Privacy Policy
Min Virksomhed v. Mathias Sørsdal (“we”, “us”) is the data controller for personal data processed in FitSync under Regulation (EU) 2016/679 (GDPR) and the Danish Data Protection Act (Databeskyttelsesloven). This page is the public Privacy Policy declared in the App Store and Google Play listings. The in-app copy (Menu → Privacy Policy) matches it.
Last updated: 2 September 2026.
Data we collect
| Category | Examples | Legal basis |
|---|---|---|
| Account data | Email, display name, hashed password, profile photo, language and unit preferences | Art. 6(1)(b) — contract |
| Onboarding & plan inputs | Age or birth year as provided, sex/gender for calorie estimates, height, weight, goals, training experience | Art. 6(1)(b); Art. 9(2)(a) where health-related |
| Health & fitness data | Weight logs, workouts, food diary, macros, measurements, daily steps from device motion sensors (not Apple Health / Health Connect), check-in photos, SnapSync meal photos | Art. 6(1)(b) + Art. 9(2)(a) — explicit consent for special-category data |
| AI & coaching content | MyCoach chat, coach↔client chat, programs and meal plans a coach assigns, SnapSync food-scan results | Art. 6(1)(b) — contract |
| Social / linking data | Gym Bud partner links, coach invite codes, report and block actions | Art. 6(1)(b) / Art. 6(1)(f) |
| Device, analytics & stability | OS/device model, crash reports, product-interaction analytics, push tokens, App Check signals. We do not use the advertising ID and do not track you across other companies’ apps or sites | Art. 6(1)(f) — legitimate interest (security and reliability) |
| Website analytics | On fitsync.website only, after you accept cookies: Google Analytics 4 (see Cookie Policy) | Art. 6(1)(a) — consent |
| Subscription & payment data | Subscription and trial status, store receipts. Card numbers are processed by Apple, Google, or Stripe and are never stored by us | Art. 6(1)(b) — contract |
How we use your data
- To create and manage your account and deliver FitSync Core and paid features.
- To power MyCoach and SnapSync: relevant fitness or meal context is read at query time to generate that one reply or scan result. See the Data & AI disclosure.
- To run Pro Coach tools when you are a coach or a linked client (roster, program/meal-plan delivery, check-in review, 1:1 chat).
- To process subscriptions and the current 14-day free trial where offered, restore purchases, and enforce free-tier monthly limits (currently 3 MyCoach messages and 3 SnapSync scans per calendar month without an active trial or subscription).
- To send reminders you enable (workouts, trial end, check-ins).
- To diagnose crashes, prevent abuse (including report/block), and improve reliability via App Check.
- To measure marketing-site traffic, only if you accept analytics cookies.
- To comply with legal obligations.
Data retention
We keep account and fitness data while your account is active. If you delete your account (in-app: Menu → Account & Security → Delete Account, or follow fitsync.website/delete-account), personal data is permanently erased within 30 days, except records we must keep for bookkeeping or legal claims (up to 5 years under the Danish Bookkeeping Act / Bogføringsloven).
Processors and international transfers
We use these processors. They may only process data on our instructions and must keep it secure:
- Google Firebase / Google Cloud (Google LLC) — authentication, database, storage, Cloud Functions, Analytics, Crashlytics, Messaging, App Check. Primary app region is EU (
europe-west1). Some Google services may process data in the United States under Standard Contractual Clauses (SCCs). - Google LLC (Gemini API) — MyCoach and SnapSync. Your data is not used to train Google models. See the AI disclosure.
- RevenueCat — subscription entitlements (app user ID and store receipts).
- Stripe, Inc. — web checkout only. Data may be processed in the United States under SCCs. Card details are handled by Stripe, not stored by us.
- Apple Inc. / Google LLC — in-app purchases. They are independent controllers for payment data under their own policies.
- Google LLC (Google Analytics 4) — marketing website, only after cookie consent. Measurement ID
G-XBJV1VGBSB.
If you link a coach (including Pro Coach) or a Gym Bud partner, the in-app surfaces for that relationship are shared with that person so the feature can work. We do not sell personal data. We do not use it for advertising or share it with ad networks.
Your rights under GDPR
- Access (Art. 15) — a copy of the personal data we hold about you.
- Rectification (Art. 16) — correct inaccurate data.
- Erasure (Art. 17) — delete your data (“right to be forgotten”).
- Restriction (Art. 18) — pause processing in certain cases.
- Portability (Art. 20) — receive your data in a structured, machine-readable format.
- Objection (Art. 21) — object to processing based on legitimate interests.
- Withdraw consent — where we rely on consent (including health data and website analytics), you may withdraw at any time. That does not affect processing already done. Stopping a health feature and/or deleting your account withdraws that consent going forward.
Email mattyofttraining@gmail.com to exercise these rights. We will respond within one month (extendable by two further months in complex cases). You may lodge a complaint with Datatilsynet at datatilsynet.dk, phone +45 33 19 32 00, or with your local EU supervisory authority.
Security
Data is encrypted in transit (TLS) and at rest with our cloud providers. Access is restricted by authentication and Firestore security rules. Paid AI endpoints use App Check. No other user can read your private data unless you explicitly link them as coach or Gym Bud for the surfaces described above.
Children
FitSync is not directed at children under 13, and we do not knowingly collect data from anyone under 13. Users aged 13–17 may use FitSync only if a parent or guardian has reviewed and agreed to our Terms of Service.
Changes
We may update this policy. Material changes will be notified in the app or on this website. The date at the top of this section is the current version.
Contact — data controller
Min Virksomhed v. Mathias Sørsdal · CVR 44426293 · Kastet 86, 7700 Thisted, Denmark
Email: mattyofttraining@gmail.com
Public privacy page: https://fitsync.website/privacy