FITOPOLIS Privacy Policy

1. In short

• FITOPOLIS is an app for personal trainers and the people they coach. The trainer runs the coaching in it, and the trainee logs what he eats, how he trains and what he weighs. They also set meetings and talk in a chat inside it.
• We keep only what the app needs to work: your phone number so you can sign in, and what you and your trainer record and send each other.
• Some of it is information about your health: weight, body measurements, what you ate and how you trained. We treat it as sensitive information.
• Your trainer sees what you record and send him. You do not see the private notes he writes about you, or his payment tracking.
• What you write for yourself stays on your phone: a note on a weigh-in, a note to yourself on a workout, and the reason you wrote when you removed a mark. It does not go to the server, and your trainer does not see it.
• The app has no ads and no usage measurement. When the app crashes, a technical crash report goes to Google (section 7). We do not sell data and do not share it for marketing.
• You can delete your account from inside the app at any time.
• The app is for ages 13 and up. A trainee aged 13 to 17 joins only with a parent's consent, and the trainer is responsible for getting it. A trainer must be 18 or older.

2. Who we are and how to reach us

FITOPOLIS ("we"). We are responsible for the data kept in the app. For any privacy question, or to use your rights under the Israeli Privacy Protection Law (section 12 below), write to support@fitopolis.co.il.

At this stage the app is in a pilot. Invited trainers and trainees download it on Android, through Google Play's closed testing track.

Your trainer does not work for us. He uses FITOPOLIS to work with you. He is responsible for what he chooses to write about you, and for getting a parent's consent when it is needed (section 13).

3. What is kept, why, and who sees it

How long each thing is kept is in section 10, and how to delete is in section 11.

3.1 The account and signing in

You sign in with an Israeli phone number and a one-time code sent by SMS. The code is valid for 5 minutes, and you can try it 5 times. There is no email and no password, and no sign-in with Google or Apple.

What is kept with the server provider:

• The phone number you verified.
• The account name.
• An internal ID. It is recorded on everything you create in the app, so we know who wrote it.
• When the account was created, and when you last used it.
• The IP address of every request to the server. The server provider also uses it to limit how many codes can be requested from each address.

Why: so you can sign in, so a trainee can be linked to the record his trainer opened for him, and to protect the accounts.

On the phone, the sign-in keys are kept in the phone's encrypted storage. When you sign out, they are deleted.

Who sees it: you, us and the server provider. A trainer sees, in the list of who joined with his code, the name or phone number you joined with, and the date.

If you are a trainee, your phone also keeps its time zone on the server, so your day in the app starts and ends at the right hour. The trainer does not see it.

3.2 What the trainer keeps about himself

• His phone number, name, photo and logo.
• His settings: notifications and quiet hours, the types of cardio he works with, the list of payment methods he accepts (names only, with no connection to them), colours and logo size, and his meeting settings — when he is available, quotas, holidays and reminders.

What his trainees see of this: his name, photo and logo, the types of cardio, the colours, and the part of the meeting settings meant for them — when a meeting can be requested, how many requests are allowed, and when he is unavailable, with the label he gave it. They also see the times when he is already busy, without names (section 3.8). The trainer's phone number, notification settings, reminders and payment methods never reach them.

3.3 What the trainer writes about the trainee, which only the trainer sees

The trainer opens a record for each client. The trainee does not see these parts of it:

• The phone number the trainer typed in, and the starting weight.
• When the coaching started.
• Private notes and a private reminder. These are free text.
• The trainee's current phase (bulk, cut, mini-cut or neutral), and text about his nutrition.
• The invitation code that was sent, and when it expires.
• If the trainee is 13 to 17: the date the trainer confirmed he received a parent's consent (section 13).
• Archive dates, which templates were assigned to the client, and whether he already uses the app.
• How much the trainee pays the trainer and on which plan, and the history of it.
• The ID of the trainee's account, so the server knows which phone to send a notification to.
• The notes the trainer writes for himself on a meeting and on a meeting proposal, and the mark that a meeting took place.

Why: so the trainer can run the coaching and track the payments his trainees make to him. FITOPOLIS does not charge money and does not move money.

The trainer may write information about your health in his notes, depending on what he chooses to write. He may also open this record before you joined the app. You can ask to see what is recorded about you (section 12).

