iamFit Privacy Policy
Effective date: 19 October 2026
iamFit is an iPhone app for logging strength and cardio workouts, for yourself or for the people you look after. This page explains what iamFit collects, why, where it is kept and for how long, and how you control it. It covers the iamFit app, its account service and the website iamfit.app.
In short
- iamFit needs you to sign in with Apple or Google. Your workouts are kept in your account on our server, so they sync between devices and you can log for others and share.
- We keep your email address and name from your sign-in provider, the workouts you log and your membership status, and use them only to run the app.
- No ads, no analytics, no tracking, no selling of data, and no third-party SDKs in the app.
- Payments go through Apple. The developer never receives your card details.
- You can export a backup and delete your account yourself in the app. Deletion removes your data from the service at once; copies in the database's recovery history expire within 30 days.
Who is responsible
The data controller for iamFit is Poom Maneesriwong, an independent developer in Thailand. For anything about your data, email support@iamfit.app.
What we collect and why
| Data | Where it comes from | What it's used for |
|---|---|---|
| Account: email address, name (if your provider shares it) and your Apple or Google user ID | Apple or Google, when you sign in | Signing you in, keeping your account separate from others, and replying when you contact us |
| Workouts: exercises, weights, reps, sets and drop sets, cardio (type, time, distance), workout dates and times, workout names, notes, routines and exercises you add | You, or people you invite to help log | Saving and syncing your log, showing history and stats |
| Profiles and sharing: profile names, who owns each profile, who can view or help log, and which account last changed each entry | You and the people you invite | Letting each person see and log only the profiles they have access to |
| Membership: when your trial started, the plan you bought, purchase IDs, expiry dates, refunds and plan changes | iamFit and Apple (App Store) | Unlocking your plan and restoring purchases |
| Security data: each device's sign-in key, stored only as a one-way hash, and request counters derived from your IP address or account, hashed the same way | iamFit's server | Keeping others out of your account and stopping abuse |
Email and name: Google shares your verified email address and the name on your Google account. Apple shares your email address, or an Apple relay address if you choose Hide My Email, and your name only at your first sign-in if you choose to share it; the app uses it to name your account and your profile (you can change it). Other iamFit users never see your email address.
Workout logs can say something about a person's body and health. iamFit uses them only to run the app and shows them only to people with access.
What iamFit doesn't collect: passwords (there are none to set), card or payment details, data from Apple Health, location, photos, contacts or microphone audio.
Why we may use it
- To provide the service you asked for: your account, saving and syncing workouts, sharing and membership.
- Legitimate interests: keeping the service secure, preventing abuse and fixing problems.
- Legal obligations: when the law requires us to keep or disclose data.
iamFit doesn't use your data for advertising or marketing, and doesn't analyse your behaviour to profile you.
People you log for
When you make a profile for someone else, such as a client, a family member or a friend, you choose the profile name (a nickname or a made-up name is fine) and what you log. iamFit doesn't contact that person, and the app doesn't ask for their permission separately.
- Log only for people who know and are fine with it, and log only what the training needs.
- For a child or a minor, get a parent's or guardian's consent first.
- You are responsible for what you log about others and for any backups you export.
- When they're ready, hand the profile to its person (Hand to its person). They then control their data fully, including removing you.
- If you think iamFit holds a profile about you that you don't want, email support@iamfit.app. The developer will look into it and act as appropriate, for example by telling the account holder or removing the profile.
Who can see your data
- You and the people you invite: your profiles are visible only to you and the people you invite (Helps log or View only). You can remove them at any time. Removing someone stops their access from then on, but can't take back what they already saw or copied.
- Your account name: a profile's owner sees the account name of each helper, and someone who receives a profile code sees the account name of whoever made that profile.
- The developer: doesn't look at your workout logs unless you ask for help, it's needed to fix a problem or keep the service secure, or the law requires it.
- Service providers listed below process data on iamFit's behalf to run the app.
- Authorities: only when the law or a valid legal order requires it, and only as much as needed.
iamFit doesn't sell or rent your data, or share it for advertising.
Service providers
| Provider | What it does for iamFit | Privacy policy |
|---|---|---|
| Cloudflare | The app's server, its database (Cloudflare D1), this website, and forwarding mail sent to support@iamfit.app. Processes IP addresses to deliver and protect the service. | cloudflare.com/privacypolicy |
| Apple | Sign in with Apple; purchases and renewals through the App Store; telling iamFit's server about purchase changes such as renewals and refunds | apple.com/legal/privacy |
| Sign in with Google, through the iPhone's system browser | policies.google.com/privacy |
Your data may be stored or processed outside your country, for example in the United States or other countries where these providers run data centers. Each provider handles data under its own agreements and privacy policy.
No ads, no tracking
- The app has no ads, no analytics and no third-party crash reporting, and doesn't track you across other companies' apps or websites.
- The app contains no third-party SDKs. Sign in with Google uses the system browser, not a Google SDK.
- If you turn on Share With App Developers in your iPhone settings, Apple may send the developer crash reports and anonymous usage statistics. You can turn it off in Settings › Privacy & Security › Analytics & Improvements.
Data on your iPhone
- The app keeps a copy of the profiles you open on your device so you can keep logging offline, and keeps changes that haven't reached the server until they sync. These files use iOS data protection and are included in your iPhone backups (iCloud Backup or a computer).
