Privacy Policy
Last updated: October 28, 2026 · Contact: support@bitefitness.app
1. Who We Are
Bite ("we", "us", "our") is a fitness coaching application. When you use Bite, we act as the data controller for your personal information.
2. What Data We Collect
2.1 Account Data
- Email address
- Password (stored as a bcrypt hash; we never store your plain-text password)
- Date of birth (used for age verification only)
- Auth provider (email, Google, or Apple)
2.2 Profile & Goals
- Name (optional)
- Body weight and height
- Fitness goals (weight loss, muscle gain, etc.)
- Training experience level and days per week
2.3 Workout Data
- Workout plans and programs
- Exercise logs: sets, reps, weight, RIR (Reps in Reserve)
- Session history and personal records (PRs)
2.4 Nutrition Data
- Meal logs including food items, calories, and macronutrients
- Meal photos (when you use photo analysis; not stored permanently)
2.5 Body & Health Metrics
- Body measurements (weight, body fat %, etc.)
- Sleep data, step count, heart rate, and HRV (if you connect Apple Health)
2.6 AI Coaching Data
- Messages you send to the AI coach
- AI-generated insights and recommendations
- Your responses to check-ins and readiness surveys
2.7 Technical Data
- Device type and operating system
- App version
- Crash reports and error logs (via Sentry)
- Product usage events (via PostHog), such as which features you open and whether an action was completed. These events do not include your workout, nutrition, body or health values, photos, or messages, and we do not record your screen.
- IP address (logged by our server infrastructure)
2.8 Social Data (if you set up a Social profile)
- Username, profile photo, bio, and link
- Posts you share, such as workouts, meals, and reports, with their captions and photos
- Comments, likes, follows, follow requests, and blocks
- Reports you submit about other users or content
3. How We Use Your Data
| Purpose | Legal Basis |
|---|---|
| Providing the coaching service (workout plans, AI insights, nutrition tracking) | Performance of contract |
| Personalizing AI coaching based on your history | Performance of contract |
| Showing your Social profile, posts, and training stats to other users, as set by you | Performance of contract |
| Reviewing reports and removing content or accounts that break our Terms | Legitimate interest |
| Sending transactional emails (verification, password reset) | Performance of contract |
| Crash reporting and app improvement | Legitimate interest |
| Measuring which features are used, to improve the app (product analytics) | Legitimate interest |
| Processing subscription payments | Performance of contract |
| Complying with legal obligations | Legal obligation |
We do not sell your data to third parties. We do not use your data for advertising.
4. AI & OpenAI
Bite uses OpenAI's API to generate coaching insights and responses. When you interact with the AI coach:
- Your workout history, nutrition data, and health metrics are sent to OpenAI as context
- OpenAI processes this data to generate a response
- OpenAI does not use API data to train its models (per their API data usage policy)
- We do not send your email address or name to OpenAI
5. Photo Processing
Meal photos: When you log a meal using the camera or photo library, the image is sent to OpenAI's Vision API for nutritional analysis. The image is not stored permanently; only the extracted nutritional data is saved.
Post photos: Photos you add to a Social post are stored in private storage (Supabase, EU). Other users see them only through links that expire after a few minutes. They are deleted when you delete the post or your account.
6. Wearables & Health Data
Bite can connect to wearables and health platforms so you don't have to log the same data twice. We only turn on each integration for users after it has been tested end-to-end on real devices and accounts, not on a fixed schedule. The current availability of every integration below is listed at bitefitness.app/integrations. Connecting any of these is always optional and can be turned off at any time from Settings.
6.1 Apple Health
If you grant permission, Bite reads the following from Apple HealthKit:
- Step count
- Sleep analysis
- Resting heart rate and heart rate variability (HRV)
- Active energy burned
- Body mass
- Biological sex and date of birth (to prefill your profile during setup)
This data never leaves Apple's HealthKit framework except as summaries sent to Bite's servers to improve your readiness score and AI coaching insights. It is never shared with advertisers or sold to third parties, in compliance with Apple's HealthKit guidelines.
6.2 Apple Watch (workout companion)
If you use the Apple Watch companion, your current workout (exercises, sets, weights, and rest timers) is mirrored to your watch and logged sets sync back to your phone. No additional health data is read beyond what Section 6.1 already covers.
6.3 Android Health Connect
If you grant permission, Bite reads the same categories as Apple Health (Section 6.1), including steps, sleep, resting heart rate, HRV, active energy, and body mass, directly from your Android device via Google's Health Connect platform. Used for the same purposes and under the same restrictions as Apple Health data.
6.4 Oura
If you connect an Oura account, Bite reads the following via Oura's API:
- Sleep stages and duration
- Daily readiness inputs
- Daily activity
- Heart rate
- Logged workouts
Used to improve your recovery assessment and coaching insights. You can disconnect your Oura account at any time from Settings, which also revokes Bite's access on Oura's side.