3.4 What the trainer and trainee both see

• Your name, height, age, photo and your colour in the app. Either of you can change the name, height and photo, and the latest change wins. The trainer sets the age and colour.
• The meal plan and workout program the trainer gave you, and the history of changes to them.
• When you joined, and when the coaching ended, if it did.
• The coaching settings: whether meals are marked, whether workouts are logged, how a workout is checked off, wake-up time and bedtime. Either of you can change them, and the trainer sees what you changed. Only you decide whether you mark meals on Saturday, and the trainer sees what you chose.
• The tracking schedule: when to weigh in, which measurements to take and when, and whether there is a recurring meeting — the day, every how many weeks, the time, the meeting type and the place. The trainer sets it, and you see it.

3.5 The invitation code

The trainer invites a trainee with a link or a QR code. The code works once and is valid for one day. Until the code is used, cancelled or expires, anyone holding it can see, without signing in, the trainer's name and the trainee's first name. He can also join in the trainee's place and see what the trainer has already recorded for him: age, height, meal plan and program. So the code is sent only to the trainee himself.

The link looks like this: fitopolis.co.il/invite/#c=.... The code sits after the # sign, so it never reaches the website's server.

Once a trainee has joined, no other account can join his record with an invitation code. When a trainee changes his phone number, we move the record to the new account, at his request.

3.6 Weigh-ins and measurements

• Weigh-in: the weight and when you weighed in. You record it, and you both see it. A note you wrote on a weigh-in stays on your phone only.
• Body measurements: which measurement (by the name the trainer gave it), how many centimetres, and when. The trainer records them, and you both see them.

This is information about your health (section 6).

3.7 Meals, workouts and cardio

• Marking a meal: which meal, on which day, when you marked it, and when you removed the mark, if you did. Both moments reach the trainer's phone, and a meal you removed the mark from appears to him as not eaten. The reason you wrote when you removed the mark stays on your phone.
• A workout you did: which workout and its name, when, how long, the volume, and the weight you lifted in each exercise.
• Cardio: how much, in which unit, and when.

You record them, and the trainer sees them. The note you write for yourself on a workout stays on your phone. This is information about your health (section 6).

3.8 Meetings

• A meeting: the day, time, length, meeting type, place and topic; if it was cancelled, when and why; whether it did not take place; and whether you confirmed you are coming. The trainer sets the meetings, and you see them. The note the trainer writes for himself on a meeting does not reach you.
• Meeting requests and proposals: who asked, which time, length and type, topic and place, and the replies — approval, rejection, another proposal or cancellation — with the reason, if you wrote one. Everything you write in a request reaches the trainer, including the reason when you tap "I can't make it". That is what the request is for.
• A wordless signal: when you act on a request, your phone leaves a short signal on the server with no words in it. It says only that something happened and on which request, so the trainer's phone wakes up.
• The trainer's busy times: so you do not ask for a time that is already taken, the trainer's phone sends each of his trainees a list of the busy times in the next three months. It holds only the day, time and length, with no name, topic or place. From the list one can tell when the trainer is busy, but not with whom.
• The phone's calendar: if you choose to add a meeting to your phone's calendar, that stays on the phone only. Your meeting reminder settings stay on the phone too.

3.9 Chat

• Messages: who sent it and when, the text (up to 4,000 characters), the message you replied to, and whether the message was edited or deleted.
• Photos and videos: the phone shrinks a photo to screen size before it is sent. A video is compressed on the phone before sending, and is sent only if it is up to 50MB after compression.
• Voice messages: the recording, its length (up to 10 minutes) and the waveform shown in the bubble. The app records only after you start a recording yourself: you press and hold the microphone button, or lock the recording to go on without a finger. The recording ends when you send or cancel. Nothing else is recorded.
• A note to the trainer at the end of a workout: if you write it, it is sent to him as a chat message, with the workout's name. The note you write for yourself on a workout is a different thing, and it stays on the phone.
• Who read what (✓/✓✓): for each side, the app keeps up to which message it has read. The other side sees ✓✓ on his messages you have already read, so he knows roughly when you opened the chat. It works the same way for both sides, and nobody else sees it.
• Editing and deleting: you can edit and delete only your own message, and only in the first 45 minutes. When a message is deleted, its text and file are deleted, and "message deleted" stays in its place. The trainer cannot delete your message.
• Where, and who sees it: the chat is only between you and your trainer. Messages are kept on the server, and files are kept in the server provider's file storage. A copy of the files is also kept on the phone of whoever sent them and of whoever received them.

