FitCi Privacy Policy

Last updated: August 30, 2026

This notice explains how your personal data is processed under Turkish Law No. 6698 (KVKK) when you use the FitCi app.

1) DATA CONTROLLER

Your data is processed by FitCi as the data controller. Contact: destek@fitciapp.com

2) DATA WE PROCESS

• Account: email, first/last name; with "Sign in with Apple" the user identifier provided by Apple and (if you share it) your email; with "Sign in with Google" your Google account ID, email and first/last name.

• Profile: date of birth/age, gender, height, weight, target weight, activity level, goals, diet preference.

• Health data (special category — KVKK art.6): your food allergies, health conditions and injuries; workout records; weight/body measurements; nutrition logs; progress photos.

• Apple Health (HealthKit): if you allow it, your weight is read; the weight and workouts you log are written to Apple Health.

• Health Connect (Android): if you allow it, your weight is read; your weight and workouts are written to Health Connect.

• Content: workout/diet photos or PDFs you import into a program.

• Usage/technical: activity logs, error logs, basic device information.

• Install source: which ad/channel you installed the app through (the campaign/source parameters provided by the store) is stored linked to your account; it is used to measure whether advertising spend works.

• Anonymous install identifier: to measure how many people install the app and leave without creating an account, a random identifier generated by the app itself is stored. It is NOT an advertising identifier (Advertising ID), does not identify you on its own, and disappears when you delete the app; no name, email or location is stored alongside it. If you create an account, this identifier is linked to your account so we can measure whether an install converts into a sign-up; if you delete your account, that link is removed.

3) PURPOSES OF PROCESSING

Account and sign-in; generating your personalized workout/nutrition program and calculating macros; progress tracking and statistics; making the program safe based on your allergy/injury information; improving the app and ensuring security.

4) LEGAL GROUNDS (KVKK art.5-6)

Your explicit consent (in particular for your health data and transfers abroad); performance of a contract; legitimate interest (security and the anonymous install measurement described above). Your health data is processed only with your explicit consent; you may withdraw your consent and delete your account.

5) TRANSFERS AND TRANSFERS ABROAD

• OpenAI (USA): to generate programs/diets and to analyze the program/diet photos you upload, the MEAL photos you take, and the text of your voice/typed food logs, the relevant profile information, photos and text are sent to OpenAI and processed in the USA — this is a transfer abroad and is subject to your explicit consent.

• Apple (USA): "Sign in with Apple" and the HealthKit integration; additionally, if you installed the app through an Apple Search Ads campaign, the attribution token generated by your device is sent to Apple's attribution service to learn which campaign the install came from.

• Google (USA): authentication for Sign in with Google; verification of subscription purchases made through Google Play; additionally, Google AdMob is used to show REWARDED ADS in the app. To serve ads and prevent abuse, AdMob processes a device identifier, coarse location (country/city level) and technical diagnostic data. These are transfers abroad.

• Meta (USA): for measuring ads that promote FitCi; install, registration and subscription purchase events (for purchases, only the amount and the currency) together with the device advertising identifier are sent to Meta. Your health, workout and nutrition data are NOT sent to Meta.

• Hosting provider: for the server/database.

ABOUT ADS: Some free features (photo calorie scan, barcode scan) unlock by watching a short rewarded ad. No ads are shown with a FitCi Pro subscription. On iOS the App Tracking Transparency (ATT) permission is requested; if you decline, ads are simply not personalized and every feature of the app remains available. On Android you can reset your advertising ID or turn off personalized ads in your device settings; all features remain available either way.

We never use your health or nutrition data for advertising and never sell it. Ad providers receive only the technical/device data listed above — your workout, diet, weight, measurement and photo data are never sent to ad networks.

6) HEALTHKIT AND HEALTH CONNECT COMMITMENT

We use Apple Health (HealthKit) and Health Connect data only for the app's health/fitness features; we do not use, sell or share it for advertising, marketing or data mining.

7) PROGRESS PHOTOS

Photos are stored on the server; location (GPS) and EXIF metadata are removed on upload. They can be protected with a Face ID lock inside the app. Only you can access them.

8) RETENTION AND DELETION

Data is kept for as long as your account is active. You can permanently delete your account from within the app; when you do, your profile, records and photo data are permanently deleted.

