Privacy Policy

Introduction

KovaFit ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application (the "App").

Information We Collect

Personal Information

We may collect personal information that you voluntarily provide to us, including but not limited to:

• Name and email address (if you create an account)
• Profile information (age, gender, fitness goals, experience level)
• Workout data (exercises performed, sets, reps, weights, duration)
• Progress photos and measurements (if you choose to add them)

Apple Health and Analytics

Apple Health permission is optional. Raw Apple Health samples, identifiers, source devices, and exact sleep intervals are read transiently on your device. KovaFit retains only sanitized daily summaries in user- and methodology-scoped device storage for up to 180 days. Raw samples and derived Recovery, Fitness Trend, training-load, sleep, confidence, chart, and insight values are not written to Firebase, product telemetry, Crashlytics, or other remote storage.

Usage Data

We automatically collect certain information when you use the App:

• Device information (device type, operating system, unique device identifiers)
• App usage data (features used, time spent, interaction patterns)
• Crash reports and performance data

Analytics product telemetry contains only allowlisted interaction names such as screen view, 7D/28D/90D range selection, permission-button selection, insight open, or consent-state change. It contains no health, workout, metric, score, sleep, chart, evidence, or free-text values.

How We Use Your Information

We use the collected information for the following purposes:

• Provide Services: To deliver personalized workout plans and AI coaching recommendations
• Improve App: To understand how users interact with our features and improve the user experience
• Analytics: To track your progress and provide meaningful insights
• Communications: To send you important updates, notifications, and promotional content (with your consent)
• Support: To respond to your inquiries and provide customer support

Third-Party Services

We use the following third-party services that may collect information:

RevenueCat

We use RevenueCat to manage in-app subscriptions. RevenueCat collects purchase data and subscription status. View their privacy policy at www.revenuecat.com/privacy

Firebase

We use Firebase for authentication, database, and analytics. View Firebase's privacy policy at firebase.google.com/support/privacy

Google AdMob

Free users may see advertisements powered by Google AdMob. KovaFit requests non-personalized ads and does not request App Tracking Transparency permission or use IDFA for personalized advertising. View AdMob's privacy policy at support.google.com/admob/answer/6128543

Vercel AI Gateway and Google Gemini AI

Cloud AI requests pass through KovaFit's authenticated Vercel server and Vercel AI Gateway to Google Gemini as the default underlying model. The server enforces App Check, trusted entitlements, quota, idempotency, payload allowlists, and redacted errors. Free Analytics insights do not use AI. Optional Pro explanations require explicit, revocable consent and send only the exact bounded derived evidence previewed in the app; raw Apple Health samples, exact sleep intervals, source/device identifiers, medical history, and unrelated workouts are excluded. Every KovaFit Gateway request opts out of provider prompt training, and Gateway reporting receives fixed app attribution rather than user IDs, email, health/workout values, prompts, or chat text. Credentials never enter the mobile app or product telemetry. Zero Data Retention is a separate plan-dependent control and is not claimed unless verified for production. View the Vercel privacy policy and Google AI principles.

Strava (Optional Integration)

If you connect Strava, KovaFit stores an encrypted Strava refresh token and non-sensitive connection metadata on our backend. A short-lived access token is kept in protected device storage. Imported Strava activities remain in KovaFit's device-local health cache and are not uploaded to our cloud database. You can revoke the connection in the app at any time. Strava privacy policy

Subscription Management

When you subscribe to KovaFit Pro, your subscription is managed through the Apple App Store or Google Play Store. We do not store your payment information directly. Subscriptions and billing are handled by:

• Apple App Store: For iOS users - governed by Apple's privacy policy
• Google Play Store: For Android users - governed by Google's privacy policy

You can manage or cancel your subscription through your App Store account settings.

Data Security

We implement appropriate technical and organizational security measures to protect your personal information. However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee its absolute security.

Your Rights

Depending on your location, you may have the following rights:

• Access: Request access to your personal data
• Correction: Request correction of inaccurate data
• Deletion: Delete your account from Settings. KovaFit uses a retryable server process to revoke connected Strava access and erase KovaFit cloud data, storage objects, and the RevenueCat customer record before deleting Firebase Authentication. App Store and Play Store transaction records remain controlled by those stores, and deleting an account does not cancel an active store subscription.
• Data Portability: Request a copy of your data in a portable format
• Withdraw Consent: Withdraw consent for data processing where consent was the legal basis
• Local Analytics Controls: Change your sleep goal, review Apple Health permissions, revoke AI explanation consent, or clear local Analytics summaries, history, and cached explanations in Settings

Children's Privacy

Our App is not intended for individuals under the age of 13. We do not knowingly collect personal information from children under 13. If you become aware that a child has provided us with personal information, please contact us, and we will take steps to delete such information.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically for any changes.