3.10 Templates and payments — the trainer's only

• Meal-plan templates (name, goal, calorie target, days and swaps), workout templates, and payment templates (monthly amount, date and interval).
• Payment records: which client, his name at the time of payment, the amount, the date, the payment method, the month and the expected amount.

These are the trainer's records of money his clients pay him. The app does not move money and does not keep credit card or bank account details. The trainee does not see these records. He sees only a confirmation of his own payment (amount and month), if the trainer chose to send one.

3.11 Notifications

• So the phone can receive notifications, the app registers the phone's notification ID (from Google Firebase) and the phone type with the server provider. When you sign out, the phone cancels the ID at Google and asks the server provider to delete the registration.
• The notification that passes through Google only wakes up the app. It carries one fixed word and a technical signal, with no name, amount, text or any detail of yours. The notification that appears on your screen is put together by your own phone, from the data it already has.
• The trainer's phone leaves short wordless notices for the trainee on the server: that his settings were updated, that the meal plan or program changed, that something changed in a meeting, and a payment confirmation (amount and month) if the trainer chose it. The trainee's phone only reads them. The trainer's phone deletes them after 30 days.

3.12 When the coaching ends

The trainer can end the coaching and move the trainee to the archive. Future meetings are cancelled, and the trainee's app locks and shows "coaching ended" with the date. The trainer can also bring the trainee back from the archive, and then the app opens again with everything it had. The trainee gets a notification when the coaching ends and when it resumes. Archiving deletes nothing, and the trainer keeps all the data. How to delete is in section 11.

3.13 Contacting the team

You can contact us from inside the app about a fault, an idea or a question, in two ways:

• "Contact the team" in the account area: you pick a topic, write in your own words, and can attach up to three photos from the gallery or the camera. You can add to the request later too.
• The "Report to the team" button in a fault notice: when something does not go out from the phone, one tap sends us technical details only. That report carries no words of yours, no photos and nothing you recorded.

What each request sends: what you wrote and the topic you picked; the photos you attached, if any; whether you are a trainer or a trainee; the app version, the phone type and the language; which screen you sent it from; and the state of the connection to the server, in codes — how many changes are waiting to go out, which type of data is stuck, which error code came back, and since when. Beyond that, your data is not sent: no weights, no marks, no names and no phone numbers. The request is kept on the server and linked to your account.

Photos: a screenshot shows what was on the screen. For a trainer, that can be details of his clients, such as names, weights, measurements and payments, including clients aged 13 to 17. Whoever attaches such a photo sends them to us too, so it is best to attach only what we need in order to understand. The app reminds you of this next to the attach button.

Who reads it: only we do. The server provider can open the request, like anything on the server (section 5). A trainer does not see a trainee's request, and a trainee does not see a trainer's request. Our AI tool (section 7) reads what you wrote and looks at the photos, to understand what it is about and pass it on to be fixed. It reads only that request, and nothing else of yours. It opens each photo for a moment, describes in words what needs fixing without the details in it, and deletes it from our computer in the same step. The photo itself stays only on the server, with the request.

What happens next: a short confirmation appears at once. Inside the request you see whether it was received, is being worked on or was handled, and when. Only we write the status. If we need to answer you, the answer comes inside the request, and each answer is written with the approval of a person on our team. We also keep an internal record of how the request was handled — when it was passed on and when it was handled — without its content.

Without a network: the request and the photos are kept on the phone and sent by themselves when there is a network. The phone also keeps a copy of the photos you sent, to show them in the request.

3.14 What stays only on your phone

These never go to the server, and nobody but you sees them:

• What you write for yourself as a trainee: a note on a weigh-in, a note to yourself on a workout, and the reason you wrote when you removed a mark.
• Your preferences: the order of your meals, your "pick one" choices, and your notification and reminder settings, including meeting reminders.
• An activity log: when you marked a meal, opened the app, weighed in or finished a workout. The app uses it only to show you your own history, and nothing analyses it to learn about you.
• Notification history, language and appearance, drafts, a workout you have not finished, the calendar you picked on the phone, and technical details such as which account last used the phone.

