Privacy Policy

1. Controller and scope

The data controller for Fitero is Hristo Lalev, an independent developer operating from Sofia, Bulgaria. You can contact the controller at support@fitero.eu; the postal address for legal correspondence is listed in the Contact section at the end of this page.

This Privacy Policy applies to the Fitero mobile application, its account and cloud-sync services, purchase entitlement handling, and related support communications. It does not govern third-party websites or app stores that have their own privacy notices.

2. Data we process

Account and authentication data

If you create an account, we process your email address, Firebase user identifier, email-verification status, authentication tokens, and account-security events. Password credentials are handled by Firebase Authentication and are not stored on the Fitero sync server.

Profile, fitness, and training data

Depending on the features you use, Fitero may process a display name or nickname, birth date, training goals and experience level, preferred equipment and training style, exercises, templates, programs, scheduled sessions, workouts, timestamps, set counts, repetitions, weight, duration, rest time, notes, targets, and body-measurement history.

Some fitness or body-measurement information may reveal information about health. You decide whether to enter this information. Where applicable law treats it as special-category data, it is processed to provide the tracking features you request and on the basis of your explicit consent where required.

App settings and device data

Fitero stores settings such as units, theme, onboarding status, trial state, notification preferences, and sync metadata. The app may receive technical information such as device model, operating-system version, app version, language, network status, identifiers, IP address, and timestamps when communicating with Firebase, RevenueCat, or the Fitero sync service.

Fitero may request notification and exact-alarm permissions so rest timers and workout reminders can work. Fitero does not require precise geolocation to provide its workout features.

Analytics and diagnostics

Firebase Analytics may process pseudonymous events such as onboarding completion, training-goal category, experience level, preferred equipment, paywall views, trial events, purchase completion, restore events, and feature-usage events such as starting or completing a workout together with aggregate metrics (for example duration, exercise count, and total volume). Analytics events never include your name, email address, workout names, template or program names, or free-text input. A Firebase user identifier may be attached after sign-in; Fitero does not intentionally send your email address as an analytics user ID.

Fitero asks before enabling usage analytics, and you can change that choice at any time in the app under Settings → “Share usage analytics.” When disabled, analytics events, screen views, analytics user identifiers, and user properties are not sent. Crash reporting (below) operates independently of this toggle.

Firebase Crashlytics may process crash reports, stack traces, app state, device and operating-system details, and diagnostic identifiers when the production app encounters an error.

Purchases and subscriptions

RevenueCat and the relevant app store process product identifiers, subscription status, entitlement status, purchase and expiration timestamps, and a pseudonymous app-user identifier. Fitero does not receive or store full payment-card details.

Support communications

If you contact us, we process your email address and the content and technical context you choose to provide so that we can answer and resolve your request.

3. Why we process data

We use personal data only when there is a valid purpose and legal basis:

• Performance of a contract: creating and securing your account, running workout features, saving your training history, syncing your chosen data, restoring purchases, and providing support.
• Consent: processing optional fitness or body-measurement information where consent is required, enabling optional notifications, and using optional analytics technologies where applicable law requires consent. Usage analytics can be switched off at any time in the app’s settings.
• Legitimate interests: protecting the service, preventing abuse, diagnosing crashes, understanding feature reliability, and improving Fitero, provided those interests do not override your rights.
• Legal obligations: complying with tax, accounting, consumer-protection, security, and lawful authority requirements.

We do not sell personal data. We do not use your workout history or body measurements to determine insurance, employment, credit, or advertising eligibility.

4. Local storage and optional cloud sync

Fitero is designed to work offline. Workout information, preferences, and app state are stored in a database and application storage on your device.

Cloud sync requires a verified Firebase account and an explicit first-link choice. When enabled, unsynced training records are sent to the Fitero backend over an authenticated connection. The backend associates records with the identity derived from your verified Firebase token and does not trust an account identifier supplied in the request body.

Sync covers workouts, exercise history, sets, user-specific measurement history, relationships between workout records, programs, scheduled program slots, targets, and custom reference records. Conflict resolution uses update timestamps, and soft-deleted records are synchronized as deletion markers before removal.

5. Recipients and service providers

We disclose data only as needed to operate Fitero, comply with law, or protect users and the service. Current categories of recipients include:

• Google Firebase: Firebase Authentication, Firebase Analytics, and Firebase Crashlytics.
• RevenueCat: subscription, purchase, entitlement, and offering management.
• Apple App Store and Google Play: app distribution, billing, refunds, and store-account administration.
• Infrastructure providers: hosting, database, networking, security, and backup services used by the authenticated Fitero sync backend.
• Authorities or professional advisers: only where legally required or reasonably necessary to establish, exercise, or defend legal claims.

These providers process information under their own terms and, where applicable, data-processing agreements. Links to provider privacy information are available from Google, RevenueCat, Apple, and Google Play.

6. International transfers

Some service providers may process information outside Bulgaria or the European Economic Area. Where required, transfers rely on a European Commission adequacy decision, the EU Standard Contractual Clauses, or another legally recognized safeguard. You may contact us for more information about safeguards relevant to your data.

7. Retention

• Local app data remains on your device until you delete it, clear the app’s storage, uninstall the app, or use an in-app erase function.
• Account and cloud-synced training data is retained while your account remains active or until you delete the account, subject to limited legal or security retention.
• Normal sync deletion markers are purged from the backend after they are older than 90 days. A full account-deletion request removes the account’s synced user data directly.
• Purchase, analytics, diagnostic, and support records are retained according to the applicable provider settings and only as long as needed for the purposes described above or required by law.

Backups and security logs may persist for a limited period before being overwritten, unless preservation is required to investigate abuse, resolve a dispute, or comply with law.

8. Security

Fitero uses authenticated Firebase identity tokens for cloud requests, encrypted network transport, per-account data separation, restricted backend access, rate limits, and other technical and organizational controls appropriate to the service. No storage or transmission method is completely secure, so absolute security cannot be guaranteed.

You are responsible for choosing a strong password, protecting access to your email and device, and signing out on devices you no longer control.

9. Your privacy rights

Depending on your location, including under the EU General Data Protection Regulation, you may have the right to request access, correction, deletion, restriction, portability, or objection; withdraw consent at any time without affecting earlier lawful processing; and receive information about relevant international-transfer safeguards.

You may also lodge a complaint with Bulgaria’s Commission for Personal Data Protection or with the supervisory authority in your habitual residence, workplace, or place of the alleged infringement.

To exercise a right, email support@fitero.eu. We may need to verify your identity before acting on a request. We normally respond within the period required by applicable law.

10. Data export, account and data deletion

You can export your complete training and measurement history as a CSV file at any time from the app’s settings (“Export my data”), independent of any account.

Signed-in users can use the account deletion control in Fitero’s settings. The flow reauthenticates the account, deletes synced data from the Fitero backend, deletes the Firebase Authentication account, and clears local user data. If a step fails, the app reports which part could not be completed so it can be retried or handled through support.

You may also request deletion at support@fitero.eu. Deleting Fitero data does not automatically delete records independently retained by an app store for billing, tax, fraud-prevention, or legal purposes.

11. Children

Fitero accounts are intended for people who are at least 16 years old. We do not knowingly create accounts for younger children. If you believe a child below that age has provided personal data, contact us so we can investigate and delete it where required.

12. Changes to this policy

We may update this policy when Fitero’s features, service providers, or legal obligations change. Material changes will be communicated through the app, website, or account email where appropriate. The effective date at the top identifies the current version.

13. Contact