FitBound Online Privacy Policy

Effective date: November 1, 2026

Controller/operator: Sacro Media LLC

Privacy contact: privacy@fitboundonline.com

Website: https://fitboundonline.com

1. Scope

This Policy explains how Sacro Media LLC (“FitBound,” “we,” “us,” or “our”) collects, uses, discloses, retains, and protects information in FitBound Online and related websites and services.

FitBound is for people who are 18 or older. Before you can use FitBound we ask for your birth date and refuse anyone under 18. If you sign in with Apple or Google before giving it, that sign-in creates your account record first; you cannot use the app until you give a birth date of 18 or older. The date is self-declared: we do not check ID. FitBound is not offered to children and we do not knowingly collect a child’s personal information. If we learn that an account belongs to someone under 18, we pause it and review it for removal.

2. Information we collect

Account and profile

• email address, authentication provider identifier, display name, username, birth date, age-gate acceptance, gender (where provided), height, target weight, locale, region, time zone, and account timestamps;
• your profile photo: if you upload one, FitBound stores it in its own storage; if you sign in with Google, we also store the web address of your Google account photo;
• versions and timestamps for the four documents you accept or acknowledge (Terms of Service, EULA, Privacy Policy and the Health & Fitness Disclaimer). The notice shown before your first meal-photo scan is acknowledged on your device only and is not stored on our servers;
• if you joined the waitlist before launch, your email address, the platform you picked (iPhone, Android or either) and the time you joined, used for nothing else;
• if you sign in with Apple or Google, the profile details that provider sends us at sign-in, normally your name and email address;
• if you send a bug report or feature request through our website, the description you write and, if you give them, your name and email address;
• preferences such as units, goals, experience level, workout schedule, training split, exercise variability, and cardio choices.

Fitness and health-related information

• workout sessions, exercises, sets, repetitions, weight, duration, distance, rest, incline, resistance, notes, effort ratings, and training location profile;
• body measurements and progress records you choose to enter;
• Health and activity readings from your phone. If you connect them, FitBound reads these on your phone: on iPhone, the heart rate your Apple Watch records while a workout is open (from Apple Health, only while the Live heart rate switch is on) and today’s step count (from Motion & Fitness); on Android, from Health Connect, today’s steps, your heart rate while a workout is open, and your most recent body weight from the last 90 days (see Section 12 for when Android reading starts). FitBound does not send these readings to its servers. If you choose to save a body weight filled in from Health Connect, it is stored as a body measurement and handled like one you type (see body measurements and Section 12). We store whether, and since when, the Live heart rate switch is on;
• verification status, confidence signals, fraud-prevention events, and the rewardable portion of activity.

Nutrition

• food and meal names, serving information, calories, protein, carbohydrates, fat, fiber, sugar, sodium, water, meal time/type, notes, entry method, confirmation status, and AI confidence;
• barcode or nutrition-label information when those features are used.

Meal photos

If you choose photo analysis, the image is processed as follows:

1. the app captures or selects the image with your permission;
2. a resized copy, with location data removed, is sent, encrypted in transit, through FitBound’s servers to OpenRouter, which passes it to a company that runs the AI model. The company that runs the model can differ from scan to scan. If a scan fails, we may send it again;
3. the AI service returns an estimate of the meal;
4. FitBound’s backend does not store photo bytes or a remote photo URL. We do not send your name, email or account number with the photo;
5. how long OpenRouter and the company that runs the model keep the photo is set by their own terms, which we have not independently verified (see Sections 5, 6 and 8);
6. the app keeps one copy on your phone as the diary thumbnail. It is stored outside iCloud and Android backups, and it is deleted shortly after you delete those entries, when you sign out, or when you delete your account.

