Privacy policy

Effective 29 September 2026

This policy covers the Fitness Mastery app for iPhone and Android.

1. How you get an account

Your coach creates your account and sends you a temporary password. The app has no public sign-up. To become a client, apply at fitnessmastery.com.

2. What we collect

Among the types of personal data this app collects, by itself or through third parties, there are:

name; email address; password; date of birth; sex; height; weight and body measurements; nutrition and dietary data; training and physical activity data; sleep data; step count; photographs; voice recordings; messages you exchange with your coach; a push notification identifier for each device you sign in on; app version and device platform; sign-in and session records.

You provide most of this yourself. We collect some of it automatically as you use the app, and some comes from Apple Health or Health Connect if you connect it. Parts of it are health data, and may indicate or allow someone to infer a health condition.

We store your password only as a salted hash and never see it.

Apple Health and Health Connect, if you turn it on. We read steps, sleep and weight, and write back a weigh-in you enter. Refuse it, or withdraw it later in your phone settings, and the rest of the app works normally.

Messages and voice notes. Anything you write or record for your coach is stored on our servers until you or your coach delete the account it belongs to. Recording is optional: the app asks for the microphone the first time you use it, and refusing leaves everything else working.

Push notifications, if you turn them on. Your phone gives us an identifier we can send a notification to. It is tied to the device rather than to you, we delete it when you sign out of that device, and refusing notifications changes nothing else about the app.

We collect no analytics, advertising or tracking data. The app holds no advertising identifier and does not track you across other apps or websites.

3. Why we use it

We use your account and profile to give you access and calculate your targets. We use your nutrition, body, habit and training data to coach you, which is the service itself. We use health data you connect to fill in your habits. We use messages and voice notes to carry the conversation with your coach. We use the notification identifier only to send you the notifications you asked for. We use technical data to keep you signed in and protect your account.

Where the GDPR applies, we rely on our coaching contract with you for the coaching data, on your explicit consent for health data you connect, and on our legitimate interest in account security for the security data.

4. Who we share it with

Your coach, who can see everything you log. That is how the coaching works.

AI providers. Some optional features send what you enter to large language models run by other companies: a photograph you take, or text you write or dictate. Each request carries only its own content, never your name, email or account identifier, and the result comes back for you to check before anything is saved. Nothing in the app requires you to use these features.

The one exception is the body fat estimate, which you turn on yourself. Each time you add a set of progress photos, it sends those photos, with your sex, age, height, weight, waist and years of lifting, to such a model, and saves the estimate that comes back with your progress, where your coach sees it too. It uses only providers that keep nothing from the request. You can turn it off on the Body fat page in the app, and your coach can turn it off for you.

Our hosting providers, whose servers hold your data in Frankfurt and Nuremberg, Germany. The second holds a live copy so the app keeps working if the first fails.

Our app update service, which receives your app version and device platform to decide which update to send you.

Our notification service, if you turn notifications on. It relays each notification to Apple or Google, who deliver it to your phone. It receives the device identifier and the text of the notification itself, which can include the first line of a message from your coach. It never receives your name, your email or anything else you log.

Everyone in this list must protect your data to the standard this policy sets, and may use it only for the purpose we gave it to them for.

We do not sell your personal data and we do not share it for advertising. Data read from Apple Health or Health Connect fills in your habits and shows you your progress. We never use it for advertising or marketing, never sell it, and never share it with anyone beyond the parties in this list.

5. Where we store it

We store your account and everything you log on servers in Frankfurt and Nuremberg, Germany.

We reach it from Hong Kong and the United States. Your coach reaches it from wherever they live. The AI providers in section 4 process their requests in the United States.

If you are in the UK or EEA, your data sits inside the EEA and leaves it when we access it. We rely on the EU Standard Contractual Clauses for those transfers.

6. How long we keep it

We keep your coaching data while you are a client, and for 24 months after your coaching ends, so you can come back to your history.

Delete your account and we erase your data from our live systems at once. We keep nightly database backups for 14 days, so a copy can survive in a backup that long. After that no copy remains.

7. Deleting your account

Open Settings, then Delete account. The app asks for your password to confirm.

Deletion happens straight away and cannot be undone. It erases your account and everything listed in section 2, then signs you out on every device. Your coach cannot get it back.

Deleting your data does not cancel a paid coaching subscription. Email support@fitnessmastery.com for that.

Data already written to Apple Health or Health Connect belongs to your phone, not to us. Delete it in the Health app if you want it gone.

8. Your rights

Ask us for a copy of your data, or to correct it, delete it, or send it to someone else. Withdraw your consent for health data at any time. Email support@fitnessmastery.com and we will answer within 30 days.

In California, you can ask what we collect, and have it deleted or corrected. We do not sell or share personal information as the CCPA defines those terms, and we will not treat you differently for exercising any right.

In the UK or EEA, you can also object to processing, restrict it, and complain to your data protection authority.

In Washington State, the My Health My Data Act lets you withdraw consent to the collection of consumer health data and have it deleted. Email us and we will do it.

9. Security

We hash passwords and session credentials rather than storing them, we encrypt traffic between the app and our servers, and we limit who can reach your data to the people and services in section 4.

No system is perfectly secure. If a breach affects your data we will tell you, and tell the regulator where the law requires it.

10. Children

The app is not for anyone under 16 and we do not knowingly collect data from children. Tell us if you believe a child has an account and we will delete it.

11. Changes

We will tell you in the app or by email before a material change takes effect. The date at the top shows the current version.

12. Who we are

Honest Strength Ltd controls your personal data. Its address is 555 Nathan Road, Kowloon, Hong Kong.

Tomic Systems, LLC publishes the app and runs its servers. Its address is 7345 W Sand Lake Road, Suite 210, Office 4414, Orlando, FL 32819, United States.

Email support@fitnessmastery.com with any question, request or complaint.

Our website has its own policy at fitnessmastery.com/privacy-policy.