Privacy
Privacy notice.
Last updated: today. This is the legal copy. The plain-English summary is at the top of each section.
What we collect
Plain English: Your email, your display name, your password (stored hashed), and the food log, water log, and tracker entries you create. We use cookies for the auth session. We use your IP address for country detection so we can show prices in the right currency.
Legal: We collect only the data needed to operate the service. We do not sell your data. We do not show you ads. We do not share your data with third parties except Stripe (payment processing), Supabase (database and auth), Resend (transactional email), and Vercel (hosting) — and only the minimum data each processor needs.
Buddy purchase
Plain English: When you buy FIT50 for a buddy, we create a pending account for them with just their name and email. The account is inactive until they activate it (set a password). If they don't activate within 14 days, we delete the account and convert your seat to a gift code.
GDPR: We create the pending account on the basis of legitimate interest (enabling the gift purchase). The data subject can object at any time by emailing us and we will delete the account immediately.
CCPA: You have the right to know what personal data we collect (this page), right to delete it (email us), and right to opt out of any sale (we don't sell data).
LGPD (Brazil): You have the right to confirmation of the existence of processing, access to your data, correction of incomplete or inaccurate data, and elimination of unnecessary, excessive, or treated data.
DPDP (India): You have the right to access, correction, erasure, and grievance redressal. Complaints can be addressed to the Data Protection Board of India.
PDPA (Singapore/Thailand): You have the right to access and correct your personal data, and to withdraw consent at any time.
What your buddy sees: Only their first name is shown to the purchaser. Their email is never revealed to the purchaser (and vice versa).
We send transactional email only: account confirmation, password reset, and buddy-pair invitations. We do not send marketing email unless you've signed up for the newsletter. You can unsubscribe from newsletter at any time. Each transactional email you receive contains your unique opt-out preferences.
Cookies
We use a single first-party session cookie for authentication. No third-party trackers, no analytics that track you across sites, no advertising cookies.
Data retention
Active accounts: kept indefinitely while your account is active. You can request deletion at any time.
Pending buddy accounts: deleted after 14 days if not activated.
Tracker entries: kept while your account is active. Deleted when you delete your account.
Your rights
Request access, correction, or deletion of your data by emailingsupport@fit50challenge.io
We respond to verified requests within 30 days (GDPR/CCPA/LGPD timeline).
Data processor
Data is hosted on Supabase (database, auth) and Vercel (hosting). Both run on AWS infrastructure. Supabase servers are physically located in the EU (Frankfurt) by default; we may add US regions for latency as user geography shifts. Stripe processes payment data on their own servers and is PCI-DSS compliant.
Contact
Email: support@fit50challenge.io