Privacy Policy

You do not need to tick a box to "accept" this Policy. By creating your account, you confirm only that you were given access to it.

1. Who we are

This Privacy Policy is published by Fitzer Tecnologia Ltda., registered under CNPJ 68.056.855/0001-78, responsible for the Fitzer app.

2. Scope

This Policy applies to the Fitzer app, available for iOS and Android, and describes how we handle the personal data of people who create an account and use the app.

3. Controller

Controller of the personal data: Fitzer Tecnologia Ltda., CNPJ 68.056.855/0001-78, with registered office at Rua Dona Carmelita Gama Romeiro, nº 300, Parque São Benedito, Pindamonhangaba/SP, CEP 12.410-200, Brazil.

Privacy contact: [email protected].

3.1. Privacy contact channel

Fitzer Tecnologia Ltda. maintains a dedicated channel for personal data protection matters at [email protected], through which data subjects and the Brazilian National Data Protection Authority may submit requests, complaints and communications.

4. Separate channels

Privacy and personal data matters should be sent to [email protected]. This channel is separate from operational support, [email protected].

5. Data we collect

We collect data you provide directly, data generated by your use of the app, and technical data necessary for the service to run and stay secure.

Fitzer does not request access to your device’s precise location and does not collect GPS coordinates. IP addresses may be processed by the infrastructure services for operation, security and abuse prevention.

Fitzer does not request access to your contact list and does not ask you to provide other people’s personal data. In the social features, we process the content and participation data that you and the other participants chose to make available to the group, such as messages, chat photos, profile picture, score and activity events, as set out in the sections of this Policy on challenges and chat.

When you enable challenge notifications, we also process your device’s push notification token, as set out in the section of this Policy on notifications.

We do not collect payment data. If you authorise it, Fitzer can read steps, sleep and exercise sessions from Apple Health (HealthKit) or Google Health Connect, as set out in the section of this Policy on integrations with health devices and apps. That integration is optional, read-only, and is not a condition for using the app. Heart rate is not read.

6. Account data

Name, email, authentication credentials, optional profile picture, preferred language, unit of measurement, and display and notification preferences.

If you sign in with your Google account, we receive from the authentication flow only the data necessary to create and identify your account, such as name, email and account identifier. Fitzer never receives your Google password.

If you sign in with your Apple account, we receive from the authentication flow the account identifier and, on the first authorisation, the name and email you choose to share. If you choose to hide your email, Apple provides a relay address, and that address is the one associated with your account. Fitzer never receives your Apple password.

7. Technical data

To operate the service and protect it against abuse, technical data is processed, such as session identifiers, date and time of access, IP address, information about the device and the operating system, app version, and error and security logs.

Part of this data is generated and kept by the infrastructure services we use, as part of their normal operation. We do not use this data for advertising or to build a behavioural profile.

8. Sensitive health data

Part of the data Fitzer processes is sensitive personal data relating to health: weight, height, body measurements, body composition, goals, the biological sex used to calculate calorie needs, workouts, food, hydration, history and progress, medication dose and time, injection site, reported symptoms, and body and progress photos.

9. Menstrual cycle

The menstrual cycle area becomes available automatically for anyone whose profile states female sex. That availability follows solely from the information you declared yourself; Fitzer never infers this from your name, photo, age or any other data.

The area being available does not mean recording is required, nor that data is processed automatically: use is voluntary and nothing is collected until you record something.

Before any processing of cycle-specific data, the app shows a consent screen the first time you open the area. Only after you consent are the period dates, associated symptoms and fertility information you enter processed. If you decline or leave that screen, nothing is recorded and the rest of the app keeps working normally.

If the profile no longer states female sex, the area stops being shown, and records already created are preserved rather than deleted. You can request deletion of those records at any time.

10. Progress photos

Progress photos exist so you can compare your own progress over time. They are not shown to other users.

Before upload, the image is resized, recompressed and has its orientation corrected. This processing creates a new file from yours, without the original metadata, including EXIF, GPS data, device model and capture date.