We store the resulting text/nutrient estimate and the technical metadata needed for the entry. The estimate is logged to your diary automatically, without a separate confirmation step, and you can edit or delete it. We also compute and store a short numeric fingerprint of the photo itself (a perceptual hash — a string of numbers derived from the image's visual pattern, not the image), so that scanning the same meal again can reuse your prior estimate, including corrections you chose to save to it, instead of sending a fresh image for analysis every time. You can see and delete these saved matches in Settings > Saved meal matches. This fingerprint cannot be used to reconstruct or view the photo. We keep up to 200 of these per account, automatically discarding the oldest once that limit is reached. We also delete a fingerprint 180 days after it was last saved. Reusing it for a repeat scan does not reset that clock. The first time you use photo or label scanning, and again if the AI services we use change, FitBound shows a notice confirming your photo is analyzed by an AI service, that the image itself is not kept, and that a fingerprint of it is stored to speed up repeat scans of the same meal.

Optional location

FitBound uses location in a few optional ways, and they behave differently:

• Training-location profile. You may label a saved training location as Home, Gym, Outdoor, or Other to tell FitBound what equipment is available there. A Home, Outdoor or Other location is a name and an equipment list only, with no coordinates. If you choose Gym and pick your gym from the nearby search, FitBound uses your position for that search (see “Nearby gyms” below) and stores that gym's public map coordinates with the location. It never stores your own position for a training location. FitBound never asks for or stores your residential street address.
• Gym verification (precise, while-in-use GPS). If you save a real gym (chosen from public map data) and use a feature that checks your presence there — starting a workout at that gym, a gym-boss encounter, or a gym-control/leaderboard action — FitBound reads your device's precise while-in-use location at that moment and compares it to the gym's known coordinates. In some checks your phone first compares its position with the gym; in others, such as tapping “Verify I'm here,” the position goes straight to our servers for the check. FitBound records a verification event containing the gym, the calculated distance to it, a pass/fail result and a mock-location flag, but not your coordinates. FitBound's server keeps only your most recent position, replaced at each passed check and deleted within 24 hours, to detect impossible travel between checks. This is precise location, not an approximate one.
• Promo-code gym boost. If a promo code gave you an XP boost at a specific gym, finishing a workout checks once whether you are at that gym, the same way as a gym verification. It records the same kind of verification event, with no coordinates.
• Nearby gyms. When you open the gym map or search for gyms near you, the app reads your position while it is open and sends it to FitBound's servers to find nearby gyms. We do not store it.
• Website promo codes. If you redeem a campus promo code on our website, we record the position your browser reports at that moment and keep it until you delete your account.
• Background location is never collected — FitBound only reads location while you are actively using the app for one of the actions above, and no background-location permission is requested on either platform.
• Show my gym. If you turn on “Show my gym” in Settings > Privacy & social (it is off by default), your friends can see your home gym's name and whether you train at the same gym, and, as long as you verified there in the last 90 days, other players who have verified at the same gym can see your username, level, rank, this season's XP and guild tag on that gym's leaderboard, and your profile photo if you chose to show one. Appearing there also needs “Appear on leaderboards” to be on.
• Map display. When you open a map screen, your device loads map imagery directly from our map-tile provider (named in Section 6) so it can draw the map you see, including pins near your current position. That provider receives your device's IP address and the map area being viewed as an ordinary part of loading those tiles — this is standard for how digital maps are drawn and is not routed through FitBound's own servers.
• Location is never used for advertising. A verification event is used to confirm presence at a gym you chose to interact with. Once you verify a gym with “Verify I'm here”, other players who verified the same gym can open your player card while “Appear on leaderboards” is on (see “Game and social”), and, if you turn on Show my gym, it decides whether you can appear on that gym's leaderboard. A check flagged for a mock location or an impossible jump between checks counts toward an automatic restriction of your account.

