Privacy Policy

Applies to the Fit Blitz mobile application on Google Play and the Apple App Store.

1. About this policy

Fit Blitz is a fitness coaching app that connects personal trainers and coaches with their clients. Trainers build and assign workout and diet plans; clients follow those plans, log their workouts, track their progress over time, and stay in touch with their trainer through in-app chat and announcements.

We handle body measurements, training history and dietary information. In most parts of the world that counts as sensitive personal data, and we treat it accordingly. This document explains, in plain language, what we collect, why, who else can see it, how long we hold it, and how you can get it back or have it erased.

If anything here is unclear, write to hsnmalik1@gmail.com. We would rather answer a question than have you guess.

2. Who is responsible for your data

Fit Blitz is operated by Hassan Malik ("we", "us", "our"). We are the data controller for the personal information described in this policy, and we decide how and why it is processed. You can reach us at any time at hsnmalik1@gmail.com.

The trainer or coach you are connected with uses Fit Blitz to deliver their service to you — they can see your profile, your plans and the activity you log so they can program for you. If you want a copy of your data, or you want it deleted, contact us at hsnmalik1@gmail.com and we will action it.

3. Information we collect

3.1 Account and identity information

• Full name, and a display name if you choose a different one
• Email address — required, and used as your login and for account notices
• Mobile number, where your trainer needs it to reach you
• Password — handled by our authentication provider and stored only as a secure hash; we never see or store the plaintext
• Profile photo, if you upload one
• Your role in the app (client or trainer) and the coach you are linked to
• Preferences such as time zone and unit preference (kg/lb, cm/ft)

3.2 Body and fitness profile

• Height and weight, including the history of those values over time
• Date of birth or age, and biological sex where you provide it
• Body measurements you or your trainer record
• Activity level, training experience and your stated goals
• Progress photographs, where you or your trainer choose to upload them

3.3 Health, injury and dietary information

Collected only when relevant to the coaching being delivered to you, usually because a trainer asked for it during onboarding:

• Injuries, pain sites and relevant medical notes you disclose so programming can be made safe for you
• Food allergies, intolerances and dietary restrictions, including those arising from religious or ethical commitments

3.4 Training and nutrition activity

• Workout plans assigned to you, and the sessions, sets, reps, loads and durations you complete
• Your workout history and progress over time
• Diet and nutrition plans assigned to you

3.5 Messages and community content

• Text messages and voice notes exchanged between you and your trainer inside the app
• Announcements your trainer posts, and any comments you add to them

3.6 Media and files

• Photos, videos and documents (such as exercise demos or plan PDFs) that you upload or that are shared with you

3.7 Device, technical and usage information

• Device model, operating system and version, and app version and build
• IP address, handled by our infrastructure provider
• Push notification token
• Crash traces, error logs and basic diagnostic data used to keep the app stable

4. Where the information comes from

• From you. When you register, complete your profile, log a workout, upload a photo or message your trainer.
• From your trainer or coach. They may enter assessment details, notes and assigned plans on your behalf.
• From your device, automatically. The technical and usage information in Section 3.7.

5. How and why we use your information

Each purpose below is paired with the legal basis we rely on for users in the UK, EU and other jurisdictions with a comparable framework.

• Creating and running your account; sign-in and authentication — Data: account and identity data — Basis: performance of a contract
• Building, delivering and adjusting your workout and diet plans — Data: body profile, health and injury data, training activity — Basis: contract; explicit consent for health data
• Calculating progress trends and history — Data: height, weight, measurements, logged activity — Basis: contract; explicit consent for health data
• Enabling chat and announcements between you and your trainer — Data: messages, voice notes, comments — Basis: contract
• Sending session reminders, plan updates and notifications — Data: contact details, push token — Basis: contract; consent where required
• Customer support and dispute resolution — Data: account data, support correspondence — Basis: legitimate interests
• Security, fraud prevention and abuse detection — Data: device and usage data, IP — Basis: legitimate interests; legal obligation
• Diagnosing crashes and improving reliability — Data: crash traces, device and usage data — Basis: legitimate interests
• Meeting legal, regulatory and law-enforcement obligations — Data: whatever the obligation requires — Basis: legal obligation

Where we rely on consent you can withdraw it at any time. Withdrawal does not affect processing that already took place, and in some cases it will mean a feature stops working — for example, we cannot calculate progress trends if you withdraw consent to us using your weight.

Plans and coaching decisions in Fit Blitz are made and reviewed by a human trainer. We do not make automated decisions that produce a legal or similarly significant effect on you.