The photos are kept in private Storage, reachable only through temporary signed links. You can view, compare and delete them at any time.

10.1. Capacity and cycle quota

These are two distinct limits. Capacity is how many photos can be stored at the same time: 12 on Free, 120 on Plus. Cycle quota is how many uploads you can make within a cycle: 2 uploads per cycle on Free, 10 uploads per cycle on Plus.

Deleting a photo frees capacity, but does not give back an upload already consumed in the cycle.

10.2. Earlier photos

Photos recorded before this structure are neither deleted nor migrated automatically. If you choose to migrate them, they take up capacity and do not consume cycle quota.

11. Body analysis

Body analysis sends three of your photos for automated analysis by artificial intelligence, producing a visual reading of your progress.

It is available only on the paid plans, Fitzer Plus and Fitzer Premium, with a minimum interval of seven full days between analyses, counted from the last analysis completed successfully.

Body analysis is not a medical diagnosis and does not assess any health condition.

The image you send does not automatically enter your progress photo gallery: you decide whether to save it. When you choose not to save it, the image is not written to your permanent collection in the app. The result of the analysis may remain in your history even without the original image.

12. Meal photos

Captured with the device camera or selected from the gallery, for the purpose of estimating food information through automated analysis.

Available only on the paid plans. The limit planned for the commercial offering of the paid plans is 210 food analyses per cycle. This limit will be enforced before the paid subscription becomes available.

The estimates may contain errors and do not replace guidance from a qualified professional. The estimate is always reviewed and confirmed by you before it is saved. The photo stays in private Storage so you can consult your diary, until you delete it or delete your account.

13. Artificial intelligence

The Free plan does not use any artificial intelligence feature. No image or data is sent to an artificial intelligence provider on Free accounts.

The paid plans, Fitzer Plus and Fitzer Premium, use artificial intelligence within the limits of each plan. Data is sent only when you start the feature; there is no background sending. Every result is an estimate, not a diagnosis, and may contain errors.

The diet and workout plan generation available on Fitzer Premium is performed locally, by rules of the app itself. It does not send data to an artificial intelligence provider.

We use two artificial intelligence providers, always reached through a Fitzer backend function. OpenAI is the provider currently used to estimate food from meal photos. Google, with the Gemini 2.5 Flash model, is the provider for body analysis and may be used as an alternative for food estimation. The provider actually called for each request depends on the backend configuration at that moment; for that reason this Policy does not claim a single provider. The app installed on your device never communicates directly with the providers, and the access keys exist only in the backend.

Only the images and text necessary for processing are sent. Your name, email, account identifier, weight, medication, symptoms and history are not sent.

Processing carried out by OpenAI and by Google follows the terms applicable to the services we have contracted and may involve infrastructure located in other countries.

Challenges, duels, groups with chat, achievements and rankings are available on the Free plan as well. Taking part is always optional.

When you take part in a challenge, the following become visible to the other participants of that challenge: your display name, your profile picture, your score, your ranking position, your completion percentage, your day streak, your achievements in the challenge, the messages and photos you send to the chat, and the automatic events described below. Invitations and participation are visible to those involved. The group image set by the creator is visible to the participants.

Certain actions generate events published automatically in the group: a completed workout, streak milestones, unlocked achievements, completion of the challenge and an improved ranking position. The workout event displays only structural information about the workout: the workout name or letter, focus, duration, number of exercises, number of sets and muscle groups worked.

We never share your clinical data, meals, medication, symptoms, weight, measurements, calories, meal photos, progress photos or body analysis photos with other users. The automatic events do not contain that data. Entering or publishing other people’s health data in any shared space in Fitzer is prohibited.

14.1. Challenge chat

The challenge chat processes the following data: the text of messages, photos sent with an optional caption, the identification of the sender by display name and profile picture, the challenge or group the message belongs to, the date and time of sending, the technical metadata necessary for delivery, reading and expiry of messages, the blocks you apply, the reports you send and the corresponding moderation records.

