Privacy Policy

This policy explains what personal data FitBlock collects, why, who handles it for us, and the choices you have. FitBlock is a workout routine builder and player. It is in beta, so we keep this policy short and specific, and we update it when the app changes.

Who we are

FitBlock is operated by Codepilot SpA, a company in Chile (“we”, “us”). We are the controller of the personal data described here. For anything about this policy or your data, write to fitblock@codepilot.cl.

This policy covers the FitBlock app at app.fitblock.cl, this website atfitblock.cl, and FitBlock’s connector for AI chat apps.

What we collect

Your account

• Email and password. If you sign up with email, we store your email address and your password. Our authentication provider stores the password only as a one-way hash; nobody at FitBlock can read it.
• Google sign-in. If you sign in with Google, Google shares yourname, email address and profile picture with us (Google’s basicopenid, email and profile permissions). We use them to create your account and to show your name and picture in the app. We don’t ask Google for anything else: no contacts, no calendar, no Gmail, no Drive.
• Account records kept by our authentication provider: when the account was created, when you last signed in, and the sessions of the devices you are signed in on.

Your profile and settings

Your language, theme, weight and distance units, workout audio settings, the bars and plates in your gym, how percentage loads are rounded, and which introductions and tips you have seen. Two profile fields are optional and empty unless you fill them in: date of birth andgender.

Your training

• Routines and templates: their names, notes, blocks, exercises, sets, reps, loads, rests and time caps, and the music you choose for them (a YouTube link, or the titles of local audio files; the files themselves stay on your device).
• Custom exercises you create, including compound exercises.
• Workouts: when you trained, which sets you completed, the loads, reps, times, distances, calories and split times you logged or the app measured.
• Personal records and their history, and the records waiting for your review.
• Shared routines: if you turn on “Share by link” for a routine, we keep the link’s token so that signed-in people who have the link can preview and copy the routine. Turning the switch off revokes the link.

Feedback you send

If you use “Send feedback”, we store your message, whether it is a problem or a suggestion, and the context the app shows you before you send it: the app version, the screen you came from, your browser and device (user agent), screen size, language, theme, whether the app is installed, and whether you were online. It includes no workout data, no location and no screenshots.

Connections you make

• Music accounts. If you connect a music account (seeThird-party services you choose), we store the access tokens, encrypted, and the permissions you granted.
• AI apps. If you connect an AI chat app, we store which app you authorised, when, and its access level: read-only, or read and change.

Technical logs

When your device talks to our servers, our hosting and database providers record technical data such as your IP address, browser, the address requested, the time and the result. These logs are used for security and to fix problems, and the providers keep them only for a short time (days, not months).

Location (GPS)

• Location is used only if you turn on “Track distance with GPS” in a workout’s settings and your browser’s location permission allows it. The switch appears only for routines with running sets.
• The app asks for your position once when you turn the switch on, to get the permission. It then follows your position from the moment you start the workout, and stops when you pause, leave the workout or finish it. Distance counts only during timed and distance sets.
• Positions are processed in your device’s memory to work out distance, pace and splits. They are never written to your device’s storage and never sent to us or anyone else.
• What is saved with the workout: the distance in metres, the time, the seconds GPS could not track, and the time of each kilometre or mile. No coordinates, no route, no map.
• Your device remembers whether you turned GPS on for each routine. You can turn it off with the same switch, or withdraw the permission in your browser or phone settings at any time.

What stays on your device

FitBlock is an installable web app that works offline, so it keeps some data in your browser’s storage on your device:

• Your sign-in session, so you stay signed in, and your name, email and picture, so the app knows you while offline.
• Copies of your settings, custom exercises, the exercise library, active and recent workouts, and changes waiting to be sent when you are back online.
• Small preferences such as the theme, the bar loader’s last load, your GPS choice per routine, and whether you dismissed the install or AI app cards.
• If you play your own audio files, a reference to each file you picked. The files never leave your device.
• The app’s own files, cached so it opens without a connection.

FitBlock doesn’t set cookies and uses no advertising identifiers. This website stores nothing on your device. Signing out removes your session; clearing the site’s data in your browser removes everything else.

How we use your data

• To provide FitBlock: keep your account, sync your routines and workouts across devices, run the workout player, and work out your records and trends.
• To send account emails: sign-up confirmation and password reset. We don’t send marketing emails.
• To keep the service secure and prevent abuse.
• To fix bugs and improve FitBlock, from the feedback you send and the technical logs.
• To answer your requests and meet our legal obligations.

We don’t use your data for advertising or profiling, we don’t sell it, and we don’t use it to train AI models.

Legal basis

• Our contract with you (the Terms of Service): your account, your training data and the account emails.
• Your consent: GPS, the optional profile fields, music account connections, AI app connections and feedback. You can withdraw it at any time; that doesn’t affect what was done before.
• Our legitimate interests: security, preventing abuse and fixing problems, using the minimum data needed.
• Legal obligations, when the law requires us to keep or disclose data.

Who processes your data for us

These providers process data on our behalf, under contracts that limit them to providing their service to us:

• Supabase (Supabase, Inc.): the database, sign-in and the server functions behind the app. All the account and training data described above is stored there.
• Cloudflare (Cloudflare, Inc.): hosts and delivers the app and this website, and passes AI app requests to our servers.
• An email delivery provider, which sends the sign-up and password reset emails.

Database backups are kept on storage we control. We may disclose data if the law requires it, or to a successor if FitBlock is transferred to another company, which would remain bound by this policy.

