Privacy Policy

Fit Oracle (the "Service") is provided by Fit Oracle LLC, a New Jersey limited liability company ("Fit Oracle LLC", "we", "us", or "our"), located at Branchburg, NJ 08876, United States. This Privacy Policy describes how we collect, use, share, and protect your information when you use the Service.

The Service is currently offered in the United States. By using the Service, you agree to this Policy. If you do not agree, please do not use the Service. This Policy is part of, and incorporated into, our Terms of Service.

Fit Oracle lets you record health- and fitness-related information — for example, body measurements, injuries, symptoms, sleep, mood, workouts, and (if you choose) meals and food photos. We treat this information with care.

Please understand that Fit Oracle LLC is a fitness-technology company, not a healthcare provider, health plan, or other "covered entity," and we are not a "business associate," under the U.S. Health Insurance Portability and Accountability Act (HIPAA). The information you record in Fit Oracle is generally not "protected health information" under HIPAA. It is, however, sensitive personal information, and we protect it as described in this Policy. The Service does not provide medical advice — see the health and safety disclaimer in our Terms of Service.

a. Information you provide.

• Account & identity: the email address, display name, and profile photo associated with your Google account when you sign in, and your preferences (units, timezone, locale, voice and audio settings).
• Profile & biometrics: date of birth, sex, height, and weight.
• Health & training inputs: injuries and medical restrictions you share, contraindications, symptom and pain logs, and metrics such as weight over time, resting heart rate, body-fat percentage, sleep, and mood.
• Training activity: your goals, plans, scheduled and completed workouts, strength sets, cardio sessions, assessments, and benchmarks.
• Nutrition (optional): if you use nutrition tracking, your meal entries and any food photos you upload, along with AI-generated estimates derived from them.
• Coaching conversations: the messages you exchange with the AI Coach.
• Equipment, shoes/gear, and social: equipment and availability, gear and mileage you track, and friend connections (sending or receiving requests by email).

b. Information you upload from other sources.

• Activity files: if you upload workout files (such as .fit, .gpx, or .tcx) from a watch or another app, we store and process the data they contain — which may include GPS location tracks, heart-rate series, cadence, and power.

c. Information collected automatically.

• Device & usage data: our cloud and infrastructure providers (such as Google Cloud) automatically record standard technical logs that may include your IP address, browser and device type, and request information, which we use to operate and secure the Service. Apart from the limited auto-renew consent audit record described in Section 3(d), we do not store your IP address against your account.
• Cookies & local storage: a small number of strictly functional cookies and similar technologies — see Section 7.
• Push notification data: if you enable notifications, the subscription details your browser provides so we can deliver them.
• Service-generated records: records the Service creates as you use it — including your Coach's action and change history (what the Coach adjusted in your plan or data, with its reasoning), audio we synthesize from the Coach's text (workout cues and read-aloud) and cache so it can be replayed, AI usage and cost information tied to your account, and first-party product-usage analytics — limited, in-house records of how you interact with the Service (for example, which guided-workout layout you use and basic interaction events such as starting, logging, or skipping a set, together with small timing and count measures) that we use to understand and improve the experience. These analytics are tied to your account, are included in your data export and deleted when you delete your account, carry no free-text content, and use no third-party tracking technologies.

d. Payment & subscription information.

• If you purchase a paid subscription, our payment provider Paddle collects your payment-card details directly — we never receive or store your full card number. Paddle gives us limited billing information so we can manage your subscription: your subscription status and plan, your billing and transaction history and identifiers, the billing country/region and tax region, your card brand and last four digits, and the billing name and email you provide at checkout. See Section 6.
• When you agree to a paid subscription with automatic renewal, we record a limited auto-renew consent audit record — the plan and price you agreed to, the version of the auto-renewal disclosure shown to you, the date and time, and the browser user-agent and IP address of that action — because consumer-protection and automatic-renewal laws require us to keep proof of the consent you gave. This record is tied to your account, is used only as evidence of your consent, and is included in your data export.

Our analytics are first-party and in-house. We do not use advertising trackers or third-party analytics/marketing cookies, and we do not share this usage data with third parties for their own purposes.

