Privacy

Who We Are

FitbyForm is a fitness accountability app at fitbyform.com. It is operated by Alex Wtorkowski, sole proprietor, operating FitbyForm (“we”, “us”, “our”), which is responsible for your data. This policy covers the website and the iOS app, which share one account and one database.

For privacy requests, deletion and anything about your data, email support@fitbyform.com. For anything else, hello@fitbyform.com.

Health data has its own page, written for the state laws that protect it: our Consumer Health Data Privacy Policy.

About the Beta

• FitbyForm is in a pre-release beta. Features will change, and some things may break.
• The beta is for adults (18 and over) in the United States.
• You can leave at any time: in the app, go to Profile, then Settings, then Delete Account.
• Requests and questions go to support@fitbyform.com.

What We Collect

Your Account

Email address, a display name, an optional username, and a password you choose. Passwords are handled by Supabase Auth and are hashed: we never see or store the plain text. If you choose to sign in with Google or Apple where that is offered, we receive your email address and name from them, and no password exists at all.

Health and Fitness Data

“Encrypted at field level” means the value in the database is ciphertext. A copy of the database, on its own, does not reveal it. Each person has their own key, which is itself encrypted with a key held outside the database.

Cycle dates are encrypted, not just the notes beside them, because when a cycle started is the medical fact. Cycle tracking is off unless you turn it on.

Social Features

FitbyForm has a small social side, and what you share there is visible to other people by design:

• Follows. Who you follow and who follows you. Follow requests need your approval.
• Posts. Progress photos, captions and reactions, shown to people who follow you and, when you post proof in a group, to that group’s members.
• Rallies. Meet-ups you host or join: the activity, title, note, time and the place name you choose. A rally set to Followers is visible to your followers and anyone you invite; a rally set to Everyone is visible to any FitbyForm member aged 18 or over. Only members 18 and over can host or see rallies open to everyone, which is why we work out from your birth year whether you are 18 or over and keep only that yes or no alongside your account.
• Cycle sharing. Only if you turn it on for a specific follower. You choose what they see: Phase Only (your current phase and cycle day, never dates) or Full Cycle (your Cycle and History screens, read only, including period dates, predictions and temperature; symptoms and mood only if you also switch those on). Your notes are never shared. You can change it or turn it off at any time.
• Reports and blocks. If you report something or block someone, we keep a record of it so we can act on it. The person you report or block is not told who did it.

Photos

Progress photos you post are stored in Cloudflare R2 and shown only to people you allow. A meal photo is sent to an AI model to recognize the food and is not stored by FitbyForm. A photo you upload to have an avatar drawn is not stored either: it is sent to the image model, the illustration comes back, and the photograph is discarded. Only the drawing is kept.

Photo Moderation

Photos you post as proof are checked automatically before they appear. An AI model (Google Gemini, reached through the Vercel AI Gateway) looks at each one for inappropriate content, such as nudity, sexual content, graphic violence or injury, hate symbols, self-harm or illegal drug use. A photo it flags is not posted, and you are asked to choose a different one. Ordinary fitness photos, like gym clothes, swimwear or a progress photo, are fine.

The photo is sent for this check without your name or email, is processed only to make the check, and is not used to train models or kept by the provider except as its API terms allow for a short time to prevent abuse. It is not used for anything else. Automatic checks can miss things, so you can also report any post, comment, rally or person in the app, and we review every report.

When you delete your account, the photos you posted are deleted from R2 along with it. The illustrations of dishes in meal plans are also stored in R2, shared by everyone who plans that dish; they are drawings of food and hold nothing about you.

Connected Services

Apple Health. Only if you connect it in the iPhone app and allow it in Apple’s permission sheet. The app reads your steps and workouts from the last 14 days on your phone and saves them to your FitbyForm account, the same as if you had logged them by hand. It only reads; it never writes to Apple Health, and nothing is sent to Apple. Data from Apple Health is never used for advertising or marketing. You can stop it from the app or in the iPhone’s Health settings.

Oura. Only if you connect it. We store the access token needed to sync, plus the activity data it returns (steps, workouts, sleep and readiness where available). Tokens are readable only by our servers, never by the app on your device. Disconnecting deletes the token, and deleting your account also revokes our access at Oura.

Location

FitbyForm asks for your location only when you tap Check In at a challenge stop, such as a landmark on the Lakefront Trail. Your phone reads its position once and works out how far you are from that stop on the phone itself. We receive and store only whether you were close enough (shown as Verified), never your position, and you can always check in without location. When venue suggestions are available and you search for a meeting place for a rally, what you type is sent to Google Places to suggest venues. If you have allowed location access for FitbyForm in your browser or phone settings, your approximate position (rounded to about 100 meters) is sent with that search so the suggestions are nearby. It is used only for that search and is not stored.

Product Analytics

To learn which features people use, the app records a short list of named events, such as “meal logged”, “challenge joined” or “rally created”. An event says that something happened, never what: “weight logged” means a weigh-in happened, not what you weigh. Events can carry only a few simple details, such as a challenge name, a day number or a streak length, and the campaign link you arrived from. We store these events in our own database.

The same events are also sent to PostHog, under a random id made for your browser, never your account id, name or email. There is no automatic capture of clicks or screens, no session recording, and no health values. PostHog is told not to build a person profile or look up where you are from your IP address.

