Data Controller
The Data Controller for personal data collected through the TrackFit app is Harem Dev (Andrea), reachable at info@harem-dev.com.
Data We Collect
TrackFit collects the following categories of personal data.
Account data — email address, display name, and authentication provider (Google, Apple on iOS, or email/password).
Profile data (provided during onboarding) — weight (kg), height (cm), training goal (strength, hypertrophy, weight loss, or maintenance).
Workout data — created workout plans (name, days, planned exercises, target sets/reps, rest times) and logged workout sessions (start/end date and time, sets actually performed with weight and reps for each exercise).
Technical data, collected automatically — crash reports and performance diagnostics (always active, to ensure app stability and quality); anonymized usage data, collected only with explicit consent given through the banner shown on first launch and revocable at any time; a device integrity identifier (App Check), used only to verify that requests come from the genuine app, without collecting personal data.
Advertising data — TrackFit shows ads served by Google AdMob. To select and measure them, AdMob processes a device advertising identifier, the IP address, the device and operating system type, and ad interactions (impressions, clicks). If you are in the European Economic Area or the United Kingdom, personalised ads are shown only if you consent through the consent form presented on first launch; if you decline, you will see non-personalised ads, selected without profiling. You can change your choice at any time from Profile → Privacy → Ad privacy options.
Subscription data — if you buy TrackFit PRO, the purchase is made through Google Play (Android) or the App Store (iOS), which handle the payment: TrackFit does not receive or store your card or payment method details. To verify the subscription and restore it on other devices, TrackFit uses RevenueCat, which receives your TrackFit account identifier (not your email) together with the purchase data: product purchased, subscription status, purchase, renewal and expiry dates, and transaction identifier. RevenueCat also automatically collects some technical data about the app and device (for example IP address, operating system and app version).
TrackFit does not collect location, contacts, photos, or other device permissions not necessary for its operation.
Purposes and Legal Basis
| Data category | Purpose | Legal basis |
|---|---|---|
| Account data | Account creation and management, authentication | Contract performance (Art. 6.1.b GDPR) |
| Profile and workout data | Core app functionality (plans, sessions, statistics, progress) | Contract performance (Art. 6.1.b GDPR) |
| Crash and performance | Identify and fix errors, ensure app stability | Legitimate interest (Art. 6.1.f GDPR) |
| Usage data (analytics) | Understand how the app is used to improve it | Explicit consent (Art. 6.1.a GDPR), revocable at any time |
| Device integrity (App Check) | Prevent abuse and unauthorized backend access | Legitimate interest (Art. 6.1.f GDPR) |
| Advertising data (AdMob) — personalised ads | Show relevant ads and measure their performance | Explicit consent (Art. 6.1.a GDPR), collected through the UMP form and revocable at any time |
| Advertising data (AdMob) — non-personalised ads | Fund the development and free distribution of the app | Legitimate interest (Art. 6.1.f GDPR) |
| Subscription data (TrackFit PRO) | Verify the subscription, enable PRO features (no ads, no plan limit) and restore it on other devices | Performance of a contract (Art. 6.1.b GDPR) |
Scroll the table to read all columns
Third-Party Services
TrackFit relies on Google Firebase (Google Ireland Limited) services for its backend infrastructure:
- Firebase Authentication — handles sign-in (Google Sign-In, Sign in with Apple on iOS, or email/password)
- Cloud Firestore — stores profile and workout data, in a European database (eur3 region)
- Firebase Crashlytics and Performance Monitoring — collect crash reports and app performance metrics; crash reports carry your Firebase user ID (an opaque identifier, not your name or email) and a short trail of recent in-app actions, so a problem can be traced
- Firebase Analytics — collects usage data (screens visited, main actions such as signing in, creating a plan or completing a workout, exercises and plans viewed, terms searched in the exercise library) linked to your Firebase user ID, an opaque identifier (not your name or email), together with a few characteristics of how you use the app (goal, training days per week, language, sign-in method, whether PRO is active); only with the user's explicit consent
- Firebase App Check — verifies app integrity via Play Integrity (Android) and App Attest (iOS), without collecting personal data
These services are provided by Google, which acts as a data processor on behalf of Harem Dev (Andrea), under its own terms and privacy policy (policies.google.com/privacy). Some technical data may be processed by Google outside the European Economic Area; in that case Google relies on Standard Contractual Clauses approved by the European Commission to ensure an adequate level of protection.