Device, security, and diagnostics

• app version, operating system, device class, language, network state, session identifiers, security events, and limited logs;
• IP address, specifically when you redeem a referral code, used only to detect obviously clustered/abusive redemption patterns (for example, many different codes or many redemptions of the same code from one address in a short window). It never automatically blocks a redemption and is not linked to any other feature;
• purchase product, store, transaction reference, entitlement state, and renewal/expiration status, and we may keep a dated history of purchase, renewal, cancellation and billing events (never card details). Apple or Google processes payment credentials.

Game and social information

• character stats, verified progression, quests, achievements, currencies, inventory, loadout, consumable effects, battles, and anti-cheat signals;
• friends, guilds, trades and leaderboards. By default other players can find you by username and see your username, level, and the profile photo you chose to show. Your friends and guild-mates also see your rank, and your friends see your guild, whether you are online right now, and your season XP on the friends leaderboard. You can turn off search, your online status and leaderboards in Settings > Privacy & social. Your player card shows more (below). Custom exercises you create are visible only to you, unless you include one in a workout you share by link, which shows its name and sets to anyone with the link;
• your player card: your friends, your guild-mates and, while “Appear on leaderboards” is on, any player who has verified at a gym where you have also verified can open it, whether or not Show my gym is on. It shows your username, level, rank, class, guild, workout streak and weekly consistency, the date you joined, your Photo or Emblem choice, and your profile photo if you chose to show one; a photo from your Google account is shown there only to your friends;
• workouts you share by link. See “Share links” in Section 6.

PC waitlist

The FitBound PC world is planned and in development. When the waitlist form on fitboundonline.com is open, joining is optional and separate from a FitBound account.

• What we collect: your email address, the time you agreed to be emailed, which version of the consent wording you agreed to, the page you signed up from, and a random unsubscribe code that we create. We do not ask for your name or any workout, health, or account information.
• Why: to email you about the FitBound PC world. We do not use the list for anything else.
• Legal basis: your consent, which you give by ticking the box next to “Email me about the FitBound PC world. No spam, unsubscribe any time.” You can withdraw it at any time by unsubscribing.
• Where it is kept: in our database provider, Supabase (see the processor register in Section 6). The sign-up passes through our website host, Vercel, like any page request. Our sign-up code uses your IP address only in memory, to limit repeated sign-ups, and does not save it with your email. We have not emailed the waitlist yet; before the first email we will name the service that sends it in the processor register.
• How long: until you unsubscribe. When you unsubscribe, your entry is deleted right away. Copies in backups are handled as described in Section 8.
• How to leave: use the unsubscribe link in any waitlist email, or email support@fitboundonline.com from the address you signed up with.

Website browser storage

Our website does not set cookies. It keeps a few items in your browser’s storage so the site works: your sign-in session, your unfinished sign-up answers (except your password; kept up to 7 days and cleared when you sign out), a promo code you opened before signing in, and whether you turned the music on (plus, for the current tab only, where the music is, so it carries on between pages). While you confirm account deletion with Google, it also keeps a short note, for up to 10 minutes, that holds ids only and no token. We do not use any of this for advertising or analytics.

3. Sources

We receive information directly from you; from your device and permissions; from Apple, Google, and connected health platforms; from authentication, database, purchase, and AI-analysis providers; and from inferences needed to provide recommendations, verification, safety, and game progression.

4. How we use information

We use information to:

• create and secure accounts;
• provide workout, nutrition, progression, social, and game features;
• personalize recommendations to goals, experience, equipment, history, and recovery;
• synchronize offline entries and verify eligible rewards;
• estimate nutrition, which you can review and edit after it is logged (and, for barcode and search entries, before);
• provide subscriptions, purchases, entitlement restoration, and support;
• prevent fraud, tampering, unsafe behavior, and abuse;
• debug, measure reliability, improve accessibility, and develop features;
• comply with legal obligations, enforce agreements, and protect rights and safety.

We do not use HealthKit, Health Connect, meal-photo, workout, nutrition, or precise-location data for targeted advertising, marketing profiles, insurance, employment, credit, or unrelated data mining.