9) SECURITY

Passwords are stored irreversibly (PBKDF2), communication is encrypted with TLS, and access is protected with JWT.

10) CHILDREN

The app is not intended for children under 13.

11) YOUR RIGHTS (KVKK art.11)

You have the right to learn whether your data is processed, to request information/correction/deletion, to learn the third parties it has been transferred to, and to request that processing be stopped and any damage be remedied. Requests: destek@fitciapp.com

12) CHANGES AND CONTACT

We may update this policy; we will notify you in the app of significant changes. Contact: destek@fitciapp.com

13) USERS IN THE EUROPEAN ECONOMIC AREA (EEA) AND THE UNITED KINGDOM — GDPR

FitCi is published on the EU/EEA and United Kingdom storefronts. If you are located in these regions, your data is processed IN ADDITION to KVKK under the EU General Data Protection Regulation (GDPR — (EU) 2016/679) and the UK GDPR. Where the rest of this notice conflicts with this section, this section prevails for users located in the EEA/UK.

CONTROLLER

Controller: CİHAD YILMAZER (sole proprietorship, Türkiye) · Ferah Mah. Denizci Sk. Deniz Apt. No:7 D:4, Üsküdar, 34692 İstanbul, Türkiye · destek@fitciapp.com

LEGAL BASES (art.6 and art.9)

• Performance of a contract (art.6(1)(b)): providing your account, subscription, programs and records.

• Explicit consent (art.6(1)(a); art.9(2)(a) for special category data): your health data — allergies, health conditions and injuries, weight and body measurements, workout and nutrition logs, progress photos — is processed ONLY with your explicit consent.

• Legitimate interests (art.6(1)(f)): security, abuse prevention and anonymous install measurement.

You may withdraw your consent at any time (art.7(3)); withdrawal does not affect the lawfulness of processing carried out before it.

AUTOMATED GENERATION AND PROFILING (art.13(2)(f) and art.22)

From the information you provide (age, gender, height, weight, goal, activity level, equipment, allergies, health conditions) your calorie and macro targets are calculated automatically and a workout/nutrition program is generated for you. How it works: calorie and macro calculations are performed by the app's own code using standard formulas; exercises and meals are selected from a curated library; allergy and injury filters are applied in code.

This generation is NOT a decision that produces legal effects concerning you or similarly significantly affects you: the output is an EDITABLE DRAFT, it is not applied until you approve it, and you can change or delete it at any time. You may nonetheless object to this processing and request human intervention.

YOUR RIGHTS (art.15–22, art.7(3), art.77)

Access (art.15) · rectification (art.16) · erasure (art.17) · restriction of processing (art.18) · data portability (art.20) · objection (art.21) · withdrawal of consent (art.7(3)).

• Erasure: you can permanently delete your account from within the app (Profile > Delete Account).

• Portability: you may request a structured, machine-readable copy of your data at destek@fitciapp.com; we will respond within 30 days at the latest.

• Complaint (art.77): you may lodge a complaint with the data protection authority of your EU member state, or with the ICO if you are in the United Kingdom.

INTERNATIONAL TRANSFERS (art.44–49)

Our servers are hosted within the European Union (Finland); in normal operation your data stays inside the EU. Processing that leaves the EU:

• OpenAI (USA): program/diet generation, photo analysis, and parsing of voice and typed food logs. Transfer safeguard: a Data Processing Agreement executed with OpenAI (GDPR art.28).

• Apple, Google, Meta (USA): authentication, rewarded ads and ad measurement — the scope is detailed in section 5.

• Türkiye: administrative access by the developer operating the service. As there is no EU adequacy decision for Türkiye, this access relies on appropriate safeguards.

For your special category data these transfers additionally rely on your explicit consent (art.49(1)(a)).

RETENTION

• Your account and content data: for as long as your account is active. When you delete your account, your profile, programs, records and photos are permanently deleted.

• Subscription and payment records: payment is handled by the store provider (Apple/Google) and is subject to statutory retention periods.

• Anonymous install identifier: it does not identify you; its link to your account is removed when the account is deleted.

• Error and security logs: kept for as long as needed for troubleshooting and security.

CHILDREN

The app is not intended for children under 13. In the EU, the age of consent for information society services varies between 13 and 16 depending on the member state; if you are below that age, do not use the app without the permission of a parent or guardian.