NOTFIT - Privacy Policy

Account details: your name, email address and password (stored encrypted), plus your Google or Apple sign-in and your phone number if you use them. We use your phone number to verify your application and, if you choose, to chat with Taz on WhatsApp.
Usage data: the workouts and programmes you complete, check-ins, rituals, streaks and points, saved recipes, nutrition preferences and how you use the app.
Device data: type of device, operating system, app version, IP address, and the token we use to send you notifications.
What you create and share: your answers when you apply and set up (such as your goals, date of birth, gender, height and weight), journal entries including any video you record, your promise, progress photos and measurements, and the posts, comments and profile picture you share in the community.
Health data: steps, sleep, heart rate, calories, exercise minutes and recovery, if you connect Health Connect, Apple Health or a wearable account. See the health and fitness section below.
Conversations with Coach AI and Taz: the messages you exchange with them in the app or on WhatsApp, including voice recordings you send instead of typing.
Membership and payments: your application, your plan, renewal dates and payment status. Card details are handled by our payment providers; we never see or store your full card number.

NotFit reads health and fitness data only after you connect a source: Health Connect on Android, Apple Health on iOS, or a WHOOP, Garmin or Oura account. What we read:

Health Connect on Android: your step count, active calories burned, and the start and end times of your exercise sessions. NotFit does not read sleep or heart rate from Health Connect.
Apple Health on iOS: your step count, active energy burned, Apple exercise minutes, workout session times, sleep sessions and time in bed, and heart rate samples.
Connected wearable accounts: if you link WHOOP, Garmin or Oura, we collect sleep duration, resting heart rate, heart rate variability, that provider’s recovery score, and daily steps where the provider reports them, from their servers.
Values you enter yourself: you can type in steps, exercise minutes, active calories, sleep minutes, resting heart rate and heart rate variability for any date.
Reading in the background: once you connect, NotFit reads these values while the app is closed. On Android that is roughly once an hour. On iOS it is a background refresh task plus the home screen widget, which reads your step count on its own, so your rings and your widget stay current.
What reaches our servers: daily totals only, stored against your account with the date and the name of the source: steps, sleep minutes, active calories, exercise minutes, a daily heart rate figure, heart rate variability and a recovery score. Individual heart rate readings and individual workout records stay on your device.
What we use it for: filling the activity rings and the day card on your home screen, the history and trends views, the leaderboards and the compare card, and, where health reminders are enabled, choosing which reminder to send you. Reminder text never contains your numbers.
Coach AI and Taz: when Coach AI or Taz writes to you, whether in the app, on WhatsApp, or in your daily affirmation, a short summary of your recent steps, sleep, heart rate, heart rate variability and recovery score is sent to our AI model provider, OpenAI, so the message can take it into account. Messages sent over WhatsApp travel through Twilio and WhatsApp.
Other members can see some of it: the steps, sleep and recovery leaderboards and the compare card show your figure next to your name and profile picture to other NotFit members. To keep your figures off those boards, disconnect your health source.
How we protect it: health data travels over HTTPS, is stored in an encrypted database hosted on Amazon Web Services, and is reachable only by NotFit staff who need it to run the service and by the AI model provider named above.
What we never do with it: we do not sell your health data, do not share it with advertising networks or data brokers, do not use it for advertising or profiling, and do not use it to decide credit, lending, insurance or employment. It is not sent to our analytics or advertising tools.
How long we keep it: we do not delete health data on a schedule. Each daily entry stays on our servers until you ask us to remove it, until you delete your account, or until it is cleared because you connected or switched a source.
Turning it off: open the wearables screen in your NotFit profile and tap Disconnect. That cancels the widget upload straight away and stops NotFit syncing from your phone. To stop all reading immediately, also withdraw the permission in Health Connect on Android or Apple Health on iOS. Neither of those deletes data we already hold.
Deleting it: email support@notfit.io and we will delete the health data held against your account. Deleting your NotFit account deletes it as well. Connecting or switching a source clears the data we already synced from any earlier source, apart from values you typed in yourself.

NotFit only reads from Health Connect and Apple Health. We never write anything back to them. Health data is used for general fitness and wellbeing only. It is not used to diagnose, treat, cure or prevent any condition, and NotFit is not a medical device. For questions or a deletion request, email support@notfit.io.

To provide and improve NotFit, including reviewing your application and running your membership.
To personalize workouts, meal plans, reminders and recommendations.
To communicate with you about updates, offers, or support.
To keep the platform secure and prevent misuse, including a membership being shared.
To power Coach AI, Taz and your in-app companion, which use your recent activity to write replies and reminders.
To confirm your membership to NotHungry, NotWell and NotSleeping when you sign in to them with your NotFit account.
To measure how well our advertising works.

We do not sell your personal data. We may share limited data with:

Service providers that run parts of NotFit for us: Amazon Web Services (hosting and storage), Bunny (video delivery), Stripe and RevenueCat (payments, and Apple or Google if you subscribed in their stores), SendGrid (email), Twilio and WhatsApp (verification codes and Taz on WhatsApp), and Google Firebase (notifications and crash reports).
Legal authorities if required by law.
Other members: your name, profile picture, community posts and comments, and your leaderboard figures are visible to other NotFit members.
OpenAI, our AI model provider, which writes Coach AI and Taz replies and turns voice recordings into text. It receives the messages you send and the context needed to answer, including the health summary described above.
NotHungry, NotWell and NotSleeping: when you sign in to one of them with your NotFit account, we tell that app whether your membership is active and share your name and email address with it. Each app has its own privacy policy for the data it handles.
Meta, which receives events from the app, such as signing up or starting a membership, so we can measure our advertising. Health data is never included.

Your data is stored securely, with encryption, on Amazon Web Services.
We take steps to protect against loss, misuse, or unauthorized access.
You are responsible for keeping your login details safe.
Some of the providers above are based in other countries, including the United States, so your data may be processed there.

Depending on your location, you have the right to:

Access the data we hold about you.
Request corrections or deletion.
Opt out of marketing communications.
Withdraw consent for certain data uses.

We keep your data for as long as your account is open.
When you delete your account in the app, we delete your account and the data linked to it, including your health data.
We keep your email address and account ID after deletion, so that if you come back your new account is recognised as yours. Payment records are kept by our payment providers as the law requires.
Your conversations with Coach AI and Taz are stored separately. To have them deleted too, email support@notfit.io.
Deleting your account does not cancel your membership payments, so cancel first. You can cancel any time at notfit.io/manage. We email you a secure link, then you choose Cancel membership. You keep access until the end of the period you have paid for. If you pay through the App Store or Google Play, cancel in your phone's subscription settings.

Our website uses cookies and similar tools, loaded through Google Tag Manager, to understand how visitors use it and to measure our advertising. The app records similar events, as described above. You can block or delete cookies in your browser settings.

The app and website link to services run by others, including our member community on Discord and the websites of NotHungry, NotWell and NotSleeping. Their own policies apply there, and we are not responsible for their privacy practices.

NotFit is not designed for users under 16. We do not knowingly collect personal data from children.

We may update this policy as the app grows. If we make major changes, we will notify users.

For questions or requests, email us at: support@notfit.io