We use readings from Apple Health, Motion & Fitness or Health Connect only to show you the feature they belong to. We do not sell them, share them, use them for advertising, or use them to decide credit, insurance, lending or employment, and readings are never used to verify a workout or decide a reward. A body weight you choose to save stops being a reading: it becomes a body measurement and, like one you type, it is used for your calorie targets and for the stat points you earn from bodyweight exercises.

5. AI-assisted processing

FitBound uses AI-assisted development and uses AI services for food-image analysis and label reading (Section 6). AI output can be wrong. Scan results are labeled “AI estimate” in your diary (or “AI estimate, reviewed” once you review them), and you can edit or delete them on any day. Check portions when accuracy matters.

For meal photos, we do not control what OpenRouter or the company that runs the model keeps, or whether it uses what it receives to train models. We have not independently verified this. Their own terms apply. We send no name, email or account number with a photo. If we add or change a processor that receives photos, we will name it here before it does.

6. Disclosure of information

We may disclose information:

• to the service providers named in the register below, for hosting, databases and authentication, account email, subscription management, image analysis, map tiles, food data and app updates;
• to Apple and Google for authentication, health permissions, purchases, subscriptions, and store compliance;
• at your direction, such as an export;
• in a corporate transaction, with appropriate confidentiality and notice;
• to comply with law or protect users, rights, safety, and service security.

We do not sell personal data or share it for cross-context behavioral advertising. We do not give sensitive health, fitness, nutrition, or location data to anyone for advertising.

Processor register

This table lists the services that receive your data as of the effective date. We update it when one changes.

Share links. If you share a workout, you get a link, and anyone with the link can see the workout. Your username is shown only if you choose to show it when you share, and your exercise notes only if you choose to include them. Shared links are deleted automatically 90 days after you create them, except that material removed after a copyright notice is handled as described in Section 8. You can delete your own links earlier in Settings > Shared workouts. Links created before October 12, 2026 may still show your username and exercise notes until they are deleted, no later than January 10, 2027.

Google profile photos. When a player's profile photo comes from their Google account, your device loads it directly from Google, which receives your device's IP address.

FitBound does not use an advertising, analytics or crash-reporting service in this version. If we turn on a service that receives your data, we will name it here first.

7. Legal bases and consent

Where applicable, we process information to perform our contract, with consent, for legitimate interests such as security and service improvement, and to comply with law. You can withdraw optional permission through FitBound or system settings. Withdrawal does not affect prior lawful processing.

Health, camera, motion, location, and photo-library permissions are requested only in context. A permission is not treated as consent for an unrelated use.

8. Retention and deletion

We keep account and user-entered data while your account is active. When you delete your account, we delete or de-identify it as described below. Backups age out on our hosting provider's schedule. The periods below are what FitBound does today.

