EchoFit

1. Who We Are

EchoFit ("we", "us", "our") is a fitness tracking application available at echofit.app and on the iOS App Store and Google Play Store. We are committed to protecting your privacy and handling your data responsibly.

2. Data We Collect

What you provide:

• Account information (if you sign up): email address, display name
• Workout data: exercises, sets, reps, weights, dates — stored locally on your device and optionally synced to your account
• Profile settings: body weight, height, age, fitness goals — used solely to personalize your experience

What we process but do NOT store:

• Voice recordings: Your microphone input is processed by the device's Speech Recognition engine (iOS: Apple's on-device AVSpeechRecognizer; Web: browser's built-in API). The audio is never sent to our servers. Only the resulting text transcript is sent for AI extraction.

What we collect automatically:

• Crash reports and error logs (anonymized, through Sentry — no personal data is attached)
• App usage counts (anonymized, through Plausible — tab views, feature use, share taps; no cookies, no personal identifiers, no transcripts)
• A few product facts tied to your account so we can tell whether EchoFit is working for you: the day you opened the app, whether you saw the upgrade screen and why, whether you started or completed a purchase, what you shared and where, the first time you used a feature, and — for notifications — how you answered the permission prompt, which type of notification you opened and from where, which notification switches you changed, and how many reminders your device scheduled. These are short labels only — never free text, never a message's content, never your training numbers — and they are deleted with your account.
• Notification and email delivery records — see section 8.

3. How We Use Your Data

• To provide the core workout tracking and AI coaching features
• To sync your data across your devices (when signed in)
• To compute your Digital Twin score, recovery insights, and personalized recommendations
• To send the notifications and emails described in section 8, under the controls described there
• To process subscription payments (via Apple IAP, Google Play, or Stripe)

We never sell, rent, or share your personal data with third parties for advertising purposes.

4. Data Storage & Security

• Local storage: All workout data is stored locally on your device first
• Cloud sync: When signed in, data syncs to Supabase (hosted on AWS in the US) with end-to-end row-level security
• Encryption: All data in transit uses TLS 1.3. Data at rest is encrypted by the hosting provider.
• Access control: Only you can access your data. Our engineers cannot access individual user workout records.

5. Third-Party Services

• Supabase (auth + database) — Privacy Policy
• Apple StoreKit / Google Play Billing — for in-app subscriptions on native platforms
• Stripe — for web subscriptions — Privacy Policy
• RevenueCat — purchase management — Privacy Policy
• OpenAI Whisper API — for Arabic voice transcription only. Audio is processed and immediately discarded per OpenAI's API terms. No training on your data.
• AI coaching and workout extraction. The text you dictate is sent to Google Gemini to extract sets and reps. When you talk to the coach, your message, the recent conversation and a short numeric summary of your training are sent to the model you chose: Google Gemini on every plan, Anthropic Claude or OpenAI GPT on Elite and Signature. Each provider processes the request under its API terms, does not train on your data, and never receives your audio, your email or your name. — Google · Anthropic · OpenAI
• Plausible Analytics — cookieless usage counts — Privacy Policy
• Sentry — crash reporting, personal data disabled — Privacy Policy
• Resend — sends our email on our behalf (a processor). It receives your email address, the message we send you, and delivery events (delivered, opened, bounced, marked as spam). — Privacy Policy
• Apple Push Notification service and your browser's push service (Apple, Google, Mozilla) — carry a push notification to your device. They receive the device address and the notification we send, never your account details.

6. Your Rights

You have the right to:

• Access all workout data you've logged (export as CSV from Settings)
• Delete your account and all associated data (Settings → Account → Delete Account)
• Opt out of push notifications and of email at any time (section 8)
• Request a copy of your personal data: privacy@echofit.app

If you are in the EU/EEA, you have additional rights under GDPR including data portability and the right to restrict processing. Contact us at privacy@echofit.app.

7. Children's Privacy

EchoFit is not directed to users under 13 years of age (or 16 in the EU). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us.

8. Notifications and Email

Push notifications. We only send push notifications after you allow them. What you can receive, by the categories you control in Settings → Notifications:

• Messages — a direct message from a friend or your coach. You can turn off message previews so the lock screen shows only who wrote.
• Friends & challenges — friend requests and acceptances, reactions to your workouts, challenge invitations and results.
• Your coach — feedback, check-in requests and replies, a program assigned to you.
• Weekly progress — your weekly summary and new personal records.
• Trial & membership — for example, that your trial ends in two days.
• Comeback nudges & announcements — a nudge after time away and occasional product announcements. Off unless you turn it on.

To deliver them we store a device token (iPhone) or a browser push subscription (web), linked to your account, with the app version and when the device was last seen. The token is removed when you sign out on that device, when the push service tells us it is no longer valid, and when you delete your account. Quiet hours (on by default, 22:00–07:00 in your time zone) deliver messages and coach notifications silently and hold other non-urgent notifications until they end, and we cap how many notifications of most kinds you can receive in a day.

How to turn them off: switch any category off in Settings → Notifications in EchoFit; or turn off notifications for EchoFit entirely in iOS Settings → Notifications → EchoFit, or in your browser's site settings on the web.

Reminders on your device. Training reminders and streak alerts are scheduled by the app on your own device, at the time and on the days you choose in Settings → Notifications. A reminder is skipped on a day you have already logged a workout, they slow down and then stop if you haven't opened the app for a while, and they are cancelled when you sign out. The rest timer can notify you when your rest ends while your phone is locked. These are created on your device; we do not send them.

Email. We send:

• Account emails — sign-in links, email confirmation and password resets. These are required to operate your account.
• Your weekly progress report (and a monthly report) built from your own training data.
• Trial and membership notices — for example, before your trial ends.
• Comeback emails when you haven't trained for a while — a short, limited series that stops after 90 days away.

When you create an account we tell you that we will email your weekly progress and occasional updates, and that you can unsubscribe at any time. Every email other than account emails carries a one-click unsubscribe link (and the standard unsubscribe header your mail app shows), which takes effect immediately without signing in; you can also switch email off in Settings → Notifications. If an address bounces or a message is marked as spam, we stop emailing that address automatically. Emails are sent through Resend (section 5).

Delivery records. For each notification and email we keep a short record: its type, the channel, and whether it was sent, held back and why (for example your settings or quiet hours), failed, delivered, opened, bounced or marked as spam. These records contain no message text. We use them to make delivery reliable and to respect your choices, keep them for 90 days, and then delete them. Your in-app notification inbox keeps your most recent notifications until you clear them.

When you delete your account we delete your device tokens and push subscriptions, your notification preferences, your notification inbox and your delivery records, along with the rest of your data.

9. Changes to This Policy

We may update this policy as our features evolve. We will notify you of significant changes via in-app notification. Continued use of EchoFit after changes means you accept the updated policy.

10. Contact

Questions? We're here: privacy@echofit.app