Last updated: August 13, 2026
FitID is a fitness app that turns your health activity into a game. This policy explains what data the app uses, where it goes, and what control you have. The short version: most health processing happens on your device. If you explicitly enable Live AI Coach, selected recent health, profile, and meal data is sent through FitID's relay to OpenAI to personalize plans and chat. You can separately opt in to private iCloud backup of structured history; meal photos are excluded. Social rankings are friends-only. We do not sell your data, provide health data to advertisers, or request permission to track you across other companies' apps and websites. Rewarded ads are optional and non-personalized.
FitID is available only to people age 13 and older. The first screen asks for your birthday before profile creation or optional external services begin. If the birthday indicates that you are under 13, it is not saved and the app does not start AI, Apple Health, social, subscription, or advertising services. An eligible birthday is carried into profile setup and saved only on your device.
With your permission, the app reads steps, energy burned, exercise time, workouts, sleep, resting heart rate, blood oxygen, respiratory rate, weight, and body fat from Apple Health to calculate your in-app XP, levels, and readiness scores. This health data is processed and stored on your device for XP, levels, readiness, and offline coach insights. The app only reads from Apple Health; it never writes to it. If you enable private iCloud history backup, structured daily summaries can also be stored in your private iCloud database as described below. If you enable Live AI Coach, the selected recent data described below is sent for that feature. Health data is never used for advertising.
Live AI Coach is off until you enable it. When enabled, FitID sends selected recent Apple Health activity, sleep, and recovery metrics; body and profile details; fitness goals and preferences; relevant meal history; and the messages you send over an encrypted connection through FitID's serverless relay to OpenAI. The relay forwards the request and response and FitID's application code does not persist that content on its servers. This context is used to generate personalized plans and answer chat messages.
FitID uses OpenAI's API. By default, OpenAI does not use API inputs or outputs to train its models unless the API account owner affirmatively opts in. Under OpenAI's standard abuse-monitoring controls, API prompts, uploaded images, and outputs may be retained for up to 30 days. Image inputs or outputs flagged by automated child-safety systems may be retained for manual review as described in OpenAI's API data controls. You can turn Live AI health-data sharing off anytime in Settings; on-device offline insights remain available.
When you log a meal with a photo or a text description, that photo or description is sent over an encrypted connection through our serverless relay to OpenAI, which estimates the meal's nutrition. The relay does not store your photo or description — it only forwards the request. The OpenAI retention and training practices described above apply. The photo and resulting nutrition estimate are stored on your device as part of your meal log.
When you scan or enter a packaged-food barcode, FitID sends only the barcode digits to Open Food Facts to look up product name and nutrition information. FitID does not send your identity, health measurements, or meal history with that lookup. Like any internet service, Open Food Facts receives ordinary request information such as your IP address and FitID's fixed app user-agent. Its own privacy practices apply. Successful results are cached on your device and remain editable before you save them to your meal log.
If you choose to create a game avatar, the photo you take or select is sent through the same relay to OpenAI to generate a stylized avatar image, and is not stored by the relay. The OpenAI retention and training practices described above apply. The generated avatar is stored on your device. If you enable the Social feature, a small avatar copy is also stored in iCloud for your friends to see.
The optional Social feature uses Apple's iCloud (CloudKit) under your own Apple account. If you set up a username, the app stores your chosen username, display name, pseudonymous profile identifier, friend code, visibility choice, a small avatar image, XP totals, scores, and overall level in iCloud for friends-only rankings and friend requests. There is no public or global leaderboard. This is shared gameplay data only — no raw health measurements, meals, or photos other than your avatar are shared with friends. You can choose Friends or Private visibility in the app, and your friend relationships are stored through iCloud.
iCloud Backup & Sync is off until you explicitly enable it in Settings. When enabled, FitID stores structured meal nutrition and notes, Health-derived daily summaries and XP, weight and body-composition entries, progress, and deletion markers in your private Apple CloudKit database. This lets your history merge and restore across Apple devices signed into the same iCloud account. Meal photos are not uploaded and remain only on the device where they were captured. This private backup is not shared with friends or used for advertising.
Turning sync off stops new synchronization but does not delete the existing private backup. Reset Profile requests permanent deletion of the private history dataset across devices. If a device is offline, the deletion remains queued and retries when iCloud is available; an older offline device will discard the reset dataset when it reconnects rather than uploading it again. If the signed-in iCloud account changes, automatic history sync pauses until you explicitly enable it for the new account.
FitID Pro is an auto-renewing subscription. Apple handles purchases, payment cards, billing, and renewals through your App Store account under Apple's privacy policy. FitID does not receive your payment card, billing address, or App Store account name.
