App Privacy Policy
Last updated: January 13, 2026
1. Introduction
Privacy is a fundamental human right. That’s why we designed FitWoody to respect your privacy, your intimacy, and your data.
Your data is yours, and with FitWoody you remain in control at all times. We collect and process only the minimum data necessary to provide the app’s features, using secure, privacy-first infrastructure and industry-standard protection measures.
This document explains what information we collect, how we use it, how we comply with privacy regulations, and what rights you have regarding your personal data.
2. Who are we?
FitWoody is developed and operated by Chubby Studio S.L., Tax ID B44691418, located in Spain at C/ Apartado 134, 01080 Vitoria-Gasteiz (Álava).
For data-protection purposes, Chubby Studio S.L. is the Data Controller.
Contact: hello@fitwoody.camp
3. What data do we process about you?
3.1. Apple Health Data
FitWoody uses the APIs provided by Apple to read and/or write the data that is found in the Apple Health application (https://www.apple.com/lae/privacy/) on your device. Access to Apple Health data is strictly subject to your explicit consent.
Data accessed
FitWoody may read:
Activity energy (burned calories)
Exercise minutes and stand minutes
Steps and floors climbed
Walking, running, cycling, wheelchair and snow sports distance
VO₂ max (aerobic capacity)
Heart rate, resting heart rate, and heart rate variability (HRV)
Respiratory rate, blood oxygen saturation (SpO₂)
Wrist temperature and body temperature
Sleep analysis (core, deep, and REM stages)
Weight and height
Body-mass index (derived)
Date of birth, biological sex, and wheelchair status
Workouts and routes (including cycling power and speed)
FitWoody may write:
Workouts and workout routes
Weight and height
Processing and Storage
Apple Health data are accessed via HealthKit APIs and used exclusively to provide FitWoody features such as activity analysis, sleep insights, metabolic metrics, readiness scores, and personalized explanations.
Depending on the feature, your data may be processed locally on your device and/or securely transmitted and stored in FitWoody’s backend infrastructure powered by Supabase.
All data stored on our servers is:
Encrypted in transit (TLS 1.2/1.3)
Encrypted at rest (AES-256)
Stored in secure data centers located in the European Union
Health data is never sold, rented, or shared with third parties for advertising, marketing, or profiling purposes.
When cloud-based processing is required, data is minimized and pseudonymized whenever possible. Direct identifiers such as name or email are not included in Health data processing.
Some features may use on-device or private-cloud Foundation Models (LLMs) to generate plain-language summaries or motivational text. These models never receive raw Health data, only de-identified summaries or contextual insights (for example, “the user had a restorative night” rather than precise metrics).
You can manage or revoke Apple Health permissions at any time in Settings → Health → Data Access & Devices → FitWoody.
FitWoody fully complies with Apple’s HealthKit Policy and App Store Review Guidelines 5.1.3.
3.2. Location Data
If you view and/or log your outdoor workouts with FitWoody, the app may access your location data to display maps and routes related to your training sessions.
FitWoody accesses location data strictly with your explicit consent. Location data may be processed locally on your device and/or securely transmitted and stored in FitWoody’s backend infrastructure when required to provide workout history and route visualization features.
Location data is used solely to deliver FitWoody functionality and is never used for marketing, advertising, profiling, or tracking purposes.
You can manage or revoke location permissions at any time from your device settings.
3.3. Account and Identification Data
FitWoody uses a minimal account system to personalize your experience and manage notifications.
Sign in with Apple: the only authentication method. FitWoody receives the email address and (optionally) the name you choose to share.
Stored information: name and email are securely stored on Supabase (EU region) to identify your account and link push/email preferences.
Notifications and marketing: you may opt-in to receive motivational push notifications or marketing emails. Consent is required and can be withdrawn anytime from Settings.
This information is used solely to operate your account and send chosen communications — never for sale or targeted advertising.
3.4 Technical and Usage Data
To improve stability and performance, FitWoody collects anonymous usage data through the following services:
All analytics are aggregated and non-identifiable. Except for communication services explicitly opted into by the user (such as email notifications).
Service
Purpose
Data Handled
Privacy Policy
TelemetryDeck
Anonymous analytics (screen views, feature use)
Randomized IDs only, no personal or Health data
telemetrydeck.com/privacy-policy.html
RevenueCat
Subscription and trial management
Purchase identifiers from Apple only
Customer.io
Transactional & marketing emails (if opt-in)
Name and email only
customer.io/legal/privacy-policy/
Supabase
Database & authentication backend
Account data (name, email) encrypted in EU
4. Principles Related to Processing According to the General Data Protection Regulation (GDPR)
At Chubby Studio S.L., privacy is a core principle. FitWoody has been designed and developed in accordance with the principles established by the General Data Protection Regulation (GDPR):
Lawfulness, fairness, and transparency
We process personal data only when there is a valid legal basis, such as user consent or the necessity to provide the service. Through this Privacy Policy, we provide clear and transparent information about how and why personal data is processed.
Purpose limitation
Personal data is collected solely for specific, explicit, and legitimate purposes related to the operation, improvement, and security of FitWoody.
Data minimization
We process only the minimum amount of personal data necessary to deliver FitWoody’s features and ensure proper functioning of the service.
Accuracy
Users can review, update, and correct their account information at any time through the app.
Storage limitation
Personal data is retained only for as long as necessary to fulfill the purposes for which it was collected, unless a longer retention period is required by law.
Integrity and confidentiality
We apply appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration, or disclosure. These measures include encryption, access controls, and regular security assessments.