We use your information to:

• Provide and personalize the Service — run intake, build and adapt your plan, guide and analyze workouts, generate audio, and track your progress;
• Process your inputs with AI to deliver coaching, analyze meal photos, and answer your questions (see Section 5);
• Operate, secure, and troubleshoot the Service, including preventing abuse, debugging, and enforcing our Terms and usage limits;
• Process payments and manage your subscription — start and convert your free trial, charge and renew your plan through our payment provider, send billing and renewal communications, handle cancellations and refunds, and detect and prevent payment fraud, chargebacks, and trial abuse (see our Subscriptions & Refunds Policy);
• Improve and develop the Service and our AI models and features, including by analyzing usage and content and creating de-identified and aggregated data;
• Communicate with you — for example, reminders and notifications you have enabled, and responses to your support requests;
• Comply with law and protect the rights, safety, and property of you, us, and others.

What we do not do. We do not sell your personal information, and we do not share your identifiable personal information with third parties so they can train their own models. We do not use the Service to make decisions that produce legal or similarly significant effects about you without human involvement.

Fit Oracle's coaching is powered by artificial intelligence. To generate plans, coaching responses, embeddings used for search, meal-photo analysis, and spoken audio, relevant parts of your information — such as your messages, profile and training context, uploaded photos, and the text to be spoken — are processed by our AI providers (currently Google's generative AI, embedding, and text-to-speech services; see Section 6).

These providers process your data on our behalf to provide the Service to you and to help us improve our own Service and models, under commercial (paid-tier) terms that prohibit them from using your content to train their own models. Your identifiable personal information is not sold and is not provided to these or other third parties for them to train their own independent models. AI outputs can be inaccurate or incomplete; they are informational and are not medical advice.

We share information only as described here:

• Service providers (subprocessors). We use trusted vendors to run the Service. They may process your information only to provide services to us. Our key providers are:
  • Google Cloud / Firebase — hosting, database, file storage, authentication (Google Sign-In), and push-message delivery;
  • Google AI (generative AI / "Gemini") — coaching, plan generation, and meal-photo analysis;
  • Google Cloud Vertex AI — text embeddings used for search and matching;
  • Google Cloud Text-to-Speech — converting coaching text to spoken audio;
  • Paddle — payment processing and merchant of record for paid subscriptions (see the next bullet).
• Payments (merchant of record). For paid subscriptions, Paddle acts as the merchant of record. Paddle independently collects and controls your payment-card and transaction data, and the information it uses to calculate and remit tax, under Paddle's own privacy policy. We receive only the limited billing information described in Section 3(d).
• Friends, at your direction. If you connect with another user, they can see your basic account identity — your display name, profile photo, and the email address on your account — along with limited coordination details such as your equipment, availability, and preferred times. They do not see your health, injury, body, nutrition, or coaching data.
• Legal and safety. We may disclose information if required by law or legal process, or where we believe in good faith it is necessary to protect rights, safety, or property, or to investigate fraud or abuse.
• Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction; we will require the recipient to honor this Policy or notify you of any material change.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

We use a small number of strictly necessary / functional cookies and similar browser storage:

• A session cookie that keeps you signed in (an HTTP-only cookie set when you authenticate);
• Preference values for your theme (light/dark) and font-size, stored in your browser's local storage with a companion cookie so pages render correctly on the server.

These are required for the Service to work or to remember your settings. We do not use advertising or third-party analytics cookies, and because we use only strictly necessary/functional cookies, we do not show a cookie consent banner. Clearing your cookies will sign you out; clearing your browser's site data (local storage) will reset your theme and font-size.

We keep your information for as long as your account is active, so the Service can coach you over time.

When you delete your account, deletion begins immediately and your account becomes inactive. After a short grace period of 7 days (during which you can cancel), your data is permanently and irreversibly purged — including your profile, workouts, symptoms and metrics, assessments, nutrition entries and food-photo files, generated coaching audio, coaching history, audit records, reminders, and push subscriptions — except for the limited billing and transaction records described below. We aim to complete the purge of active systems within about 30 days of the deletion request. You may also request immediate deletion.

