This Privacy Policy explains how personal data is processed when you use the SnapFit mobile application (the “App”), including when you create an account, record workouts, upload photographs, use social features and location services, receive notifications, and use AI-powered image analysis tools.
1. Data Controller and Contact Information
The controller of personal data is the individual operating the SnapFit project: Kacper Dudzik. Contact address: Zielone Wzgórze 81, Rzeszów. Email for privacy inquiries and exercising data protection rights: k.dudzik@snapfit.pl
If SnapFit is subsequently operated through a registered sole proprietorship or company, the controller details will be updated before responsibility for processing changes. Information about a data protection officer or a representative in the European Economic Area (EEA) will be provided if one must be appointed under applicable law.
2. Scope and Nature of Processing
This Policy applies to the App’s currently available features on iOS and Android devices. The App may be accessible worldwide. Users residing in the European Economic Area (“EEA”) have rights under, in particular, Regulation (EU) 2016/679 (the “GDPR”). Additional national laws may apply depending on the user’s location and the controller’s place of establishment.
SnapFit is a fitness and social application, not a medical device or a medical diagnostic service. Measurements, activity histories and photograph-analysis results support workout-related features and activity verification; they do not constitute a medical diagnosis.
3. Categories of Personal Data We Collect
| Category | Examples of personal data |
|---|---|
| Account and authentication | User ID, username, email address, Apple or Google sign-in identifier, OTP authentication information and technical login information. We do not store a conventional account password because authentication is passwordless. |
| Profile and preferences | Profile picture and thumbnail; selected sex, body weight (kg), preferred training days, onboarding completion, how the user discovered SnapFit, notification settings and lock-screen training settings. |
| Workouts, statistics and gamification | Exercise types, sets, repetitions, weights used, workout logs, total training sessions, training streaks, start/end times, workout status, points, verification history and outcome. |
| Published content and community | Workout photographs and thumbnails, descriptions, highlights, music identifiers, venue details, reactions, comments, friendships/following relationships and leaderboards. |
| Location | Latitude and longitude associated with a post, location accuracy, recorded time and selected place/venue information; device location if permission is granted. |
| Technical and communication data | Device details, App version, timestamps, push token, marketing preferences and consent records, referral code, contact history and information needed for service security. |
| AI content analysis | Uploaded photos, necessary workout context, automated evaluation results, reason for the decision and verification status. Data transmitted depends on the particular feature. |
Not all data is required to register. Some information is provided voluntarily when particular features are used. Do not post another person’s personal information, addresses, health information or other particularly sensitive information in public content unless there is a lawful and necessary reason to do so.
4. Purposes and Legal Bases for Processing
Each processing activity must have an appropriate legal basis. The table below describes the App’s main purposes. The additional rules in Section 5 apply where special categories of personal data are processed.
| Purpose and examples | Legal basis under Article 6 GDPR |
|---|---|
| Account creation, OTP, Apple/Google sign-in, sessions, profile and core account features | Article 6(1)(b): performance of the contract to provide the App |
| Workout logs, points, statistics, leaderboards, friendships, and publication of posts and comments requested by the user | Article 6(1)(b): performance of a contract; certain moderation activities may also rely on Article 6(1)(f) |
| Photo analysis and workout verification necessary to provide a selected feature | Article 6(1)(b): performance of a contract; where health data is processed, an applicable Article 9 GDPR condition is also required |
| Device location and workout-venue assignment when the user chooses this feature | Article 6(1)(a): consent to optional location processing, or Article 6(1)(b) where necessary for the specifically requested feature; device permission to access location is separate |
| Technical messages, OTP, security notices and material service changes | Article 6(1)(b): performance of a contract; Article 6(1)(c): legal obligation; or Article 6(1)(f): legitimate interests, depending on the purpose |
| Newsletters, offers, promotional push notifications and marketing email | Article 6(1)(a): voluntary consent, together with any locally required electronic marketing consent |
| Preventing abuse, fraudulent points, spam and Terms of Service violations; pursuing or defending claims | Article 6(1)(f): legitimate interests in securing the service and the parties’ rights |
| Responding to data rights requests, regulatory inquiries and legal obligations | Article 6(1)(c): legal obligation; Article 6(1)(f) in justified cases |
Where processing relies on legitimate interests, you may object. The controller must balance its interests against users’ rights and freedoms, with particular regard to minors. Consent given for one purpose does not automatically cover another. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
5. Health-Related and Other Sensitive Data
Body weight, detailed exercise records, workout intensity, activity history and physique photographs may, in context, reveal information about an individual’s health. To the extent that particular processing constitutes processing of health data or another special category of personal data, the controller must satisfy both Article 6 GDPR and an applicable condition under Article 9(2) GDPR, including obtaining explicit consent where no other valid condition applies.