6. Health and fitness data

Height, weight, body composition, injury history and dietary restrictions are treated as special category or sensitive personal data under the GDPR, the UK GDPR, the CPRA and comparable laws. Four commitments apply to all of it:

• We collect it only where it is needed to deliver the coaching you or your trainer asked for.
• We ask for your explicit consent at the point of collection, separately from your acceptance of our general terms.
• We never use it for advertising, ad targeting, marketing profiling, credit scoring or insurance purposes, and we never sell it.
• Internal access is restricted to staff who need it for support, security or legal reasons.

7. Who we share information with

• Your trainer or coach. The trainer you are connected with can see your profile, body measurements, health disclosures, assigned plans and logged activity. This is the core of the product — a coach cannot program for someone whose data they cannot see.
• Service providers. We use vetted third parties for hosting, storage, and push delivery. They act on our instructions under written contracts, may use the data only to provide the service to us, and must apply appropriate security measures. See Section 8.
• Professional advisers. Our accountants, insurers and lawyers may see personal data where necessary, under duties of confidentiality.
• Legal and safety. We may disclose information where legally required, or where we reasonably believe it necessary to comply with valid legal process, enforce our terms, investigate fraud or security incidents, or protect the rights, property or safety of any person.
• Business transfers. If we are involved in a merger, acquisition or sale of assets, personal data may transfer to the counterparty. It remains subject to this policy, and we will notify you before any material change takes effect.

We do not sell your personal information and we do not share it for advertising.

8. Third-party services we rely on

• Google Firebase / Google Cloud Platform (Google LLC / Google Ireland Ltd) — Purpose: app hosting, authentication, database, and file/media storage — Data involved: all categories described in this policy — Processing location: Google Cloud infrastructure (may include the EU and US)
• Firebase Cloud Messaging (Google) & Apple Push Notification service — Purpose: delivering push notifications — Data involved: push tokens, notification content — Processing location: United States

Apple and Google also act as independent controllers in respect of app distribution and platform-level diagnostics. Their handling of that data is governed by their own privacy policies, not this one.

9. Local storage and cookies

The Fit Blitz mobile app does not use cookies. It uses local storage on your device to keep you signed in and to cache your plans for offline access. If our website uses cookies, they are limited to what is strictly necessary to run the site plus, only with your consent, basic analytics. We do not use advertising or cross-site tracking cookies anywhere.

10. Permissions the app asks for

• Notifications — session reminders, plan updates and messages from your trainer — Optional
• Camera — progress photos, profile pictures and chat images — Optional
• Microphone — recording voice notes to send in chat — Optional
• Photos / media — uploading existing images to your profile or chat — Optional

Every one of these can be declined at install time or withdrawn later in your device settings. Declining a permission disables the feature that depends on it and nothing else. Fit Blitz does not request location, health-platform, calendar or contacts access.

11. What we do not do

• We do not sell personal information, and we have not done so.
• We do not share personal information for cross-context behavioural advertising.
• We do not run third-party advertising networks or ad SDKs inside the app.
• We do not use your health or body data to train general-purpose machine learning models.
• We do not provide your data to data brokers.
• We do not read the content of your in-app messages except where required for a support request you raised, a safety investigation, or a legal obligation.
• We do not use dark patterns to obtain consent, and refusing an optional permission never degrades the core service.

12. How long we keep information

• Account and profile data — while the account is active, then up to 30 days after deletion is confirmed
• Body measurements, health and injury data — for the life of the account, or until you request earlier erasure
• Workout, diet and progress records — as above
• Messages and voice notes — until you or your trainer delete them, or the account is deleted
• Inactive accounts — flagged after 24 months without a sign-in; we email you before deletion and delete 30 days later if there is no response
• Support correspondence — 24 months from the close of the ticket
• Crash and diagnostic data — 90 days
• Encrypted backups — rolling 35 days, after which deleted records fall out of the cycle permanently

Where we must keep something for a legal reason, we restrict it so that it is retained but no longer used operationally.

13. Deleting your account and your data

You can delete your Fit Blitz account and the personal data associated with it in two ways:

• In the app. Profile › Settings › Delete Account, then confirm.
• By email. Write to hsnmalik1@gmail.com from the address registered to your account.

What gets deleted: your profile, email and contact details, height, weight and measurement history, health and injury disclosures, dietary information, workout and diet logs, progress photos, messages and voice notes, and push tokens.

What may be retained, and why: a minimal record confirming deletion took place; anonymised aggregate statistics that can no longer identify you; and anything subject to an active legal hold.

