Privacy Policy

Data We Collect

Account Information

When you create an account, we collect:

• Email address — used for account identification and communication
• Display name — shown in-app on your profile
• Profile photo (optional) — uploaded if you choose to set one

If you sign in with Apple or Google, we receive basic profile information (name and email) from those providers. We do not receive or store your Apple/Google password.

Fitness & Training Data

To provide personalised workout plans, we collect:

• Fitness assessment — your selected skill goals, experience level, and preferred training frequency
• Workout history — exercises performed, sets, reps, duration, and difficulty feedback you provide after each set
• Progress records — personal records, milestones, and progression levels
• Achievements — badges and streaks earned through training

App Preferences

• Unit preference (metric or imperial)
• Favourite exercises
• App settings and display preferences

Analytics Data

We collect anonymised usage data to understand how people use the app and improve the experience. This may include screen views, feature usage, error reports, and subscription-related events. Analytics data is associated with a random device identifier, not your name or email. See the "Analytics" section below for more detail.

We do not collect data for advertising purposes.

How We Use Your Data

We do not use your data for advertising, sell your data to third parties, or build advertising profiles.

Third-Party Services

We use the following third-party services to operate bit by bit:

Firebase (Google)

• Firebase Authentication — manages account creation, sign-in, and session tokens
• Cloud Firestore — stores and syncs your user data (profile, workouts, progress) across devices
• Firebase Storage — hosts profile photos you upload
• Firebase Analytics — collects anonymised usage events (see Analytics section)

Firebase processes data under Google's terms. Data is stored on Google Cloud servers. See Firebase Privacy.

RevenueCat

RevenueCat manages our subscription system. We share an anonymous user identifier and subscription status (processed through Apple's App Store). See RevenueCat Privacy.

Apple App Store

Subscriptions are processed through Apple's in-app purchase system. Apple handles all payment processing — we never see or store your payment card details. See Apple Privacy.

Expo Updates

We use Expo to deliver over-the-air code updates. Expo receives basic device metadata (device type, OS version) to deliver the correct update. No personal or fitness data is shared with Expo. See Expo Privacy.

Apple / Google Sign-In

If you choose to sign in with Apple or Google, the respective provider handles authentication and shares your name and email with us. We do not receive your password. You can manage these connections in your Apple or Google account settings.

Analytics

We use Firebase Analytics to understand how people use bit by bit and to improve the app.

Analytics events may include screen views, feature usage, error reports, and subscription-related events. Events are associated with a randomly generated device identifier, not your name or email. We use this data in aggregate to make product decisions. We do not build individual profiles from analytics data or use analytics for advertising.

You cannot currently opt out of analytics within the app. If this is important to you, contact us and we'll consider adding this option.

Data Storage & Sync

Your data is stored on your device and, when you're signed in, synced to Cloud Firestore (Google) so it's backed up and available across devices. Profile photos are stored in Firebase Storage (Google Cloud).

Data in transit: All data transferred between your device and our servers uses HTTPS encryption (TLS).

Data at rest: Stored in Google Cloud's infrastructure with Google's standard encryption.

Data Retention

• Active accounts: Your data is retained as long as your account exists
• Deleted accounts: When you delete your account, we delete your profile, workout data, and progress from our servers. Analytics data that has already been aggregated cannot be individually removed, but it is not personally identifiable
• Subscription data: Third-party subscription providers may retain transaction records as required for financial compliance, even after account deletion

Your Rights

All Users

You have the right to:

• Access your data — view your profile, workout history, and progress in-app
• Delete your account and data — available in Profile > Settings within the app
• Export your data — contact us and we'll provide your data in a portable format

Australian Privacy Act

As an Australian business, we comply with the Australian Privacy Principles (APPs) under the Privacy Act 1988. You may lodge a complaint about our handling of your personal information by contacting us. If unsatisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

European Users (GDPR)

If you're in the European Economic Area, you have additional rights under the GDPR:

• Rectification — correct inaccurate personal data
• Restriction — request we limit processing of your data
• Portability — receive your data in a machine-readable format
• Objection — object to processing based on legitimate interests
• Withdraw consent — where processing is based on consent

Our legal basis for processing:

• Contract performance — providing the training service you signed up for
• Legitimate interests — analytics to improve the app, security
• Consent — optional features like profile photos

To exercise these rights, contact us at privacy@bitbybit.fit. We'll respond within 30 days.

California Users (CCPA)

If you're a California resident, you have the right to:

• Know what personal information we collect and how it's used
• Delete your personal information
• Non-discrimination — we won't treat you differently for exercising your rights

We do not sell personal information. We do not share personal information for cross-context behavioural advertising.

Children's Privacy

bit by bit is not directed at children under 16. We do not knowingly collect personal information from children under 16. If you believe a child under 16 has provided us with personal information, please contact us and we will delete it.

Account Deletion

You can delete your account at any time from Profile > Settings within the app. When you delete your account:

• Your profile, workout data, and progress are permanently deleted from our servers
• Your authentication account is removed
• Third-party services (e.g. RevenueCat) may retain anonymised transaction records as required for financial compliance
• Previously aggregated analytics data cannot be individually removed but is not personally identifiable

Active subscriptions are not automatically cancelled when you delete your account. Manage your subscription through Apple Settings > Subscriptions before deleting your account to avoid continued billing.

Changes to This Policy

We may update this privacy policy from time to time. If we make significant changes, we'll notify you through the app or by email. The "Last updated" date at the top shows when the policy was last revised.

Contact Us

If you have questions about this privacy policy or your data:

Email: privacy@bitbybit.fit

Tobey Lee Hahn Speck
ABN 13 904 149 472
Australia