FitCore Privacy Policy
Last updated: 21st October 2026
Who we are
FitCore is made by SpaceCore Web Ltd ("we", "us"), 36 Deans Lane, Sandbach, Cheshire, England. We are the data controller for personal data processed through the app. Contact us about anything in this policy at contact@spacecor.es.
What we collect and why
Data you log in the app
Workouts and sets, plans and programmes, custom exercises, notes, food and meals you log, calorie and macro goals, water and supplements, weigh-ins, body measurements, hours of sleep, bulk/cut phases, and settings. If you add them: your sex, date of birth, height and activity level, which are used only to estimate the calories you burn.
Some of this, such as your weight, body measurements, sleep, diet and exercise, is health data. We only process it because you choose to enter it, and with your explicit consent (UK GDPR Article 9(2)(a)). You can delete it at any time.
Without an account
Everything stays on your phone. We receive none of it.
With an account (optional)
If you create an account, we store your email address, a securely hashed password and, if you add one, your name, or, if you use "Continue with Google", your email address, name and Google account identifier as provided by Google. Your logged data (listed above, except progress photos) is then synced to our cloud database so it's backed up and available on your other devices. This is processed to provide the service you asked for (UK GDPR Article 6(1)(b)), plus your consent for the health data.
Progress photos
Photos are stored in the app's private storage on your phone. They are not synced, backed up to our servers or included in exports. If you share with a personal trainer who can see your body data, you can choose to share individual photos with them: only the photos you switch on are uploaded, to private storage that only you and those trainers can access, and your trainer views them through links that expire after an hour. Switching a photo off, deleting it, or ending the last link that shares body data deletes the uploaded copy; the photo stays on your phone.
Sharing with a personal trainer (optional)
If you have an account, you can invite a personal trainer from Settings → Personal trainer. You choose what they can see: training (workouts, personal bests, plans and programmes), nutrition (food log, targets, water and supplements) and/or body (weigh-ins, measurements, sleep and phases; your height, age and sex are shared only if you share both training and body). Your trainer sees this synced data on the FitCore trainer dashboard while the link is active. They can't change your data. We share it only because you ask us to, and you can change what's shared or end the link at any time in the app, which stops their access immediately. Your trainer sees your email address and the name you give (in the invite or your account profile, which you can change at any time); you see theirs. Your trainer is responsible for how they use what you share with them.
You and your trainer can also message each other, and they can comment on individual workouts or send you a programme, which you can choose to add to your plans in the app. If your trainer asks for weekly check-ins, the check-ins you send (how you rate your week and any notes) are stored the same way. If you turn on "Share live workouts" for a trainer, the workout you're doing is sent every few seconds while it runs (exercises, sets, rest timer) so they can follow along; only the latest snapshot is kept, and turning it off deletes it. Messages and check-ins are stored in our cloud database so both of you can read them. You keep your message history after a link ends; your trainer loses access to it. Messages are deleted when the client's account is deleted.
So that new messages reach you when the app is closed, a phone that shares with a trainer registers for push notifications. We store a push token for that phone (an identifier for sending it notifications, removed when you sign out) with your account. When your trainer messages you, the notification (their name and the start of the message) is delivered through Expo's push service and Google's Firebase Cloud Messaging. You can turn these notifications off in your phone's settings.
Food searches and barcode scans
When you search for a food or scan a barcode, the search text or barcode is sent to Open Food Facts, an open food database, to look the product up. Nothing that identifies you is sent with it.
Crash reports
If the app crashes, it may send a crash report to our error-monitoring provider (Sentry) so we can fix the problem: the error and where in the app it happened, the screens you'd visited, your device model, operating system and app version. Reports contain no name, email, account identifier or any of your logged data, and we strip IP addresses. This is in our legitimate interest in keeping the app working (UK GDPR Article 6(1)(f)). You can turn crash reports off in Settings → Your Data.
Notifications and widgets
Reminders, rest-timer alerts, the lock-screen countdown and home-screen widgets are all created on your phone. We don't receive anything when they're shown. The only notifications sent from our servers are trainer messages (see above).
Health Connect (Android, optional)
If you connect FitCore to Health Connect (Settings → Health Connect), and only for the parts you turn on:
- Workouts: FitCore writes your finished workouts (name, start and end time, notes) to Health Connect.
- Weight: FitCore writes your weigh-ins to Health Connect, and reads weigh-ins other apps or smart scales have saved there. Those become weigh-ins in FitCore, treated like ones you entered yourself (so they sync with your account if you have one).
- Sleep: FitCore reads how long you slept each night (start, end and time asleep) to show on your Body screen and next to your training. Nights become sleep entries in FitCore, like ones you enter yourself.
- Steps: FitCore reads today's step count to show on your Home screen. It stays on your phone; we don't store or upload it.
FitCore reads nothing else from Health Connect. Data read from Health Connect is used only to show it to you in the app and is never sold, used for advertising, or shared with anyone except a personal trainer you choose to share your body data with. You can turn each part off in FitCore, and remove FitCore's access or data at any time in Health Connect. FitCore's use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements.
Subscriptions
If you subscribe to FitCore Premium or a trainer plan, we keep a record of the subscription (which plan, when it started, renews or ends, and which store it was bought through), linked to your account, so we can unlock the right features. Payments are taken by Google Play (in the app) or Stripe (on the web); we never see your card details. This is processed to provide the service you bought (UK GDPR Article 6(1)(b)), and kept for as long as the law requires for tax and accounting.
Who processes your data for us
| Service | What for | Data |
|---|---|---|
| Supabase | Accounts and cloud sync (hosted in London, UK) | Account details and your synced data |
| "Continue with Google" sign-in | Your Google account identity, only if you use it | |
| Expo (650 Industries) and Google Firebase Cloud Messaging | Delivering trainer message notifications | Push token, trainer's name and message preview, only if you share with a trainer |
| RevenueCat | Managing FitCore Premium and trainer subscriptions | Your account identifier and subscription details (product, dates, status) |
| Google Play | Taking payment for FitCore Premium in the app | Handled by Google under its own terms; we don't receive your card details |
| Stripe | Taking payment for trainer plans on the web | Payment details go to Stripe directly; we don't receive card numbers |
| Sentry | Crash reports | Anonymous error and device details |
| Open Food Facts | Food search and barcode lookup | Search text and barcodes only |
Where a provider processes data outside the UK, transfers are protected by the UK International Data Transfer Agreement or Addendum, or an adequacy decision.
How long we keep it
Data on your phone stays until you delete it or uninstall the app. Cloud data is kept while you have an account. When you delete your account, your account and all synced data are deleted from our database straight away; copies in our provider's encrypted backups are removed as those backups expire, within 30 days.
Your rights
Under UK data protection law you can:
- Access and take your data: Settings → Your Data → "Export as spreadsheet" (CSV) or "Export backup" (a full file). You can also ask us for a copy.
- Correct it: edit anything in the app.
- Delete it: delete individual entries, or your whole account in Settings → Account → Delete Account. See how to delete your account if you no longer have the app.
- Stop sharing with a trainer: Settings → Personal trainer → Stop sharing. Their access ends immediately.
- Withdraw consent for health data at any time by deleting it or your account, and object to crash reporting by turning it off.
If you're unhappy with how we handle your data, please contact us first. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint.
Security
Data is encrypted in transit (HTTPS) and at rest in our database. Each account can only read and write its own data, which is enforced by the database itself. Passwords are never stored in readable form.
Children
FitCore isn't intended for anyone under 13, and we don't knowingly collect data from children under 13.
Changes
If we change this policy, we'll update the date above, and tell you in the app if the change is significant.