MyFit Privacy Policy
2026-09-19
What we collect and why
When you register, MyFit collects your email address and account credentials through Supabase Authentication. Information you enter in your profile includes your name, optional birth year, height and weight, fitness goal, experience, training frequency and preferred days, session length, current training, equipment and physical limitations. We store this profile, your plan preferences and notes, generated plans, sessions and completion status in Supabase to provide your account and workout experience.
Explicit permission before sharing with OpenAI
OpenAI is our third-party AI provider. Before each plan request, the app shows a separate disclosure and requires an unchecked permission control to be enabled. Only after you choose “Allow sharing and create plan” do we send the training profile fields listed above, except your account name, together with the plan start date, duration and your notes through our Supabase backend to the OpenAI API to generate your workout plan. Email addresses and account IDs are not included in the AI prompt. Free-text notes and limitations are shared as entered, so do not include identifying or contact details.
Optional Apple Health data
A separate, initially disabled control lets you choose whether to include Apple Health workouts in that one plan request. This is separate from the Apple Health system permission. If both permissions are granted, MyFit reads up to the latest 500 workouts and sends their activity type, start time, duration, distance, calories and available average, minimum and maximum heart rate through Supabase to OpenAI for workout personalization. If the control is off, no Apple Health workouts are read or sent for that request. New plans do not retain the raw Health workout input in the plan record; generated guidance may reflect that context. Earlier app versions may have stored workout input with plans.
Providers and protection
Supabase provides authentication and cloud storage. OpenAI processes the consented training context. RevenueCat receives the account identifier and purchase/entitlement information to manage premium access; Apple processes purchases and payment details. MyFit does not receive payment card details. We require service providers that process personal data on our behalf to provide the same or equivalent protection described in this policy, including confidentiality, appropriate security and use limited to providing the service, under their applicable data processing terms. We use encrypted HTTPS connections. We do not sell your data, use it for advertising or tracking, or authorize training AI models with your Health data. Providers may process information outside your country subject to their applicable safeguards.
AI retention
OpenAI API data is not used for model training by default. MyFit requests store=false for AI responses. This does not mean zero retention: OpenAI may retain prompts and responses in abuse-monitoring logs for up to 30 days, or longer for legal or safety reasons; limited technical caching may also apply. See the linked OpenAI data controls and data processing terms for details.
Choices, retention and deletion
Permission is specific to each plan request and is not remembered as ongoing approval. Choose “Don’t allow now” or close the form to send no AI request. You can still use existing plans subject to your subscription access. Decline future requests to stop future sharing, and turn off Health access in iOS Settings at any time. A completed transmission cannot be recalled. Profile data and plans are kept while your account exists unless deleted. Delete your account from Profile to remove the associated account and cloud records and request RevenueCat customer deletion; this does not cancel an Apple subscription or override provider legal/security retention. Manage subscriptions with Apple. Contact us for access, correction or deletion questions.
Notifications and contact
Notification preferences and scheduled workout dates are used for workout reminders. Device notification permissions are optional. For questions or privacy requests, contact davut.okan@gmail.com.
OpenAI API data controls · OpenAI Data Processing Addendum · Supabase DPA · RevenueCat DPA