Data provided for a personal workout log should be limited to what is necessary. Optional functions that require explicit consent may be unavailable if consent is refused or withdrawn. We do not treat mere acceptance of this general Privacy Policy as implied consent for processing special-category data.
6. Photographs, Posts and Social Features
Users may upload workout photographs and descriptions, react to posts, comment, follow other users, form connections and take part in leaderboards. Visibility of usernames, profile photographs, post content, workout results and interactions depends on the relevant feature and its privacy settings. Other users may retain information made available to them, for example through screenshots; we cannot technically retract every such copy.
When publishing material, you must respect the privacy of people appearing in photographs and obtain any required permissions or other lawful basis for publication. The controller may moderate content that infringes third-party rights in accordance with applicable law and the Terms of Service.
Sensitive details included in descriptions or visible in photographs may become accessible to the intended audience of a post. Before posting, users should check its visibility and any attached location information.
7. Location and Workout Venue Information
Once the user grants the relevant device permission, the App may access device location to the extent required to associate a workout with a location, find a venue or create a post. We may record GPS coordinates, accuracy in metres, the time of location capture and the selected venue name. Coordinates may be processed by Mapbox to resolve a venue name or geographic information.
Location permission can be disabled in device settings. This may prevent automatic venue assignment but should not be required for features that do not need location information. Users should be able to determine whether location will be associated with a public post. We exercise particular caution with children’s location data because it may reveal where they live, train or spend time.
8. Artificial Intelligence and Automated Workout Verification
SnapFit uses the OpenAI API to analyse photographs uploaded with workout posts, including to identify the context of an activity and verify whether content satisfies the rules for awarding points. The analysis may result in the recording of a verification outcome, explanation, publication status or awarded points. AI results may be inaccurate and are not medical advice or a professional assessment of exercise technique.
We send the external provider only information necessary for the requested analysis and should minimise that information. Under OpenAI’s published API data policies, API inputs are not used to train models by default unless the customer affirmatively enables data sharing. Safety logs and application state may nevertheless be retained for periods that depend on the endpoint and configuration. The exact endpoint and retention settings must be checked.
If an automated result rejects a workout or denies points, a user may contact the controller using the details in Section 1 to request an explanation and review. If SnapFit later introduces solely automated decisions producing legal or similarly significant effects, the controller will assess Article 22 GDPR and implement any required safeguards, including human intervention where applicable.
9. Authentication, Device Information and Notifications
Users may sign in using a one-time email code (OTP), a Google account or an Apple account. Where a third-party sign-in method is selected, the controller receives necessary identifiers and authentication data within the scope of the provider’s service. SnapFit does not receive the password to the user’s Google or Apple account. One-time codes and login metadata are processed to the extent necessary to protect accounts.
To deliver mobile notifications, we may process Expo push tokens and the information required to deliver messages through Apple Push Notification service or Firebase Cloud Messaging. Workout reminders, streak alerts, social interactions and security communications are distinguished from promotional messages. Device notification permissions can be changed in phone settings; marketing preferences can be changed in the available SnapFit settings or by contacting the controller.
Device information and App version may be used for proper operation, compatibility and service security. SnapFit does not currently use a separately implemented analytics platform to profile user behaviour or an advertising SDK for personalised targeting. Technical service providers may process their own operational data under the terms and privacy rules governing their services.
10. Marketing and Communications
SnapFit may send workout reminders, information about friends’ activity, training-streak notifications and account-related messages. Promotional news and offers are sent only where the required consent has been obtained. Marketing consent must be voluntary, specific and separate from acceptance of the Terms of Service and from the operating system’s permission to receive push notifications.
