Privacy Policy

Privacy Policy FitnessRec

We, PARSREC YAZILIM LIMITED SIRKETI, B BLOK, NO:4/4 ESREF DINCER MAHALLESI OZLEM SOKAK Gemlik, 16000 Bursa, Turkey, are committed to protecting the privacy of users of the FitnessRec website, the FitnessRec applications for phones, watches, desktop and the web, and related services (together the “FitnessRec Services” or the “Services”).

For the purposes of this Privacy Policy, PARSREC YAZILIM LIMITED SIRKETI is the “data controller” for all FitnessRec Services.

This Privacy Policy describes what data we collect, why, how long we keep it, who else processes it on our behalf, and what your rights are. It is part of our Terms of Use and applies to all FitnessRec Services. It does not apply to third-party websites, services or applications, even where they can be reached from the Services.

By using any of the FitnessRec Services you confirm that you have read and understood this Privacy Policy and that you meet the age requirements in section 15. If you do not accept this Privacy Policy, please do not use our Services.

Last revised: September 2026

1. What data we collect

1.1 Personal and non-personal data

The term “personal data” is defined by the European General Data Protection Regulation (GDPR). You can think of your personal data as any data that allows you to be identified or that can be correlated to you. Most of what FitnessRec holds about you is health data, which the GDPR treats as a special category that may only be processed with your explicit consent.

“Non-personal” data cannot be correlated to any specific person. By removing identifiable parts and anonymising personal data, personal data may be converted into non-personal data.

1.2 Data you give us

Account: your e-mail address and password (stored only as a salted hash), or the identity we receive from a sign-in provider (section 8.1); your username and display name, profile photo, preferred language and app settings.
Profile: date of birth, sex, height, weight, activity level, fitness goals and, if you choose to enter them, health conditions and other context you want the app to take into account.
What you log: workouts, programs and sets; foods, meals and water; supplements, medications and other compounds with their doses and schedules; body measurements and progress photos or videos; sleep; notes; and, only if you opt in to those features, menstrual-cycle, fertility and IVF entries.
Documents you upload: lab reports and blood-work results (PDF or photos), DEXA and other body-composition reports, and raw genetic-test files. These are health and genetic data and are processed only with the explicit consent you give when you upload them.
What you write and share: posts, comments and reactions in the feed, direct messages, group chats, posts on the feedback board, and anything you choose to share with a trainer or another user.
AI assistant: the messages you type, the images you attach, and your voice while a voice session is active, together with the assistant’s answers and, if you turn Memory on, the short notes the assistant keeps about you.
Payments: your subscription status and purchase history. The store or payment provider handles card details; we never see them.
Consents you give us, and messages you send to support.

1.3 Data from your devices and connected services

Only if you connect them (section 2.4), we receive health and fitness data from Apple Health, Google Health Connect and Samsung Health, and from device or service accounts such as Garmin, Polar, Fitbit, Withings, Oura, Suunto, Dexcom, FreeStyle Libre and Keto-Mojo. Depending on the source this can include:

Personal characteristics: biological sex, date of birth.

Body measurements: weight, height, body-mass index, body-fat percentage, lean mass, circumferences, bio-impedance readings and body-composition reports.

Activity: step count, flights climbed, distance, active time, workout sessions (type, duration, intensity, heart-rate zones), workout routes with GPS coordinates, and power, cadence and pace where your device records them.

Energy: active, resting and total calories burned; dietary calories consumed.

Sleep: duration, stages, efficiency and other sleep analysis your device provides, including naps.

Cardiovascular: heart rate, resting heart rate, heart-rate variability, blood-oxygen saturation, cardio-fitness (VO₂max) estimates, blood pressure, and electrocardiogram (ECG) recordings including the waveform, the rhythm classification produced by the recording device and the average heart rate during the recording.

Other health metrics: blood glucose (including continuous-glucose readings), blood ketones, respiratory rate, skin and body temperature, UV exposure, mindfulness minutes, and, where your device supports it, raw optical pulse and other sensor recordings used by the sensor-fusion features.

Nutrition: the macronutrients, micronutrients and water intake recorded by your other apps.

Reproductive health (only if you enable those features): cycle, basal body temperature and related entries.

The data types available depend on what your platform or device supports and on the permissions you grant; you control each type separately.

1.4 Location

With your permission we use your location (i) to record the route of outdoor workouts and (ii) to show local weather on the diary. Location is used only while you use those features and is never collected in the background.