Timing: deletion is actioned within 30 days of a verified request and purged from encrypted backups within a further 35 days. You receive written confirmation once complete. Deleting the app from your phone does not delete your account.

14. How we protect your information

• All traffic between the app and our servers is encrypted with TLS 1.2 or above.
• Data at rest is encrypted by our infrastructure provider.
• Passwords are stored only as secure hashes. We cannot recover them and will never ask you for one.
• Access is role-based on the principle of least privilege, and administrative access is protected by multi-factor authentication.
• We maintain audit logging and keep a documented incident-response plan. Where a breach is likely to result in a risk to your rights and freedoms, we notify the relevant authority and affected users without undue delay.

No system is perfectly secure. Please use a strong, unique password, enable device-level security, and tell us at hsnmalik1@gmail.com if you think something is wrong.

15. International transfers

Fit Blitz runs on Google Firebase infrastructure, which may store or process your information in a country other than your own, including the United States. Where personal data moves out of the EEA or the UK, we rely on an adequacy decision covering the destination, or on Standard Contractual Clauses together with appropriate technical safeguards such as encryption. You may request a copy of the safeguards in place by writing to hsnmalik1@gmail.com.

16. Children and teenagers

Fit Blitz is not directed at children under 13, and we do not knowingly collect personal information from them. If we discover we hold data from a child under 13 without verifiable parental consent, we delete it promptly. Where the age of digital consent is higher than 13 — including several EU member states, where it may be up to 16 — that higher local age applies instead. Users below the age of digital consent may use Fit Blitz only with verifiable consent from a parent or guardian, who may contact hsnmalik1@gmail.com at any time to review, correct or delete their child's information.

17. Your rights and choices

Depending on where you live, you may have some or all of the following rights:

• Access — a copy of the personal data we hold about you
• Correction — to fix data that is wrong or incomplete
• Deletion — to have your data erased, subject to the exceptions in Section 13
• Portability — to receive your data in a structured, machine-readable format
• Restriction — to have processing paused while a dispute is resolved
• Objection — to object to processing based on legitimate interests
• Withdrawal of consent — at any time, without affecting prior processing
• Opt-out — of marketing communications via the unsubscribe link
• Non-discrimination — we will not degrade your service because you exercised a right
• Complaint — to your local data protection authority

To exercise a right, email hsnmalik1@gmail.com. We verify identity before acting, usually by confirming control of the registered email address, and we respond within 30 days (extendable where a request is complex, and we will tell you if we need the extension). There is no charge unless a request is manifestly unfounded or excessive.

18. Regional disclosures

European Economic Area and United Kingdom. Our legal bases are set out in Section 5. You have the right to lodge a complaint with your national data protection authority; in the UK this is the Information Commissioner's Office.

California. In the past twelve months we collected the categories of personal information described in Section 3, for the purposes in Section 5, and disclosed them for business purposes to the recipients in Sections 7 and 8. We have not sold personal information and have not shared it for cross-context behavioural advertising. You may exercise your rights to know, delete, correct and opt out as described in Section 17, and we will not discriminate against you for doing so.

India. Where the Digital Personal Data Protection Act, 2023 applies, we process personal data on the basis of your consent or a legitimate use recognised by the Act. Our Grievance Officer can be reached at hsnmalik1@gmail.com.

Other jurisdictions. Users in Canada, Australia, Brazil, the Gulf states, Singapore and elsewhere have rights under their own laws. We apply the standards in this policy globally and will honour any additional right your local law grants you.

19. Changes to this policy

We update this policy when the product changes or the law does. The effective date at the top always reflects the current version. For material changes — a new category of data, a new purpose, a new class of recipient — we give notice by in-app notification and, where the law requires it, ask for fresh consent. Continuing to use Fit Blitz after a change takes effect means you accept the updated policy. If you do not, you can delete your account under Section 13.

20. How to contact us

• All enquiries — privacy and data-rights requests, general support, and security or vulnerability reports — hsnmalik1@gmail.com
• Operator — Hassan Malik

We acknowledge every privacy enquiry within 3 business days and aim to resolve it within 30 days.

Appendix A — Data safety summary

This grid corresponds to the Google Play Data Safety declaration and the Apple App Privacy labels filed for Fit Blitz.

Data is encrypted in transit and at rest. Users can request that their data be deleted. No collected data is used for advertising or third-party marketing, and no advertising SDKs are present in the app.

© 2026 Fit Blitz. This policy forms part of the Fit Blitz Terms of Service.