Privacy Policy

1. Information We Collect

1.1 Information You Provide

Account Information

• Email address
• Display name (optional)
• Profile photo (optional)
• Authentication data from third-party sign-in providers (Apple Sign-In)

Physical and Health Information

• Date of birth, gender
• Height, weight, body fat percentage
• Physical injuries and limitations
• Fitness experience level and activity level
• Body measurements you log over time (e.g., weight progression)

Apple Health and Apple Watch (Optional)

If you grant permission, the App reads and writes the following data through Apple HealthKit:

• Weight (read and write): weigh-ins recorded by other apps and smart scales are read so they appear in your weight trend, and the weight you log in OneFit AI is written to Apple Health so your other health apps stay in sync
• Daily step count (read): used only to score squad step challenges you choose to join
• Heart rate, calories burned and workout duration (read): recorded during workouts tracked with the Apple Watch companion app

Weight read from Apple Health is stored as a body measurement in your account and is treated like any weight you log by hand, including the anonymized coaching context described in Section 4. Health data is never used for advertising or marketing and is never sold. You can revoke HealthKit permissions at any time via iOS Settings → Privacy & Security → Health, or in the Health app under Data Access & Devices.

Progress Photos (Optional)

You can take or import photos of your body to see your visual progress over time:

• Progress photos are stored in private storage tied to your account and are shown only to you. They are never public, never shared, never sent to AI providers and never used for advertising
• Before upload the App strips the embedded camera metadata from the image, including any GPS location. Only the date the photo was taken is kept, to place it on your timeline
• You can delete any photo at any time, and all progress photos are deleted with your account

Fitness Goals and Preferences

• Primary and secondary fitness goals
• Target weight and body composition goals
• Workout preferences (duration, frequency, types, equipment)
• Exercise restrictions and disliked exercises

Nutrition Information

• Dietary restrictions and food allergies
• Calorie and macronutrient targets
• Meal logs and food entries
• Meal photos uploaded for AI scanning

Workout Data

• Workout logs (exercises, sets, reps, weight)
• Workout completion history and duration
• Personal records and favorites

Communications

• AI Coach conversation messages (text)
• Feedback, bug reports, and support requests

Voice Input (Optional)

When you use voice features (e.g., voice meal logging or speaking to the AI Coach):

• Audio is captured momentarily for speech-to-text conversion
• Speech recognition is performed on-device using Apple's speech framework
• The original audio is never transmitted to our servers or stored
• Only the transcribed text is sent to our backend (covered above under “AI Coach conversation messages” and meal logs)

Search History

• Exercise searches within the workout builder
• Food and meal database searches

Search history is stored on your account to power features like recent searches and personalized suggestions.

1.2 Information Collected Automatically

Device and Usage Information

• Device type, model, and operating system version
• App version and build number
• Usage patterns and feature interactions
• Crash reports and performance data
• Push notification tokens

Analytics Data

• Screen views and navigation patterns
• Feature usage frequency
• Session duration and engagement metrics

We do not collect precise location data, contacts, or call logs.

1.3 Information from Third Parties

• Apple Sign-In: Name and email (as authorized by you)
• Apple App Store: Subscription and purchase status

2. How We Use Your Information

We do not sell your personal information to third parties.

3. How We Share Your Information

We share your information only in the following circumstances:

3.1 Third-Party Service Providers

3.2 Legal Requirements

We may disclose your information if required by law, legal process, or government request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

3.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity. We will notify you of any such change.

4. AI Data Processing

4.1 What Data is Sent to AI Providers

• AI Coach: Your fitness profile (goals, experience, preferences, and the equipment and training limits you tell Ori about), recent conversation messages plus earlier messages relevant to your question, summaries of your workouts, nutrition logs, recovery and body measurements, and local date/timezone
• AI Workouts: Your fitness profile, equipment availability, workout preferences, and exercise restrictions
• Meal Scanning: Your meal photo (as image data) and meal type
• Conversation memory: So Ori can recall earlier conversations, we create embeddings (numeric representations) of your coach messages with our AI provider and store them with your account. They are deleted with your account

4.2 What is NOT Sent

We do not send your name, email address, account ID, or any other personally identifiable information to AI providers. Fitness profile data is sent as context parameters only. Progress photos are never sent to AI providers.

4.3 AI Provider Data Practices

Our AI providers (OpenAI, Anthropic, OpenRouter) process data according to their respective privacy policies. As of our last review, OpenAI does not use API data to train its models. We select providers and configurations that prioritize data privacy.

5. Data Retention

When you delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required by law or for legitimate business purposes (e.g., fraud prevention, resolving disputes).

6. Data Security

We implement appropriate technical and organizational measures to protect your information, including:

• Encryption of data in transit (TLS/HTTPS)
• Encryption of data at rest
• Secure authentication (including third-party sign-in)
• Row-level security on database tables
• Access controls and least-privilege principles

No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

7. Your Rights

7.1 All Users

Regardless of your location, you have the right to:

• Access your personal data through the App
• Update your profile and preferences at any time
• Delete your account and associated data from within the App
• Opt out of push notifications via device settings
• Opt out of analytics data collection via App privacy settings

7.2 European Economic Area (EEA) and UK Residents (GDPR)

If you are in the EEA or UK, you also have the right to:

• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your data (“right to be forgotten”)
• Restriction: Request limitation of data processing
• Portability: Receive your data in a structured, machine-readable format
• Object: Object to processing based on legitimate interests
• Withdraw consent: Withdraw consent at any time (without affecting prior processing)
• Lodge a complaint: File a complaint with your local data protection authority

To exercise these rights, contact us at [email protected]. We will respond within 30 days.

Data Controller: GoldBits LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, United States

7.3 California Residents (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect and how it is used
• Delete your personal information
• Opt out of the sale of personal information (we do not sell personal information)
• Non-discrimination for exercising your privacy rights

8. International Data Transfers

Your information may be transferred to and processed in the United States, where our servers and service providers are located. If you are located outside the United States, you consent to the transfer of your data to the United States.

For EEA/UK users, we rely on Standard Contractual Clauses (SCCs) or equivalent safeguards for international data transfers where required by law.

9. Children’s Privacy

The Service is not intended for users under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected data from a child under 16, we will promptly delete it. If you believe a child under 16 has provided us with personal information, please contact us at [email protected].

10. Push Notifications

We may send push notifications for workout reminders, meal logging reminders, progress updates, and important service announcements. You can disable push notifications at any time through your device settings. Disabling notifications does not affect your ability to use the Service.

11. Cookies and Tracking

The App does not use browser cookies. Our analytics providers (Amplitude, Firebase) use device identifiers and SDK-based tracking to collect usage data. You can opt out of analytics data collection via the App's privacy settings.

We do not track users across third-party apps or websites for advertising purposes.

12. Third-Party Links

The App may contain links to third-party websites or services (e.g., our feedback board, Discord community). We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy in the App or by other reasonable means. The “Last Updated” date at the top of this policy indicates when the latest revisions were made. Your continued use of the Service after changes become effective constitutes acceptance of the revised Privacy Policy.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, contact us at:

GoldBits LLC
30 N Gould St, Ste N
Sheridan, WY 82801
Email: [email protected]

For GDPR-related inquiries, you may also contact your local data protection authority.