1.5 Data we derive

From the data above the app computes scores and estimates for you: biological-age, strain, recovery, sleep and stress scores, cardio load, insulin-resistance indices, a rhythm screen for ECG recordings that carry no classification from the device, blood-pressure trends from pulse arrival time, expected compound levels from your logged doses, interaction and pharmacogenomic advisories, and structured summaries of the reports you upload. These are estimates for your information and self-tracking, not diagnoses (see the Terms of Use).

1.6 Technical data

When you use the Services we receive your IP address, device type and operating system, app version, language and time zone, a push-notification token for each device you sign in on, and server logs of the requests your app makes (time, endpoint, status). We do not run third-party analytics or tracking software in the apps.

2. How is data collected?

2.1 Registration

To use the Services you need an account. You can register with an e-mail address and password, or sign in with Apple, Google or Facebook (section 8.1). Before completing registration you confirm that you have read this Privacy Policy and accept the Terms of Use.

2.2 Using the app

Everything you log, upload, write or connect is collected because you chose to do so, and you can edit or delete it in the app at any time. Features that involve health or genetic data, cloud AI, sharing with a trainer or connecting an external assistant ask for your explicit consent before they are used for the first time.

2.3 Device permissions

Some features need access to your device. Your operating system asks you the first time a feature needs it, and you can revoke access in your device settings at any time.

Camera: barcode scanning, food and lab-report photos, progress photos and videos, and video calls.
Photo library: choosing existing photos or documents to upload, and saving exports.
Microphone: voice input for the AI assistant, voice and video calls, and recording progress videos.
Location: workout routes and local weather, only while you use those features.
Bluetooth: routing call audio to your headphones.
Notifications: the reminders, messages and updates you have turned on.
Health data (Apple Health, Google Health Connect, Samsung Health): section 2.4.
Advertising consent (where the law requires it): personalised ads on the free plan, section 8.4.

Barcode recognition and photo processing happen on your device; only the result — the barcode, or the photo you chose to upload — leaves it.

2.4 Health data synchronisation

Health synchronisation is optional and requires your explicit authorisation, granted per data type in the platform’s own permission screen. We read only the types you authorise, and we write back the workouts and nutrition you log in FitnessRec so that your other apps can see them. When you disconnect a source we stop reading from it; data already synchronised stays in your account until you delete it.

For all health and fitness data received from Apple Health, Google Health Connect, Samsung Health and connected devices we commit that:

it is used only to provide the features you use — your diary, analytics, scores and reports, and the trainer sharing you have authorised — and never for advertising, marketing or any use-based data mining;
it is never sold;
it is not transferred to third parties except to the processors named in section 8, acting on our instructions, as required by law, or as part of a merger or sale of assets of which you have been informed and for which applicable consent requirements have been met;
Apple Health data is not stored by us in iCloud and is not disclosed to any third party without your consent;
humans do not read it unless you have authorised it (for example a trainer), it is needed to investigate abuse or a security incident, the law requires it, or it has been aggregated and anonymised.

Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3. Legal bases

We process your data on the following legal bases:

performance of the contract with you (Art. 6(1)(b) GDPR) — providing the Services you signed up for;
your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR) — for all health, genetic and other special-category data, for connecting health platforms and devices, for cloud AI processing, for sharing data with a trainer or an external assistant, and for personalised advertising. You can withdraw any consent at any time in the app, with effect for the future;
our legitimate interests (Art. 6(1)(f) GDPR) — keeping the Services secure, preventing abuse, moderating reported content, and improving the Services using aggregated statistics;
legal obligations (Art. 6(1)(c) GDPR) — for example keeping payment records.

We may also process data where necessary to protect the vital interests of a user or of another person.

4. Purposes

We collect, process and use data for the following purposes:

to provide, operate and maintain the Services and keep your data in sync across your devices;
to compute your scores, estimates, advisories and reports (section 1.5);
to answer you through the AI assistant when you use it;
to deliver the social features, messages and calls between users, and the trainer coaching you have authorised;
to process subscriptions and purchases;
to send the notifications you have turned on;
to show advertising on the free plan;
to respond to your support requests and feedback;
to detect and prevent abuse, fraud and security incidents, to act on content that is reported to us, and to enforce our Terms;
to comply with our legal obligations;
for any other purpose you have consented to in a particular case.

We do not make automated decisions about you with legal or similarly significant effects, and we do not build advertising profiles from health data. If we ever want to use your data for a new purpose, we will tell you first and, where the law requires it, ask for your consent.