The phone also keeps a copy of what is on the server: for a trainer, his clients' data; for everyone, the chat files. That way the app works without a network.

If we ever want to send to the server something you write for yourself, we will update this policy first.

Phone backup: the app is not included in the automatic backup to your Google account. What is kept only on the phone stays there, and is deleted when the app is removed. What is on the server loads again when you sign in.

4. What will be added during the pilot

During the pilot we will add one more part, in an app update through Google Play:

• Operations: the trainer will get a morning brief and a daily summary, which his phone works out from the data it already has. And we will see general numbers, such as how many users there are, with nobody's details.

From the start of the pilot the app reads a short list from the server, with no personal data: switches that turn a part of the app on or off remotely, and the lowest app version that may still run. On a phone with an older version, the app asks you to update, and what you entered stays on the phone until the update.

Before each such update we will update this policy and the date at its top.

5. Who sees what

A trainee sees nothing of another trainee, except the trainer's busy times, without names. A trainer does not see another trainer's clients.

"Us: yes" means the data is on the server, and we can technically open it as the account holder with the server provider. The server provider can open it as the operator of the server. But we do not read what users record and send. We handle accounts — linking to a record, changing a number, disabling and deleting — only to handle a request of yours or a fault, and each such action is done with the approval of a person on our team. There are three exceptions: a request you sent us (section 3.13); finding the rows of a deletion you asked for — there we find only what has to be deleted, and we report what we saw to nobody; and your request to see your data (section 12) — there we collect only your data, only to send it to you. The app is tested with test accounts, not with users' accounts.

6. Information about your health

Weight, body measurements, what you ate, which workouts you did, how much you lifted and cardio — all of these are information about your health. The trainer's notes, chat messages, photos and recordings may include such information too. On Google Play the app is declared as a fitness and activity app.

We treat this information as sensitive. We use it only so that you and your trainer can work with it, and not for advertising, sale or marketing.

There is one exception: a request to us (section 3.13). If you write in it about weight or health, or attach a screenshot that shows such information, we and our AI tool will see it, and use it only to handle the request. A photo a trainer attaches may show such information about his clients too.

7. Who the data is shared with

We do not sell data and do not give it to advertisers. Data goes only to those the app cannot work without:

• TaskLite — the server provider. An Israeli business. Everything on the server, files included, is kept with it, on Amazon Web Services servers in Ireland. According to its policy, it has sub-processors of its own, among them an error-reporting service and an AI service. We do not know whether our users' data reaches them.
• The SMS provider. The code messages go out through TaskLite's account, and your phone number passes to its messaging provider.
• Google Firebase Cloud Messaging. Delivers notifications to the phone. It receives the phone's notification ID, and the notifications themselves carry no personal content (section 3.11).
• Google Firebase Crashlytics. When the app crashes, it sends Google a technical report: where in the code it failed, the phone model and system version, the app version, the time, and a random installation ID. We do not add a name, phone number, account ID or anything you recorded to the report. When the crash is in a component of the phone's system, the report also carries the system's error message, which in rare cases can quote text that was in the app at that moment. We use the report only to fix faults. Google keeps the reports for 90 days.
• Google Play. Where the app is downloaded. In the pilot, testers join with a Google account, through a Google group they join themselves. As the group's managers we see the email address you joined with, and use it only to run the test. It does not reach the app and is not kept in it. What Google collects there is under Google's policy.
• Our email. An email you send to support@fitopolis.co.il passes on its way to us through an email-forwarding service, which can see its content.
• The website fitopolis.co.il. Hosted by a website-hosting provider, with no visitor tracking.
• Our AI tool — Anthropic's Claude. We run the server with it: it sets up boards and settings, and handles accounts when needed — linking to a record, changing a number, a deletion request — each action with the approval of a person on our team. For that, Anthropic processes for us, as a service provider, your phone number, name and account ID. The tool does not open what is kept in the account: weights, marks, notes, payments, meetings, chat messages and what is attached to them. There are two exceptions. The first — your request to see your data (section 12): then the tool collects only your data, only so that we send it to you, with the approval of a person on our team. The second — a request you sent us (section 3.13): the tool reads that request, including the photos you attached, and if a photo shows details — yours, or a trainer's clients' — the tool sees them too. The tool also writes the request's status on it, and our answers with the approval of a person on our team.
• Your trainer. Receives what section 5 says.
• When the law requires it. If a law or a court order requires us to hand over data, we will hand over only what is required.

