Back to home

FitFaber Privacy Policy

Effective date: June 29, 2026
Last updated: June 29, 2026 (clarification of data processing infrastructure)

1. General Provisions

1.1. This Privacy Policy (the Policy) describes how personal data of users of the FitFaber mobile application (the App) and related services on the website https://fitfaber.app/ (the Website) are processed and protected.

1.2. Data Controller:

NameIndividual Entrepreneur Bogdanov Ramil Askhatovich
INN (tax ID)861204323964
OGRNIP318028000059869
Email for personal data inquiriesinfo@fitfaber.app
Websitehttps://fitfaber.app/

1.3. This Policy is prepared in accordance with Federal Law No. 152-FZ of July 27, 2006 “On Personal Data” (152-FZ) and other applicable laws of the Russian Federation. If you access the App from outside Russia, local data protection laws may also apply to you.

1.4. By using the App, registering an account, or subscribing, you confirm that you have read this Policy. Separate consent for personal data processing is requested at registration and, where necessary, for specific categories of data.

1.5. The App is intended for persons aged 18 and over. We do not knowingly collect personal data from minors. If you become aware that a minor has provided us with data without the consent of a legal guardian, please contact us — we will take steps to delete such data.

2. Definitions

2.1. Personal data means any information relating to an identified or identifiable natural person (data subject).

2.2. Processing of personal data means any action or set of actions with personal data, including collection, recording, organization, accumulation, storage, updating, retrieval, use, transfer, depersonalization, blocking, deletion, and destruction.

2.3. User means a natural person using the App as an athlete or coach.

2.4. Third parties / processors means organizations to which the Controller entrusts personal data processing or that receive data in connection with providing services (hosting, analytics, payments, push notifications, etc.).

3. Data We Process

3.1. Account Data

  • email address;
  • password (stored in encrypted form, not accessible in plain text);
  • username (nickname), display name;
  • role in the App (athlete / coach);
  • interface language;
  • registration date and time;
  • email verification status.

3.2. Profile Data

  • profile photo (avatar);
  • additional profile photos;
  • “About me” text description;
  • for coaches: education, credentials, and descriptions of athlete case studies.

3.3. Health, Fitness, and Workout Data

The App is a fitness service and processes data related to the user’s physical condition and lifestyle, including:

  • sex, age, height, weight, target weight;
  • fitness level, training goals (weight loss, muscle gain, maintenance, etc.);
  • daily activity level, metabolism type (subjective assessment);
  • chronic conditions and health limitations specified by the user in the questionnaire;
  • working weights, pull-up results, and other questionnaire metrics;
  • training programs, cycles, weeks, days, exercises, sets, repetitions, weights;
  • workout completion reports, post-set well-being feedback;
  • calorie and macronutrient (PFC) recommendations calculated from the questionnaire.

Important: this information is provided voluntarily by the user. The App is not a medical device and is not intended for diagnosis or treatment.

3.4. Measurements and Progress Photos

  • body weight and measurements;
  • progress photos (front, side, back views);
  • photo visibility settings for the coach (per measurement entry);
  • measurement date and history.

3.5. Coach–Athlete Interaction Data

  • athlete–coach linkage information (contract / account connection);
  • training programs and reports assigned by the coach;
  • offline athlete cards (for coaches managing clients without an App account);
  • financial income tracking from athletes (for coaches).

3.6. Messages and Notifications

  • chat message text between users;
  • images attached to messages;
  • message read status;
  • device push token, platform (iOS / Android), device language;
  • in-app notification history.

3.7. Subscription and Payment Data

The Controller does not store full bank card details. Payment processing is handled by app stores:

  • RuStore (RuStore build, Android);
  • Google Play (Google Play build, Android);
  • App Store (iOS; subscription management via Adapty).

The Controller may receive subscription status, product identifier, and period end date from these services, but not payment instrument details.

3.8. Technical and Analytics Data

  • user identifier (UUID) in the authentication system;
  • device model, operating system version;
  • App version;
  • anonymized or pseudonymized App usage data (events, screens, sessions) via AppMetrica;
  • IP address (when accessing the Controller’s servers and the push notification delivery service);
  • locally on the device: video cache, settings (SharedPreferences, secure storage), local Realm database (exercise catalog, progress cache).

