Privacy Policy
Last updated: 1 October 2026
The PolFit app is currently available in Spanish only. This English translation of our privacy policy is provided for convenience. In case of discrepancy, the Spanish version prevails.
PolFit is a training app that generates personalised workout plans using artificial intelligence. To do that, it needs to know things about your body and your training. This page explains what we collect, why, who we share it with, and how you can delete all of it.
Who is responsible for your data
Antonio José Vera Bravo, data controller.
Contact: [email protected]
What we collect
| Category | Specific data | Why |
|---|---|---|
| Account | Name, email address and password (stored hashed, never in plain text). | To create your account, identify you and let you recover access. |
| Health and fitness | Date of birth, sex, weight, height, goals, injuries, experience level, years training, strength marks, availability and preferences. | To generate a training plan adapted to you. |
| Activity | Logged sessions, sets, reps, weights, comments and progress reviews. | To track your progress and analyse it to adjust your plan. |
| Technical | IP address and error data when the app crashes. | To diagnose faults and keep the service running. |
| App usage | Usage milestones — first open, initial questionnaire steps, sign-up completed, plan generated, plan accepted, workout logged (with which number it is) and review requested — along with the app version, the operating system and its version, the device model and the language. They are tied to your internal account identifier (a random code) and to your account email. We do not send your name. Your IP address is not stored and your location is not inferred. | To understand how the app is used so we can improve it, and to recognise each user in analytics. You can turn this off. |
Health and fitness data is a special category of personal data under Article 9 of the General Data Protection Regulation. We only process it with your explicit consent, which you give by completing the initial questionnaire. You can withdraw it at any time by deleting your account.
Legal basis
- Performance of a contract (Art. 6(1)(b)) for account data: without it we cannot give you access.
- Explicit consent (Art. 9(2)(a)) for health and fitness data, and for sending it to the artificial intelligence providers that generate your plan.
- Legitimate interest (Art. 6(1)(f)) for technical error-diagnosis data, limited to keeping the service running and secure.
- Legitimate interest (Art. 6(1)(f)) for usage analytics, limited to improving the product and with an opt-out switch available at any time inside the app. Usage data contains no health data: it is navigation and activity milestones, never your profile, your injuries, your weights or your personal records.
Artificial intelligence: what leaves our servers
To generate your plan and analyse your progress, we send your profile and training history to generative artificial intelligence providers acting as data processors on our behalf. This includes your health data. We do not send your name, your email or any account identifier, and from your date of birth we only send your computed age.
We choose providers and API plans whose terms do not contemplate using submitted data to train their models, and we configure our accounts accordingly wherever the provider allows it. Should we find that this no longer holds, or should we switch to a provider or plan without it, we would update this policy and tell you beforehand.
Usage analytics: what we measure and how to turn it off
We use PostHog to understand how the app is used and decide what to improve. The data is processed in the European Union (Frankfurt, Germany) and does not leave the EU.
We measure milestones, not everything you do: the first time you open the app, the steps of the initial questionnaire, whether you complete sign-up, whether a plan is generated, whether you accept it, whether you log a workout — and which number it is — and whether you request a review. These come with the app version, the operating system, the device model and the language. This data is tied to your internal account identifier and to your account email, which PostHog stores as a property of the person so that we can recognise each user in product analytics. We do not send your name.
What we do not do: we do not store your IP address (it is discarded before the data is stored and geolocation is disabled), we do not record your screen or your taps, we do not use advertising identifiers, we do not track you across other apps or websites, and we send no health or training data to analytics: not your weight, not your injuries, not your records, not the contents of your plan.
You can turn it off whenever you want, from Profile → Settings inside the app. Turning it off stops the measuring and also deletes what had already been collected about you. While it is off, we send analytics neither your email nor any other data. The same happens automatically if you delete your account. The first time you open the app we tell you that we measure and where to switch it off.
Who we share your data with
These are the processors we currently use. We update this list whenever it changes.
| Provider | Purpose | Location |
|---|---|---|
| OpenRouter | Routes plan-generation and progress-analysis requests to the AI model. | United States |
| OpenAI | The AI model that generates plans and analyses progress, reached through OpenRouter. | United States |
| Resend | Sending email: address verification and password recovery. | United States |
| Sentry | Error and crash reporting. | United States |
| Cloudflare | Encrypted database backups. | United States |
| PostHog | App usage analytics, to know what to improve. You can turn it off from Profile → Settings. | Germany (European Union) |
| Contabo | Server hosting the application and the database. | Germany |
We do not sell your data, do not share it with advertisers and do not use it for advertising. Transfers to the United States rely on the European Commission's Standard Contractual Clauses or on the EU-US Data Privacy Framework, depending on the provider.
How long we keep it
We keep your data for as long as you have an account. When you delete it, your profile, plans, sessions and reviews are removed from our database within seconds.
With one exception you should know about: we take a daily backup of the database and keep the last seven. That means your data may remain inside an encrypted backup for up to seven days after you delete your account, until that backup rotates out and is destroyed. Backups are only ever restored after catastrophic data loss, never to recover a deleted account.
How to delete your account
From inside the app: Profile → Danger zone → Delete account. It is immediate and irreversible: there is no grace period and no way to recover it.
If you cannot access your account, email us at [email protected] from the address you registered with. More detail on the data deletion page.
Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by emailing [email protected]. We respond within one month.
If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency.
Minimum age
PolFit is intended for people over 16 years old. We do not knowingly collect data from anyone younger. If we find an account belonging to someone under 16, we delete it.
Medical disclaimer
PolFit is not medical advice. Training plans are generated automatically by artificial intelligence and are not reviewed by a healthcare professional. Consult a doctor or a qualified professional before starting any exercise programme, especially if you have an injury, a pre-existing medical condition or are pregnant. If you feel pain or dizziness while training, stop.
Changes to this policy
If we change this policy materially, we will tell you by email before the change takes effect. The date of the last update appears at the top of this page.