Fitamin Privacy Policy
Version 1.0 · 9 November 2026
1. Who we are
The personal data operator is an individual, Roman A. Baev ("Operator", "we"). Contact for privacy requests: privacy@fitamin.app.
Fitamin is an app for personal trainers (iOS, Android): a training calendar, attendance marks, session write-offs from packages, and client cards. The app is currently in closed beta.
This policy explains what data we process, why, how long we keep it, and how you can control it. It follows Russian Federal Law No. 152-FZ "On Personal Data".
2. Data we process
Your account data (the trainer using the app):
- email address (for sign-in with a one-time code);
- first and last name, username, date of birth and avatar link — if you provide them;
- technical sign-in session data: IP address, device and app type (User-Agent), session start and expiry time.
Data about your clients that you enter in the app:
- first and last name, date of birth, avatar link;
- contacts: phone numbers, email addresses, messengers, social networks;
- your notes and tags on a client card;
- calendar records: events, participation, attendance marks;
- session packages: name, number of sessions, validity period, price and currency, write-offs and their reversals.
Technical service data: request and error logs, performance and availability metrics. We use them to run and protect the service, not for advertising or profiling.
We do not collect: location, phone contacts, photos or documents from your device, payment card data, or advertising data. The app contains no third-party advertising or analytics SDKs.
Do not enter special categories of data (health, racial or ethnic origin, political or religious beliefs) or data of minors without a legal guardian's consent (see the Terms of Use).
3. Purposes and legal bases
| Purpose | Basis |
|---|---|
| Signing in, creating and maintaining your account | Performance of the agreement with you (Terms of Use) |
| Operating the calendar, attendance and package records, storing client cards | Performance of the agreement; for client data, the bases ensured by the trainer (see section 4) |
| Security, abuse prevention, troubleshooting | Operator's legitimate interest in running the service |
| Answering requests, support | Your request / consent |
We do not use your data for automated decisions with legal effect, sell it, or share it for advertising.
4. Client data entered by trainers
You enter your clients' data. You confirm that you are entitled to pass it to us for processing in the app: the client knows about it and agrees, and for a minor, a legal guardian has agreed. We process this data only to run the app on your instructions and do not use it for our own purposes.
A client whose data is in the app may contact us at privacy@fitamin.app or their trainer. We may ask for proof of identity.
5. Who receives data
- Selectel (Cloud Technologies LLC) — server hosting, object storage for backups, and sending sign-in code emails. Servers are located in the Russian Federation.
- Apple and Google — distribution platforms (TestFlight, App Store, Google Play). They receive data about your installation and diagnostics under their own rules; we do not give them your account content.
- Public authorities — only on a lawful request.
We do not transfer personal data outside the Russian Federation.
6. Retention
- Account data and client data — while the account exists.
- After account deletion, data is kept for 14 days so that you can change your mind, then deleted or anonymised (section 7); backups containing it are overwritten within 30 days.
- Technical sessions — until the session expires, plus 30 days.
- Logs and metrics — up to 90 days (traces about 7 days).
- Requests to privacy@fitamin.app — 3 years after the request is closed.
7. Your rights and deletion
You may: obtain information about how your data is processed; correct it; withdraw consent; request deletion or restriction of processing; complain to Roskomnadzor or a court.
Account deletion is available in the app (the Profile section). Then:
- at once: your account and profile are hidden and you are signed out on all devices; the data is still kept;
- for 14 days you can change your mind: sign in again by code with the same email and the account is restored with all its data;
- after 14 days we delete your email and sign-in link, anonymise your personal profile and delete everything you entered about your clients: names, dates of birth, contacts, notes and tags;
- records of events, packages and write-offs stay without personal data where needed to keep other users' data consistent (an empty entry with no name or contacts remains in them).
If a client registered in the app on your invitation, their own profile belongs to them and is not deleted with your account.
If you want your data deleted at once, without waiting 14 days, write to privacy@fitamin.app: we will delete it early within 30 days. After deletion the data stays in backups until they are overwritten (30 days) and is not used.
For other requests write to privacy@fitamin.app. We reply within 10 business days (extendable as the law allows).
8. Security
Data travels over HTTPS. Sign-in is passwordless, by a one-time code (valid for 10 minutes, limited attempts). Codes are stored hashed. Server access is limited to keys; backups are kept apart from the main server. No system is perfectly secure; we take reasonable measures and report incidents as the law requires.
9. Children
The app is intended for trainers aged 18 and over. A trainer may enter data of minor clients only with the consent of their legal guardians.
10. Changes
We may change this policy. The current version is always at https://fitamin.app/privacy; we will tell you about material changes in the app or by email.
11. Contact
Roman A. Baev, privacy@fitamin.app.