Privacy Policy

1. Who is the data controller

The data controller is Miloš Anđelković. For any questions about privacy and exercising your rights, you can contact us at kontakt@fitler.app.

2. What data we collect

• Account data: first and last name, email address, role (trainer or client), password (stored encrypted).
• Content you enter: training programs, nutrition plans, exercises, recipes, goals, habits, notes and messages between trainer and client.
• Health and body data (sensitive): body measurements, weight, progress photos and similar data you enter to track results. We treat this data as especially sensitive (a special category) and process it only with your explicit consent.
• Payment data: for trainers who subscribe, subscription and transaction data is processed by an external payment processor (see section 5). We do not store card numbers.
• Technical data and analytics: anonymized/pseudonymized data about app usage (in-app events, device type) to improve the service. We do not send sensitive health data to analytics tools.

3. Legal basis for processing

• Performance of a contract (Art. 6(1)(b) GDPR) — providing the service that connects trainer and client and the app's core functionality.
• Explicit consent (Art. 9(2)(a) GDPR) — for processing health and body data (measurements, progress photos). You can withdraw consent at any time.
• Legitimate interest (Art. 6(1)(f)) — security, abuse prevention and improving the service through aggregated analytics.
• Legal obligation (Art. 6(1)(c)) — retaining billing data where required by law.

4. How we use data

We use data solely to provide the service: connecting trainer and client, creating and assigning programs and nutrition, tracking progress, communication through the app, sending notifications and processing subscriptions. We do not sell personal data and do not share it with third parties for marketing.

5. Data sharing and processors

Only the connected trainer and client can see your data within their relationship. To provide the service we use trusted processors that process data on our behalf:

• Supabase — database, authentication and photo storage.
• Railway — hosting for our server (API).
• Paddle — subscription payment processing (as merchant of record), when in-app payments are active.
• Resend — sending transactional emails (account confirmation, data export).
• PostHog — usage analytics (without sensitive health data).
• Expo — app delivery and push notifications; Vercel and Cloudflare — site hosting and DNS.

Some processors may process data outside Serbia/the EU (e.g. in the USA). In that case the transfer is carried out with appropriate safeguards (standard contractual clauses or an equivalent mechanism).

6. How long we keep data

We keep data while the account is active. If an account is inactive for more than 12 months, we may flag it for deletion after prior notice by email. When you delete your account (in the app, Settings → Delete account), we permanently remove your data and associated photos, except data we are legally required to retain (e.g. billing records).

7. Your rights

Under the law, you have the right to:

• access your data and obtain a copy of it;
• rectify inaccurate data;
• erase data (“right to be forgotten”) — available directly in the app;
• data portability (export in a machine-readable format);
• restrict processing and object to processing;
• withdraw consent at any time (without affecting processing before withdrawal);
• lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection (in the EU: the competent supervisory authority).

You can send your request to kontakt@fitler.app.

8. Security

We apply technical and organizational safeguards: password encryption, row-level access control in the database (RLS) so that only the connected trainer/client can access the data, and encrypted data transmission. No system is completely secure, but we continuously work to protect your data.

9. Children

Fitler is not intended for people under 16. We do not knowingly collect data from children. If you believe a child has provided us with data, contact us for deletion.

10. Changes to this policy

We may update this policy from time to time. We will notify you of significant changes in the app or by email. The date of the last update is shown at the top of the page.

11. Contact

For any privacy questions, write to us at kontakt@fitler.app.