The purpose is to enable conversation between the participants of the challenge you chose. Messages and photos are visible only to the current participants of the challenge, from the date each one joined; whoever joins later does not see the history prior to their own entry, and whoever leaves or is removed loses access.

Chat photos are kept in a private Storage space, reachable only through temporary signed links, issued only to current participants of the challenge. Blocking a participant hides their messages and photos from you. Reporting a message records the report with a copy of the reported content, to allow review even after the message expires.

14.2. Chat retention

Chat messages and photos have a retention period set at the moment of sending, according to the plan of the challenge creator: 48 hours when the creator is on the Free plan and 10 days when the creator is on a paid plan, Fitzer Plus or Fitzer Premium.

Once the period ends, the message and the photo stop being accessible to any participant. Permanent removal of the corresponding records and files is carried out by automated batch cleanup routines and may take additional time after the accessibility period ends.

Deleting one of your messages removes its content for everyone and sends the associated photo for permanent removal. Recorded reports follow their own period, limited to the purpose of moderation.

After a workout, you can generate a sharing card with workout information, such as name, focus, duration, estimated active calories, muscle groups and weekly progress, with the option of including a photo of yourself chosen from the gallery. The card is assembled on your device.

External sharing, through third party apps, only happens when you trigger the share and choose the destination. From that moment, the processing of the shared content follows the rules of the destination app, over which Fitzer has no control.

Sending the card to a Fitzer group publishes the image in the chat of the chosen challenge, as a chat photo, subject to the chat visibility and retention rules described in this Policy.

15. Advertising

The Fitzer Free plan may display advertising inside the app, in formats such as banners and full screen ads. Advertising is served by Google AdMob, the advertising platform operated by Google. The ad-free plans, such as Fitzer Plus and Fitzer Premium, do not receive advertising from Fitzer.

To deliver, measure and protect the ads, Google may process technical data from your device, such as device identifiers, IP address, general device information and data about your interaction with the ads, to the extent necessary for their operation, measurement, security and fraud prevention. Depending on your region, your consent choices and the system permissions, advertising identifiers may be used to personalise the ads; without those conditions, ads are served without personalisation based on those identifiers.

Where the law requires it, the app presents a consent request before any ad request is made, and you can review your choices in the ad privacy options area, where applicable to your region. On iOS, the system asks separately about tracking across apps; declining that permission does not prevent the display of ads that are not based on that identifier. Declining ad consent or tracking does not prevent you from using the app.

Your health and usage data in Fitzer, including weight, food, workouts, symptoms, cycle, photos, analyses and conversations, are not used by Fitzer to target advertising and are not sent to the advertising platform as targeting criteria. The processing carried out by Google as the advertising provider is described in the policies published by Google.

16. Analytics and crash reporting

Fitzer does not integrate third party analytics tools, behavioural tracking or automatic crash reporting.

The Google advertising SDK, present in the Free plan, generates its own technical, performance and diagnostic data to deliver and measure ads, as set out in the section of this Policy on advertising. That data is processed by Google as the advertising provider; Fitzer only accesses aggregated reports.

17. Purposes of processing

To enable your account and your authentication; to calculate goals and estimates for calories, protein and water; to organise medication reminders; to record and display your history of weight, measurements, workouts and meals; to generate artificial intelligence estimates from photos you send; to enable your participation in social features when you choose to, including the challenge chat and the automatic events; to deliver the notifications you enable; to operate the reporting, blocking and moderation mechanisms; and to ensure security and prevent fraud and abuse.

18. Legal bases

Ordinary personal data is processed to perform the contract entered into when you create an account and use the app, to comply with legal obligations where applicable, and on the basis of legitimate interest limited to what is necessary for security and the prevention of fraud and abuse.

Sensitive personal data is processed under the situations authorised by applicable law. Where specific consent is the applicable basis, it must be requested prominently and tied to the stated purpose.

We describe the practices we adopt; we do not claim guaranteed compliance with any legislation.