Marketing consent can be withdrawn at any time without affecting access to core features. Withdrawal does not prevent necessary account-security or service-related communications. We may retain the minimum information necessary to record a withdrawal and prevent further unauthorised marketing contact.
11. Data Recipients and Service Providers
Where necessary to provide the service, we may share data with providers processing it on our instructions or, where appropriate, with independent controllers. Recipients do not automatically receive every category of personal data.
| Provider | Role and possible data | Location / transfer notes |
|---|---|---|
| Render | Backend hosting and database: accounts, workout logs, posts and metadata. Selected server/database region: Frankfurt. | Core hosting in the EEA; Render also describes operations or access from the United States. |
| Google Cloud Storage | Storage of photographs, thumbnails and related file objects and metadata. | The bucket region has not been confirmed; check the actual configuration. |
| OpenAI API | Analysis of uploaded photographs and necessary context; activity-evaluation outputs. | Processing outside the EEA may occur depending on API settings and the agreement. |
| Mapbox | Geocoding, identifying and displaying venues; coordinates and request information. | Mapbox describes processing including in the United States. |
| Resend | OTP and transactional emails and, where consent is obtained, marketing messages. | Resend describes customer-data storage in the United States. |
| Expo and Apple/Google push services | Push tokens and message content needed to deliver notifications. | Processing depends on the providers’ and subprocessors’ infrastructure. |
| Apple / Google sign-in | Identity verification and sign-in service identifiers. | They may also act as independent controllers. |
| Other SnapFit users | Posts, profiles, reactions, leaderboards and content disclosed according to feature visibility. | Scope depends on the content shared within the App. |
Data may also be disclosed to authorised advisers, public authorities, courts or law-enforcement bodies where a lawful basis exists. We do not sell personal data to data brokers. Future payment, advertising, marketplace and affiliate integrations are not presented as active services in this version and will require an update to this Policy before launch.
12. Transfers of Data Outside the EEA
Although the designated Render services are hosted in Frankfurt, some providers and their subprocessors may process or access data outside the EEA, particularly in the United States. Depending on the service, this may include Render, Resend, Mapbox, OpenAI, Google, Apple and Expo.
Where the GDPR applies to a transfer outside the EEA, we rely on an appropriate mechanism under Chapter V GDPR, depending on the recipient and transfer: a European Commission adequacy decision, valid certification under the EU–US Data Privacy Framework, or standard contractual clauses together with any necessary supplementary measures. Information about the transfer safeguards and how to obtain a copy may be requested using the contact details in Section 1.
Selecting a European hosting region does not necessarily prevent international administrative access or subsequent data transfers. The controller reviews relevant data processing agreements, subprocessor lists and service configuration against the providers’ actual processing arrangements.
13. Data Retention
We retain personal data only for as long as necessary for the relevant purpose, and for any additional period justified by a legal obligation, investigation of an incident, or the establishment, exercise or defence of legal claims. Different categories of data may have different deletion periods.
| Data category | Retention period or criteria |
|---|---|
| Account, profile, workouts, posts, reactions and location linked to posts | Generally while the account exists or until the relevant post is deleted earlier; following account deletion, until operational deletion is completed, subject to legal exceptions. |
| Photographs and thumbnails in file storage | Until the post/account is deleted or another lawful purpose applies; deletion must also cover file objects and technical copies under the controller’s control. |
| OTP codes and authentication data | For the code’s validity period and a limited further period justified by security and technical auditing. |
| Marketing consent and withdrawal records | Until consent is withdrawn; minimal proof of consent/withdrawal may be retained for the period needed to demonstrate compliance and defend claims. |
| Data rights requests, incidents and disputes | Until the matter is closed and any relevant, proportionate legal or claims-related period expires. |
| Backups and provider logs | According to verified retention and overwrite cycles; copies may remain for a limited period after deletion from the active database. |
| Content submitted to API providers | According to the service and documented retention terms; for example, some standard OpenAI API abuse-monitoring logs may be retained for up to 30 days, depending on configuration and exceptions. |
14. Account and Data Deletion
Users can initiate account deletion directly in the App. Under the current operating model, deleting an account removes account data and related information in SnapFit’s active systems, including the profile, posts and photographs, workout history, reactions and comments, social connections and account-linked location records, to the extent controlled by the controller.