Later: when the app comes to iPhone, notifications will also pass through Apple, and test downloads will go through TestFlight. Before any such change, and before we add any other outside service, we will update this policy.

8. Where the data is kept

• On the server: with TaskLite, on Amazon Web Services servers in Ireland, in the European Union — that is, outside Israel. The files — photos, videos and recordings — are kept there too.
• On your phone: in the app's private folder.
• Not in your phone's backup: the app is not included in the backup to your Google account (section 3.14).

9. How we protect it

• The connection between the app and the server is encrypted (HTTPS).
• On every request the server checks who is asking, and returns to each person only what he is allowed to see.
• In the chat, the server lets each side edit and delete only its own messages.
• A link to download a file from the server is valid for 15 minutes only.
• The sign-in keys are kept in the phone's encrypted storage. There are no passwords.
• The app holds no secret server keys. The Firebase identifier inside the app is public, and it is locked to our app only.
• Notifications travel without personal content.
• The sign-in code is valid for 5 minutes, and the number of attempts and codes is limited.
• On the phone, the data is kept in the app's private folder, which other apps cannot reach. It is not encrypted separately, so it matters that your phone is locked with a code.

No method guarantees full protection. If a security incident touches your data, we will tell you, and report to the authorities as the law requires.

10. How long we keep it

11. Deletion

11.1 Deleting your account from inside the app

Trainers and trainees can delete their account from inside the app, in the account area. A trainee can also do it from the "coaching ended" screen. You need a network connection, and we send a new SMS code to make sure it is you.

Before the deletion, the app deletes from the server the photos you attached to requests to the team, and the photos, videos and recordings you sent in the chat. The server provider does not delete files together with the account, so the app does it first. Before you confirm, it tells you how long this will take. The files are deleted even if the code then fails.

At the moment of deletion, the identifying details in the account are erased, all your sign-ins on all phones are cancelled, and the phones' notification registrations are deleted. Everything you created yourself is deleted from the app, and no user can see it any more. Your phone is emptied and goes back to the opening screen, keeping only the language and appearance you chose. The final deletion from the server is done by the server provider, under its own policy (section 10).

Removing the app from your phone does not delete your account.

11.2 A trainee who deletes his account

What you recorded and sent yourself is deleted with the account: the weigh-ins, meal marks, workouts, cardio, your chat messages and read marks, the meeting requests you opened and your signals on them, and your requests to the team. Your time zone and your Saturday choice are erased before that.

What the trainer recorded about you: the name, phone, age, height, photo, starting weight, notes, settings, meal plan, program and their history, the measurements, future meetings, meeting requests, and the messages the trainer sent you in the chat and their files. All of these are deleted by the trainer's phone, on the server and on his phone, the next time his app connects to the server. If it does not connect, we delete them by hand in our weekly check, with the approval of a person on our team. Until then they stay on the server and the trainer still sees them, including what you wrote in meeting requests he opened.

What stays with the trainer — a minimal record: instead of the name it says "a client who deleted his account", in the payment records too. What stays is an internal ID, the payments, prices and plans over time, when the coaching started, archive dates, the date of parental consent if there was one, and when the account was deleted. From meetings that took place, the day, time, length, meeting type and whether it took place stay, without topic, place or notes. Why: these are the trainer's records of the money he received and the coaching he gave. They stay until the trainer deletes the client permanently or deletes his own account.

If you changed your phone number: what was created under the account with the old number is not deleted automatically with the new account. We delete it by hand in our weekly check, with the approval of a person on our team. Until then the trainer still sees the old records.

11.3 A trainer who deletes his account

Before the deletion, the trainer's phone deletes the files he sent in the chat, his photo and logo, and the photos he attached to requests to the team. It also deletes the meeting requests his trainees opened and the signals on them.

