Privacy policy

This policy explains how the SimuFit strength-training app (app.simufit.app) and this website (simufit.app) handle your personal data. We keep it simple: we collect only what the service needs, and we never sell your data.

Who is responsible

The controller is Simulingo (simulingo.eu). Send privacy questions and requests to [email protected].

The simufit.app website

The website uses no tracking or advertising cookies and no analytics tools. It stores only your chosen language and theme (light or dark) in your browser's localStorage so the site remembers them next time. This information stays on your device.

The website and the app are delivered through Cloudflare's network. As with any online service, this infrastructure processes technically necessary data such as your IP address and browser details to deliver the pages and protect them from attacks. We do not use this data to identify you.

What the app processes

Guest mode

You can use the app without an account. Your programs, workouts and settings are then stored only in the browser on this device and are not sent to our servers. The one exception is an AI-generated program: if you ask for one, the necessary profile data is processed as described below.

With an account

• Account data: email address, a password hash (we never store the password itself), language and unit settings, and which version of the terms you accepted.
• Profile: date of birth, sex, height, weight, optional waist size, goals, experience, training days, equipment and exercise preferences.
• Health-related data: injuries and limitations, health-screening answers, pregnancy or postpartum status, and body measurements. These are special category data under the EU General Data Protection Regulation (GDPR), and we process them only with your explicit consent.
• Workout logs: programs, completed workouts, sets, weights, reps, notes and progress.
• Nutrition: dietary preferences and the guideline targets calculated from them, if you use the nutrition section.
• Technical data: sign-in sessions and server logs for security and troubleshooting. The app uses a strictly necessary sign-in cookie and stores data in your browser so it also works offline.

Why we process data and on what legal basis

• Providing the service (account, sync, programs, workout log and reports): our contract with you (GDPR Article 6(1)(b)).
• Health-related data to build a safe program: your explicit consent (Article 9(2)(a)). If you withdraw it, we can no longer adapt your program to your health information.
• AI processing: your separate consent, which you can withdraw at any time in Profile.
• Security and abuse prevention, such as limiting sign-in attempts and keeping logs: our legitimate interest in keeping the service safe.
• Legal obligations, such as bookkeeping, where they apply.

The app may collect privacy-friendly usage statistics that record event names only, never health values, with IP addresses anonymised. We show no ads, and we do not sell or share your data for marketing.

How we use AI

If you consent, the app sends a minimal training profile to our AI provider (OpenAI or Anthropic, depending on the current configuration): your age, body measurements, goal, equipment, limitations and health-screening result. Your name and email are never sent. The data is used only to create your program or meal ideas, and the result is checked against safety rules before you see it. Monthly insights use summarised numbers, never your individual log entries.

The AI provider processes this data under its data processing terms. Under those terms, data sent through the API is not used to train the provider's models. These providers are based in the United States, so transfers rely on GDPR safeguards such as the European Commission's standard contractual clauses.

You can use template programs and your own custom programs entirely without AI.

Service providers and transfers

We use carefully chosen service providers as data processors: Cloudflare to deliver the website and app, a cloud provider for servers and the database, and the AI provider described above. They may process data only on our behalf and under contract. If data is transferred outside the EU/EEA, the transfer relies on safeguards required by the GDPR.

Exercise videos are embedded from YouTube in privacy-enhanced mode (youtube-nocookie.com). When you play a video, YouTube may process your data under its own policies.

How long we keep data

• Account data is kept for as long as your account exists.
• Inputs and outputs of AI requests are kept for up to 180 days for quality assurance and abuse investigation. After that, only aggregated statistics are kept.
• Technical logs are kept only as long as security and troubleshooting require.
• When you delete your account, it is deactivated immediately and all your personal data is permanently deleted within 30 days. Copies in backups are removed when those backups reach the end of their normal retention.

Your rights

You have the right to:

• access your data and get a copy. You can export everything, including your full workout log, as a JSON file from Profile → Account;
• correct inaccurate data. You can edit most of it yourself in the app;
• delete your account and data from Profile → Account;
• withdraw consent at any time. This does not affect the lawfulness of processing before the withdrawal;
• ask us to restrict processing, object to processing, and move your data to another service;
• lodge a complaint with a supervisory authority. In Finland this is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto, tietosuoja.fi).

Send requests to [email protected]. We reply within one month.

Security

Passwords are hashed with Argon2id, connections are encrypted, health-related data is also encrypted at rest, and sign-in tokens are short-lived and rotated. Administrative actions are logged.

Age limit

SimuFit is for people aged 16 and over. Users aged 16 or 17 need the consent of a parent or guardian. We do not knowingly process data of anyone under 16.

Changes

We update this policy when needed and will tell you about material changes in the app in advance. The date of the latest update is shown on this page.