Privacy Policy

This Privacy Policy describes how NetFit ("we", "us", "our") processes personal data when you use the NetFit platform (the "Service") on the web, iOS, or Android. NetFit is a software platform for independent Coaches and their Clients.

White-label branding: After sign-in, you may see your Coach's custom app name or logo inside the product. That branding is controlled by the Coach. The mobile app may be distributed under the NetFit store name while displaying Coach branding in the interface.

Data controller: NetFit — privacy inquiries: support@netfit.coach.

Coaches are independent professionals. When a Coach invites you, they may act as a separate controller for coaching-related decisions; we provide the platform that stores and transmits data at their direction. Coaches must comply with applicable privacy laws when handling client data.

We collect the following categories of personal information:

• Identifiers & account data: name, email address, role (coach or client), profile photo, user ID, and authentication tokens via Supabase Auth (email, password, Apple Sign In, or Google Sign In when enabled).
• Fitness & wellness data you enter: workouts, metrics, body measurements, progress photos, nutrition logs, habits, sleep/water entries, onboarding health questionnaires, and related notes. This may include special category data under GDPR (health-related information) that you voluntarily provide.
• Communications: in-app messages, forum posts, form responses, and file attachments you choose to send.
• Payments (if enabled): billing status, plan metadata, and transaction references processed by Stripe; we do not store full payment card numbers.
• Device & technical data: push notification tokens (if you opt in), device type, operating system, app version, IP address, user agent, and server logs for security, fraud prevention, and reliability.
• Mobile permissions: camera and photo library (only when you upload avatars or progress photos), notifications (only if you grant permission). We do not access these without your action in the app.

We do not knowingly collect data from children under 16. We do not buy personal information from data brokers.

• Directly from you when you register, complete onboarding, or use the Service
• From your Coach when they invite you or assign content
• Automatically from your device and browser when you use the Service
• From authentication providers (Apple, Google) when you choose those sign-in methods

• Provide, operate, and improve the Service
• Authenticate users and enforce access controls between coaches and clients
• Deliver assigned workouts, meal plans, tasks, and messages
• Send transactional emails (invitations, password reset, security alerts, booking confirmations and reminders) via our email provider
• Send push notifications you opt into (reminders, messages)
• Process payments when coaches use billing features
• Detect abuse, fraud, and security incidents
• Comply with legal obligations and respond to lawful requests

Where GDPR or similar laws apply, we rely on:

• Contract (Art. 6(1)(b)): providing the Service you requested
• Legitimate interests (Art. 6(1)(f)): security, fraud prevention, product improvement, and internal analytics that do not override your rights
• Consent (Art. 6(1)(a)): optional push notifications and, where required, processing of health-related data you voluntarily submit. You may withdraw consent at any time without affecting prior lawful processing.
• Legal obligation (Art. 6(1)(c)): tax, accounting, or regulatory requirements where applicable

For special category health data under GDPR Art. 9, we process only data you voluntarily provide for coaching purposes, based on your explicit consent or as necessary for the coaching relationship you request.

We do not sell your personal information. We do not share personal data for cross-context behavioral advertising. We disclose data only as follows:

• Your Coach — data you share within the coaching relationship (workouts, metrics, messages, photos, etc.)
• Supabase — database, authentication, file storage, and realtime (supabase.com)
• Cloudflare — web hosting, network delivery, and security for the app and its API (cloudflare.com); where enabled, Cloudflare Stream also hosts videos that Coaches upload
• Upstash — short-lived request counters, keyed by IP address and request path, used to limit abuse and repeated sign-in attempts (upstash.com)
• Stripe — payment processing when billing is enabled (stripe.com)
• RevenueCat — subscription purchases made in the iOS and Android apps, alongside Apple and Google, who take the payment (revenuecat.com)
• Resend — transactional email such as invitations, password resets, and booking confirmations and reminders (resend.com)
• Expo — delivers push notifications to the mobile app and, where enabled, over-the-air app updates (expo.dev); notifications are relayed through Apple's and Google's push services, and web notifications through your browser vendor's push service
• Sentry — error monitoring for the web app, where enabled: technical error details with your internal user ID and role, but not your name or email (sentry.io)
• Apple / Google — only when you choose Sign in with Apple or Google
• Google / Microsoft — only when a Coach connects a calendar: we read busy times and add booking events, which include the client's name, to that calendar
• Our moderators — a reported message, post, comment, or profile is shared with our moderators, together with the report, so they can review it
• Legal & safety — when required by law, court order, or to protect rights, safety, and security

Processors are bound by data processing agreements requiring appropriate technical and organizational safeguards. A list of subprocessors is available on request.

California residents have additional rights. In the preceding 12 months we have collected the categories listed in "Information we collect" for the business purposes described above. We have not sold personal information and not shared it for cross-context behavioral advertising.

Your rights include:

• Right to know what we collect, use, and disclose
• Right to delete personal information (with legal exceptions)
• Right to correct inaccurate information
• Right to opt out of sale/sharing — see our Do Not Sell or Share page (not applicable; we do not sell)
• Right to limit use of sensitive personal information — we use sensitive data only to provide the Service
• Right to non-discrimination for exercising privacy rights

Submit requests via support@netfit.coach or Support. We verify identity before fulfilling requests.

Depending on your location, you may have the right to:

• Access a copy of your personal data
• Correct inaccurate or incomplete data
• Delete your account and associated data (Settings → Account on web or mobile)
• Download your data: get a copy of the personal data we hold about you in Settings → Account on the web or in the mobile app (we ask you to sign in again first); on the web you can also download a ZIP that includes your photos and files. If you cannot use the download, contact support@netfit.coach
• Object to or restrict certain processing
• Withdraw consent where processing is consent-based
• Lodge a complaint with your supervisory authority (EEA/UK users)

We respond to verified requests within 30 days (45 days where permitted by law). Account deletion permanently removes your profile and associated content from our systems, subject to backup retention windows and legal holds.

• Account data: retained while your account is active
• Fitness & message data: retained until you delete it or delete your account
• Server logs: typically 30–90 days for security monitoring
• Backups: may persist in encrypted backups for a limited period after deletion
• Legal holds: longer retention where required by law or dispute resolution

We use industry-standard measures including encrypted transport (HTTPS/TLS), access controls, row-level security on profile data, secure session storage on mobile (expo-secure-store), and private storage with signed URLs for sensitive media. No method of transmission is 100% secure; notify us promptly at support@netfit.coach if you suspect unauthorized access.

The web app uses essential cookies and local storage for authentication sessions. We do not use third-party advertising cookies. Push notification tokens are stored to deliver notifications you opt into. You can control cookies in your browser settings; disabling essential cookies may prevent login.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects. AI coaching features generate suggestions only; coaches and clients remain responsible for decisions about exercise and nutrition.

The Service is not directed to children under 16. We do not knowingly collect data from children. Contact us at support@netfit.coach if you believe a child has provided data and we will delete it.

Data may be processed in the United States and other countries where our processors operate (including EU-based Supabase regions if configured). Where required, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) and processor agreements. Contact us for a copy of relevant safeguards.

We may update this policy. Material changes will be reflected by the "Last updated" date and, where required, additional notice in the app or by email. Continued use after changes constitutes acceptance where permitted by law.