Privacy policy

FITIT (fitit.ca) is operated by QSMART LTD., 7890 Bathurst St, Toronto, ON L4J 0J8 ("we", "us"). We are responsible for the personal information described in this policy.

Questions or requests about privacy: info@fitit.ca.

Information you give us:

• Account details: your name, email address and password. Passwords are handled by Google Firebase Authentication; we never see or store your password.
• If you sign in with Google or Facebook: the name and email address that provider shares with us. We do not receive your provider password and we do not post to your account.
• Onboarding choices: fitness goals, experience level, preferred workout types, equipment, preferred session length and training days. You can also add an optional note about accessibility needs. Please do not put medical details or diagnoses in that note.
• Training records: the workouts you start and finish, and the sets, repetitions, weights and times you log.
• Measurements you choose to enter, such as body weight, waist, chest and hip size.
• Your favourite programs, program enrolments, reminder settings and notifications.

Information created when you use FITIT:

• Your time zone, so we can show your weeks and days correctly and send reminders at the right local time.
• Subscription status (plan, billing period, whether it renews). Payments are handled by Stripe; we never see or store your card number.
• Records of emails we send you (so we do not send the same one twice) and, from our email provider, whether an email was delivered or bounced.
• Standard technical data: your IP address and request details appear in the logs of our hosting provider (Google Cloud), which we use to keep the service secure and working.

Some of this is information about your health and fitness. We treat it as sensitive: we use it only to provide FITIT to you, we rely on your consent (given when you create an account and choose to answer the onboarding questions), and we do not share it with advertisers. Every onboarding question except your name is optional.

You can create an account and sign in with Google or Facebook instead of a password. If you do:

• We ask the provider only for your basic profile: your name and email address. We do not request, and cannot see, your Gmail, Google Drive, Calendar, Contacts, friends list, posts or any other data in those accounts.
• We use that name and email address only to create and secure your FITIT account, to sign you in, and to send you the service emails described below. We do not use them for advertising, we do not sell them, and we do not transfer them to anyone except the service providers listed in this policy, as needed to run FITIT, or where the law requires.
• No person at FITIT reads your information from these providers except where needed for support you ask for, security, or to comply with the law.
• FITIT's use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
• You can stop using this sign-in method at any time, and you can remove FITIT's access in your Google or Facebook account settings. Deleting your FITIT account in Settings also deletes the information we hold.

FITIT uses only the cookies and browser storage it needs to work. We do not use advertising, tracking or analytics cookies.

• __session (cookie, strictly necessary): keeps you signed in. It is httpOnly and, on the live site, secure. It lasts up to 5 days if you tick “Remember me” and otherwise ends when you close your browser (and no longer than one day).
• tz (cookie, functional): stores your time zone for up to one year so pages can show the right day and week.
• fitit.rememberMe and fitit.rememberedEmail (browser storage on your device, only if you choose them): remember your “Remember me” choice and your email address on the login form. We never store your password there. Untick “Remember me” to remove the saved email.
• Firebase Authentication also keeps your sign-in state in your browser's storage while you are signed in.

You can clear cookies and site storage in your browser at any time. If you block the strictly necessary cookie you will not be able to stay signed in.

• To create and secure your account and sign you in.
• To suggest suitable programs, run your workouts, and show your progress and records.
• To send service messages: a welcome email, security and account notices, billing receipts and payment-failure notices, and workout reminders only if you turn them on.
• To process Premium subscriptions and decide which programs you can open.
• To keep FITIT secure, prevent abuse, fix problems and meet our legal obligations.

We rely on your consent for health and fitness information and for optional features such as reminders. You can withdraw consent at any time by changing your settings or deleting your account; some features then stop working.

We do not use your information to make automated decisions that have legal or similarly significant effects on you.

We currently send service emails only. Reminder emails are off until you turn them on in Settings, and you can turn them off the same way. If we ever send marketing or promotional email we will ask for your permission first and include a working unsubscribe link, as Canada's anti-spam law requires.

We do not sell your personal information. We share it only with service providers that help us run FITIT, and only what they need:

• Google (Firebase and Google Cloud): authentication, our database, file storage and hosting.
• Stripe: payment processing for Premium. Stripe receives your email, billing details and payment information directly and handles them under its own privacy policy.
• Brevo: sending our service emails (your name, email address and the content of the message).
• Google or Meta (Facebook), only if you choose to sign in with them, under their own privacy policies.

We may also disclose information when the law requires it, to protect people's safety or our rights, or as part of a sale or reorganisation of the business (in which case this policy would continue to apply to your information).

Administrators can see the basics of an account (name, email address, role and whether it is active) so they can run the service. The admin tools do not show members' workouts or measurements. Admin actions are recorded in an audit log. Trainer accounts are not available yet; when they are, a trainer will see your training history only if you are assigned to that trainer.

Our providers operate data centres in several countries. Your information may be stored and processed outside Canada, including in the United States, where it may be accessible to courts and authorities under local law. We choose providers that protect it with strong technical and contractual safeguards.

We keep your information while your account is active. When you delete your account in Settings, we immediately and permanently delete your profile, preferences, workouts, measurements, notifications, subscription record and email records, and remove your sign-in. If you have an active paid subscription, we cancel it first.

Some things are kept for legitimate reasons: Stripe keeps payment and invoice records as tax and accounting law requires; our hosting provider keeps short-lived technical logs; and our admin audit log, which records administrative actions on the service, is kept for security and accountability.

• Access and portability: download everything we hold about your account as a file from Settings (“Download your data”).
• Correction: change your name and preferences yourself, or ask us to fix anything else.
• Deletion: permanently delete your account and data from Settings.
• Withdraw consent or turn off optional features, such as reminders, at any time.
• Ask us a question or make a request by email; we will respond within 30 days. If you are not satisfied, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, in Quebec, the Commission d'accès à l'information.

We use encrypted connections (HTTPS), restrict access to data with server-side checks and database security rules, keep sign-in cookies out of reach of page scripts, give administrators only the access they need, and keep secrets out of our code. No system is perfectly secure. If a breach creates a real risk of significant harm to you, we will tell you and the regulator as the law requires.

FITIT is for adults. It is not intended for children under 16, and we do not knowingly collect their information. If you believe a child has given us personal information, contact us and we will delete it.

We may update this policy as FITIT changes. The date at the top shows when it last changed. For significant changes we will notify you by email or inside the app before they take effect.

Privacy questions and requests: info@fitit.ca.