1. Who we are
This notice describes personal information processed when you visit or use YavaFit, operated under the name YavaFit (“we”, “us”). It covers our website, accounts, training tools and community features.
For access, correction, deletion, portability, or other privacy requests, contact YavaFit through the contact details on Help & support.
Include your account email and what you need. We may need to verify account ownership. Never send your password, a verification code, or private progress photos.
2. Information we use
- Account information: your email, display name, authentication details, signup eligibility and terms confirmation, and your chosen @username. Supabase handles password authentication; we do not display your password.
- Profile and preferences: the photo and bio you provide, fitness goal, experience, training days, optional gender selection, city and country, and discovery preference.
- Training and progress: your selected plans, completed workouts, exercise replacements, set weights and repetitions, optional body weight, height, waist/chest/hip measurements, personal goals and target weight, measurement dates and private notes, progress photos, and photo captions or dates you enter. These may reveal information about your fitness or health. You do not need to upload photos to train.
- Community activity: posts, uploaded media, comments, likes, follows, conversation membership, messages and read status.
- Technical information: authentication cookies and browser storage, and connection information such as IP address, browser details and request logs processed by our hosting and infrastructure providers to deliver and protect the service.
- Support information: what you choose to send when asking for help or exercising a privacy right. Please avoid unnecessary health information.
We obtain this information from you, your use of the app, your device, and other members who interact with you. We do not require payment card details for the current free service.
3. Why we use it
We use account information to create and secure your account, send authentication or recovery emails, and provide the features you request. We use preferences to suggest suitable plans, training records to show progress, and community information to deliver posts, connections and conversations.
Where a law requires a legal basis, core account and training processing is necessary to provide the service you request; proportionate security, reliability and abuse prevention serve our legitimate interests; and required records or disclosures may be processed to comply with legal obligations. Optional permissions and sharing depend on your choices. Where consent is legally required, you may withdraw it without affecting earlier lawful processing.
Plan matching uses your chosen goal, experience and number of training days to rank our plan library. You can preview and choose another plan. This is a fitness recommendation, not a medical assessment or a decision about your legal rights.
We do not sell personal information or use your private progress photos or messages for advertising. The current app does not include advertising pixels or a separate audience analytics SDK.
4. What others can see
- Member profiles: signed-in members can view your display name, @username, avatar, bio, training goal and experience, shared posts, and social connections. Turning off Nearby athletes removes you from city discovery; it does not make your entire profile invisible.
- City and country: other members see these when you enable discovery. Your email and gender selection are not included in the member profile shown by the app.
- Progress photos: private originals are available to you through authenticated, temporary links. Explicitly sharing a new check-in creates a separate community copy, visible to other members through a public image URL. You can delete your own community post, but that does not delete the private original, automatically remove the public image file, or retract copies someone has saved. Older check-ins that were explicitly shared can also remain visible through their community post.
- Public uploads: avatars and ordinary community image uploads use public image URLs. Anyone who obtains one of those URLs may be able to view or copy the image, even though the community screens require sign-in.
- Messages: conversations are shown to their members. Messages are not end-to-end encrypted; infrastructure processing and authorized access may be necessary to operate the service or comply with law.
Other people can screenshot or reshare information you send them. Avoid including addresses, identity documents, financial details or sensitive medical information in your bio, posts or messages.
5. Location is optional
You can select a country and city manually. If you tap “Use my location” and allow the browser permission, your device sends coordinates to our location endpoint to find a nearby city using the app’s city database. Coordinates are not saved as profile fields; the city and country you confirm are saved if you choose to save them.
There is no background location tracking or live distance map. You can deny or revoke location permission in your browser, clear your profile location, and switch off discovery in Settings → Location & visibility. Searching a different city does not change your saved profile location.
6. Providers and international processing
We use Supabase for authentication, databases and file storage, and Vercel for website hosting and delivery. Authentication and recovery emails are delivered through the email services configured for our authentication provider. These providers process information needed for their functions, including infrastructure and security logs.
Exercise videos and their thumbnails use YouTube/Google. Loading a thumbnail or embedded player sends connection information to those services. Embedded players use YouTube’s privacy-enhanced domain, which does not make them anonymous or prevent all processing. See Google’s privacy policy and our Cookies & storage notice.
Information may be processed outside the country where you live, depending on our providers’ infrastructure and project configuration. We do not promise that all data stays in a particular country. Where transfer restrictions apply, the operator must use the safeguards required by applicable law; you can request details about the arrangements relevant to your account.
We may also disclose information when required by law, to address fraud or security threats, to protect rights and safety, or as part of a business transfer subject to appropriate protections. We do not give other members access to your private training records through these features.
7. Storage, retention and security
Account, training and community records are retained while needed to provide your account and the features you use. After a deletion request, information may still need to be retained to meet legal obligations, resolve disputes, prevent abuse, or support limited backup recovery. The relevant purpose, sensitivity, legal requirements and provider backup cycles determine retention; we do not promise an unverified fixed deletion deadline.
We use authentication, access controls and private storage for private progress photos. No internet service can guarantee absolute security. Keep your password private, use a strong unique password and sign out on shared devices. Browser storage may contain unsent drafts; see Cookies & storage for how to clear it.
8. Your choices and rights
You can edit your name, bio, photo, @username and preferences in Settings; disable discovery or clear your location there; and choose private saving or community sharing for a new check-in in Progress. Body measurements, height, personal goals and target weight are kept in private account records and are not displayed on your member profile or automatically shared with photos. You can edit or delete individual measurement check-ins, clear your height, or remove your personal goal and target in Progress. Optional gender selection can be changed to “Prefer not to say”.
Depending on applicable law, you may have rights to access, correct, delete or obtain a copy of your information, restrict its processing, withdraw consent, or object to processing based on legitimate interests. You may also complain to the data protection authority where you live or work. These rights can be subject to legal exceptions.
Self-service account deletion, full data export and deletion of stored progress-photo originals are not currently available in the app. Signing out, removing an avatar, deleting a post, or hiding your profile from discovery does not delete your account or all associated files. Use the privacy contact route for account-wide or stored-file requests.
For access, correction, deletion, portability, or other privacy requests, contact YavaFit through the contact details on Help & support.
Include your account email and what you need. We may need to verify account ownership. Never send your password, a verification code, or private progress photos.
9. Adults and policy changes
YavaFit is intended for adults aged 18 and over. Do not create an account if you are under 18. If you believe a child has provided personal information, contact the operator so it can be investigated.
We update this notice when the service or its data practices change. The date above identifies the current version. For material changes affecting your choices, we will provide an appropriate notice or seek consent when required.