Privacy Policy

What we collect

• Phone number — for sign-in and one-time-code authentication.
• Password — stored only as a hash (scrypt); we never see or store your actual password.
• Coach profile — name, bio, avatar, social links and contact details you enter.
• Student details — age, height, weight and training history needed to write a program.
• Photos and files — images you upload in the request form (e.g. physique photos) and payment receipts.
• Program content — exercises, training programs and notes you create.
• Technical data — such as IP address, browser type and technical logs needed for security and debugging.

How we use it

• To authenticate you and secure your account.
• To provide the service: building programs, the exercise library, PDF export and the public coach page.
• To deliver a student’s request to the intended coach.
• To process subscription payments.
• To improve the service, provide support and maintain security.

Sharing

We do not sell your personal data. Information and photos you submit in a request form are visible only to the coach you send them to. To run the service we rely on a few service providers with access limited to what they need: an SMS provider (SMS.ir) to send sign-in codes, a payment gateway (ZarinPal) for subscriptions, and hosting/file-storage infrastructure.

Private photos and files

Physique photos and payment receipts are kept in private storage and are not publicly accessible. A coach views them only through a short-lived, secure link. Profile avatars and exercise GIFs are public because they are meant to be shown in the app.

Retention

We keep your data while your account is active or as needed to provide the service. If you delete your account, we delete or anonymize your personal data within a reasonable period, except where the law requires us to retain some of it (e.g. financial records).

Security

Traffic is encrypted (HTTPS), passwords are stored hashed, and access to private photos is restricted and time-limited. Still, no system is perfectly secure and we cannot guarantee absolute security.

Your rights

• Access and correct the information we hold about you.
• Delete your account and personal data.
• Opt out of non-essential messages.

Children

fitlo is not designed for people under the age of majority. If you are underage, please use the service only with the permission and supervision of a legal guardian.

Changes to this policy

We may update this policy. The new version is published on this page with an updated date, and continued use of the service means you accept it.

Contact

For any privacy question or a data-deletion request, contact us at support@fitlo.ir.