Third-party services you choose

Some features connect FitBlock to services run by other companies. They are optional, they only start when you use them, and each company handles data under its own terms and privacy policy.

Google sign-in

When you sign in with Google, Google authenticates you and shares the name, email and profile picture described above. You can remove FitBlock’s access at any time in your Google Account atmyaccount.google.com/connections; you will then need another way to sign in.

YouTube

If you add a YouTube video or playlist link to a routine, the workout plays it in YouTube’s official embedded player, which uses YouTube API Services. By using YouTube in FitBlock you agree to the YouTube Terms of Service, and Google handles what the player collects under the Google Privacy Policy. The player is loaded only when a workout with YouTube music starts, and YouTube may set its own cookies when it plays. FitBlock stores only the link you added.

FitBlock currently doesn’t ask for access to your YouTube account. If we offer it later, it will be read-only access to list your playlists, the tokens will be stored encrypted, and you will be able to disconnect it in Settings → Music or revoke it atsecurity.google.com/settings/security/permissions. Disconnecting deletes the stored tokens and asks Google to revoke them.

Spotify

Spotify is not offered yet. When it is, you will be able to connect a Spotify account to play your playlists during a workout. FitBlock would then store encrypted access tokens and ask Spotify for permission to read your playlists and control playback; Spotify’s player also requires access to your Spotify email and subscription type, which FitBlock doesn’t store. Spotify’s own privacy policy would apply, and you could disconnect in Settings → Music.

AI chat apps (MCP)

You can connect an AI chat app such as Claude or ChatGPT to FitBlock through its MCP connector. You sign in to FitBlock and approve the connection on a FitBlock consent screen; no password or key is shared with the AI app.

• A connected app can read your exercises, routines, workouts, settings and personal records. It can create and change exercises, routines and workouts only if you allowed changes.
• No AI app can delete your data, change your personal records, read your feedback or reach your music tokens.
• What you share in a chat, and what the AI app reads from FitBlock, is then handled by that app’s provider (for example Anthropic or OpenAI) under its own terms and privacy policy.
• You can change an app’s access level or disconnect it at any time in Settings → AI apps.

Google user data

FitBlock’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

In practice: we use the name, email and picture from Google sign-in, and any YouTube data you allow, only to provide the FitBlock features you use. We don’t transfer them to others except as needed to provide those features, to comply with the law, or as part of a merger or acquisition; we don’t use them for advertising; and no person reads them unless you ask us to, it is needed for security, or the law requires it.

What we don’t do

• No ads, in the app or on this website.
• No selling or renting of your data.
• No analytics, tracking pixels or third-party trackers. Neither the app nor this website loads third-party scripts, apart from YouTube’s player (and Spotify’s, once offered) when you choose to play music from them.
• No storing or sending of your GPS positions.

How long we keep data

• Your account, settings and training data: for as long as your account exists, or until you delete them.
• Feedback: for as long as your account exists, unless you ask us to delete it sooner.
• Music and AI app connections: until you disconnect them or delete your account.
• Technical logs: a few days, as kept by our providers.
• Backups: copies of the database roll over within 14 days, so deleted data disappears from them within that time.

Deleting your account

The app doesn’t have a delete button yet. To delete your account, emailfitblock@codepilot.cl from the address of your FitBlock account, with the subject “Delete my FitBlock account”. If you write from another address, we will ask you to confirm from the account’s address first.

• Within 30 days of confirming the request, we delete your account and all its data: your sign-in record, profile and settings, routines and templates, custom exercises, workouts, personal records, shared links, feedback, music connections (we also ask the music provider to revoke the tokens) and AI app connections.
• We email you when it is done. Backups roll over within 14 days after that.
• We keep only a record that we received and completed the request (your email and the dates), to show we did.
• Routines you shared that others already copied belong to their accounts and are not deleted.
• Before deleting, you can ask us for a copy of your data. Data on your devices stays until you sign out or clear the site’s data.

Security

• All traffic is encrypted with HTTPS.
• The database checks every request so that each account reaches only its own data; AI apps are read-only unless you allow changes.
• Passwords are stored as hashes, and music tokens are encrypted.
• The app and this website use a strict Content Security Policy.

No system is perfectly secure. If a breach affects your data, we will tell you and the authorities as the law requires.

International transfers

Our providers run servers outside Chile, for example in the United States or the European Union, so your data may be stored and processed there. We use providers that commit by contract to protect it and to use it only to provide their service to us.

Children

You must be at least 14 years old to use FitBlock. We don’t knowingly collect data from anyone younger. If you believe a child under 14 has an account, write tofitblock@codepilot.cl and we will delete it.

Your rights

Under Chile’s data protection law, and the law where you live, you can ask us to:

• tell you what data we hold about you and give you a copy (access);
• correct data that is wrong (rectification);
• delete your data (deletion);
• stop or limit a use of your data (objection and restriction);
• give you your data in a structured, machine-readable format (portability);
• withdraw a consent you gave.

You can change most of your data yourself in the app. For anything else, write tofitblock@codepilot.cl. We answer within 30 days and may ask you to confirm it is your account. If you are not satisfied with our answer, you can complain to the data protection authority: in Chile, the Agencia de Protección de Datos Personales.

Changes to this policy

When we change this policy, we update the date at the top. If a change is significant, we tell you in the app or by email before it applies.

Contact

Codepilot SpA, Chile. Email: fitblock@codepilot.cl.