Privacy Policy

Version 1.6 · Effective from 14 October 2026

FitQ Studio OÜ and Geneto OÜ (together, "we") respect your privacy and are committed to protecting your personal data. This Privacy Policy describes how we collect, use, retain and protect your data when you use our services, including:

the FitQ web application (fitq.me), FitQ mobile applications (iOS and Android) and FitQ TV applications (Apple TV, Android TV, Samsung Smart TV)
the FunTastyQ Fit web application (funtastyq.com) and mobile applications (iOS and Android)
the Gymwolf web application (gymwolf.com) and mobile applications
the SparQ web and mobile applications

These services may use a shared user account: data associated with your account is stored in a shared database and may be visible and usable across the listed services (for example, a workout logged in Gymwolf may appear in your FitQ diary). All of the services are operated by the joint controllers named below, and this Privacy Policy applies to all of them equally.

1. Data Controllers

The joint controllers of your personal data are:

FitQ Studio OÜ

Registry code: 16016552
VAT number: EE102393398
Address: Metsa tn 10, 61503 Elva, Tartumaa, Estonia
E-mail: privacy@fitq.ee

Geneto OÜ

Registry code: 14091673
Address: Narva mnt 9, 51009 Tartu, Tartumaa, Estonia
E-mail: cs@fitq.me

For privacy matters, the primary contact point is privacy@fitq.ee; for questions concerning the FunTastyQ Fit services you may also contact cs@fitq.me. You may exercise your rights through either controller.

2. Data We Collect

2.1 Account Data

Name and e-mail address
Phone number (optional)
Profile picture (optional)
Date of birth and gender (for personalising the service)

2.2 Health and Training Data

Height, weight and body mass index
Workout history, goals and progress
Gym workout logs: exercises performed, sets, repetitions, weights and other workout details, and body measurements you record (primarily Gymwolf)
Where available, optional perceived exertion ratings and workout photos you choose to add
Generated and guided workouts, their completion history and related fitness statistics (primarily SparQ)
Video and training programme viewing history (including in the FitQ TV apps)
Nutrition diary: meals, foods and recipes, quantities and nutrition goals (primarily FunTastyQ Fit)
Food photos you submit for the AI nutrition estimate (FunTastyQ Fit; see section 2.8)
Health condition data (only with your explicit consent)

2.3 Genetic Data (FunTastyQ Fit)

We collect genetic data only if you have opted in to the relevant functionality, i.e. ordered a genetic test. The test is carried out together with our genetic testing partner laboratory, which receives only your sample and the code generated for it — the laboratory does not receive your name or any other identifying data. We have concluded a contract with the laboratory ensuring that the data is used solely for providing our service.

We process genetic data on the basis of your explicit consent (GDPR Art. 9(2)(a)). If you withdraw your consent, we will delete your genetic data and no further recommendations or risk scores based on genetic information will be calculated; you may continue to use the other parts of the service. We will ask for your separate consent before using your genetic information for research and development or for personalised offers.

2.4 Family Member Data (FunTastyQ Fit)

If you enter data about your family members into the service (e.g. physical characteristics for nutrition recommendations), you are responsible for having the right to provide that data. We process family member data only for providing the service.

2.5 Payment Data

Subscription and payment history
We do not store your payment card details ourselves – they are processed by our payment providers (e.g. Stripe)

2.6 Customer Support Data

Messages you send to customer support (by e-mail, in an app or on our website, or via Facebook Messenger or Instagram where these channels are available) and our replies, including attachments and the contact or profile information provided through that channel
Error reports you submit about food data, recipes or other content, together with the information needed to resolve them
Technical delivery and read-status information for support messages; support e-mails may use a small tracking image to indicate whether a message was opened

2.7 Technical Data

IP address and device information
Browser type and version
Login time
App usage statistics

2.8 Food Photos for the AI Nutrition Estimate (FunTastyQ Fit)

FunTastyQ Fit offers an optional feature that estimates the foods, portion sizes, calories and macronutrients of a meal from a photo. If you use it, the following applies:

What is sent: only the food photo you take or choose, together with the language of the app. Before the photo is sent, location (GPS) data and other metadata are removed from it and it is reduced to the size needed for the analysis. Your name, e-mail address and other account details are not sent.
Recipient: the photo is passed through our server to Anthropic, the provider of the Claude AI models, which acts as our processor. Anthropic may process the data in the United States and in other countries where its cloud service providers operate (see section 7).
Purpose: solely to produce the estimate shown to you. You review the estimate, can correct it and decide whether to save it to your nutrition diary; only what you save is stored in your diary.
Retention: we do not store the photo. It is held in our server's memory only while your request is processed. To prevent accidental duplicate requests, we keep the estimate result and a technical checksum of the photo, linked to your account, for up to 7 days. Under its commercial terms, Anthropic automatically deletes inputs and outputs received through its API within 30 days, unless longer retention is required by law or the content is flagged as violating its usage policy, and may not use them to train its models.
Your choice: using the feature is voluntary, and you can always add foods manually instead. Please photograph only food and avoid including people, documents or other personal information in the picture.

