Privacy policy
Effective September 11, 2026
FitSecret is a training log. It collects the workout data you enter and the account details needed to sync it between your devices — nothing else. There is no advertising in the app, and your data is never sold or shared with advertisers.
Who we are
FitSecret (“the app”) is published by FitSecret. This policy covers the iOS app, the Android app, and the web version. Questions about it go to support@meego.tw.
What we collect
Only what you give us, in four groups:
Account details. Your email address, the name you enter, and whether you signed up as a trainer or a trainee. Passwords are handled by our authentication provider and stored only as a salted hash — we never see or store the password itself.
Training data. The programs you build or are assigned (weeks, days, exercises, target sets and reps, coaching cues), and the sessions you log — date, the weight, reps and reps-in-reserve of each set, per-exercise ratings and notes, session notes, and your fatigue rating. Also any custom exercises you add.
Body weight. Weight measurements you record, stored with the date and time you measured them and whether the entry was typed by hand or read from Apple Health.
On-device settings. Your language, theme, units, rest-timer defaults and current week, plus a cached copy of your recent training data so the app opens without waiting for the network. All of this stays on the device and is cleared when you delete the app.
We do not collect location, contacts, photos, advertising identifiers, or analytics about how you use the screens. There are no third-party trackers in the app.
Apple Health (iOS only)
If you turn on Health sync, the app asks iOS for permission to read and write body mass — that one data type and no other. It is used for a single purpose: to keep your weight trend consistent between FitSecret and Health. Weights you log in the app are written to Health, and weights Health already holds are read in so your chart is complete.
Health data is never used for advertising, marketing, or any similar service, and is never disclosed to third parties, sold, or used for anything beyond your own weight history. You can revoke the permission at any time in the iOS Settings app under Privacy & Security → Health; the app keeps working without it. Android does not read health data at all.
Why we hold it
To give you an account, to show you your training history on every device you sign in from, to draw your progress charts, and — if you have connected to one — to let your trainer coach you. That is the whole list. We process this data to perform the service you asked for, and in the case of health and fitness data, on the consent you give when you create an account and when you grant the Health permission.
Who else can see it
A trainer you connect to. Connecting with a trainer’s code is an explicit act, and it lets that trainer read your name and email, every session you log, your body-weight history, and any custom exercises you added. They cannot edit your sessions. If you disconnect or switch trainers, the previous trainer immediately loses access to all of it.
Service providers. Our database, authentication and hosting run on Supabase. App updates are delivered through Expo, which receives your device’s platform and app version to decide which update to send. The apps are distributed by Apple and Google, who provide us with aggregate download and crash statistics we cannot tie back to you.
Exercise illustrations are fetched from a public GitHub repository as you browse the library, which means GitHub sees the request (including your IP address) the way any website you visit would. No account data is sent with it.
We do not sell your data, and we do not share it with advertisers or data brokers. Beyond the above, we disclose data only if the law requires it.
Where it is kept, and for how long
Your data is stored in your Supabase project’s region and protected by row-level security rules, so one account cannot read another’s except through the trainer relationship described above. Traffic is encrypted in transit with TLS.
We keep your training history for as long as your account exists, because a training log is only useful with its history intact. Delete your account and everything tied to it — profile, programs, sessions, body weights, custom exercises — is deleted with it.
Your choices
See or correct your data. Everything we hold about you is visible in the app, and most of it is editable there.
Delete it. Email support@meego.tw from your account address and we will delete your account and all associated records. Deleting the app alone only clears the on-device copy.
Get a copy. Ask at the same address and we will send your data in a machine-readable format.
Withdraw consent. Disconnect from your trainer in the app, or revoke the Health permission in iOS Settings, at any time.
Depending on where you live you may also have the right to object to or restrict processing, or to complain to your local data protection authority.
Children
FitSecret is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has created an account, write to us and we will remove it.
Changes to this policy
If we change what we collect or who we share it with, we will update this page and move the effective date at the top. Material changes will also be announced in the app.
Contact
Questions, requests, or complaints: support@meego.tw.