PRIVACY POLICY — FITABYSS
Last updated: 22 August 2026
FITABYSS ("FITABYSS", "we", "us", "the app") is a personal fitness and habit app. This policy explains what data the app collects, why, who it is shared with, how long it is kept, and how you can delete it. By using FITABYSS you agree to this policy.
Contact for any privacy question or request: rajxshshanmugam1@gmail.com
1. SUMMARY
- FITABYSS is free. No ads, no advertising SDKs, no analytics or tracking SDKs, no in-app purchases.
- We never sell your personal data, and we never share it with third parties for advertising or marketing.
- Most of your data stays on your device. Only an account email and a copy of your onboarding profile are stored on our server, and only if you create an account.
- You can delete everything at any time — see section 6 (Data retention) and section 7 (Data deletion).
2. WHAT WE COLLECT
2.1 Data you enter (onboarding profile)
Name (or hunter name), age, height, weight, gender, work start/end hours, sleep start/end hours, job type, fitness level, injuries or limitations, indoor/outdoor training preference, fitness goal, weekly target.
Why: to generate and personalise your daily quests and their difficulty. Nothing else.
2.2 Account data (only if you sign up)
Email address and an authentication record (encrypted password credential, account creation time, last sign-in time) held by our authentication provider.
Why: to let you sign in, recover your password, and keep your profile tied to your account across devices.
2.3 Progress data
XP, level, rank, streaks, completed quests, stats, titles, fatigue, potions, achievements and other in-game state.
Why: to run the game. This data is stored only on your device — it is not uploaded to our servers.
2.4 Approximate location — optional
If, and only if, you choose outdoor training, the app asks for approximate location while the app is open. The coordinates are rounded to roughly 1 km precision and sent to the Open-Meteo weather service to fetch current conditions, which unlock weather-aware outdoor quests.
- Location is never collected in the background.
- Location is never shared with advertisers or data brokers.
- The rounded coordinates are cached on your device only (refreshed at most once an hour) and are not sent to or stored on our servers.
- Users who train indoors only are never asked for location.
2.5 Device data
A locally generated random device identifier and basic device/OS information, used so the app runs correctly and can schedule local reminders. It is not linked to advertising, is not sold, and does not leave your device except as required by Google Play to deliver the app itself.
2.6 Notifications
Reminders are local notifications scheduled on your device. We do not operate a push server and do not collect push tokens.
3. WHAT WE DO NOT COLLECT
We do not collect contacts, photos, files, call logs, SMS, microphone or camera data, precise or background location, browsing history, health-platform records (Google Fit / Health Connect), or advertising identifiers. FITABYSS contains no advertising, analytics, attribution, or third-party crash-reporting SDKs.
4. WHERE YOUR DATA IS STORED
- Onboarding profile, progress, settings, weather cache: on your device, in app-private storage.
- Session tokens: on your device, in the operating system's secure store.
- Account email and authentication record: Supabase (our hosting and authentication provider), encrypted in transit and at rest.
- Copy of your onboarding profile (only if signed in): Supabase "profiles" table, protected by row-level security so only your own account can read it.
5. THIRD-PARTY SERVICES
- Supabase — hosts the account and the profile copy described above. Data is encrypted in transit (HTTPS/TLS) and at rest. Privacy: https://supabase.com/privacy
- Open-Meteo — receives only rounded coordinates (~1 km) at the moment a weather check runs, and returns current conditions. No name, email, account or device identifier is sent. Terms: https://open-meteo.com/en/terms
- Google Play — distributes the app and provides standard, aggregated install and stability reporting. Privacy: https://policies.google.com/privacy
We do not sell personal data, and we do not transfer personal data to third parties for advertising or marketing purposes.
6. DATA RETENTION
We keep personal data only for as long as it is needed for the purposes described in this policy, and no longer. The specific retention periods are:
- On-device data (profile, progress, settings, cached weather, session tokens): kept on your device until you reset the app (Profile > Reset) or uninstall it. Either action removes it immediately and permanently. We cannot read or recover it.
- Account record (email, authentication credential, sign-in timestamps): kept for as long as your account exists. Deleted within 30 days of a verified deletion request.
- Cloud copy of your onboarding profile: kept for as long as your account exists. Deleted within 30 days of a verified deletion request, and immediately when the account is deleted.
- Approximate location: not retained by us at all. Rounded coordinates are used for a single weather request and cached only on your device, where each refresh overwrites the previous value.
- Security and operational logs (for example sign-in and password-reset attempts, kept to prevent abuse): deleted automatically on a rolling basis by our hosting provider, no later than 30 days.
- Encrypted backups: deleted data may remain in encrypted backups for up to 90 days after deletion, after which the backups are overwritten and the data is permanently gone.
- Inactive accounts: if an account is not signed into for 24 months, we may delete that account and all data associated with it.
- Support email you send us: kept for up to 12 months after your request is resolved, then deleted.
When a retention period ends, the data is deleted or irreversibly anonymised.
7. DATA DELETION
You can remove your data in three ways:
1. Reset inside the app — Profile > Reset clears the profile, progress and cached data held on your device, immediately.
2. Uninstall the app — removes all data FITABYSS stored on your device, immediately.
3. Delete your account and cloud data — email rajxshshanmugam1@gmail.com from the address you registered with, using the subject "Delete my FITABYSS account". We verify the request and erase your account record and cloud profile within 30 days; encrypted backups are overwritten within a further 90 days as described in section 6. We confirm by email when the deletion is done.
Uninstalling the app does not by itself delete your account — use the third option for that. Deleting your account does not require uninstalling the app.
8. SECURITY
- All network traffic uses HTTPS/TLS.
- Session tokens are held in the operating system's secure store, not in plain app storage.
- The cloud profile table is protected by row-level security: an account can read and write only its own row.
- The app never stores your password; authentication is handled by Supabase.
No system is perfectly secure, but FITABYSS holds no payment data, no government identifiers and no precise location, which keeps the exposure limited.
9. CHILDREN
FITABYSS is not directed at children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, email rajxshshanmugam1@gmail.com and we will delete it.
10. YOUR RIGHTS
Depending on where you live — for example under the EU/UK GDPR, or India's Digital Personal Data Protection Act, 2023 — you may have the right to access, correct, export or delete your personal data, to withdraw consent, and to complain to a data-protection authority.
To exercise any of these, email rajxshshanmugam1@gmail.com. We respond within 30 days. You can also correct your profile at any time inside the app, and withdraw location consent at any time in your device's Android settings.
11. HEALTH DISCLAIMER
FITABYSS is a fitness and motivation app, not a medical service. The data it holds is not medical data and is not used for diagnosis or treatment. Consult a qualified professional before starting any exercise programme.
12. CHANGES TO THIS POLICY
If we change this policy we will update the "Last updated" date above and publish the new version at the same URL. Material changes will also be announced in the app. Continuing to use FITABYSS after a change means you accept the updated policy.
13. CONTACT
Email: rajxshshanmugam1@gmail.com
App: FITABYSS (Google Play)