5. How long and where data is stored

Account and profile data: for as long as your account exists; deleted within 30 days of account deletion.
Health, fitness, nutrition and body data, uploaded documents and genetic files: for as long as your account exists or until you delete the individual item in the app; permanently deleted within 30 days of account deletion.
Scores and estimates: computed from your data and deleted with it.
AI conversations and Memory: until you delete the conversation or the memory entry, or your account. Voice audio is processed live and is not stored; the transcript is kept in the conversation.
Messages and posts: until you delete them or your account. Content that has been reported may be kept for up to 90 days after the report is closed, to handle appeals and repeated abuse.
Payment and subscription records: 7 years after the transaction, as required by tax and accounting law.
Support communications: 2 years after the last interaction.
Server logs: 90 days.
Aggregated, anonymised statistics: may be kept indefinitely.

You can delete your account yourself in the app under Settings → Account → Delete account. This deletes your account and its data from our servers; the 30-day windows above cover backups and the records we must keep by law. You can export your data beforehand under Settings → Privacy → Export data.

Where: your data is stored on our servers in the European Union (Germany). Some of the processors named in section 8 operate in the United States; section 7 describes the safeguards for those transfers.

Private Mode: the app can be switched to Private Mode, in which your health data is moved into encrypted storage on your own device and removed from our servers. In Private Mode we hold only your account and subscription. Features that need our servers, such as cloud AI, are then offered as an explicit choice that tells you what leaves the device before you use them. A passphrase-protected export that you make yourself is the only backup in Private Mode: if the device is lost or the app is uninstalled, that data is gone and we cannot recover it.

6. Cookies and local storage

Our website uses cookies and similar browser storage to sign you in, remember your preferences and keep the site secure. The apps store your settings and a sign-in token on your device for the same reasons. You can delete or block cookies in your browser settings; some functions may then not work. We do not use cookies or pixels for cross-site tracking or advertising.

7. International transfers

Your personal data is transferred to third parties only where we are legally obliged to, where the transfer is necessary to provide the Services, or where you have consented to it. Service providers receive only the data needed for their task, under contracts that bind them to data-protection law and to our instructions.

Where a provider processes data outside the European Union or the European Economic Area, we ensure appropriate safeguards through one or more of the following: (i) Standard Contractual Clauses approved by the European Commission, (ii) the EU-US Data Privacy Framework for transfers to certified US organisations (https://www.dataprivacyframework.gov/), or (iii) another legally recognised transfer mechanism. These safeguards provide a level of protection consistent with EU standards.

8. Third parties that process your data

We share data only with the providers we need to run the Services. Each is bound by contract to process data solely on our instructions, and each receives only what its task requires. Please also read their privacy policies.

8.1 Sign-in providers

If you sign in with Apple, Google or Facebook, that provider gives us your e-mail address (or, with Apple, a private relay address if you choose to hide yours), your name if you share it, and a unique identifier, and it learns that you have signed in to FitnessRec. We store the e-mail address as your contact address and note that you registered through that provider. Their privacy policies: Apple https://www.apple.com/legal/privacy/, Google https://policies.google.com/privacy, Meta/Facebook https://www.facebook.com/privacy/policy/.

8.2 Push notifications

Notifications are delivered through the Apple Push Notification service on iOS and through Firebase Cloud Messaging, a Google service, on Android. Only a device token and the content of the notification pass through them.

8.3 Payments

Subscriptions on iOS and Android are sold through Apple’s App Store and Google Play under their terms. RevenueCat manages subscription status for us and receives your purchase and subscription data, never your health data (https://www.revenuecat.com/privacy). On the web, payments are processed by Stripe; card details go directly to Stripe and never touch our servers (https://stripe.com/privacy).

8.4 Advertising on the free plan

The free plan shows banner and interstitial ads served by Google AdMob. We do not track you across other companies’ apps and websites: the iOS app never asks for your device’s advertising identifier, so on iPhone and iPad ads are served without it. Where the law requires it (for example in the EEA and the UK) we ask for your consent through Google’s consent prompt before the first ad; if you decline, ads are shown without personalisation. AdMob receives standard ad-request data such as device type and coarse location derived from your IP address, and on Android your device’s advertising identifier, which you can reset or delete in the Android settings. It never receives health, fitness, nutrition or any other data from your account: advertising is kept completely separate from your health data. Paid plans have no ads. You can change ad personalisation at any time in your device’s privacy settings. Google’s advertising policy: https://policies.google.com/technologies/ads.

8.5 AI providers

The AI features — the assistant (text and voice), meal-photo recognition, the extraction of values from lab reports and body-composition reports, and the assistant’s Memory notes — run on AI models hosted by third-party providers. A request sends the provider what that request needs: your message or spoken words, the image or document you submitted, and the data the assistant looks up to answer you (for example the metrics, foods or supplements you ask about). For voice, the audio itself is sent for speech recognition and the reply for speech synthesis.

