Privacy Policy
Last updated: August 20, 2026 · Version 0.9 (
📋 Plain-language summary
- What we collect: identity (name, email and/or phone, date of birth), precise GPS location, workouts, goals, discovery preferences, photos and videos, messages, technical device data.
- How you sign up: primarily with Google or Apple. Email and phone signup are also available.
- Why: to run the app — show you people and places nearby, compute your OnFit level, deliver messages and notifications.
- What's sensitive: exact location, workout data (health), your goal (including Rehabilitation), live-training presence, and the fact that gender combined with visibility preferences allows your orientation to be inferred.
- Your OnFit level is public, computed automatically from how often you train.
- Stored in Canada (AWS
ca-central-1) — including your email and videos. Some providers receive data abroad (mostly the US): Mapbox, Sentry (crash reports), Google and Apple (sign-in and notifications). - We sell nothing. No third-party ads, no advertising identifier, no cross-app tracking, no third-party analytics. We do show our own banners, targeted by gender/age (see §4).
- Your rights: access, correction, deletion, portability. 30-day response.
- 18+ only.
This summary does not replace the full text below.
1. Who we are
OnFit Inc. ("OnFit", "we") operates the OnFit mobile application and onfitapp.com.
Controller: OnFit Inc., 216-155 rue du Prince-Édouard, Québec (Québec) G1K 0L2, Canada
Privacy Officer (Law 25, s. 3.1): David Cassivi, privacy officer — contact@onfitapp.com.
Governed by Law 25 (Québec) and PIPEDA (federal).
2. What we collect and why
2.1 Identity and account
You create your account with your phone number: we text you a verification code. That's the main path. You can also sign in with Google or Apple. There is no password — we never ask for one and we store none.
| Data | Purpose | Legal basis |
|---|---|---|
| First/last name, username | Create and display your profile | Performance of contract |
| Email address | Service messages and replying to a support request. It reaches us from Google or Apple if you use social sign-in. An account created by phone does not necessarily have an email. With Apple this may be a private-relay address (@privaterelay.appleid.com). | Performance of contract |
| Phone number | Creating your account and signing in — it is your main account identifier. We pass it to Twilio, which texts you the code and validates it (see §4.2). | Performance of contract |
| Google / Apple account id | Social sign-in (we do not receive or store your provider profile photo) | Performance of contract |
| Date of birth | Age requirement (18+), age-range display and filters | Performance of contract |
| Gender | Discovery display and filters | Consent |
| Bio, profile picture, gallery photos and videos | Profile content | Consent |
| Preferred language | Interface and communications language | Performance of contract |
Social accounts: when you sign up with Google or Apple, your account is created with no password and treated as already verified (the provider vouches for your email).
2.2 Sensitive information
The following are sensitive personal information under Law 25 (health, precise geolocation, inferred orientation). You control most of them via in-app settings.
| Data | Detail | Purpose |
|---|---|---|
| Precise location | Latitude/longitude and reverse-geocoded address, collected in the foreground only while you use the map or discovery. Only your current position is kept — no movement history. | Map, nearby places, nearby-member discovery |
| Live training | The fact that you are training "live" right now, to an audience you choose (FitFriends, followers, or everyone — followers by default). | Real-time presence, invitations to train together |
| Workout data | Sessions (start, end), training types, muscle groups, cardio, and the OnFit level frozen at the time of a post | Personal log, OnFit-level computation |
| Fitness goals | Including Rehabilitation, which may reveal a medical condition; premium members can filter on this attribute. | Suggestion relevance |
| Connection intents | Training partner, Social fitness, Dating | Discovery |
| Gender visibility preferences | Who can discover you, which genders you want to see | Discovery |
Transparency: gender combined with visibility preferences and the Dating intent permits an inference of sexual orientation. We treat this combination as sensitive and share it with no third party.
2.3 Activity and content
Posts, photos and videos, comments, likes, follows, private messages and chat proposals, OnFits sent and received, Explore swipe decisions, reports and blocks. Swipes help avoid showing you the same profile twice; retention is in §6. Also: the support requests you send us (category, subject, message, and the reply-to email address you provide — we ask for it because an account created by phone does not necessarily have an email), and the events you create or sign up for (place, date, and your attendance).
