Last updated: November 4, 2026
Developer / Разработчик: ZackysStudio App / Приложение: Fitcore — workout & nutrition tracker Contact / Контакты: zackysstudio.support@gmail.com
This Privacy Policy explains how Fitcore (“the App”, “we”, “us”), published by ZackysStudio, handles information when you use the App. The App is a workout planning, nutrition tracking and AI fitness assistant app for a general audience. It is not directed to children under 16 (or the equivalent minimum age in your country).
By entering the App (signing in or creating an account) you accept this Policy and our Terms of Use. We keep a record of this acceptance (see section 2.14).
Полный текст — на английском; при расхождениях приоритет у английской версии.
Úplné znění je v angličtině; při rozporech má přednost anglická verze.
When you register with an email and password, or sign in with Google, we process your email address. Passwords are stored hashed and are never accessible to us in plain text. If you sign in with Google, Google shares your email, name and profile picture with our authentication service. Our authentication service also keeps technical session records (session tokens and timestamps) so that you stay signed in.
So that your profile and subscription work on your account, our server stores: your first and last name, gender, date of birth / age, height, weight, body-fat percentage (if you enter it), activity level, experience level and nutrition goal; your Premium status and its expiry date; and usage counters (how many AI scans, chat messages and workout generations you have used in the current period, and when that period started). We also keep a record of your acceptance of these documents (section 2.14).
Body measurements and goals may be considered health data. We use them only to provide the App’s features (see sections 3 and 4).
Access to this data is limited to the developer (ZackysStudio), who may view it in an administration panel to operate the service and to provide support.
The following stays on your device only and is not sent to our server: your workout history and logged exercises, custom exercises, workout programs, your nutrition log, your AI chat history, your calorie and macro targets (calculated on the device), your settings and your reminders. Because of this, this data is not available on another device, and it is lost if you delete the App’s data or uninstall the App.
Depending on your device settings, Android may include the App’s data in your Google backup and restore it when you reinstall the App. That backup is controlled by Google and your device settings, not by us. Your sign-in token is the exception: it is kept in the device’s encrypted secure storage and is excluded from Android backups, so after reinstalling the App or moving to a new phone you sign in again (your local data may be restored, your sign-in is not).
If you sign in with a different account on the same device, the previous account’s local data is set aside on the device and restored when you sign in to that account again. Deleting your account removes this local data from the device (see section 7).
If you use the food-scanning feature, the photo(s) of your meal and any description you type are sent to our server, which forwards them to Google’s Gemini API to recognize the food and estimate its calories and macros. We do not store the photos on our server; Google processes them as described in section 2.6. See: https://ai.google.dev/gemini-api/terms
This content is forwarded to Google’s Gemini API to generate the response. We do not store the content of your messages or generated programs on our server (your chat history is kept on your device only).
Google processes this content as an independent provider under the Gemini API terms. Those terms differ between free-of-charge and paid usage; under the free-of-charge terms Google may use submitted content to improve its products and it may be reviewed by people. Please do not put information in photos or chat messages that you do not want processed this way. See: https://ai.google.dev/gemini-api/terms
When you search for a food by name, the search text is sent directly from your device to Open Food Facts (search.openfoodfacts.org) and/or USDA FoodData Central (api.nal.usda.gov) to find nutrition values. When you scan a barcode, the barcode number is sent directly from your device to Open Food Facts (world.openfoodfacts.org); the barcode is read on your device and the camera image is not sent anywhere. These services receive the search text or barcode number and your IP address; they do not receive your account, name or email.
Products you have looked up are kept in a cache on your device only (up to 100 products, for up to 30 days) and are set aside with your other local data when you sign in to another account. Product data comes from Open Food Facts contributors under the Open Database License (ODbL).
If you buy a Premium subscription, the transaction is handled by Google Play Billing or the App Store. We use RevenueCat to validate and manage your subscription status. RevenueCat processes a purchase token and an app-user identifier (our internal account ID) to confirm whether your subscription is active. We never receive or store your full payment card details — those are handled by the app store. See: https://www.revenuecat.com/privacy
When you register, we send you a confirmation email (and, if you ask, a new confirmation link). If you use “Forgot password?”, we send you an email with a link to set a new password. These emails are sent through Resend, which processes your email address and the message to deliver it. We send no marketing emails. See: https://resend.com/legal/privacy-policy
To keep the free AI-scan limit fair — so that creating a new account does not give new free scans — the App sends a device identifier with its requests (on Android, the device’s Android ID). Our server keeps only a one-way (keyed) hash of it, never the identifier itself, together with the number of AI scans used on that device and when the counting period started. While your account exists, we also record that it was used on that device; this link is removed when the account is deleted.
Our server keeps a technical request log: the time, request type and address path, response code, response time and size, your IP address and your account ID. The log does not contain the content of requests — no photos, messages or tokens. Entries are deleted automatically after 14 days. Our server is reached through Cloudflare, which processes requests (including your IP address) in order to deliver and protect the service.
The App may download its fonts from Google Fonts the first time they are needed. This reveals your IP address to Google; no account data is sent.
The App can schedule reminders about workouts and meals at times you choose. These reminders are scheduled entirely on your device using the device’s own notification system; no reminder content or schedule is sent to us.