Deletion may take time to complete across the database, file storage and provider systems. It does not necessarily mean that backups are overwritten immediately or that information retained under a legal obligation is erased. Some information shared with others or independently copied by them (for example, screenshots) may remain outside the controller’s control.
You may also request deletion using the contact address in Section 1. To meet Google Play requirements, account deletion should also be available through a separate public web page: www.snapfit.pl/delete_account. Signing out, suspending or deactivating an account is not equivalent to account deletion.
15. Rights of Data Subjects
Subject to the conditions and limits set out in the GDPR, individuals may request access to their personal data and a copy of it, rectification, erasure, restriction of processing and data portability as provided by law; object to processing based on legitimate interests; withdraw consent; and, where applicable, exercise protections concerning solely automated decision-making.
Requests may be submitted to the email address in Section 1. We respond without undue delay and generally within one month of receipt. Where permitted by law, that period may be extended after informing the requester. We may request appropriate identity verification to prevent disclosure to an unauthorised person.
Users may lodge a complaint with a competent data protection supervisory authority. In Poland this is the President of the Personal Data Protection Office (uodo.gov.pl); in Spain it is the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es). Jurisdiction may depend on the individual’s habitual residence, workplace or the place of the alleged infringement.
16. Minors and Age Restrictions
The App is designed for users aged at least 13, but minors’ eligibility to use particular functions or consent to processing depends on applicable law. For consent-based processing involving information society services, parental authorisation is generally required below the age of 16 in Poland; the relevant age threshold in Spain is 14. Other countries may impose different thresholds and requirements.
Where consent is necessary and a user is below the age at which they can validly give it, appropriate consent or authorisation from a parent or guardian must be obtained and verified as required by law. A minor simply ticking an acceptance box does not replace legally required verification. The controller should not make consent-dependent features available until a suitable mechanism is in place.
Minors’ data and settings require additional safeguards, including restrictions on default visibility of profiles and precise location. A future physical-rewards redemption programme, if implemented, will be limited to people who satisfy its separate eligibility rules, generally adults aged 18 or over. Merely confirming an age in terms and conditions does not reliably verify adulthood. The App does not currently collect delivery addresses for such a programme.
17. Device Permissions and Local Technologies
The App may request access to the camera, photo library (if the user selects a photo from the device), location and notifications. Granting device permission enables technical access but does not replace a separate lawful basis for processing when one is required. Permissions can be revoked in device settings, which may limit particular functions.
The App may store session identifiers and technical settings on the device as necessary for functionality, security and user preferences. No additional advertising-tracking technology is described as active in the confirmed current configuration because SnapFit has not implemented one; any future introduction would require a separate compliance assessment and updated disclosures.
18. Data Security and Personal Data Breaches
The controller uses technical and organisational measures proportionate to the risks, including access controls, authentication, data permissions, secure transmission, minimisation of materials sent to providers, provider reviews, deletion processes and backups. No information system can guarantee absolute security against every incident.
If a personal data breach occurs, its nature, impact and risks to individuals are assessed; the controller notifies the supervisory authority and affected people where required by law. If you suspect account compromise, disclosure of data or another security incident, contact us using the details in Section 1.
19. Future Subscriptions, Advertising, Shop and Rewards
This version of the Policy does not describe paid subscriptions, personalised advertising, an owned-product shop or shipments of physical rewards as currently active. Before SnapFit launches Apple/Google payments, an online shop, affiliate programmes, logistics providers or the collection of shipping addresses, it will update information concerning data categories, recipients, retention periods, legal bases and any new transfers outside the EEA.
Points and activity metrics currently available in the App are recorded to provide gamification features. This Policy does not create an entitlement to any particular reward and does not constitute terms and conditions of a loyalty or rewards programme.
20. Changes to This Policy and Contact
This Policy may be updated following changes in features, providers, legislation or processing practices. The current version will be made available in the App. We will communicate material changes appropriately before new types of processing begin, where required. If a change requires renewed consent, we will obtain it separately rather than relying solely on publication of an updated Policy.
For questions about privacy, your account or data protection rights, contact the controller using the details in Section 1.