6.5 Polar
If you connect a Polar account, Bite reads the following via Polar's AccessLink API:
- Sleep
- Daily activity
- Nightly recovery ("Nightly Recharge")
- Training sessions
Used to improve your recovery assessment and coaching insights. You can disconnect your Polar account at any time from Settings.
6.6 WHOOP
If you connect a WHOOP account, Bite reads sleep, workout, and physiological data such as resting heart rate and HRV via WHOOP's API.
Bite computes its own recovery assessment from this underlying data; we do not display WHOOP's proprietary Recovery Score or Strain metrics inside Bite. You can disconnect your WHOOP account at any time from Settings, which also revokes Bite's access on WHOOP's side.
Where each wearable provider is legally based, once its integration is enabled:
| Provider | Location |
|---|---|
| Apple (HealthKit) | Data stays on your device; only summaries sync to Bite |
| Google (Health Connect) | Data stays on your device; only summaries sync to Bite |
| Oura Health Oy | Finland (EU) |
| Polar Electro Oy | Finland (EU) |
| WHOOP, Inc. | USA |
WHOOP is a US-based processor and, once enabled, will be covered by Standard Contractual Clauses (SCCs) for GDPR compliance, the same protection already in place for our other US-based service providers listed in Section 8.
7. Social Features
Social is optional. Nothing you log is shown to other users until you set up a Social profile, and a new profile is private by default. You can change this at any time in Edit Profile.
7.1 Who can see what
| What | Private profile (default) | Public profile |
|---|---|---|
| Username, name, and profile photo | Bite users, so they can find you and ask to follow | Bite users |
| Posts, photos, comments, and likes | Followers you approve | Everyone, except posts you limit to followers |
| Bio, link, followers, following, level, workout stats, weekly activity, and achievements | Followers you approve | Everyone |
| Training stats in Head to Head (workouts, training time, volume, muscle split, Strength Map) | Followers you approve | Everyone |
| Your lifts on exercise leaderboards | Followers you approve | Your followers |
| That you are training right now ("Show when I'm training", on by default) | Your followers | Your followers |
| Your current exercise and sets ("Let followers watch live", on by default) | Your followers, unless you turn it off | Your followers, unless you turn it off |
Head to Head stats are based on all the workouts you log, including ones you never post.
7.2 Blocking, reporting, and moderation
You can block any user. A blocked user cannot find you, see your profile or content, or interact with you, and you will not see theirs. You can report profiles, posts, comments, and shared programs. Our team reviews reports and may remove content or suspend accounts that break our Terms. We keep reports as safety records. When an account is deleted, its link to those records is removed.
7.3 Deleting Social data
Deleting a post removes it with its photos, comments, and likes. Deleting your account removes your Social profile, posts, photos, comments, likes, and follows.
8. Who We Share Data With
| Service | Purpose | Location |
|---|---|---|
| Supabase | Database and file storage | EU (AWS eu-west-1) |
| OpenAI | AI coaching features | USA |
| RevenueCat | Subscription management | USA |
| Sentry | Crash reporting | USA |
| PostHog | Product analytics | EU |
| Resend | Transactional email | USA |
| Other Bite users | What your Social profile shows, as set by you (Section 7) | Worldwide |
All US-based processors are covered by Standard Contractual Clauses (SCCs) for GDPR compliance.
9. Data Retention
| Data type | Retention period |
|---|---|
| Account data | Until account deletion |
| Workout & nutrition logs | Until account deletion |
| AI conversation history | Until account deletion |
| Social posts, photos, comments, and likes | Until you delete them or your account |
| Reports about users or content | Kept as safety records; links to deleted accounts are removed |
| Crash logs (Sentry) | 90 days |
| Product usage events (PostHog) | Up to 12 months |
| Email logs | 30 days |
You may request deletion of your account and all associated data at any time through the app (Settings → Delete Account) or by emailing support@bitefitness.app.
10. Your Rights (GDPR)
If you are in the European Economic Area, you have the right to:
- Access: request a copy of your personal data
- Rectification: correct inaccurate data
- Erasure: request deletion of your data ("right to be forgotten")
- Portability: receive your data in a machine-readable format
- Restriction: restrict how we process your data
- Object: object to processing based on legitimate interest
- Withdraw consent: where processing is based on consent
To exercise any of these rights, email support@bitefitness.app. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.
11. Children's Privacy
Bite is only for adults and is not intended for anyone under 18. We check the date of birth during registration and do not let anyone younger sign up. If we learn that someone under 18 has an account, we will delete the account and its data.
12. Security
We protect your data using:
- HTTPS for all data in transit
- bcrypt password hashing
- JWT tokens with short expiry (15 minutes)
- No plaintext secrets in code or version control
13. Changes to This Policy
We will notify you of material changes via email or in-app notification. The "last updated" date at the top of this page will always reflect the most recent version.
14. Contact
For privacy questions or data requests: support@bitefitness.app