Firebase Analytics, Crashlytics, and other Google analytics services are not used. Only Firebase Cloud Messaging (FCM) is used for push notification delivery; the device push token is also stored in the Controller’s database in Russia (see Section 6).

4. Purposes of Personal Data Processing

PurposeExamples of data
Registration and authenticationemail, password, role
Providing App featuresprofile, workouts, measurements, nutrition
Connecting athlete and coachcontract, program and report synchronization
Messagingchat, attachments
Push notificationspush token, language
Premium subscriptionssubscription status, product ID
Personalizing workouts and nutritionquestionnaire, program parameters (processed on Controller servers in Russia)
Analytics and service improvementAppMetrica events
Security and abuse preventiontechnical logs
Legal complianceupon request from authorized authorities
Processing user inquiriesemail, inquiry content

5. Legal Bases for Processing (152-FZ)

Personal data is processed on the following grounds:

  1. Consent of the data subject (Article 6(1)(1) of 152-FZ) — at registration, when uploading photos, when processing health-related information in the questionnaire, when enabling push notifications and analytics (where applicable).
  2. Performance of a contract (user agreement / offer) to which the data subject is a party (Article 6(1)(5) of 152-FZ) — to provide App features, synchronize data, enable chats and subscriptions.
  3. Legitimate interests of the Controller (Article 6(1)(7) of 152-FZ) — ensuring security, preventing fraud, improving service quality (to the extent that does not violate the data subject’s rights).
  4. Compliance with legal obligations (Article 6(1)(2) of 152-FZ).

Processing of health-related information (Article 10 of 152-FZ) is carried out only with the user’s separate consent, expressed when completing the questionnaire and accepting the terms for processing such data.

6. Storage, Localization, and Third-Party Disclosure

6.1. Where Personal Data Is Stored

6.1.1. Recording, systematization, accumulation, and storage of personal data of users who are citizens of the Russian Federation are carried out using databases located in the Russian Federation.

6.1.2. The primary application server is a Beget VPS (Russia). It hosts a Supabase installation (database, authentication, file storage): https://parnodoniroop.beget.app/.

6.1.3. This infrastructure stores, among other things: accounts, profiles, workouts, measurements, photos, chat messages, push tokens, notifications, and other data described in Section 3.

6.2. Disclosure to Third Parties

To operate the App, the Controller engages the following categories of recipients / processors:

ServicePurposeData transferred (approximate)Location
Beget (VPS hosting)server hostingdata on VPS disks within hostingRussia
Supabase (on Controller’s VPS)DB, auth, filesall primary user dataRussia
Firebase Cloud Messaging (Google LLC)push notification deliverydevice push token (token also stored in DB in Russia)Google infrastructure (may be outside Russia)
AppMetrica (Yandex LLC)usage analyticsanonymized/pseudonymized events, device identifiersRussia (Yandex service)
Adaptysubscription management App Store (iOS) onlyuser identifier, subscription statusmay be outside Russia
RuStore (VK LLC)subscription payments (Android, RuStore)purchase identifier, subscription status (no card data)Russia
Google Playsubscription payments (Android, Google Play)purchase identifier, subscription statusmay be outside Russia
Apple App Storesubscription payments (iOS)purchase identifier, subscription statusmay be outside Russia

Data is transferred only to the extent necessary to provide the service, based on agreements with processors and, where required, your consent.

External AI model providers and Firebase Analytics are not used.

The Controller does not sell personal data to third parties for marketing purposes.

7. Data Sharing Between Coach and Athlete

7.1. When a coach is connected to an athlete’s account, certain data becomes available to the coach within the App:

  • training programs and reports;
  • measurements (numeric values);
  • assigned programs and completion status;
  • chat correspondence.

7.2. Progress photos may be hidden from the coach by default. The athlete independently controls photo visibility for each measurement entry (the “Do not show photos to coach” option).

7.3. A coach is not a data controller with respect to an athlete’s data; they access it as an authorized person under arrangements with the athlete and the App’s functionality. The Controller is not responsible for further use of athlete data by a coach outside the App.