These providers process requests on our behalf, do not use your data to train their models, and keep a request only for as long as their published data policies state. The current providers are shown in the app before you first use the assistant and can be reviewed at any time from the assistant’s side panel; at the time of writing they are Baseten, Fireworks AI, Together AI, Meta (Llama API) and Google (Gemini API). Cloud AI is used only after you have acknowledged that disclosure. Instead of cloud AI you can connect your own AI server, in which case your requests go to that server and to no provider.

The assistant’s answers are stored in your conversation history in your account (or on your device in Private Mode). If you turn on Memory, the short notes the assistant extracts from your conversations are stored with your account and can be reviewed, edited and deleted under Settings → AI Assistant → Memory.

8.6 AI connectors

You can connect an external AI assistant of your choice to your FitnessRec data under Settings → AI connectors. Doing so lets that assistant read the data you authorise — your metrics, diary, workouts, nutrition, compounds and reports — and save drafts into your account. What that assistant does with the data is governed by its own privacy policy, not by ours. You can see and revoke every connection in the same screen.

8.7 Health platforms and devices

When you connect a platform or device we receive the data types you authorise from that service, and the service learns that you use FitnessRec. Each provider’s own privacy policy governs its side of the connection: Apple Health (https://www.apple.com/legal/privacy/), Google Health Connect and Fitbit (https://policies.google.com/privacy), Samsung Health (https://account.samsung.com/membership/terms/privacypolicy), Garmin (https://www.garmin.com/en-US/privacy/), and Polar, Withings, Oura, Suunto, Dexcom, Abbott (FreeStyle Libre) and Keto-Mojo, whose privacy policies are published on their websites.

8.8 Weather and maps

Local weather comes from Apple Weather: your approximate location is sent to Apple to fetch the forecast (https://weatherkit.apple.com/legal-attribution.html). Route maps are drawn with map tiles from OpenStreetMap contributors; the tiles requested reveal only the map area being viewed (https://wiki.osmfoundation.org/wiki/Privacy_Policy).

8.9 Hosting

Our servers, storage, search, real-time messaging and call relays run with hosting providers in the European Union under data-processing agreements. Voice and video calls between users are encrypted in transit and relayed through our servers; they are not recorded.

9. Social features, groups and community

9.1 Feed, messages and calls

The feed, comments, direct messages and calls are visible to the people you share them with: a post to your followers, a message or call to its recipients. Your username and profile photo are visible to other users, and other users can find you by username. Your health data is never visible to anyone unless you share it yourself in a post or message, share it with a group (9.2) or authorise a trainer (section 10). Message requests from people you do not follow are held until you accept them. Calls are relayed through our servers, encrypted in transit and not recorded.

9.2 Groups

A group is a private circle you are invited into by username, with an owner, optional admins and members. Groups exist to share selected wearable and diary metrics — steps, calories and nutrition, resting heart rate and heart-rate variability, VO₂max, blood oxygen, respiratory rate, skin temperature, blood pressure, sleep and blood glucose — and to chat. Nothing is shared automatically: for each group you choose, metric by metric, which of your metrics its members may see, and you can switch any of them off again at any time. Members see the metrics you have made visible as daily values and short trends, not your underlying records or documents. Group chat messages are visible to all current members. When you leave a group, or are removed by its owner or an admin, members lose access to your metrics immediately; messages you sent remain in the group’s chat unless you delete them.

9.3 Blocking, reporting and moderation

You can block and mute other users and report any post, comment, message, group or user. When something is reported, our moderators read the reported content and its surrounding context in order to decide on it; we act on reports within 24 hours and may remove content or suspend accounts under the Terms of Use.

10. Trainers and other professionals

You can connect with a personal trainer, dietician or similar professional (“Authorised Professional”) on the Professional plan. This is entirely optional: a professional can only send you a connection request if you allow requests (Settings → Trainer access), and nothing is shared until you accept.

Once you accept, the professional can message and call you in the app and can see your personal records, your fitness-test results and the results of any genetic test you have uploaded. Everything else is off until you switch it on, category by category, in Settings → Trainer access: profile basics, body measurements, progress photos and videos, blood-work results, nutrition, workouts and programs, supplement plan, supplement logs, cycle data, pelvic-health entries, survey answers, and derived analytics (your scores, compound-level estimates and interaction advisories). For nutrition, workouts and the supplement plan you can additionally allow the professional to edit — for example to assign a program, a diet or a cycle, which you then see in your own diary. You can change or revoke any of this at any time; once revoked or once you remove the professional, their access stops immediately.

