Privacy policy

Last updated October 31, 2026

KinFit is a fitness app run by 17242654 Canada Inc. in Ontario, Canada ("we"). You bring your own AI assistant, it writes your weekly plan, and the app keeps the plan and what you log. This policy explains what we collect, why, who else handles it and how to delete it.

What we collect

• Account: your email address, first name and how you sign in (Apple, Google or a password). Passwords are stored only as a secure hash. If you use Sign in with Apple and hide your email, we get Apple's relay address.
• Profile: your goal, sex, birth year, height, weight, units, training experience, training days, where you train, diet, foods to leave out, injuries, cardio preferences and any notes you add.
• Profile photo, only if you add one: a small copy of the photo you pick, stored privately with your account and shown only to you. If you sign in with Google, the app shows your Google photo until you change or remove it.
• Plans and logs: the weekly plans your AI writes, and the meals, workouts, cardio, weigh-ins, water, fasts, body measurements and check-ins you log.
• Health data, only if you connect Apple Health or Health Connect: we read your weight, body fat, steps, active calories, exercise minutes, distance, sleep, heart rate, resting heart rate, heart rate variability and VO2 max, and keep a daily summary with your account. We write the workouts, weigh-ins, water and meals you log back to Apple Health or Health Connect. During a workout on Apple Watch, the watch shows your heart rate and saves the workout to Apple Health with heart rate and energy; heart rate is not kept with your account.
• Progress photos, only if you take them: the photos you add to track your progress, with their date and pose. They are resized and stripped of location and camera details before upload, and stored privately with your account.
• AI connections: which assistants you connected, the keys you created (stored only as a hash) and when each was last used.

We do not collect your location, contacts, advertising ID or any photo you did not add yourself. The app has no ads, no analytics or tracking tools, and we do not track you across other apps or websites.

How we use it

Only to run the app: to show your plan and progress, keep your history backed up and in sync across your devices, and let the AI assistant you connected read and update your plan. We do not sell your information, use it for advertising or share it for anyone else's marketing.

Your AI assistant

When you connect an assistant such as Claude, ChatGPT, Gemini or Muse, it can read your profile, plans, logs and measurements, and save plans, profile changes and ticks for you. It sees your health data only if you turn on sharing in the app, and a progress photo only if you turn on sharing for that photo. What happens to information once your assistant has it is covered by that provider's privacy policy (Anthropic, OpenAI, Google or Meta). You can disconnect an assistant or revoke a key at any time in the app in Settings, under Connect your AI.

Health data

Health data is used only to show your progress and, if you turn on sharing, to help your AI adjust your plan. It is never sold, used for advertising or given to data brokers, and it is not shared with anyone except your own AI assistant when you turn sharing on. Use of information received from Health Connect follows the Health Connect Permissions policy, including the Limited Use requirements. Data from Apple Health is used the same way and never for advertising.

Who else handles your data

• Supabase runs our database, sign-in and server code. Your data is stored on its servers in the United States.
• Apple and Google handle Sign in with Apple and Google sign-in when you use them.
• Cloudflare hosts these web pages and stores progress photos and your profile photo in a private bucket that only your account can open, through links that expire within an hour.

Because your data is stored in the United States, it may be accessed by courts or authorities there under United States law.

Security

Data is encrypted in transit. Each account can reach only its own data, and the assistant keys you create are stored only as a hash. The app also keeps a copy on your phone so you can log without a connection.

Keeping and deleting your data

We keep your data while you have an account. You can delete your account in the app in Settings, under Delete account, or on the delete account page. Deleting removes your account, your progress photos and everything listed above straight away. Copies may remain in our hosting provider's routine backups for a short time until those backups expire. Data the app wrote to Apple Health or Health Connect stays there until you remove it in that app.

Your rights

You can see and correct your details in the app, and delete your account at any time. To ask what we hold about you, or with any other privacy question or complaint, email support@kin-fit.app. If you are not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada.

Children

KinFit is not meant for children under 16, and we do not knowingly collect their information. If you think a child has made an account, email us and we will delete it.

Changes

If we change this policy, we will post the new version here with a new date.