8. Cross-Border Transfer of Personal Data

8.1. The primary volume of personal data (accounts, profiles, workouts, measurements, photos, chat) is stored and processed on servers in the Russian Federation (Section 6.1).

8.2. Cross-border transfer may occur in a limited scope when using:

  • Firebase Cloud Messaging (Google) — to deliver push notifications (device push token is transferred);
  • Adapty — for App Store (iOS) subscriptions;
  • Google Play / Apple App Store — purchase and subscription status information.

AppMetrica (Yandex) and Beget hosting are located in the Russian Federation.

8.3. Cross-border transfer is carried out in accordance with Article 12 of 152-FZ based on your consent expressed at registration and acceptance of this Policy, and, where necessary, on other grounds provided by law.

8.4. You may withdraw consent to cross-border transfer; however, features requiring such transfer (push notifications, App Store / Google Play subscriptions) may become unavailable.

9. Data Retention Periods

CategoryPeriod
Account and profile datauntil account deletion + 30 days for backup
Workouts, measurements, progressuntil account deletion
Chat messagesuntil account deletion; deleted user’s message text is replaced with “[account deleted]”, attachments are removed
Push tokensuntil account deletion or revocation of notification permission
Analytics data (AppMetrica)in accordance with AppMetrica policy (typically up to 14 months)
Support inquiries3 years from the date of inquiry

After retention periods expire, data is deleted or depersonalized unless otherwise required by law.

10. Account Deletion

10.1. You can delete your account in the Profile section of the App.

10.2. Upon account deletion, the Controller:

  • deletes the profile, workout data, measurements, push tokens, and notifications;
  • deletes profile photos and chat attachments from storage;
  • anonymizes messages you sent in chats (text is replaced, attachments are removed);
  • deletes the authentication account.

10.3. Certain depersonalized analytics records and backup copies may be retained for a limited time in accordance with Section 9.

11. Personal Data Security Measures

The Controller applies organizational and technical measures, including:

  • password encryption and secure token storage on the device;
  • access controls (Row Level Security in the database);
  • HTTPS for data transmission;
  • limiting employee access to data on a need-to-know basis;
  • regular software updates.

Absolute security of data transmission over the internet cannot be guaranteed. Users are responsible for safeguarding their account credentials.

12. Data Subject Rights

Under 152-FZ, you have the right to:

  1. Receive information about the processing of your personal data.
  2. Request correction, blocking, or deletion of data if it is incomplete, outdated, inaccurate, or unlawfully processed.
  3. Withdraw consent to processing (withdrawal does not affect the lawfulness of processing before withdrawal).
  4. Lodge a complaint against the Controller’s actions with Roskomnadzor (rkn.gov.ru) or in court.
  5. Delete your account and related data via the in-App function.
  6. Obtain information about whether data is held and receive a copy of processed data — by sending a request to info@fitfaber.app.

Requests are reviewed within 30 calendar days (unless a different period is established by law).

To verify the requester’s identity, the Controller may ask for confirmation that the request comes from the account owner (for example, from the email address linked to the account).

13. Cookies and Similar Technologies

13.1. The mobile App does not use cookies in the traditional sense but uses local device storage and identifiers for analytics and authentication.

13.2. The website fitfaber.app may use cookies; a separate notice applies when visiting the Website (if provided).

14. Automated Processing

14.1. The App uses automated algorithms on the Controller’s servers in Russia to calculate workout, calorie, and macronutrient recommendations based on questionnaire data and user feedback. External artificial intelligence services are not used.

14.2. Decisions that produce legal effects or significantly affect user rights within the meaning of Article 16 of 152-FZ are not made solely by automated means. Recommendations are informational; the final decision on training and load rests with the user (and/or their coach).

15. Changes to This Policy

15.1. The Controller may update this Policy. The current version is published at: https://fitfaber.app/privacy.

15.2. For material changes, the Controller will notify users via the App, push notification, or email.

15.3. Continued use of the App after changes take effect constitutes acceptance of the updated Policy, unless otherwise required by law.

16. Contact

For questions about personal data processing:

Email: info@fitfaber.app

A full postal address for written inquiries is provided upon request by the data subject.