Authorised Professionals are independent users of the Services, not our employees or representatives. Data you share with them is handled under this Privacy Policy on our side; we do not control what they do with it outside the app, so please review a professional’s own terms before granting access. Messages and calls between you and a professional are encrypted in transit. We may modify or discontinue this feature with notice in the app; existing authorisations would then be revoked.

11. Data security

Encryption in transit: all traffic between your device and our servers is protected with TLS 1.2 or higher.
Encryption at rest: data on our servers and in backups is encrypted with industry-standard encryption.
Ownership rules: every record is bound to its owner, and our servers enforce that a user can read only their own data, data explicitly shared with them, or public posts.
Access controls: only authorised staff can reach production systems, only when needed for operation or support, and access is logged.
Sign-in security: passwords are stored only as salted hashes; sign in with Apple, Google or Facebook is supported.
Private Mode: the option to keep your health data only on your device, encrypted, with no copy on our servers.

Health data is stored separately from advertising identifiers and is never shared with advertising networks. No system can guarantee absolute security, but we protect your data using industry best practices. Please use a strong password, do not share your credentials, and contact us at support@parsrec.com immediately if you believe your account has been compromised.

12. Websites of third parties

We occasionally link to websites of third parties. Although we select them carefully, we give no guarantee and assume no liability for the correctness or completeness of their content or the security of their data handling. This Privacy Policy does not apply to linked third-party websites.

13. Changes to this Privacy Policy

We may need to change this Privacy Policy, for example when we add features or change a provider. We will publish the new version at this address and in the app, update the “Last revised” date, and, for material changes, notify you in the app and ask you to review the changes before they take effect.

14. Your rights

You may at any time and at no cost ask us for information about the personal data we process about you, for the correction of errors, for the restriction or termination of processing, or for erasure — subject to mandatory legal provisions to the contrary. If you are a “data subject” under the GDPR, you have the right:

to obtain information about the personal data we process about you (Art. 15 GDPR);
to have incorrect data corrected and incomplete data completed without delay (Art. 16 GDPR);
to have your personal data deleted, unless the processing is required for the exercise of the right to freedom of expression and information, to fulfil a legal obligation, for reasons of public interest, or to establish, exercise or defend legal claims (Art. 17 GDPR);
to have processing restricted where you dispute the accuracy of the data or the processing is unlawful (Art. 18 GDPR);
to receive the personal data you provided to us in a structured, commonly used and machine-readable format, or to have it transmitted to another controller (Art. 20 GDPR);
to withdraw a consent you have given us at any time, with effect for the future (Art. 7(3) GDPR);
to object to processing based on our legitimate interests for reasons arising from your particular situation, and to object to direct marketing at any time (Art. 21 GDPR);
to lodge a complaint with a supervisory authority, as a rule the authority of your usual place of residence or work, or of our registered office (Art. 77 GDPR).

Most of these rights you can exercise yourself in the app: Settings → Privacy → Export data gives you a machine-readable copy of your data, every entry can be edited or deleted where it was logged, consents for health platforms, trainers, AI features and connectors can be withdrawn in their settings screens, and Settings → Account → Delete account deletes your account. For anything else, contact us at the address below.

15. Children

FitnessRec is designed for users aged 13 and older. We do not knowingly collect personal information from children under 13; if we learn that we have, we delete it promptly. Users between 13 and 17 may use FitnessRec only with verifiable parental or guardian consent, and the parent or guardian must review and agree to this Privacy Policy on the child’s behalf. Users 18 and older have full access without a consent requirement.

Because of the sensitive nature of health data, connecting health platforms or devices, uploading medical or genetic documents and using the AI features require parental consent for users under 18. We never use data from minors for advertising or marketing, and we do not share it with third parties beyond what is necessary to provide the Services. Parents and guardians may review the personal information we hold about their child, request its deletion together with the account, refuse further collection, or revoke a consent previously given, by contacting support@parsrec.com with proof of their relationship to the child. We comply with the Children’s Online Privacy Protection Act (COPPA) and comparable regulations, and we do not condition a child’s use of any feature on disclosing more personal information than is reasonably necessary.

16. Contact

To exercise your rights, or for any question about this Privacy Policy, contact us at any time by letter or e-mail:

PARSREC YAZILIM LIMITED SIRKETI
B BLOK, NO:4/4 ESREF DINCER MAHALLESI OZLEM SOKAK Gemlik
16000 Bursa
Turkey

E-Mail: support@parsrec.com
Managing director: Emre Akkoc
Recorded in the Commercial Register at Gemlik

under number:5993
VAT ID No.: TR7220928896