Privacy Policy
Last updated · 19 July 2026
Your camera video is processed on your phone and never uploaded, stored or seen by us. We keep only your account details and workout results (sets, reps, scores) so your progress follows you between devices. If you join a group, its members see your display name and weekly activity totals — never your video. We don't sell data and we don't run ads.
1. Who we are
FitFormBuddy is operated by Activity Score Limited ("we", "us"), a company registered in the United Kingdom. We are the data controller for the personal data described in this policy, and we process it in accordance with UK GDPR and the Data Protection Act 2018. You can reach us about anything in this policy at info@activityscore.co.uk.
2. Your camera, your phone
FitFormBuddy's coaching works by analysing your movement through your phone's camera entirely on your device:
- Video never leaves your phone. Camera frames are analysed in real time to estimate body pose, then immediately discarded. No video or images are recorded, uploaded or stored — by design, the app works fully offline during a workout.
- No biometric identification. Pose estimation produces a set of moving skeleton points used only to count reps and check form in the moment. We do not create or store any template that could identify you from your body or face.
- Casting stays local. If you mirror your coaching view to a TV, the stream travels directly over your home network and never through our servers.
3. What we do collect
- Account data — your email address, name and sign-in provider (Apple, Google or email), managed through Google Firebase Authentication.
- Profile & preferences — training goal, available equipment, weekly schedule and session length, used to build your plan.
- Workout results — exercises performed, sets, reps, weights, durations, form scores, coaching cue counts and streaks. These are numbers and labels, never video.
- Subscription status — whether you have an active subscription or trial. Payments are handled entirely by Apple's App Store or Google Play; we never see your card details.
- Technical basics — app version, device model and crash reports so we can keep the app working.
- Push notification token — if you turn notifications on, a token identifying your device to the push service, used only to send you the notifications you've chosen (like group activity). We delete it when you sign out or turn notifications off.
- In-app usage analytics — events recording which features are used (for example, that a workout was started or a screen was viewed), linked to your account identifier so we can see what to improve — never your video, which stays on your phone. You can switch analytics and crash reporting off at any time in the app's settings.
This website itself requires no account and sets no cookies at all — no advertising, no analytics, no tracking.
4. Our lawful bases
Under UK GDPR we rely on:
- Contract — to provide the app you signed up for: your account, plans, workouts and sync.
- Explicit consent — your workout results are health-related data (special category data under Article 9). We process them only with your explicit consent, given when you create your account, and you can withdraw it at any time by deleting your account. Health app integrations are likewise consent-only.
- Legitimate interests — keeping the service secure, preventing abuse, fixing crashes and understanding which features are used so we can improve them.
- Legal obligation — where the law requires us to keep or disclose something.
5. How we use your data
- To run your guided workouts, count your reps and coach your form.
- To build and adapt your weekly plan. Plan structure is computed by deterministic rules; we use an AI language service (Microsoft Azure OpenAI) only to phrase short plan explanations, and it receives aggregate training statistics — never your video, your name or your contact details.
- To sync your progress across your devices and back it up.
- To manage your subscription entitlement, respond to support requests and keep the service secure.
We do not sell personal data, share it with advertisers, or use it to train AI models.
6. Groups and leaderboards
If you create or join a group, other members of that group can see your display name and your weekly activity — points, workout days and form scores. They cannot see your individual exercises, weights or any camera data. Joining a group is optional and always your choice; we share your weekly activity with a group only because you chose to join it, and leaving a group removes you from its leaderboard. Only people with your group's invite code can join — entering a code shows the group's name, member count and the creator's display name before joining. Pick a display name you're happy for other members to see.
7. Health app integrations
If you choose to connect Apple Health or Health Connect, we write your completed workouts to it with your permission. We do not read other data from your health apps. You can revoke this at any time in your device settings.
8. Who helps us run the service
We use a small number of processors, bound by data-processing agreements: Google Firebase (authentication, push notifications, usage analytics and crash reporting), Microsoft Azure (API hosting, database and plan phrasing), Apple and Google (billing), and Vercel (hosting this website). Some processors may handle data outside the UK/EEA; where they do, transfers are protected by recognised safeguards such as Standard Contractual Clauses.
9. Keeping your data safe
All data is encrypted in transit (TLS) and at rest, access is limited to authenticated sessions and least-privilege systems, and we review our security practices regularly. No system is perfectly secure, but the most sensitive thing — your camera video — never leaves your device in the first place.
10. How long we keep it
We keep your account and workout data while your account is active. You can delete your account in the app or by emailing us, and your personal data will be deleted within 30 days, with residual copies leaving encrypted backups within 90 days.
11. Your rights
Under UK GDPR you can ask for a copy of your data, ask us to correct or delete it, restrict or object to processing, withdraw consent, and take your data elsewhere. Email info@activityscore.co.uk and we'll respond within one month. You also have the right to complain to the ICO (ico.org.uk · 0303 123 1113).
12. Children
FitFormBuddy is not intended for anyone under 16, and we do not knowingly collect data from children. If we learn we have collected a child's data we will delete it immediately.
13. Changes
If we change this policy we'll update this page and the date at the top, and for significant changes we'll tell you in the app before they take effect.