Photos and videos: your files are kept in their original format (videos are then optimized automatically by AWS in Canada, with no analysis of their content). An original file may contain metadata, including the GPS coordinates of where the photo was taken.
2.4 OnFit level — automated decision
Your level (Base, Core, Active, Prime, Elite, Athlete) is computed automatically from the number of workouts you publish over a recent rolling window (currently 10 days, re-checked every 5 days), is publicly displayed, and premium members can filter on it. No legal or contractual consequence attaches: it affects neither your access, nor a price, nor a right. Under Law 25 (s. 12.1) you may request the information used, the principal factors, and submit observations to a member of our team.
2.5 Technical and diagnostic data
Device identifiers and push tokens, device name (often a real first name), device model and OS, an installation identifier sent at launch for updates, IP address, usage logs.
Time spent in the app. Each time you open the app and leave it, we record the start time, the end time and the length of the session. These sessions stay on our own servers, in Canada: we send them to no external analytics tool. We use them, in aggregate, to measure how long members spend in the app; our internal statistics may break those durations down by gender and age range. They are deleted with your account.
Error and crash reports (Sentry). To diagnose failures, the app and server send error reports to Sentry (see §4). On your device, these are scrubbed before sending: emails, phone numbers, auth tokens and IP addresses are removed, and no account identifier is attached. They contain technical data (device model, app version, error trace, the screens you visited). On the server, only serious errors (HTTP 500) are reported; a trace may contain technical identifiers.
2.6 What we do not collect
No advertising identifier (IDFA/AAID), no App Tracking Transparency prompt, no third-party ad network, no third-party analytics in the app (the onfitapp.com website does use Google Analytics — see §10), no cross-app tracking, no biometric data (no selfie verification, no facial recognition, no Face ID), no wearable or health-platform integration (Apple Health, Google Fit), no processing of your data or media by any artificial-intelligence system. We store no payment card data — the app has no payment, shop or marketplace functionality.
3. Device permissions
| Permission | Why | If you refuse |
|---|---|---|
| Location (while in use) | Map, nearby places and members — foreground only | Map and nearby discovery stop working |
| Photos / media library | Pick a photo, publish content | You can't publish media |
| Camera | Take a photo or film a training video | You can't capture media in-app |
| Microphone | Record the audio of a training video | Your videos have no sound |
| Notifications | Messages, OnFits, profile activity | No notifications |
We request no background location and no contacts access. You can revoke any permission in your device settings at any time.
4. Who we share with
We do not sell your personal information and share it with no one for third-party advertising.
4.1 Other members
Your profile, OnFit level, posts and approximate distance are visible per your privacy settings. We never show another member your exact coordinates.
4.2 Our service providers
| Provider | What it receives | Outside Canada? |
|---|---|---|
| Amazon Web Services (database, files, email, video transcode, cache) | Hosting of everything: database, photos and videos (S3), email (SES), video optimization (Elemental MediaConvert). Region ca-central-1. | No — Canada |
| Twilio (Twilio Inc.) | Your phone number, every time you create an account or sign in. Twilio generates the code, texts it to you and validates it — we never see the code. Your number is then handed to the mobile carriers that deliver the message. | Yes — United States |
| Amazon CloudFront | Your photos and videos, cached at global edge locations (time-limited signed links) | Yes (global edge) |
| Sentry (Functional Software, Inc.) | Error and crash reports: technical trace, device context, navigation breadcrumbs. Emails, phones, tokens and IP removed; no account identifier attached. | Yes — United States |
| Mapbox | Your position (as map camera) and tile requests, plus map-usage telemetry | Yes — United States |
| Expo (650 Industries) | Push token, installation id, IP address, notification content | Yes — United States |
| Google (FCM) and Apple (APNs) | Android / iOS push token and notification content | Yes — United States |
| Google and Apple — social sign-in | Account id, email and name, if you use that sign-in (Apple may supply a private-relay address) | Yes — United States |
| Google Maps / Places | Place coordinates, for admin-side gym lookup only — nearby-member search now runs on our own servers, with no call to Google | Yes — United States |
| Microsoft 365 | Transactional email — dormant fallback only (primary email is AWS SES, in Canada) | Yes — United States / European Union (depending on the Microsoft data centre) |
Each provider is bound by contract, may use your information only to serve us, and may not retain it longer than necessary.