We use the same analysis in food and recipe campaigns to check that a submitted photo shows food. In that case the photo is stored by us as part of your campaign entry.

2.9 Optional GPS Workout Tracking

This section applies across our apps wherever GPS workout tracking is available. The available features and controls may vary by app and device.

If you choose GPS tracking for a workout and grant location permission on your device, the app processes your precise location, position timestamps and accuracy information to measure distance and record your workout route. Tracking can continue while that workout is running and the app is in the background or the screen is locked. Your device shows a location indicator or an ongoing workout notification. You can pause or stop tracking using the controls available in the app, or withdraw location permission in your device settings. GPS tracking is optional and is not started automatically for a new workout.

If you choose to save a route to your account, its coordinates are sent to our server and linked to your account so that you can view it later. Where the app offers a distance-only option and you select it, the saved workout sent to our server contains the distance and timing summary without the route coordinates. A workout in progress and any unsent changes may be stored on your device until you save or discard them or complete synchronisation.

Workout routes, perceived exertion ratings and workout photos are private to your account and are not published or shared automatically. Where the relevant export or sharing feature is available, you can choose to export a GPX route or share a workout image yourself. We do not use GPS routes for advertising or tracking you across other companies' apps or services. These data are retained under the workout diary and health-data retention rules in section 5; you can exercise the deletion and other rights described in sections 8 and 9.

2.10 Scientific Research Using Truly Anonymous Statistics

By accepting the version of our Terms of Service that includes the anonymous-research clause, you agree that we may use truly anonymous, aggregated statistics from our services for scientific research and share those statistics with universities and other research institutions for that purpose. This applies across our services. We do not treat acceptance of an older version, continued use of an app or a device permission as agreement to this new clause.

This permission covers only information that cannot identify you or anyone else, directly or indirectly, including when combined with other information reasonably available to us or the recipient. Removing a name or e-mail address, replacing an account ID with a code or hash, or retaining a key that links a record back to a person is not sufficient. Pseudonymised records remain outside this permission.

Research recipients receive only anonymous group statistics or summaries. We do not share personal data, individual health or genetic records, raw workout or nutrition diary records, precise GPS routes, photos, free-text messages, account identifiers or linking keys under this clause. Genetic data, data derived from genetic tests, data you enter about family members and data imported from device health platforms are not included in this anonymous-research permission. The separate protections and consent requirements in sections 2.3, 2.4 and 3 remain unchanged.

Before anonymous statistics are used or shared for research, we must document that the proposed dataset cannot reasonably be used to single out, link or re-identify a person. We combine, generalise or suppress information as necessary, including small groups and unusual combinations. If anonymity cannot be established, the information is not used or shared under this clause. Before sharing, the research institution must agree to use the information only for the stated scientific purpose, not attempt re-identification or link it back to people, and not pass it on outside those conditions. Published research results must also be anonymous.

Anonymising source records is itself processing of personal data. This clause does not provide a new legal basis or consent for using personal data or health data for research before they have been anonymised. Any such processing must have an appropriate legal basis and satisfy the additional protections and separate consent requirements that apply, including restrictions on data obtained from health platforms. Accepting general Terms does not replace those requirements.

After information has genuinely and irreversibly become anonymous, it is no longer linked to your account. Anonymous research statistics may therefore be retained after account deletion and cannot be retrieved or removed for a specific person. Your rights and applicable consent choices for the original personal data remain unchanged under sections 5, 8 and 9.

3. Health Platform Integrations (Health Connect, Apple Health, Google Fit)

If you connect our app to your device's health platform — Android Health Connect, Apple Health (HealthKit) or Google Fit — or to an external service (e.g. Strava), we read the following data with your permission (the same applies when data moves between our own services, e.g. Gymwolf workouts appearing in your FitQ diary):

steps and physical activity
workouts (type, duration, time)
energy burned (calories)
weight

We read only the data types listed above — no more than is necessary to fill your diary and calculate your energy needs (the principle of data minimisation / minimum scope). On Android, the app may read Health Connect data in the background, even when the app is not open, so that your diary stays automatically in sync.

We use this data solely to display and record your workouts, activity and weight in your own diary and to calculate your energy needs. Data read from health platforms:

is not used for advertising or marketing;
is not sold or shared with third parties;
is processed only on the basis of your consent, which you give through your device's health platform permissions.

You can withdraw the permission at any time in your device settings (e.g. Health Connect or Apple Health permission management) — in that case no new data will be read. Data read from health platforms is deleted together with your account.