For the TrackFit PRO subscription, payments are handled by Google Play (Google Ireland Limited) on Android and by the App Store (Apple Distribution International Ltd.) on iOS, under their respective terms and privacy policies. Purchase verification and subscription status management are entrusted to RevenueCat, Inc. (United States), which acts as a data processor on behalf of Harem Dev (Andrea) (revenuecat.com/privacy). As RevenueCat is based outside the European Economic Area, data is transferred with the safeguards required by the GDPR (for example the Standard Contractual Clauses approved by the European Commission).
For monetisation, TrackFit also uses Google AdMob (Google Ireland Limited), which serves interstitial, rewarded and banner ads inside the app. Consent from European users is collected through Google's User Messaging Platform (UMP), compliant with IAB Europe's Transparency & Consent Framework. For advertising data Google acts as an independent controller: its partner terms apply (policies.google.com/technologies/partner-sites).
TrackFit does not sell your data and does not share profile or workout data with advertisers or any other third party for marketing purposes.
Health Connect (optional)
On Android you can link TrackFit to Health Connect (Google) from the Profile; it is off until you turn it on and you can turn it off at any time (and revoke the permissions in Health Connect's settings). If you link it, TrackFit writes the workouts you finish to Health Connect (date, duration and the name of the day) and reads weight, steps and heart rate. The data read is only used to show you the weight to import into your profile, today's steps and the heart rate of your workout: it is shown on the device and is not stored on Harem Dev (Andrea)’s servers or shared with third parties; only the weight, if you choose to import it, enters your profile like any weight you type in.
Data Retention and Account Deletion
Data is retained for the entire duration of the account, until the user requests its deletion.
Subscription data is kept for as long as the account exists. When you request deletion of your account, Harem Dev (Andrea) will also ask RevenueCat to remove your identifier; transaction data that Google Play or Apple must retain to comply with legal obligations (for example tax) stays with the Store. Deleting your account does not cancel an active subscription: it must be cancelled separately on the Store it was purchased from (Google Play or the App Store).
You can delete your account directly in the app (Profile → Account → Delete account): the account and the associated data (profile, plans, workouts, preferences) are deleted immediately and permanently. The steps are also at https://trackfit-a3b40.web.app/delete-account/en/. If you can't access the app, email info@harem-dev.com: the request will be processed within 30 days.
Crash reports and performance metrics, when collected, are retained by Google under its own retention policies (typically 90 days).
Your Rights
As a data subject, you have the right to (Art. 15-22 GDPR):
- Access — obtain confirmation that your data exists and a copy of it
- Rectification — correct inaccurate data (weight, height, and goal can be edited directly in the app)
- Erasure ("right to be forgotten") — request the deletion of your data
- Restriction — request the restriction of processing in certain cases
- Portability — receive your data in a structured, machine-readable format
- Objection — object to processing based on legitimate interest
- Withdraw consent — for usage data (analytics), from your Profile, and for personalised ads, from Profile → Privacy → Ad privacy options: both revocable at any time without affecting the lawfulness of processing already carried out
To exercise any of these rights, email info@harem-dev.com. You also have the right to lodge a complaint with your national data protection authority (in Italy, the Garante per la Protezione dei Dati Personali, garanteprivacy.it).
Data Security
Your data is protected by:
- Firestore security rules — each user can only access their own data; accepted fields, types, and plausible ranges (e.g. weight 0–500 kg) are validated server-side too
- Firebase Authentication — secure credential management, never stored in plain text
- Firebase App Check — verifies that backend requests only come from the genuine TrackFit app
Despite these measures, no system is 100% invulnerable: in the event of a data breach that poses a risk to your rights, you will be notified as required by Art. 33-34 GDPR.
Children
TrackFit is not directed at children under 16 and does not knowingly collect data from children under that age. If you are a parent or guardian and believe your child has provided Harem Dev (Andrea) with personal data, please contact Harem Dev (Andrea) at info@harem-dev.com to request its removal.
Changes to This Policy
This policy may be updated periodically, for example when new features process personal data (e.g. new integrations or third-party services). Material changes will be communicated through the app or via email. The date of the last update is shown at the top of this document.
Contact
For any question about this policy or about the processing of your personal data, contact Harem Dev (Andrea): info@harem-dev.com