Privacy Policy

1. Who is the controller

FitTask is a hobby project developed and maintained by a single developer (“we”). We are the controller of your personal data under the General Data Protection Regulation (GDPR).

For any privacy question, or to access or delete your data, write to fittask.support@gmail.com.

2. Scope

This policy covers the promotional site www.fit-task.com, the web app at app.fit-task.com, the Android app and the Wear OS watch app.

3. What data we process

We process only the data needed to make the app work:

• Account data: first and last name, e-mail address, role (client or trainer) and password. The password is never stored in readable form, only as a salted PBKDF2 hash. If you enable two-factor authentication (2FA), we also store hashed backup codes.
• Profile data (optional): date of birth, gender, height and similar details you enter yourself.
• Training data: plans, completed sets and weights, personal records, notes, training templates.
• GPS routes and sports activities you record with the app or watch (route, pace, duration).
• Nutrition: food diary, custom foods, meals and goals.
• Body measurements, habits and the injury and pain journal you enter yourself.
• Health data from Health Connect (steps, heart rate, sleep, calories burned) – only if you connect it and allow it.
• Messages between client and trainer, and collaboration requests.
• Technical data: device token for push notifications, IP address and error logs needed to run and secure the service.

We do not collect background location outside an activity that you start yourself.

4. Health data (special category)

Health-related data (e.g. heart rate, sleep, injuries, body measurements) is a special category of data. We process it only on the basis of your explicit consent, which you give by entering or connecting that data.

Your trainer sees health data only if you allow it, category by category. You can withdraw that permission at any time in settings.

FitTask is not a medical device and is not intended to diagnose, treat or prevent any disease.

5. Why we process data (legal basis)

• Providing the service (Art. 6(1)(b) GDPR): account, training, client–trainer collaboration, messages.
• Consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR): health data, beta test invitation, push notifications. You can withdraw consent at any time.
• Legitimate interest (Art. 6(1)(f) GDPR): security, preventing abuse and fixing errors.

We do not sell your data, use it for advertising, or profile you for marketing.

6. Who can see your data

• Your active trainer sees the training, nutrition, measurement and message data you share within the collaboration, and health data only with your permission.
• Other users cannot see your data. A trainer can only work with you if you search for them and send a request, and the collaboration starts only once the trainer accepts.
• We have technical access to the database solely for maintenance and support.

7. Service providers (processors)

To run the service we use the following third parties, who process data only as far as necessary:

• Hosting: SmarterASP.NET / Site4Now – server for the website, app and database.
• Google Firebase Cloud Messaging – delivering push notifications to your device.
• Google Maps – map display and GPS routes.
• Open Food Facts – food and barcode lookup (only the query is sent, no personal data).
• Google Fonts – loading fonts on this site; Google sees your IP address when doing so.
• Google Play and Health Connect – Android app distribution and optional health data sync.
• Web3Forms – a service that delivers messages from the forms on this website (support and beta sign-up) to our e-mail address; the message content and your e-mail pass through it, and processing may take place outside the EU/EEA.

Some of these providers may process data outside the EU/EEA under appropriate safeguards (e.g. standard contractual clauses).

8. Cookies and tracking

The promotional site www.fit-task.com sets no tracking cookies and uses no analytics or advertising scripts.

The web app uses only a strictly necessary sign-in (session) cookie, without which login would not work. Consent is not required for such cookies.

9. How long we keep data

• Account and training data is kept while you have an account.
• When you delete your account, personal data is deleted; only data we must keep for security or legal reasons may remain, for the shortest time necessary. Backups are overwritten in the normal cycle.
• An e-mail registered for the beta test is kept until the test ends or until you withdraw consent.
• Support messages are kept for at most 2 years after the request is closed.

10. Your rights

Under the GDPR you have the right to:

• access and export your data (in the app: Settings → Download my data),
• rectify inaccurate data,
• erase your data (in the app: Settings → Delete account),
• restrict and object to processing,
• data portability,
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

Send your request to fittask.support@gmail.com; we reply within 30 days. If you believe we process data unlawfully, you can lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), azop.hr, or your local supervisory authority.

11. Security

We protect data with reasonable technical measures: encrypted connection (HTTPS), hashed passwords, optional two-factor authentication (2FA) and restricted database access. No system is completely secure, so please use a strong, unique password. If an incident puts your rights at risk, we will notify you and the competent authority as required by law.

12. Children

FitTask is intended for people aged 16 and over. If we learn that a younger person opened an account without parental consent, we will delete it.

13. Changes to this policy

We may update this policy from time to time. The last-updated date is at the top of the page, and we will notify you of material changes in the app or by e-mail.