- Your sign-in key is kept in the device's Keychain, usable on this device only.
- Settings such as weight and distance units, language, the sign-in method you used last and the profile you opened last are kept on the device. Units and language also have a small copy in the Keychain so a reinstall doesn't ask again; iOS may keep it after the app is deleted.
- Signing out leaves the copy on the device so unsent changes aren't lost. Delete the app to remove it. Deleting your account removes that account's copy from the iPhone you delete it on.
- A backup file is created only when you export one, and you choose where it goes. Once exported, the file is in your hands.
How long we keep data
| Data | How long |
|---|---|
| Account, profiles, workouts, routines, exercises you added, and the change history used for syncing | As long as the account exists |
| Workouts and routines in the Trash, and profiles removed with Delete profile | Hidden, but still in the owner's account until the account is deleted, so they can be restored or exported. Email us to have them erased sooner. |
| Purchase records linked to the account, and the Sign in with Apple key (encrypted) | As long as the account exists |
| Each device's sign-in | 30 days, or until you sign out |
| Invitation and profile codes | One use within 7 days. Expired invitation codes are removed automatically; profile codes stay until the profile, or the account that made them, is deleted. Both are stored only as one-way hashes. |
| Abuse-prevention counters | Up to 1 hour |
| Sign-in replay protection | 15 minutes |
| Apple notification IDs (no personal data) | 90 days |
| Purchase facts Apple sent that no account has claimed (no account data) | 400 days |
| Emails sent to support@iamfit.app | As long as needed to help you; ask any time to have them deleted |
| Copies in the database's recovery history | Up to 30 days, then they expire |
Deleting your account
In the app: Account › tap the card with your name at the top › Delete account and data › type DELETE › Confirm account deletion. Full steps, and how to ask by email if you can't sign in: Delete your iamFit account.
Removed at once when you confirm
- Your account, email address, name, and the link to Apple or Google
- Your sign-ins on every device
- Every profile you own, including profiles you made for others and haven't handed over, with their workouts, routines, exercises you added, Trash and change history
- Access you gave others, access others gave you, and unused invitation codes
- Purchase records linked to the account
- The account's copy on the iPhone you delete it from
Not removed
- Profiles you've handed to their person, which are theirs now, and workouts you logged as a helper in other people's profiles. These stay with those profiles but are no longer linked to your account.
- Backup files you exported
- Your Apple subscription. Deleting your account doesn't cancel it; cancel it in your Apple account settings.
- Emails you sent to support@iamfit.app (ask and they'll be deleted)
After deletion: iamFit asks Apple to revoke Sign in with Apple as soon as it can, and keeps retrying if Apple can't be reached. For Google, you can remove iamFit from your account's connected apps at myaccount.google.com/connections. Copies in the database's recovery history (Cloudflare D1) can remain for up to 30 days before they expire. They exist only to recover the service after a failure.
Security
- Data always travels over HTTPS.
- There's no password to leak: you sign in with Apple or Google.
- The server stores sign-in keys, invitation codes and profile codes only as one-way hashes (SHA-256), and keeps the Sign in with Apple key encrypted.
- Every request is checked on the server: you must own the profile or have been invited before you can read or change it.
- Deleting an account needs a sign-in within the last 10 minutes and typing DELETE.
- On your iPhone, the sign-in key is in the Keychain and files use iOS data protection.
No system is perfectly secure. If something happens that affects your data, the developer will tell you and the relevant authorities as the law requires.
Children
iamFit isn't made for children, and people under 13 shouldn't create an account. If you're a minor where you live, please have a parent or guardian know about and agree to your use. Coaches or helpers who log for a child must have a parent's or guardian's consent first. If you find a child's data in iamFit without that consent, email support@iamfit.app and it will be deleted.
Your rights
Under Thailand's Personal Data Protection Act B.E. 2562 (2019) (PDPA) and similar laws elsewhere, such as the GDPR, you have these rights.
| Right | How |
|---|---|
| See your data and get a copy | Account › Export a backup (one profile you own at a time), or email us for a copy of everything in your account |
| Take your data elsewhere | The backup is a JSON file that other software can read |
| Correct your data | Edit workouts and profile names in the app; email us for anything else |
| Erase your data | Delete your account in the app, or email us |
| Object, restrict use or withdraw consent | Email us |
| Complain | Thailand's Personal Data Protection Committee (PDPC), or the data protection authority where you live |
Email support@iamfit.app. We reply within 3 days and complete requests within 30 days, free of charge. We may ask you to write from your account's email address to confirm the account is yours.
Emailing support
Mail sent to support@iamfit.app is forwarded by Cloudflare's email routing to the developer's mailbox. The developer receives your email address and message and uses them only to reply. Please don't send workout data or backup files unless you're asked to, to solve a problem.
This website
iamfit.app is served by Cloudflare, which may process IP addresses to deliver and protect the site. The site has no analytics, uses no cookies, and loads no scripts, fonts or images from anywhere else.
Changes
If this policy changes, this page will be updated with a new effective date. For important changes, such as collecting a new kind of data or using data for a new purpose, the app will tell you before they take effect.
Contact
Poom Maneesriwong (independent developer, Thailand) · support@iamfit.app