Privacy Policy
Last Updated: October 20, 2026 • Official Domain: fithost.amitrana.tech
Summary of Our Commitment: Fit Host is engineered around privacy-first principles. We do not sell your personal biometrics or workout data to advertisers, health insurers, or data brokers. Data remains stored locally on your device in Guest Mode, and encrypts via Supabase Row Level Security when you choose to synchronize to the cloud.
1. Information We Collect
The data Fit Host processes depends entirely on whether you utilize Guest Mode or register an Authenticated Account:
- Account Information: When signing up, we collect your email address, display name, and authentication tokens via Supabase. If you sign in using Google OAuth, we receive your name, email address, and avatar image URL provided by Google.
- Workout & Exercise Data: Exercise names, sets, repetitions, resistance weight, RPE (rate of perceived exertion), workout duration, and personal workout notes.
- Hydration & Fluid Logs: Volumes of fluid intake (milliliters) and timestamps of fluid consumption.
- Nutrition & Macronutrient Logs: Caloric totals, protein, carbohydrates, fats (in grams), and meal classifications (Breakfast, Lunch, Dinner, Snacks).
- Activity & Step Counts: Daily step counts and estimated distances recorded via native mobile pedometer sensors.
- Guest Data: In Guest Mode, all data is written strictly to an isolated local SQLite database on your device and is never transmitted to our cloud servers without your explicit consent.
2. How We Store and Protect Your Data
We implement defense-in-depth security measures to protect your physical training and wellness records:
- Row Level Security (RLS): Our Supabase PostgreSQL database enforces strict database-level RLS policies (
auth.uid() = user_id). No user can access or view another user's workout or nutrition logs. - Local Drift Database: On mobile devices, data is stored in an embedded SQLite database using Drift ORM. This data resides solely in your device's sandboxed application storage.
- Encryption in Transit: All communications between mobile clients, the Next.js web application, and Supabase occur over TLS 1.3 / HTTPS.
3. Third-Party Service Providers
Fit Host uses a minimal set of trusted infrastructure partners:
- Supabase Inc.: Authoritative cloud database and authentication provider.
- Vercel Inc.: Hosting infrastructure and Edge Network for the Fit Host web platform.
- Google Cloud Identity: Optional third-party authentication via Google OAuth.
4. User Rights and Data Deletion
You retain absolute ownership of your personal fitness records. You have the right to:
- Access and export your full workout and nutrition history.
- Request immediate and permanent account deletion. Upon deletion, all associated records in our database cascade-delete automatically via PostgreSQL foreign key constraints.
- Clear all local mobile cache by uninstalling the app or using the in-app reset tools.
5. Contact and Inquiries
If you have questions regarding this Privacy Policy or wish to request data deletion, please submit an inquiry via our Support Center or email our security team directly.