Last updated: October 19, 2026
The Data Controller for personal data collected through the TrackFit app is the app's developer, reachable at trackfit.app.mobile@gmail.com.
TrackFit collects the following categories of personal data.
Account data — email address, display name, and authentication provider (Google or email/password; Sign in with Apple is not yet available).
Profile data (provided during onboarding) — weight (kg), height (cm), training goal (strength, hypertrophy, weight loss, or maintenance).
Workout data — created workout plans (name, days, planned exercises, target sets/reps, rest times) and logged workout sessions (start/end date and time, sets actually performed with weight and reps for each exercise).
Technical data, collected automatically — crash reports and performance diagnostics (always active, to ensure app stability and quality); anonymized usage data, collected only with explicit consent given through the banner shown on first launch and revocable at any time; a device integrity identifier (App Check), used only to verify that requests come from the genuine app, without collecting personal data.
Advertising data — TrackFit shows ads served by Google AdMob. To select and measure them, AdMob processes a device advertising identifier, the IP address, the device and operating system type, and ad interactions (impressions, clicks). If you are in the European Economic Area or the United Kingdom, personalised ads are shown only if you consent through the consent form presented on first launch; if you decline, you will see non-personalised ads, selected without profiling. You can change your choice at any time from Profile → Privacy → Ad privacy options.
Subscription data — if you buy TrackFit PRO, the purchase is made through Google Play, which handles the payment: TrackFit does not receive or store your card or payment method details. To verify the subscription and restore it on other devices, TrackFit uses RevenueCat, which receives your TrackFit account identifier (not your email) together with the purchase data: product purchased, subscription status, purchase, renewal and expiry dates, and transaction identifier. RevenueCat also automatically collects some technical data about the app and device (for example IP address, operating system and app version).
TrackFit does not collect location, contacts, photos, or other device permissions not necessary for its operation.
| Data category | Purpose | Legal basis |
|---|---|---|
| Account data | Account creation and management, authentication | Contract performance (Art. 6.1.b GDPR) |
| Profile and workout data | Core app functionality (plans, sessions, statistics, progress) | Contract performance (Art. 6.1.b GDPR) |
| Crash and performance | Identify and fix errors, ensure app stability | Legitimate interest (Art. 6.1.f GDPR) |
| Usage data (analytics) | Understand how the app is used to improve it | Explicit consent (Art. 6.1.a GDPR), revocable at any time |
| Device integrity (App Check) | Prevent abuse and unauthorized backend access | Legitimate interest (Art. 6.1.f GDPR) |
| Advertising data (AdMob) — personalised ads | Show relevant ads and measure their performance | Explicit consent (Art. 6.1.a GDPR), collected through the UMP form and revocable at any time |
| Advertising data (AdMob) — non-personalised ads | Fund the development and free distribution of the app | Legitimate interest (Art. 6.1.f GDPR) |
| Subscription data (TrackFit PRO) | Verify the subscription, enable PRO features (no ads, no plan limit) and restore it on other devices | Performance of a contract (Art. 6.1.b GDPR) |
TrackFit relies on Google Firebase (Google Ireland Limited) services for its backend infrastructure:
These services are provided by Google, which acts as a data processor on behalf of the Controller, under its own terms and privacy policy (policies.google.com/privacy). Some technical data may be processed by Google outside the European Economic Area; in that case Google relies on Standard Contractual Clauses approved by the European Commission to ensure an adequate level of protection.
For the TrackFit PRO subscription, payments are handled by Google Play (Google Ireland Limited), under its own terms and privacy policy. Purchase verification and subscription status management are entrusted to RevenueCat, Inc. (United States), which acts as a data processor on behalf of the Controller (revenuecat.com/privacy). As RevenueCat is based outside the European Economic Area, data is transferred with the safeguards required by the GDPR (for example the Standard Contractual Clauses approved by the European Commission).
For monetisation, TrackFit also uses Google AdMob (Google Ireland Limited), which serves interstitial, rewarded and banner ads inside the app. Consent from European users is collected through Google's User Messaging Platform (UMP), compliant with IAB Europe's Transparency & Consent Framework. For advertising data Google acts as an independent controller: its partner terms apply (policies.google.com/technologies/partner-sites).
TrackFit does not sell your data and does not share profile or workout data with advertisers or any other third party for marketing purposes.
On Android you can link TrackFit to Health Connect (Google) from the Profile; it is off until you turn it on and you can turn it off at any time (and revoke the permissions in Health Connect's settings). If you link it, TrackFit writes the workouts you finish to Health Connect (date, duration and the name of the day) and reads weight, steps and heart rate. The data read is only used to show you the weight to import into your profile, today's steps and the heart rate of your workout: it is shown on the device and is not stored on our servers or shared with third parties; only the weight, if you choose to import it, enters your profile like any weight you type in.
Data is retained for the entire duration of the account, until the user requests its deletion.
Subscription data is kept for as long as the account exists. When you request deletion of your account, we will also ask RevenueCat to remove your identifier; transaction data that Google Play must retain to comply with legal obligations (for example tax) stays with Google. Deleting your account does not cancel an active subscription: it must be cancelled separately on Google Play.
You can delete your account directly in the app (Profile → Account → Delete account): the account and the associated data (profile, plans, workouts, preferences) are deleted immediately and permanently. The steps are also on this page. If you can't access the app, email trackfit.app.mobile@gmail.com: the request will be processed within 30 days.
Crash reports and performance metrics, when collected, are retained by Google under its own retention policies (typically 90 days).
As a data subject, you have the right to (Art. 15-22 GDPR):
To exercise any of these rights, email trackfit.app.mobile@gmail.com. You also have the right to lodge a complaint with your national data protection authority (in Italy, the Garante per la Protezione dei Dati Personali, garanteprivacy.it).
Your data is protected by:
Despite these measures, no system is 100% invulnerable: in the event of a data breach that poses a risk to your rights, you will be notified as required by Art. 33-34 GDPR.
TrackFit is not directed at children under 16 and does not knowingly collect data from children under that age. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at trackfit.app.mobile@gmail.com to request its removal.
This policy may be updated periodically, for example when new features process personal data (e.g. iOS support). Material changes will be communicated through the app or via email. The date of the last update is shown at the top of this document.
For any question about this policy or about the processing of your personal data, write to: trackfit.app.mobile@gmail.com