Privacy Policy

Effective August 14, 2026

This policy explains what FitBase (operated by WebFace Media) collects, why, and what we do with it. The short version: we collect what the product needs to work, we don't run ad trackers, we never sell your data, and your card number never touches our servers.

1. What we collect

Account: your email address and optional display name. If you sign in with Google, Google sends us your name, email, and avatar — we never see your Google password.
Training data: the workouts you build, the sessions you log (exercises, sets, reps, weights, dates), and your My Gym equipment list.
Coaching: invites, engagements, and which coach you work with.
Payments: handled entirely by Stripe. We store engagement and payout status, never card numbers.
Technical: our own privacy-respecting page analytics (self-hosted, aggregate page views — no cross-site tracking, no advertising IDs) and standard server logs.

2. How we use it

To run the product: show your library and plans, sync your log, generate AI coaching from your goals + equipment + recent training, connect you with a coach you hire, and email you things you asked for (password resets, invites). We don't sell personal data and we don't use it for third-party advertising.

3. The AI coach and your data

When you ask the AI coach for a plan or progression advice, the relevant context — your goal text, equipment list, and summaries of recent logged training — is sent to Anthropic's Claude API to generate the answer. Per Anthropic's commercial API terms, this data is not used to train their models. The API key and all AI processing stay server-side.

4. Who can see your training data

You. Your workouts and logs are private to your account by default. If you hire a coach (or accept a coach's invite), that coach can see the training data needed to coach you, for the duration of the engagement. We access personal data only to operate and debug the service.

5. Cookies and storage

FitBase stores your sign-in token in your browser's local storage — that's it. No third-party advertising cookies.

6. Retention and deletion

We keep your data while your account is active. Email us to delete your account: your workouts, sessions, and gym profile are removed. Some records we're required to keep (e.g. payment records at Stripe) follow their own retention rules.

7. Security

Traffic is TLS-encrypted, passwords are hashed (never stored in plain text), and secrets live only on our servers. No system is perfectly secure — if a breach affecting you occurs, we'll notify you.

8. Your rights

Under Canadian privacy law (PIPEDA) — and simply as our default — you can ask what we hold about you, ask us to correct it, or ask us to delete it. Write to tommyadeniyi@gmail.com and we'll act on it promptly.

9. Children

FitBase isn't intended for anyone under 16, and we don't knowingly collect their data.

10. Changes

If this policy changes materially, we'll announce it in the app. The effective date at the top always tells you the current version.