4.3 Our advertising and marketing
OnFit shows its own banners (map, profile), targeted by your gender, age and region; a banner may send you to an advertiser's external site (when you tap it, your browser reveals what any outbound click reveals: IP, user-agent, referrer). We count impressions and clicks in aggregate. No third-party ad network, no advertising SDK, no sharing of your data with advertisers for targeting.
We may also send promotional notifications, targeted by gender and age. Under Canada's Anti-Spam Law (CASL), you can turn these off in notification settings.
4.4 Other cases
Legal obligation or court order; protection of our rights or others' safety; a corporate transaction, of which you would be notified beforehand.
5. Transfers outside Québec
Primary storage is in Canada (ca-central-1) — including your files, videos and transactional email. Certain communications to providers outside Québec (mostly the US), listed in §4.2, are necessary to operate the service: content delivery (CloudFront), error monitoring (Sentry), map (Mapbox), notifications (Expo, Google, Apple) and social sign-in (Google, Apple).
6. Retention
We keep your information as long as your account exists, then delete it when you close your account, except the exceptions below. We keep no location history (only your current position, overwritten each update). Error reports sent to Sentry are kept per that provider's policy (about 90 days by default).
Two exceptions survive account closure:
- if you give a reason for leaving, it is kept with your email and username for statistics;
- your uploaded photos and videos may persist in our file storage and on the content-delivery network.
7. Your rights
You may exercise these rights free of charge: access, rectification, deletion, portability (structured, commonly used technical format), withdrawal of consent, explanation of your OnFit level (§2.4), and cessation of dissemination / de-indexing.
How: from the app's settings (account deletion), or by email to contact@onfitapp.com. We respond within 30 days. We may ask you to confirm your identity. Unsatisfied? Complain to the Commission d'accès à l'information du Québec (cai.gouv.qc.ca) or the Office of the Privacy Commissioner of Canada (priv.gc.ca).
8. Security
We apply reasonable security measures given the sensitivity of the information: TLS in transit and encryption at rest, verification codes generated and validated by Twilio — we do not store them, time-limited signed file links, Canadian cloud hosting, least-privilege staff access, and access logging. Our admin team's passwords are bcrypt-hashed; member accounts have no password at all.
No system is perfectly secure. In the event of a confidentiality incident presenting a risk of serious injury, we will promptly notify the Commission d'accès à l'information and affected individuals, per Law 25. We maintain a confidentiality incident register.
9. Minimum age
OnFit is restricted to people 18 and over. By creating an account, you represent that you are 18 or older. We do not knowingly collect information about minors and will delete any account we learn belongs to someone under 18. Report one: contact@onfitapp.com.
10. Cookies
The mobile app uses no advertising cookies or third-party trackers. The website onfitapp.com uses strictly necessary cookies The mobile app uses no advertising cookies and no third-party trackers. The onfitapp.com website does use Google Analytics to measure traffic: Google (in the United States) receives your IP address, the pages you view and a cookie identifier. That is the website only — none of it exists in the app..
11. Changes
Material changes will be announced in the app before taking effect and the date above updated. Because the app can be updated over-the-air (OTA), we will also notify you if such an update materially changes our information practices. Where a change affects consent-based processing, we will ask again. Previous versions available on request.
12. Upcoming features
For transparency, features in development that may change data collection: SMS code delivery for phone signup (will enable an SMS provider — Twilio or AWS SNS); a consent-acceptance screen with recording (KAN-497); possible future paid premium features (no payment functionality exists today; this policy would be amended beforehand).
13. Contact
OnFit Inc. — 216-155 rue du Prince-Édouard, Québec (Québec) G1K 0L2, Canada
Privacy Officer: David Cassivi, privacy officer
Email: contact@onfitapp.com