You accept this Policy and the Terms of Use by entering the App: signing in or creating an account. When you register you also tick a box confirming it. So that we can show that you accepted them, the App sends our server a record when you enter it: your account, the versions of this Policy and of the Terms (the “Last updated” date of each document), the date and time, how you accepted (the checkbox at registration, or by entering the App), the app version and the interface language. This record does not include your IP address.
We record your acceptance again when we publish a new version of these documents. The record is kept for as long as your account exists and is deleted when you delete your account.
If you tap the flag next to an AI answer (in the AI assistant chat, the workout generator or the food-scan result) and send a report, we receive: the text of that answer, your preceding question or description (if there was one), the reason you selected, your optional comment, your interface language, the app version and your account ID. We use reports only to review and improve the safety of AI answers and to meet app store requirements. Reports are visible to the developer and are not shared with other users or providers. You can send up to 20 reports per day. Please do not include information in a report that you do not want us to see. Reports are kept until you delete your account and are deleted together with it.
When you create an account or change your password, our authentication server checks the new password against the Pwned Passwords service of Have I Been Pwned (api.pwnedpasswords.com), which lists passwords exposed in known data breaches. Only the first five characters of a one-way hash (SHA-1) of the password are sent. The password itself, your email and any other account data are never sent, and the service cannot tell which password or account the request is about. The request is made by our server, so the service sees our server’s IP address, not yours. If the password appears in known breaches, we ask you to choose another one. See: https://haveibeenpwned.com/Passwords
We (and our providers, for their own described purposes) use the information to:
We do not sell your personal information, and we do not use your data for advertising.
android.permission.CAMERA) — only for the barcode scanner. The camera image is
processed on your device to read the barcode; the App does not save or upload it, and only
the barcode number is used (see section 2.7). The permission is requested when you first open
the scanner and is optional: if you decline, you can type the number instead.com.android.vending.BILLING) — to offer and manage Premium purchases.android.permission.SCHEDULE_EXACT_ALARM) — only so the rest-timer signal
arrives on time while the screen is off.We share data only with the providers below, and only as needed to provide the App’s features:
| Provider | What it receives | Why |
|---|---|---|
| Google (Gemini API) | Photos, messages and profile details described in 2.4–2.5 | Food recognition, AI assistant, workout generation |
| Google (Sign-In) | Your Google account details if you choose Google sign-in | Sign-in |
| Google (Fonts) | Your IP address | Download app fonts |
| RevenueCat and Google Play / App Store | Purchase token, account ID, subscription status | Premium subscriptions |
| Resend | Your email address and the account message (confirmation, password reset) | Account emails |
| Cloudflare | Requests to our server, including IP address | Delivering and protecting our server |
| Open Food Facts, USDA FoodData Central | Food search text or barcode number, and IP address (directly from your device) | Nutrition values |
| Have I Been Pwned (Pwned Passwords) | First five characters of a one-way hash of a new password, and our server’s IP address | Reject passwords from known data breaches |
Our database and backend run on infrastructure that we operate directly rather than on a third-party cloud database provider. We do not use advertising or analytics SDKs.
We may also disclose information if required by law. We do not sell your personal information.
We keep your account and profile data while your account is active.
You can delete your account yourself in the App: open the Profile tab, scroll to the bottom and tap Delete account, then type the confirmation word and confirm. Deletion is immediate. You can also request deletion by email — see our Data Deletion page or write to zackysstudio.support@gmail.com.
When your account is deleted, we remove: your sign-in account and sessions, your profile and subscription status, your usage counters, the request-log entries linked to your account, your record of acceptance of these documents, your reports about AI answers, and we ask RevenueCat to delete your subscriber record. The App’s data on your device is erased too.
A few things remain, as described on the Data Deletion page: a short record that the deletion happened (date, technical account ID, masked email and IP address) kept for security and accountability; the device scan counter (linked to a hash of the device, not to your account); records that app stores and payment providers must keep by law; and data held by the providers named above under their own policies. Deleted data may also remain in the routine database backups of our server, which we keep for 14 days and then overwrite.
Deleting your account does not cancel an active Google Play / App Store subscription — cancel it separately in your store account.
Depending on where you live (for example under the EU/UK GDPR or the CCPA), you may have the right to access, correct, delete, or restrict processing of your personal data, to object to certain processing, to withdraw consent, or to receive your data in a portable format. You can delete your account in the App (section 7). To exercise other rights, contact us at zackysstudio.support@gmail.com. You also have the right to complain to your data-protection authority (in the Czech Republic: the Office for Personal Data Protection, https://www.uoou.gov.cz).
Our servers and providers may process data in countries other than your own, including the United States. Where required, transfers rely on appropriate safeguards under the providers’ own frameworks (for example, standard contractual clauses or the EU–US Data Privacy Framework).
The App is intended for a general audience and is not directed to children under the age of 16 (or the applicable age in your jurisdiction). We do not knowingly collect personal information from children. The App does not let you enter a date of birth that makes you younger than 16. If you believe a child has provided us personal information, contact us at zackysstudio.support@gmail.com and we will take appropriate steps.
The App is not a medical device and the health, nutrition and workout information it provides — including AI assistant responses — is for general informational purposes only and is not medical advice. Consult a qualified physician before starting any exercise program or changing your diet.
We may update this Policy from time to time. Material changes will be reflected by updating the “Last updated” date above and, where appropriate, through an in-app notice. When we publish a new version of this Policy or of the Terms, the App records your acceptance of the new version the next time you sign in.
ZackysStudio Email: zackysstudio.support@gmail.com