19. Consents and device permissions

Operating system permissions, such as camera, photo gallery, notifications and reading Apple Health or Health Connect, are technical authorisations granted to the app by your device. You manage them in the system settings and can revoke them at any time. Granting a technical permission is not, in itself, legal consent to data processing.

Legal consents are recorded separately. Fitzer currently records acceptance of the Terms of Use and keeps a record of the initial consent associated with your profile. For body analysis, photos are only sent after your explicit confirmation within the feature itself.

20. Infrastructure and processing providers

Supabase: database, authentication, Storage and backend functions, with infrastructure in the South America region (São Paulo).

OpenAI: artificial intelligence model currently used to estimate food from meal photos, as set out in the section of this Policy on artificial intelligence.

Google: the Gemini 2.5 Flash model, for body analysis and as an alternative for food estimation; the OAuth authentication flow when you choose to sign in with your Google account; and the Google AdMob platform, for advertising in the Free plan, as set out in the section of this Policy on advertising.

Apple: the Sign in with Apple authentication flow, when you choose that sign-in.

Expo: delivery service for challenge push notifications. It receives your device’s notification token and the content of each notification, as set out in the section of this Policy on notifications.

Open Food Facts: public food database consulted when you scan a barcode. The query sends only the barcode and the interface language. It does not send your name, email, account identifier or any health data.

These providers process data to enable Fitzer features, under the terms of service applicable to each one.

21. App stores

Apple and Google Play distribute the app. They are not providers engaged by us to process the data you record in Fitzer.

Apple and Google may process data relating to your store account, to downloading and updating the app and, where applicable, to payments, under the terms and privacy policies of those companies, over which we have no control. We recommend consulting those policies directly.

Fitzer does not sell personal data.

We do not share your clinical data, meals, medication or symptoms with other users of the app under any circumstances.

In challenges, it is you who decides to share content with the group by taking part, sending messages, photos or the workout card, within the limits described in the sections on challenges and chat. When you share content with external apps through the system share menu, the chosen destination processes that content under its own rules.

23. International transfers

Using artificial intelligence features involves sending images and text to the providers (OpenAI and Google), and serving advertising involves the processing of technical data by Google, which may mean processing outside Brazil.

Processing data outside Brazil is subject to the applicable rules on international transfers of personal data and to the terms of the provider involved.

24. Storage

Database and Storage hosted by Supabase, in the South America region (São Paulo). Photos are kept in private buckets, reachable only through temporary signed links, never through a direct public URL.

25. Retention

Account data, health records and photos remain while your account is active, or until you delete the record or the photo.

Challenge chat messages and photos follow the specific periods described in the section on chat retention: 48 hours on the Free plan and 10 days on the paid plans, counted from sending and set by the plan of the challenge creator.

The push notification token remains associated with your account while it is active and is deactivated when you sign out of the account on the device.

Body analysis images that you choose not to save are not written to your permanent collection in the app.

Technical logs and infrastructure backups are kept by the services we use for a limited period, as part of their operation, and are replaced by the rotation cycle.

Data necessary to comply with a legal obligation or to exercise rights may be kept for the applicable periods.

26. Deleting content and deleting your account

Deleting content: you delete a single record or photo; the rest of the account continues.

Deleting your account: requested on the dedicated screen in the app, with explicit confirmation, or through an external request as described on the account deletion page of our website. The request triggers removal of your authentication account, your records in the personal data tables, including the messages you sent in challenges, and your files in the spaces for meals, progress, body analysis, profile picture, challenge group images and photos you sent in the challenge chat.

Records already deleted may remain in backups until those are replaced by the rotation cycle, without being reintroduced into the app. For that reason this Policy does not describe deletion as immediate and total across all copies.

Anonymised data and data subject to legal retention may be kept.

27. Your rights

You may confirm that processing exists, access your data, correct incomplete or outdated data, request portability or export, request deletion of your account, withdraw consents, object to a specific processing activity, request review of an automated decision where applicable, and obtain information about who your data is shared with.

Requests to confirm processing and for simplified access are answered immediately whenever technically possible. Other requests are answered within the applicable legal deadlines.

