StableFit logo
For coaches
Client experience
UA EN PL
Download

Privacy Policy

Last Updated: 9 September 2026

1. Introduction

StableFit respects your privacy. This Privacy Policy explains how we collect, use, and share information about you when you use our Coach and Client mobile applications and website.

Data controller: Ihor Savva, operating as SavvaDev - Ihor Savva, a sole proprietorship registered in Poland. Contact: support@stable-fit.com. Registered office: Poland, woj. MAZOWIECKIE, pow. Warszawa, gm. Warszawa, miejsc. Warszawa, ul. Bobrowiecka, nr 10, lok. 67, 00-728. Tax identification number (NIP): 5214103415.

2. Roles (Coach and Client)

  • StableFit is the controller of your account, authentication, device and usage data, push tokens, analytics and crash data, and Coach subscription status (billing records we store on our servers).
  • Your Coach is an independent controller of personal data they process in the course of coaching (training plans, notes, surveys they send, and the progress data they view). We process that content to provide the platform.
  • By accepting a Coach invitation, a Client understands that the assigned Coach can see the Client's progress data and photos in the Service. Coaches cannot delete Clients; a Client who wants data removed should contact us (and may also ask their Coach to stop using the data in their own records).

3. Information We Collect

  • Account data: name, email address, role (Coach or Client), authentication identifiers. You may sign in with Apple or Google; those providers share the identifiers you authorize.
  • Health and fitness data (special category): if you choose to provide it - body measurements (for example weight and circumferences), progress photos, workout logs, nutrition and water logs, and survey answers about training or diet. Processing this data requires your explicit consent. Some features will not work if you do not provide it.
  • Communications: in-app chat and similar messages between Coach and Client.
  • Device and usage data: app logs, device type, OS version, performance data, crash reports, and approximate diagnostics needed to run the Service.
  • Push notifications: a device push token (Apple Push Notification service or Firebase Cloud Messaging) if you allow notifications.
  • Analytics: events about how you use the app, collected via Google Firebase (Analytics, Crashlytics, Performance, Remote Config) and PostHog (product analytics).
  • Subscription data (Coaches): product identifier, store (App Store or Google Play), billing period, transaction identifiers, subscription status, and related timestamps. This status is stored on your StableFit account so Pro access follows the account, not a single device. We do not receive your full payment card number. Apple and Google process the payment.

We do not sell your personal data or photos to third parties, and we do not use progress photos for advertising.

4. Legal Bases (GDPR / Polish RODO)

  • Contract (Art. 6(1)(b)): creating and operating your account, providing the Service, storing Coach subscription status, customer support.
  • Consent (Art. 6(1)(a) and, for health data, Art. 9(2)(a)): health and fitness data, progress photos, optional push notifications. You may withdraw consent at any time (for example by deleting photos or measurements, disabling notifications, or requesting account deletion). Withdrawal does not affect processing already carried out.
  • Legitimate interests (Art. 6(1)(f)): security, fraud prevention, fixing bugs, and understanding product usage (Firebase and PostHog) in a way that is proportionate and not overridden by your interests.
  • Legal obligation (Art. 6(1)(c)): where we must keep limited billing or accounting records or respond to lawful requests.

5. How We Use Your Information

  • To provide and maintain the Service, including matching a Client with their assigned Coach.
  • To allow Coaches to view Client progress after the Client is assigned.
  • To apply Coach plan limits (free plan up to three Clients; Pro via in-app subscription) and keep subscription status on the Coach account across devices.
  • To send transactional and (if enabled) push notifications.
  • To monitor usage, diagnose crashes, and improve the Service.

6. Sharing and Processors

We share data only as needed to run the Service:

  • With your Coach: the assigned Coach can access your progress data and photos in the app. Our app does not provide a dedicated "Download" button, but a Coach using a web browser may still save images with standard browser functions.
  • Supabase - database, authentication, and file storage. Data location: EU (North).
  • Google Firebase (Google Ireland Limited / Google LLC) - Analytics, Crashlytics, Performance, Remote Config, Cloud Messaging.
  • PostHog - product analytics.
  • RevenueCat - subscription status and App Store / Google Play receipt validation. Apple and Google process the purchase itself.
  • Apple / Google - Sign in with Apple, Google Sign-In, push delivery, and in-app purchases where you use those services.
  • Cloudflare - hosting and security for this website.
  • Legal requirements: we may disclose data if required by Polish or other applicable law or valid public-authority requests.

7. International Transfers

Some processors (including Google, PostHog, RevenueCat, and Apple) may process data outside the European Economic Area, including in the United States. Where we do so, we rely on an adequacy decision (including the EU-US Data Privacy Framework where a processor is certified) and/or Standard Contractual Clauses, plus supplementary measures where appropriate.

8. Data Storage and Security

Account and content data (including photos) are stored using Supabase. Access to photos is limited to the authorized Client and their assigned Coach, plus our processors as needed to operate storage. No method of transmission or storage is 100% secure; we use commercially reasonable technical and organizational measures.

9. Retention

We keep personal data while your account is active and as needed for the purposes in this Policy. After we process an account deletion request, we remove data from our active databases. Limited copies may remain in backups for a short period until those backups rotate. Subscription and transaction identifiers may be kept for as long as Apple, Google, or applicable accounting rules require. If a Coach is in read-only mode for plan limits, we do not delete Client data for that reason alone.

10. Your Rights

If the GDPR/RODO applies (including if you are in the EEA), you may:

  • Access a copy of the personal data we hold about you.
  • Rectify inaccurate data.
  • Erase your account and associated data (photos, measurements, and other content we store), subject to legal retention.
  • Restrict or object to certain processing, and request portability of data you provided.
  • Withdraw consent for health data and photos by deleting them or not uploading new ones, and for notifications in device settings.

To exercise these rights, email support@stable-fit.com. We will respond without undue delay and in any event within one month (extendable by two months for complex requests, with notice). Cancelling a Pro subscription in Apple or Google does not by itself delete your StableFit account.

11. Children

The Service is for users 18 years or older. We do not knowingly collect personal data from children. If you believe we have, contact us and we will delete it.

12. Changes

We may update this Privacy Policy. We will change the "Last Updated" date and, where the change is material, provide additional notice in the app or by email.