4. Purposes and Legal Bases of Processing

We process your data for the following purposes and on the following legal bases:

Providing the service and managing your account – performance of a contract (GDPR Art. 6(1)(b))
Creating personalised training and nutrition plans and tracking progress – performance of a contract and your consent
Processing health data (incl. weight, health condition, data read from health platforms) – your explicit consent (GDPR Art. 9(2)(a)), which you may withdraw at any time
Processing genetic data for the genetic test and personalised feedback – your explicit consent (GDPR Art. 9(2)(a)), which you may withdraw at any time
Processing payments and accounting – performance of a contract and legal obligation (GDPR Art. 6(1)(c))
Optional AI features you choose to use (e.g. the AI nutrition estimate from a food photo) – performance of a contract (GDPR Art. 6(1)(b))
Customer support, including reviewing the food data error reports you submit – performance of a contract and our legitimate interest (GDPR Art. 6(1)(b) and (f))
Improving the service, fixing errors and statistics – our legitimate interest (GDPR Art. 6(1)(f))
Newsletters and marketing messages – your consent (GDPR Art. 6(1)(a)), which you may withdraw at any time

5. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes described in this policy or to comply with legal obligations:

Account data, diaries and workout/viewing history – until you delete your account. Upon account deletion, we delete or anonymise your personal data within 30 days.
Health and body data – until account deletion or withdrawal of consent, whichever comes first.
Genetic data – until account deletion or withdrawal of consent, whichever comes first.
Payment, billing and partner transaction data (including purchases, refunds, gift cards, sport-benefit payments and share rewards) – 7 years from the transaction and, where necessary, for reconciliation with the relevant partner. After account deletion, we remove names and replace e-mail addresses in the retained records where possible. Transaction references may remain linked for accounting and reconciliation; replacing an e-mail address does not by itself make these records anonymous.
Technical logs (IP address, device information) – up to 12 months.
Customer support correspondence – normally up to 3 years after the last activity in the conversation, including related follow-up requests. An unresolved request or a legal dispute may require longer retention for that purpose. After the retention period, we delete the correspondence and attachments and retain only a statistical record without the account link or contact information. During account deletion, we remove names, replace contact e-mail addresses and remove technical e-mail headers from support records; the text of a conversation may still contain information you included yourself and is retained for the remainder of the applicable support retention period.
Newsletter subscription – until you withdraw your consent.

After the retention period expires, the data is irreversibly deleted or anonymised. Only genuinely anonymous statistics that meet section 2.10 may be retained for scientific research; pseudonymised or identifiable records do not qualify.

6. Processors and Third Parties

To provide the services, we use the service providers and integrations below. Their role depends on the feature: some process data on our behalf under our instructions, while others act as independent controllers under their own privacy policies. Transfers outside the European Union are described in section 7.

6.1 Hosting, Login and Communication

Google Cloud – servers, databases, file storage and logs (data centres in the European Union, Finland), including photos you upload
Google Firebase – login and authentication, push notifications (Firebase Cloud Messaging) and app crash reports (Crashlytics, linked to your account ID)
Google Workspace – our e-mail, including messages you send to customer support
Twilio SendGrid – sending e-mails (e.g. password resets, reminders, summaries, support replies and newsletters)
Slack – internal notifications to our team about purchases, cancellations and failed payments (including your name, e-mail address, the product and cancellation feedback)
Meta (Facebook Messenger and Instagram) – where you contact our support through these channels, delivery of messages, attachments and profile information between that platform and our support system; Meta also processes information under its own privacy policy

6.2 Artificial Intelligence Services

Anthropic – the AI nutrition estimate from food photos and checking that a photo submitted to a food or recipe campaign shows food (see section 2.8). Only the photo is sent, with location and other metadata removed – not your name, e-mail address or account ID.
OpenAI – reviewing food and recipe data that users submit, reviewing food data error reports and helping our team analyse customer support messages, and translating content into other languages (e.g. a programme comment you ask to have translated). Requests are limited to the content and context needed for the task. A support message or other free text may contain personal data, including contact information you have included yourself.

For direct API requests, OpenAI states that submitted content is not used to train its models by default unless the customer opts in, and that abuse-monitoring logs may be retained for up to 30 days, with exceptions for legal or safety needs. Anthropic's standard API retention and exceptions are described in section 2.8. Provider handling also depends on the service, account settings and contractual arrangements; this API description does not imply that every tool used by our team has identical retention settings. We do not make decisions with legal or similarly significant effects about you based solely on AI outputs.

6.3 Payments and Subscriptions

Stripe Payments Europe Ltd – card payments on the web
Modena, Zlick and Stebby – other payment methods on the web (bank link and card payments, payment by mobile phone bill, and payment with employee sport benefits); the provider you choose receives the data needed for the payment (e.g. name, e-mail address or phone number)
Apple (App Store) and Google (Google Play) – in-app subscription purchases. Apple and Google process the payment under their own terms; we use the purchase identifier to check the status of your subscription.