You may lodge a complaint with the Brazilian National Data Protection Authority.

28. Data export

Export is available on the account screen and gathers the records from your personal data tables, such as profile, medication, weight, meals, workouts and symptoms.

The export includes the records associated with your photos, but does not include the image files. In the current version, it also does not include data from the social features, such as challenges, chat messages, blocks and reports. To obtain the images or the social data, use the privacy channel.

29. Correcting data

You can correct most of your data directly on the app screens. For corrections not available in the interface, use the privacy channel.

Where processing is based on consent, it may be withdrawn at any time through the privacy channel or, where available, by turning off the corresponding feature. Withdrawal does not affect the lawfulness of processing carried out beforehand.

31. Children and adolescents

Fitzer is intended exclusively for people aged 18 or over. Fitzer does not intend to knowingly collect personal data from people under 18, and the app blocks completion of sign up when the age provided is below that limit.

If an account is identified as belonging to someone under 18, it may be blocked, and the associated data will be handled under this Policy and applicable law, respecting the technical and legal periods described in the section on deleting content and deleting your account.

Requests relating to this subject can be sent to [email protected].

32. Security

Fitzer uses access controls in the database, private storage with temporary signed links, HTTPS connections, and the security mechanisms offered by the infrastructure platform and by your device’s operating system. The session token is encrypted on the device itself, and the key for that cipher is kept in the operating system’s secure storage (Keychain on iOS, Keystore on Android).

No system is completely immune to incidents. We work to reduce risks and to respond appropriately if one occurs.

33. Notifications

Fitzer uses two types of notification: local notifications and remote push notifications.

Local notifications: protein, water, medication and daily summary reminders are scheduled locally by the app itself, on your device, without sending your health data to an external push notification service.

Remote push notifications: used only for challenges, such as chat messages, participant progress, ranking, achievements and challenge notices. To deliver them, the app registers your device’s notification token in our backend, associated with your account and the device platform. Sending is done through the Expo push service, which receives the token and the content of the notification: the group name, the sender’s display name and an excerpt of the message or the summary of the event. No health data is included in push notifications.

You control push notifications per challenge and per category in the settings of the challenge itself, in addition to the operating system’s notification permission. Without the system permission, no token is registered. When you sign out of the account, the device token is deactivated.

34. Cookies and similar technologies

The Fitzer app, being a mobile app, does not use cookies. If the public Fitzer website comes to use cookies or similar technologies, that will be described in a dedicated notice published on the website.

35. Integrations with health devices and apps

Fitzer has an optional, read-only integration with Apple Health (HealthKit) on iOS and with Google Health Connect on Android. It is only switched on if you grant the system permission; the app works in full without it.

When authorised, the integration reads three categories: steps, to estimate your daily movement expenditure; sleep, for the summary of your night and your recovery; and exercise sessions, with duration, distance and energy, to recognise workouts recorded in other apps or on watches, such as the Apple Watch or devices connected to Health Connect, avoiding duplicate records. Heart rate, weight, nutrition, glucose, cycle and extended history are not read, and Fitzer writes nothing to those platforms.

The data read is processed on your device and kept only in the app’s memory and local cache. Steps, sleep sessions and exercise sessions read from those platforms are not sent to our servers and are not persisted in your account. The activity records that remain in your account are only the ones you save in the app yourself.

That data is not used for advertising, is not sent to the advertising platform and is not shared with third parties.

You can withdraw the permission at any time in the operating system’s privacy settings. Refusing or withdrawing permission for health app integration will not prevent you from using the other Fitzer features that do not depend on that data. New integrations, such as heart rate, will be preceded by an update to this Privacy Policy and to the declarations presented in the app stores.

36. Changes to this Policy

Changes that broaden the types of data processed or their purposes will be communicated. Where required by applicable law, we will request a new statement from the user or adopt another appropriate legal measure before the new processing.

Editorial corrections do not require new consent.

37. Contact

For any matter relating to this Privacy Policy or to your personal data, get in touch at [email protected].