• meal photo sent for analysis: FitBound stores no image or photo URL. How long OpenRouter and the company that runs the model keep a photo is set by their own terms;
• imported workout history (a Fitbod file you choose to import): only on this device, tied to the account that imported it, not in cloud backups; kept until you remove it, delete your account in the app, clear app data or uninstall;
• local meal photo: one copy per scan, kept outside device backups; deleted shortly after its entries are deleted, on sign-out and on account deletion. This is entirely on your device and outside our control; your phone may also clear it when storage runs low;
• meal-photo fingerprint (Section 2, "Meal photos"): up to 200 most recent per account, oldest discarded first, and deleted 180 days after it was last saved;
• meal-scan quality log (the AI estimate next to what you logged, per food): deleted automatically 90 days after the scan, when you tap “Forget all saved matches” in Settings > Saved meal matches, or when you delete your account;
• active account records: while the account is active;
• deleted account primary records: deleted or de-identified within 30 days; in practice this happens within seconds of a deletion request;
• account deletion log: when you delete your account we keep a minimal log of the fact that a deletion occurred (the account identifier and the email on file at the time) to support fraud prevention and dispute handling. This log has no set expiry date;
• reports and your current moderation status: no set deletion date; the log of each admin or moderation action is deleted after 12 months (below);
• copyright notices, counter-notices and strike records: kept, including after an account is deleted, for three years after the last action on the notice; removing them after that is currently a manual step we run once a year;
• material removed after a copyright notice: kept out of public view for 90 days after removal, and longer only while a counter-notice or a court action about it is pending; after that we delete it at our next cleanup;
• website bug reports and feature requests: no set deletion date;
• subscriptions and purchases: deleting your account does not cancel an App Store or Google Play subscription, and the purchase record kept by Apple, Google and RevenueCat is governed by their terms;
• gym-verification events (the gym, time, distance and flags described in Section 2, with no coordinates): deleted automatically 90 days after the event;
• your most recent position: replaced at each passed check and deleted automatically within 24 hours, by a job that runs every 10 minutes, and at once when you turn Location verification off;
• website promo-code redemptions: the position recorded at redemption is kept until you delete your account;
• referral-redemption fraud-detection signals (the IP address described above in "Device, security, and diagnostics"): deleted automatically after 12 months;
• admin and moderation action records and AI spending records (the cost of each scan, with no photo or food): deleted automatically after 12 months;
• referral records (who invited whom and the reward): kept until either account is deleted;
• FitBound's own purchase history (entitlement state and dated purchase events): kept until you delete your account;
• store transaction/financial records: as required by tax, accounting, store, and consumer-protection law, held by Apple, Google and RevenueCat under their own systems and terms;
• legal acceptance records: retained as necessary to document the agreement.

We may retain de-identified data that cannot reasonably be linked back to a person.

9. Security and breach response

We use measures appropriate to the sensitivity of the data, including encrypted transport, managed authentication, row-level security enabled on the data tables, separation of user-editable data from server-authoritative rewards, and audit logging.

No system is completely secure. If an incident triggers the FTC Health Breach Notification Rule or another notification law, we will provide required notices to affected individuals, regulators, and others within the required time.

To report a security vulnerability, contact security@fitboundonline.com.

10. Your choices and rights

You can review and edit profile, plan, workout, nutrition, and permission settings; disconnect health access in system settings; and decline optional location or meal photos.

You can delete your account at any time from within FitBound (Settings > Delete account) or, while signed in, on fitboundonline.com/account; this is an automated, self-service action that removes or de-identifies your data as described in Section 8, typically within seconds. You will be asked to sign in again to confirm, in the app and on the website. Deleting your account does not cancel a store subscription; cancel it in the App Store or Google Play.

You can export a copy of your data at any time from within FitBound (Settings > Data & integrations > Nutrition & Body Report > Export a copy of my data), covering your workouts, nutrition entries, body measurements, currency and progression history, inventory, achievements, guild membership, and other account records, as a self-service action requiring no wait or request. The export does not include your sign-in email address. Workout history you import from another app stays only on your device and isn't included in this export; your original file is your copy. A few records are not in this export: content authored by other people about you (such as a moderation report someone else filed), internal rate-limiting bookkeeping, the per-scan AI cost records behind the scan spending cap (cost and token counts, no photo or food), the name and email your Apple or Google sign-in sent, and website bug reports and feature requests, and PC waitlist entries, which are not linked to your account. For anything not covered by the in-app export, email privacy@fitboundonline.com and we will fulfill an access or portability request manually within the time required by applicable law.

Depending on where you live and whether an applicable law’s thresholds or exemptions are met, you may have rights to confirm processing, access, correct, delete, obtain a portable copy, opt out of certain profiling or targeted advertising, withdraw consent, and appeal a denied request. We will not discriminate against you for exercising a right.

Submit a request to privacy@fitboundonline.com. We may reasonably verify your identity. Authorized-agent requests require proof of authority. We will provide an appeal route when required.