To verify Pro access and prevent abuse, the app sends an Apple-signed StoreKit transaction, an Apple-signed app-transaction proof when required for TestFlight, and Apple's device-verification identifier to FitID's relay. The relay verifies the signatures and current status with Apple's App Store Server API. Raw signed values are not written to FitID's database; successful results may be cached in server memory for up to five minutes and inactive results for up to ten seconds. Where a persistent quota identifier is required, FitID uses a one-way SHA-256 value derived from the original transaction identifier and stores related counters for up to two days. You can manage or cancel the subscription in your device's Settings → your Apple Account → Subscriptions.
AI requests include a hardware-backed App Attest proof that verifies the request came from a genuine FitID installation and prevents replay attacks. The relay stores the credential's public verification key, registration time, environment flag, and anti-replay counter for up to 400 days. One-time request challenges expire after five minutes. Attestation requests are rate-limited using a one-way digest of the request IP address, and AI feature, request, reward, and quota records generally expire within two days. These security records are not used for advertising or tracking across other companies' apps or websites.
For Health-history backfill eligibility, FitID stores a one-way App Attest installation digest together with a pseudonymous profile identifier and profile creation time for up to five years. Monthly token-use records expire about seven days after the relevant month ends. One-time redemption markers expire after ten minutes, rewarded-use grants after one day, and rewarded-ad transaction replay records after two days.
Reminders (such as the streak reminder) are scheduled locally on your device. CloudKit may use Apple's silent remote notifications to tell FitID that private history or Social data changed; these do not present a member-facing alert. FitID does not operate a separate marketing push-notification server.
FitID uses Apple's MetricKit and unified logging to diagnose crashes, hangs, launch performance, storage failures, and coarse feature outcomes. These diagnostics are kept on your device by FitID and never include health measurements, meal or coach text, photos, friend data, transaction payloads, or stable user identifiers. FitID does not include a separate third-party crash-reporting SDK. Google Mobile Ads may collect its own crash, performance, and diagnostic data as described below.
FitID is free to use. To help cover feature costs, free members can choose to watch a short rewarded video ad to unlock an AI macro estimate, additional coach messages, or one Health-history backfill token. Backfill video tokens are limited to one per calendar month and are unavailable for the first 30 days after profile creation. Ads are never shown automatically — you always opt in before a video starts, and FitID Pro provides these features without rewarded ads.
These ads are served by Google AdMob. We request non-personalized ads only. FitID sets the non-personalized-ad flag, disables Google's publisher first-party identifier and ad-personalization setting, does not request access to Apple's IDFA, and does not show the App Tracking Transparency prompt.
Google Mobile Ads and Google's User Messaging Platform may process the device's IP address and IP-derived coarse location, device or SDK identifiers, ads viewed and ad interactions, app/ad product interactions, consent choices, and crash, performance, or other diagnostic data for ad delivery, measurement, analytics, fraud prevention, security, and app functionality. Non-personalized ads may still use contextual information and identifiers for purposes such as frequency capping and aggregated reporting. Google processes this data under its partner-sites policy. FitID does not send Google your Apple Health data, profile details, meal logs, coach messages, or photos.
Google's User Messaging Platform checks whether a regional privacy message is required and stores your consent choices. No ad is requested until the platform reports that ads may be requested. Where required, Settings provides an Ad Privacy Choices control so you can revise those choices.
Google sends signed rewarded-ad completion details to FitID's relay. FitID validates the ad unit, timestamp, one-time nonce, transaction identifier, requested feature, and App Attest installation digest before granting a use. The retention periods for these anti-fraud records are described in “App verification and relay security.”
FitID Pro, an optional paid subscription, removes ads entirely.
Saved profile, health-derived, meal, and coach content lives primarily on your device; Social data and any structured history backup you explicitly enable live in your iCloud account. Meal photos are excluded from history backup. FitID's server-side security, entitlement, quota, and rewarded-access records follow the specific periods stated above. OpenAI, Google, Apple, and Open Food Facts retain information under their own policies. You can delete individual meals or days of health data inside the app at any time. "Reset Profile" in Settings deletes your character, progress, meal logs, coach history, and requests deletion of both your private history backup and social leaderboard records from iCloud. If iCloud is unavailable, deletion remains queued and retries when service returns. Deleting the app removes remaining on-device data but does not itself delete iCloud records.
FitID is not directed at children under 13 and blocks them before collecting or saving profile information or starting optional external services. If you believe that information from a child under 13 reached FitID despite this gate, contact us so we can investigate and delete it.
If this policy changes, we will update this page and the "Last updated" date above.
Questions or data requests: aidanvare@gmail.com