This Privacy Policy explains how doit.fitness ("we", "us", or "our") collects, uses, and shares information about you when you use our mobile applications and services (collectively, the "Services").

1. DATA USAGE

The data controller responsible for your information is doit.fitness. If you have questions about this policy or our privacy practices, please contact us at support@doit.fitness.

2. TYPES OF DATA WE COLLECT

1. A. Data Provided by You
2. Account Information: When you sign up, we collect your name and email address.
3. Personal Fitness Characteristics: To provide personalized workouts and goal tracking, we collect your height, weight, and fitness goals.
4. Content: Your workout logs, exercise routines, and participation in fitness challenges.

Health data with your consent

If you explicitly grant permission, we may access data from Apple Health (via HealthKit) or Google Health Connect. This includes vitals and activity data used to refine your personalized goals and exercises. We do not use this data for marketing or advertising.

Automated collection

1. Analytics: Only if you accept analytics cookies, we use PostHog to record the pages you visit and the buttons and links you use, so we can understand how the website is used and improve it. If you create an account, these events are linked to your account ID. See section 7.
2. Crash Reporting: We collect anonymous crash data to diagnose technical issues and improve stability.

3. PURPOSE OF PROCESSING

We process your data to:

1. - Provide and maintain the Services, including personalized workouts and goal tracking.
2. - Communicate with you about your account, updates, and promotions.
3. - Analyze usage patterns to improve our Services.
4. - Comply with legal obligations.

4. DATA SHARING

We do not sell your personal data. We may share your information with:

1. Service Providers: Trusted third-party vendors who assist us in operating our Services, such as hosting (Vercel), authentication and databases (Supabase), spam protection (Cloudflare Turnstile) and analytics (PostHog, only with your consent).
2. Legal Compliance: We may disclose your information if required by law or to protect our rights.

5. DATA OWNERSHIP

You retain ownership of your personal data. We process it on your behalf to provide the Services. You can request access, correction, or deletion of your data by contacting us at support@doit.fitness.

6. YOUR RIGHTS & DATA DELETION

You have the right to access, correct, or delete your data. Upon your request, we will permanently delete your information from our databases. Deletion requests can be made via the App settings or by emailing support@doit.fitness.

7. COOKIES AND ANALYTICS

Our website uses two kinds of cookies and similar browser storage. Strictly necessary cookies keep the website working and are always on. Analytics cookies are off until you choose to accept them in the cookie banner. No analytics data is collected or sent before you make a choice. You can change or withdraw your choice at any time from "Cookie preferences" in the website footer. When you withdraw consent we stop collecting analytics and delete the analytics cookies from your browser.

When you submit the waiting list form, Cloudflare Turnstile checks signals from your browser to tell people from bots. This is needed to protect the form from spam.

When you join the waiting list, we record that a sign-up happened using a one-way hash of your email address, never the address itself, so we can count sign-ups without sending your email to our analytics provider.

8. INTERNATIONAL DATA TRANSFERS

Our analytics provider, PostHog, Inc., and some of our other service providers store data on servers in the United States. This means your data may be processed outside Canada, Brazil or the country where you live. We rely on our providers' data processing agreements, including standard contractual clauses where required, to protect your data when it is transferred. Personal data processed in another country may be accessible to the courts and authorities of that country.

9. YOUR RIGHTS IN BRAZIL AND CANADA

If you are in Brazil, the Lei Geral de Proteção de Dados (LGPD, Law 13,709/2018, article 18) gives you the right to:

1. - Confirm whether we process your data, and access it.
2. - Correct incomplete, inaccurate or outdated data.
3. - Ask for unnecessary or excessive data to be anonymised, blocked or deleted.
4. - Receive your data in a portable format.
5. - Ask for data processed with your consent to be deleted.
6. - Know which companies we share your data with.
7. - Be told what happens if you refuse consent, and withdraw consent at any time.
8. - Complain to the Autoridade Nacional de Proteção de Dados (ANPD).

If you are in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) and, in Quebec, Law 25 give you the right to access your personal information, ask for it to be corrected, and withdraw your consent. You can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.

To exercise any of these rights, email support@doit.fitness. We will reply within the time limits set by the law that applies to you.

10. CONTACT AND DATA PROTECTION OFFICER

For privacy questions or requests, including requests to our data protection officer (encarregado), contact us at support@doit.fitness.