from your answers, your movement check and your workout history, and adapts it as you train. It uses your health answers to keep you away from exercises that are not safe for you, to pause training when something needs attention, and to suggest a professional check when your answers call for one.
Personal Data processed: goals, preferred intensity, focus areas and training days; home equipment, available space and quiet mode; language and time zone; health data (see “Health data” below); movement-check results (reps or seconds you enter yourself; the camera is not used); workout results: sets, reps, completion, skipped and replaced exercises and the reasons; pain reports during workouts: area, severity, character and warning signs; feedback on difficulty and on how each body area felt; liked and hidden exercises, readiness check-ins and pain follow-ups; a random install identifier attached to each workout result, so results sent twice are not counted twice.
Place of processing: European Union (Netherlands) – Railway, Inc. data centre – Railway Privacy Policy
An optional assistant you can chat with about your training, which can change your plan only through a fixed set of defined actions.
When the AI coach is available, your chat messages are sent to Anthropic’s Claude model together with the context it needs to answer: earlier messages, facts the coach has remembered about you, reported pain areas, paused movement patterns, your plan and today’s session, dates and your language. When you write a free-text health note, the note itself is sent so the model can turn it into structured answers you then confirm. We store the conversation, the remembered facts, requests the coach could not handle and usage counts; Anthropic processes the content under its commercial terms, which do not allow it to train its models on this data. The app asks for your permission before your first chat, and you can turn the AI coach off in the app’s settings at any time. Coach replies are general fitness guidance, not medical advice.
Personal Data processed: chat messages; free-text health notes; health and training context described above.
Place of processing: United States – Anthropic Privacy Policy
Workout reminders on the days and at the time you choose.
Sends the workout reminders you set up. We store your device’s push token and platform, and your reminder days and time. A reminder carries only its text — never health data.
Personal Data processed: push notification token; device platform; reminder schedule.
Place of processing: United States – Expo Privacy Policy
Understanding how the app is used, without tracking you across other apps.
Tells us how the app is used, so we know which parts help and which get in the way. You are identified only by your account identifier — never by email, name or date of birth. We send a short list of product events (for example: signed in and how, onboarding step viewed, workout started or completed, coach message sent) and screen names. Message text and health data are never sent. Session recording and automatic capture of taps are switched off.
Personal Data processed: account identifier; product events and screen names; device model, operating system and app version.
Place of processing: European Union (Germany) – PostHog Privacy Policy
Finding out what broke, so it can be fixed.
Reports app crashes and measures performance on a 20% sample of app activity. A report contains your account identifier (never your email), the error, recent navigation, taps and request addresses leading up to it, and device and app details. Session recording is switched off.
Personal Data processed: account identifier; crash data and breadcrumbs; performance data; device model, operating system and app version.
Place of processing: European Union (Germany) – Sentry Privacy Policy
When a request fails, our server records what went wrong so we can fix it: the address, the error and your account identifier. Passwords and tokens are always removed. Apart from sign-in requests, only the names of the fields you sent are kept, never what you entered, and the query part of the address is dropped. Entries are deleted after 30 days.
Personal Data processed: account identifier; request address and error details; user agent (which app version or browser made the request); app version and device platform.
Place of processing: European Union (Netherlands) – Railway, Inc. data centre – Railway Privacy Policy
Where the Service runs and the Data is stored.
Hosts our server, its database and its cache. All the account, training and health data described in this policy is stored here.
Personal Data processed: all data described in this policy that is stored on our server.
Place of processing: European Union (Netherlands) – Railway Privacy Policy
Before your first plan, the app asks about injuries and current pain, and during workouts you can report pain. Depending on your answers, the Service may hold back some exercises, keep your plan gentler, pause training, or suggest that you see a professional before you continue. These are product safety rules, not a medical assessment. Fitblast is a general fitness app, not a medical device, and nothing in it is medical advice.
Your plan is produced and adjusted automatically by our rule-based algorithm, and the AI coach answers automatically. Neither makes decisions that have legal effects on you or similarly significantly affect you. You can always change your answers, replace exercises, or delete your account.
The app asks for permission to send notifications (for reminders) and may open your photo library if you choose a profile picture; the picture stays on your device and is not uploaded. The app does not use your location, contacts, camera, microphone, Apple Health or Health Connect.
The Service is for adults aged 18 and over. We ask for your date of birth and refuse accounts under 18.
We do not sell your Data, we do not show advertising, and we do not track you across other companies’ apps or websites. The app does not ask for Apple’s App Tracking Transparency permission because it does not track.
We process Personal Data about you when one of the following applies:
Data processed to perform our agreement with you is kept until you delete your account. Data processed on the basis of consent is kept until you withdraw it. Data kept for our legitimate interests is kept only as long as that interest requires (see “Retention time”). When the retention period ends, the Data is deleted, and the rights below can no longer be exercised for it.
You have the right to:
Where Data is processed for our legitimate interests, you may object on grounds relating to your particular situation, and we will stop unless we have compelling reasons to continue. Fitblast does not use your Data for direct marketing.
You can delete your account at any time in the app, under Profile → Delete account. This immediately and permanently deletes your account and everything linked to it: name, email address, date of birth, health answers, workout history including pain you reported during workouts, coach conversations, reminders, consent records and error log entries.
Because the Service cannot build a safe plan without your health answers, withdrawing your consent to health data means deleting your account, or writing to us and we will do it for you. Deleting the account in the app does not yet remove what PostHog and Sentry hold under your account identifier; write to us and we will have it deleted too.
Write to us at the address below. Requests are free of charge, and we answer as soon as possible and always within one month.
Contact email: dev@fitblast.com
We may use your Personal Data for legal purposes, in court or in the steps leading to possible legal action arising from improper use of the Service, and we may have to disclose it when public authorities lawfully request it.
For operation and maintenance, the Service keeps the logs described under “Crash reporting and error monitoring”, and nothing beyond them.
More details about the processing of Personal Data can be requested from us at any time using the contact address.
We may change this policy. We will tell you in the app and ask for your consent again where the law requires it. The date of the latest update is at the bottom of this page.