Then everything the trainer created is deleted: his details, the client records, the measurements, the templates, the payments, the meetings, the requests he opened and the messages he sent. Each of his trainees' apps will show "coaching ended", and from there the trainee can delete his own account.

What the trainees recorded and sent themselves — weigh-ins, marks, workouts, cardio and their chat messages — stays with the server provider. No user of the app can see it, not even the trainee who recorded it. We and the server provider can still open it. When the trainee deletes his account, those rows are deleted. Files he sent in the chat may stay in the server provider's storage, because once the record is deleted the app can no longer reach them. We have asked the server provider for a way to delete all of this at the same moment.

11.4 A trainer who deletes a client permanently

The client's record with the trainer, the measurements, the tracking settings, the payment records, the meetings and requests, and the messages the trainer sent him in the chat and their files are deleted. The trainee's app will show "coaching ended", and from there he can delete his account. What the trainee recorded and sent himself stays with the server provider, exactly as in section 11.3.

11.5 If you no longer have the app

Go to fitopolis.co.il/delete-account-en.html. It offers two ways:

• Install the app again, sign in with the same number and delete from the account area. This is a full deletion.
• Write to support@fitopolis.co.il. We will confirm the request comes from you with a message to the account's number. Then we will disable the account, and with the approval of a person on our team delete what you recorded and what the trainer recorded about you. Finally we will ask the server provider to delete the account itself. Until it does, the account record itself (the number and the name) stays with it, disabled.

A parent of a trainee aged 13 to 17 can ask for deletion the same way, or together with the child from inside the app.

11.6 Signing out

Signing out deletes the sign-in keys from the phone and cancels the notification ID. The data on the server stays.

12. Your rights

Under the Israeli Privacy Protection Law, 5741-1981, you have these rights:

• There is no legal duty to give us data. What you give, you give by choice. But without a phone number you cannot sign in, and without your records your trainer will not see your progress.
• Who receives the data: your trainer and the providers in section 7, for the purposes in section 3.
• Seeing the data about you: you can ask to see the data about you on the server, including what your trainer recorded about you. The app has no export, so we answer such a request by hand, within 30 days: we collect only your data, and send it to you.
• Correcting it: you can correct your name, height and photo in the app. For anything else, ask your trainer or write to us.
• Deleting it: section 11.
• If you did not get an answer: you can turn to the Privacy Protection Authority.

Write to support@fitopolis.co.il.

13. Minors

• FITOPOLIS is for ages 13 and up. Under 13, it may not be used.
• A trainee aged 13 to 17 joins only with his parents' consent. Obtaining the consent is the trainer's responsibility. When a trainer adds a client, the app asks whether the client is under 18. If so, he cannot be added unless the trainer confirms that he received the consent of a parent or guardian. The app keeps the date of the confirmation, and only the trainer sees it. The consent itself stays with the trainer.
• The app does not check age by itself, and it relies on the trainer's answer. If we find out a user is under 13, we will disable his account and delete it as in section 11.5.
• A trainer must be 18 or older.
• A photo a trainer attaches to a request to us may show details of his clients, including clients aged 13 to 17. We and our AI tool will see them, and use them only to handle the request (section 3.13).
• A parent who wants to see what is kept about his child, correct it or delete it, writes to support@fitopolis.co.il.

14. What we do not do

• We do not collect location or contacts.
• We record nothing, except a voice message you record yourself in the chat (section 3.9).
• No ads and no advertising IDs.
• We do not measure how you use the app. If we add anything like that, we will update this policy first. Crash reporting (section 7) is technical, and we add no details of yours to it. The server provider records, like any server, the IP address of every request and when an account last used it.
• We do not sell data and do not share it for marketing.
• No payment inside the app, and no credit card or bank account details kept.
• No email or password, and no sign-in with Google or Apple.
• We do not read what you record and send, except a request to us and your request to see your data.
• What you write for yourself as a trainee, and the activity log, do not go to the server.

15. Phone permissions (Android)

Photos and videos from the gallery are picked through the phone's own picker, without giving the app access to the gallery.

iPhone: at the start of the pilot the app is on Android only. When it comes to iPhone, we will update this list.

16. Changes to this policy

Before any app update that adds a type of data, we will update this policy and the date at its top, and describe the change in the update notes on Google Play.

17. Contact

FITOPOLIS · support@fitopolis.co.il