11. State-specific disclosures

FitBound is based in New Jersey. The New Jersey Data Privacy Act, the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”), and other state consumer privacy laws may apply depending on statutory thresholds, exemptions, residency, and processing. Regardless of threshold, FitBound’s design avoids the sale of personal data and targeted advertising based on health data.

California (CCPA/CPRA)

The table below identifies the categories of personal information FitBound actually collects, mapped to the categories defined in Cal. Civ. Code § 1798.140, and the categories of third parties each category is disclosed to for a business purpose (see Section 6 for the specific companies). FitBound does not sell personal information and does not share personal information for cross-context behavioral advertising, so no category below is disclosed for those purposes.

Sensitive personal information. Several of the categories above — health, fitness, and nutrition data, and precise geolocation in particular — also qualify as "sensitive personal information" under CPRA. FitBound only uses sensitive personal information to provide the features you use it for (workout tracking, nutrition estimates, recovery/progression, gym verification) and does not use it to infer characteristics about you for advertising or any purpose beyond providing the service. You can contact us using Section 10 to ask us to limit any use you believe goes beyond that.

Do Not Track. FitBound's app does not currently respond to browser "Do Not Track" signals.

No discrimination. We will not deny goods or services, charge different prices, or provide a different level of service because you exercised a CCPA/CPRA right.

12. Health platforms

Access to Apple Health (HealthKit), Motion & Fitness and Android Health Connect is optional and granular. You choose which types FitBound may read, and you can change or remove access at any time: in Apple Health for heart rate, in iPhone Settings > Privacy & Security > Motion & Fitness for steps, with the Live heart rate switch in FitBound's Settings, or in Health Connect on Android.

Health Connect reading on Android is switched on by an app update after this policy is published.

• What we read. iPhone: the heart rate your Apple Watch records, read from Apple Health while a workout is open and the Live heart rate switch is on, and today's step count from Motion & Fitness. Android (Health Connect): today's steps, your heart rate while a workout is open, and your most recent body weight. We read only while the app is open, never in the background. We read today's steps, heart-rate readings from the last three minutes, and weight entries from the last 90 days; we do not ask for access to your older history. We do not read workouts recorded by other apps.
• Where it stays. The readings are used on your phone and are not uploaded to FitBound's servers, so they are not in your account export and there is nothing for account deletion to remove. One exception: if you tap "Use this weight" and save the form, that weight is stored on our servers as a body measurement. It is in your account export and is deleted when you delete your account. Data already in Apple Health or Health Connect stays under your control in those apps; deleting your FitBound account does not delete it there.
• What we do with it. Show you your own numbers: today's steps with an estimate of the calories they burned on the Food tab, your heart rate during a workout, and a suggested starting value for your body weight on the body-measurements form. We never use the readings for advertising, marketing, data brokerage, credit, insurance or employment decisions, never use them to verify a workout or decide a reward, and never show them to other players. A body weight you save is a body measurement: it is used for your calorie targets and for the stat points from bodyweight exercises, just like a weight you type.
• Security. The readings are held in the app's memory on your phone while they are shown, under your phone's own protections; FitBound does not save them to your phone's storage.
• If this changes. If a future version ever sends health-platform data to our servers, or writes data to your health app, we will update this policy first and ask for your permission in the app before it happens.

Our use of data received through Health Connect follows Google Play's Health Connect permissions policy, including its Limited Use requirements, and our use of HealthKit and Motion data follows Apple's App Review Guideline 5.1.3.

13. International use

FitBound is designed for use in the United States.

14. Changes

We may update this Policy. We will post a version and effective date and provide additional notice or obtain renewed consent where required. Materially different uses of sensitive data require appropriate notice and choice before the new use.

15. Contact

Sacro Media LLC

Operating as FitBound Online

privacy@fitboundonline.com

19 Raritan Drive, Califon, NJ 07830, United States