Accountability
We document, review, and continuously improve our data-protection practices to ensure ongoing compliance with the GDPR.
5. Supabase Security
FitWoody uses Supabase as its backend infrastructure provider.
Supabase implements industry-standard security practices, including:
Encryption at rest and in transit
Strict role-based access control (RBAC)
Network isolation and secure key management
Continuous monitoring and regular security audits
Supabase is designed to support compliance with major regulatory frameworks such as GDPR and HIPAA (when properly configured), and follows best practices for data protection and privacy by design.
Access to production data is strictly limited to authorized personnel and protected by technical and organizational safeguards.
6. Data Retention & Security
Account data (name and email) are retained only while your FitWoody account is active.
You can delete your account and all related data at any time via the app or by emailing hello@fitwoody.camp.
Aggregated anonymous analytics may be kept longer for statistical purposes.
We protect your data with encryption (TLS 1.3 in transit, AES-256 at rest) and strict access controls.
All team members with access operate under signed confidentiality agreements.
FitWoody complies with Apple Developer security requirements and undergoes regular internal audits.
Your Rights
You may at any time:
Request access, correction, or deletion of your data.
Withdraw consent for push or email marketing.
Request data portability.
File a complaint with the Spanish Data Protection Agency (AEPD).
To exercise these rights, contact us at hello@fitwoody.camp or by post to Chubby Studio S.L., C/ Apartado 134, 01080 Vitoria-Gasteiz (Álava).
8. Information on the Processing of Personal Data
In accordance with the General Data Protection Regulation (GDPR) and Organic Law 3/2018, of December 5, on Personal Data Protection and the Guarantee of Digital Rights, we provide the following information regarding the processing of personal data in FitWoody:
Data Controller
Chubby Studio S.L., Tax ID B44691418
C/ Apartado 134, 01080 Vitoria-Gasteiz (Álava), Spain
Contact
Email: hello@fitwoody.camp
Personal Data Processed
Account and identification data (name and email)
Health-related data strictly necessary to provide FitWoody features
Limited technical and usage data required for stability and performance
Purpose of Processing
Personal data is processed to:
Operate and maintain the FitWoody application
Provide personalized insights and features
Manage subscriptions and user accounts
Send communications explicitly opted into by the user
Improve performance, reliability, and security of the service
Legal Basis for Processing
The processing of personal data is based on:
The user’s explicit consent, and
The legitimate interest of providing, maintaining, and improving the service, in accordance with Article 6.1(f) GDPR.
Data Recipients
Personal data is not sold or shared with third parties.
Certain service providers act as data processors under GDPR-compliant data processing agreements, including Supabase, RevenueCat, TelemetryDeck, and Customer.io.
International Data Transfers
No international transfers of personal data outside the European Union are carried out.
Data Retention Period
Personal data is retained only for as long as the user account remains active or as required by applicable law. Once no longer necessary, data is securely deleted or anonymized.
9. What rights do you have regarding the processing of your personal data?
In accordance with the General Data Protection Regulation (GDPR), you have the following rights regarding the processing of your personal data:
Right of access
You may request confirmation as to whether Chubby Studio S.L. is processing your personal data and, if so, obtain information about the data processed, the purpose of the processing, and other relevant details.
Right to rectification
You have the right to request the correction of inaccurate or incomplete personal data. You can update or modify your account information directly within the FitWoody app or by contacting us.
Right to erasure (“right to be forgotten”)
You may request the deletion of your personal data when it is no longer necessary for the purposes for which it was collected, when you withdraw your consent, or when the data has been processed unlawfully, subject to applicable legal obligations.
Right to restriction of processing
You may request that the processing of your personal data be restricted in certain circumstances, such as when you contest the accuracy of the data or object to its processing.
Right to data portability
You have the right to receive your personal data in a structured, commonly used, and machine-readable format and, where technically feasible, to request that it be transmitted to another data controller.
Right to object
You have the right to object to the processing of your personal data based on legitimate interests, unless there are compelling legal grounds to continue processing.
Right to withdraw consent
Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of processing prior to withdrawal.
How to exercise your rights
You can exercise any of these rights directly through the FitWoody app or by contacting us at hello@fitwoody.camp.
We may request proof of identity when required by law.
Right to lodge a complaint
If you believe that your data protection rights have been violated, you have the right to file a complaint with the Spanish Data Protection Agency (AEPD) or the relevant supervisory authority in your country.
10. Cookies and other similar technologies
As the privacy of FitWoody users is very important to us, we do not use cookies or any other user activity tracking technology that collects personal data about the user in the application.
However, as we pointed out in the third clause, we use the services of TelemetryDeck and RevenueCat to analyze, anonymously, the use of the application to identify and implement improvements in FitWoody.
11. Changes to the Privacy Policy
We continually strive to improve FitWoody to provide you with the best user experience. Therefore, if these changes affect your privacy, we will have to modify this Privacy Policy. The same applies if legislative changes occur.
Therefore, if we change this Privacy Policy, we will notify you through our website and in the application itself. In any case, at the beginning of these terms, we indicate the date of the last version that is in effect and the date of its publication.
12. Applicable Regulations
The terms of this Privacy Policy are governed by the European data protection regulations that apply to us, specifically, Regulation (EU) 2016/679 of the European Parliament and of the Council, dated April 27, 2016, concerning the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
13. We Resolve Your Doubts
Chubby Studio S.L.
C/ Apartado 134, 01080 Vitoria-Gasteiz (Álava)
Email: hello@fitwoody.camp
Website: https://fitwoody.camp