Billing and transaction records. If you have made a payment, we — and our payment provider, Paddle — retain limited financial records (such as invoices, the plan and amount, transaction identifiers, refunds, and the billing/tax region) for as long as tax, accounting, and similar laws require, generally up to 7 years, even after you delete your account. These records are kept separately, are not used to coach you, and are deleted or de-identified once they are no longer required.

Backups. Residual copies may persist in routine, secured backups for a limited period (generally rotated out within 30–90 days) before being overwritten.

De-identified data. We may retain de-identified or aggregated data (which cannot reasonably be used to identify you), and limited operational and security logs, for longer to operate, secure, and improve the Service.

You have meaningful control over your information:

• Access & export. You can download a machine-readable (JSON) copy of the data the Service stores about you, plus your uploaded food-photo files, from Settings → Account & data. (Generated coaching-audio files are not included in the export, but they are deleted when you delete your account.)
• Correct & update. You can edit your profile, goals, equipment, injuries, and other details in Settings, or by asking the Coach in chat.
• Delete food photos. You can delete your food photos at any time in Settings → Privacy.
• Delete your account. You can delete your account and all associated data from Settings → Account & data (see Section 8).
• Notifications. You control push notifications and quiet hours in Settings → Notifications, and at your device/browser level.

To make any other privacy request, email us at contact@fitoracle.ai. We will verify your request against your account before acting on it.

If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, gives you certain rights. This section supplements the rest of this Policy.

Categories of personal information we collect. We collect the following categories of personal information: identifiers (such as name, email, and account/device identifiers); internet or network activity (usage and log data); geolocation data (from activity files you upload, if any); visual information (food photos you upload); for paid subscribers, commercial information (the subscription you purchased and your billing and transaction history) and limited financial/payment information (billing name and email, card brand and last four digits, and tax region — your full card number is held by our payment provider, not by us); and sensitive personal information — including health, injury, and fitness-related information you provide. We collect these from you and from the Google account you sign in with, use them for the purposes described in Section 4, and retain each category as described in Section 8.

Sources and disclosures. We obtain personal information as described in Section 3 and disclose it to service providers for business purposes as described in Section 6. For paid subscriptions, we obtain billing information from, and disclose transaction information to, Paddle, our payment provider and merchant of record (see Section 6).

No sale or sharing. We do not sell your personal information and do not share it for cross-context behavioral advertising. We have no actual knowledge of selling or sharing the personal information of consumers under 16 years of age.

Use of sensitive personal information. We use sensitive personal information only to provide and improve the Service as described in this Policy — not to infer characteristics about you for purposes that would require offering you a right to limit such use.

Your rights. Subject to verification and legal limits, you may request to: know the personal information we have collected and how we use and disclose it; access/port a copy of it; correct inaccurate information; and delete it. You also have the right not to be discriminated against for exercising these rights.

How to exercise. Use the in-app tools in Section 9, or email contact@fitoracle.ai. You may use an authorized agent to submit a request on your behalf, subject to our verification of the agent's authority and your identity.

We use reasonable administrative, technical, and organizational measures designed to protect your information — including encryption in transit, access controls, and reliance on established cloud infrastructure. Your account is protected by Google Sign-In. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. If a breach affecting your personal information occurs, we will notify you and the appropriate authorities as required by applicable law. Please keep your Google account secure, and contact us at contact@fitoracle.ai if you believe your account has been compromised.

The Service is intended for users 13 and older, and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you are between 13 and 17, you may use the Service only with the consent and supervision of a parent or legal guardian (see our Terms of Service).

If you believe a child under 13 has provided us personal information, contact us at contact@fitoracle.ai and we will delete it.

The Service is operated from, and intended for users in, the United States. Your information is stored and processed on Google Cloud (United States, us-central1 region). It is not designed for use in, and we make no representations about its suitability for, jurisdictions outside the United States. If you access the Service from outside the United States, you do so on your own initiative and are responsible for compliance with local law.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, for material changes, provide a more prominent notice (such as in the app). Your continued use of the Service after an update takes effect means you accept the revised Policy.

Questions or requests about your privacy? Contact us at:

Fit Oracle LLC

Branchburg, NJ 08876, United States

Email: contact@fitoracle.ai