6.4 Analytics and Marketing

Google Analytics for Firebase – app usage statistics in the mobile apps
Google Analytics and Google Tag Manager – usage statistics on the FitQ website (with your consent)
Meta (Facebook) Pixel – marketing analytics on our websites (with your consent)
Plausible Analytics – privacy-friendly visitor statistics on our websites
Mixpanel – analytics in older FunTastyQ Fit mobile apps (version 1.x). These versions can send an account identifier and profile information, including age, gender, body mass index (BMI), weight goal, activity level, pregnancy status and trimester, breastfeeding status and nutrition-plan settings.
AppsFlyer – app installation and campaign statistics in the older FunTastyQ Fit mobile apps (version 1.x)
Meta (Facebook) SDK – Facebook Login and app event statistics in the older FunTastyQ Fit mobile apps (version 1.x)

6.5 Content and Other Services

Vimeo and YouTube – playing videos; when you play a video hosted by them, the provider receives your IP address and device information
Genetic testing partner laboratory – analysis of the genetic test (receives only a pseudonymised sample and code, not your name or contact details)
Koos – issuing rewards to users who report errors to us (receives your name and e-mail address)
Agora – video calls between trainers and clients in FitQ messaging (receives a technical user identifier)

6.6 Services You Choose to Connect

The following integrations are used only when you choose the relevant feature. Where a provider processes data as an independent controller, its own privacy policy also applies. Device health-platform permissions are described in section 3:

Sign in with Apple, Google Sign-In and Facebook Login – logging in; we receive your name and e-mail address from the provider
Apple Health (HealthKit), Android Health Connect and Google Fit – see section 3
Strava – importing your activities after you connect your Strava account
MyFitness – importing your MyFitness gym bookings as workouts after you connect your MyFitness account; your MyFitness login details are sent directly from the app to MyFitness
Elisa – if you created your account through Elisa, your login and account data (name, e-mail address and phone number) are synchronised with Elisa's customer account system

We do not sell or rent your personal data to third parties. We disclose data to public authorities only where required by law.

7. Data Transfers Outside the European Union

We store your data primarily in data centres located in the European Union. Some of our service providers (e.g. Google, Stripe, Meta, Twilio SendGrid, Slack, Anthropic, OpenAI, Mixpanel, AppsFlyer, Vimeo and Agora) may also process data in the United States or other countries outside the European Union. In such cases we rely on the European Commission's adequacy decision (EU–US Data Privacy Framework) or on Standard Contractual Clauses approved by the European Commission.

8. Your Rights

Under the GDPR, you have the following rights:

Right of access to your data
Right to rectification
Right to erasure
Right to restriction of processing
Right to data portability
Right to object
Right to withdraw consent at any time

To exercise your rights, contact us at privacy@fitq.ee (or cs@fitq.me). We will respond to your request within 30 days at the latest.

9. Account and Data Deletion

You can delete your account and the personal data associated with it:

in the app or on the web: Settings → Delete account, or
by sending a request to privacy@fitq.ee.

We will delete or anonymise your personal data within 30 days, except for records we are required or entitled to retain for the purposes and periods in section 5, including accounting, transaction and gift records and support correspondence. Where a transaction is still being reconciled with a partner, the contact information needed to complete that reconciliation may be retained until it is resolved. We limit access to the retained information; account deletion does not imply that every retained record has become anonymous.

10. Cookies and Similar Technologies

We use cookies and similar technologies:

Necessary cookies – for login and session functionality; the service does not work without them
Analytics and marketing cookies – only with your consent

You can manage your cookie preferences in your browser settings. Declining analytics and marketing cookies does not limit the use of the core features of the service.

11. Security Measures

We apply appropriate technical and organisational measures to protect your data:

Encrypted data transmission (TLS)
Access restrictions and role-based access to data
Data storage in secure data centres located in the European Union
Pseudonymisation of genetic samples (the laboratory sees only a code)
Regular review of security measures

12. Children's Data

Our services are not directed at children under the age of 16. A person under 16 may use the service only with the consent of a parent or guardian. If we become aware that we have collected data of a child under 16 without parental consent, we will delete it without delay.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes in the app or by e-mail before the changes take effect. Each version is marked with a version number and effective date.

14. Supervisory Authority

If you are not satisfied with how we process your data, you have the right to lodge a complaint with the Estonian Data Protection Inspectorate:

Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate)

E-mail: info@aki.ee
Website: www.aki.ee

If you have any questions, contact us at privacy@fitq.ee or cs@fitq.me

Governing language: This Privacy Policy is drawn up in English. Translations into other languages are provided for convenience only; in the event of any discrepancy or dispute, the English-language version prevails.