Error Reports

When something breaks, the app sends an error report to Sentry so we can fix it: the error message and technical trace, which part of the app it happened in, and the page path. Reports are built to leave out health values, passwords, tokens and what you typed.

Service Records

For each AI request we keep a record of which feature ran, which model answered, and what it cost us, so we can keep the service affordable. The record does not include what was sent or what came back. When you delete your account, the record stops being linked to you.

What We Do Not Collect

• No advertising identifiers, no ad networks, no tracking pixels.
• No contacts, and no photo library access beyond the file you pick.
• No analytics profile built to target you.

AI Features and Your Consent

Some features use AI models run by other companies. The app explains exactly what is sent and to whom, and asks for your agreement, before the first one runs. If you say no, those features stay off and everything else keeps working. You can withdraw your agreement in the app at any time. The safety check on proof photos is not one of these optional features: it runs on every photo posted as proof, as described under Photo Moderation.

None of these requests include your name or email address. The data is used only to answer your request. Anthropic does not use data sent through its commercial API to train its models. Google, OpenAI, OpenRouter, TypeSafe and Vercel process it under their API terms.

Who Else Sees It

These companies handle data for us. Each receives only what it needs for its job and processes it on our behalf. If we add one, we update this list before it receives anything.

We do not sell your data. Not to advertisers, not to data brokers, not to insurers. Health data is never used for advertising or marketing. There is no version of this where your weight is a product.

Who Can See It Inside FitbyForm

Every table enforces row-level security, so the app can only ever read your own rows. Other people see only what you deliberately share: a post, a rally, a challenge you join, or a cycle you choose to share with a specific follower. Your weight and your food log are never shown to anyone else, and your cycle dates are shown only to a follower you have given Full Cycle.

Step progress as a percentage of your goal, to members of a challenge circle you are in, only if you turn it on. It is off until you switch on Share My Step Progress With My Circle for that challenge, it is never your step count, and turning it off, leaving the circle or blocking someone stops it at once.

Our own access is limited to what is needed to run the service and to review reports of abuse. Field-level encryption means the most sensitive values are not readable from the database console.

Law Enforcement Requests

• A warrant, or equivalent, is required. We disclose the content of your account, including health data, only in response to a valid search warrant or an equivalent court order. A subpoena or an informal request is not enough, and we push back on requests that are too broad.
• We tell you first. We notify you before disclosing anything, unless a court order or law forbids it or there is an emergency involving risk of death or serious harm. If we were barred from telling you, we tell you once the bar ends.
• Reproductive health data is never disclosed voluntarily. We do not hand over cycle dates, symptoms or phases to anyone unless legally compelled, and we challenge demands that seek it to investigate or penalize lawful reproductive health care.
• Encryption limits what exists to hand over. Cycle dates, weight and other sensitive values are encrypted with a key per person, and deleting your account destroys that key.
• We report on it. Each year we publish how many requests we received and how many we answered, even when the answer is none.

How Long We Keep It

• Your account and everything in it: for as long as you have an account.
• When you delete your account: your rows and the photos you posted (in R2) are deleted straight away, including your encryption key, which makes the encrypted data unrecoverable rather than merely hidden. Copies in our database provider’s routine backups expire on their normal schedule.
• Meal and avatar photos sent to AI: not stored by FitbyForm. The AI providers keep request data only as their API terms allow (Anthropic, for example, deletes API data within 30 days).
• Proof photos checked by moderation: the photo you post is kept in R2 like any post. The copy sent for the check is not used for training and is kept by the provider only as briefly as its API terms allow for abuse prevention.
• Analytics events and error reports: kept by PostHog and Sentry for their standard retention periods. They are not linked to your account.
• Reports: kept while they are reviewed and afterward as a record of what action was taken.

Deleting Your Account

You can delete your account yourself, in the app: Profile, then Settings, then Delete Account. You confirm it, and it is done. Your profile, logs, posts, rallies, follows, cycle data, the photos you posted and your encryption key are removed, and any Oura connection is revoked. You do not need to email us, though you can at support@fitbyform.com if you would rather.

Your Choices

• Get a copy. Ask and we will export everything we hold on you.
• Correct it. Everything you logged is editable in the app.
• Delete it. Your whole account from Settings, or individual logs, posts and photos.
• Withdraw AI consent. AI features stop until you agree again.
• Disconnect a service. Removes the token immediately.
• Block or report someone. From their profile, post or rally.

FitbyForm is offered in the United States. If you are in California, the CCPA gives you these rights, and residents of other states have similar ones. Wherever you live, email support@fitbyform.com and we will do it. We do not think you should have to cite a regulation.

Adults Only

During the beta, FitbyForm is for adults aged 18 and over, and we do not knowingly hold data about anyone younger. Tell us at support@fitbyform.com if you believe we do and we will delete it.

This Is Not Medical Advice

Calorie targets are an estimate from a standard equation. Cycle phases are arithmetic from the dates you log. None of it is contraception, fertility advice, diagnosis or treatment, and none of it should replace a clinician.

Changes

If this policy changes in a way that affects what we do with your data, we will email you before it takes effect rather than quietly changing the date at the top.

Contact

Alex Wtorkowski, sole proprietor, operating FitbyForm. Questions, requests or complaints: support@fitbyform.com. We reply within a few business days, and within 24 hours for anything about safety or abuse.