Privacy Policy

Effective date: November 10, 2026 · Version 2026-11-10 · Last updated November 12, 2026

This Privacy Policy explains how AllinFit, LLC, a Delaware limited liability company ("All-In Fit", "we", "us"), collects, uses, shares and protects personal information when you use the All-In Fit apps, websites, coach portal and the Alfi AI assistant (the "Services"), and the choices and rights you have. Residents of Washington State and other U.S. states with consumer-health-data laws should also read our Consumer Health Data Privacy Policy.

The short version

• We collect the information you give us (account, body and fitness data, workouts, meals, photos, messages) and some technical data, to run the Services for you.
• Some of it is health information. We process it only with your consent and to provide the features you use.
• We do not sell your personal information and never use your health data, photos or AI conversations for advertising. Our marketing website uses advertising cookies only if you accept them. To measure our own ad campaigns, the mobile app tells Meta, TikTok and Google that the app was installed, an account was created or a subscription was started — nothing else, and you can switch this off in the app.
• When you connect to a coach, the coach sees your fitness, nutrition, measurement and progress data.
• When you use Alfi, relevant data is sent to our AI providers to generate answers — only after you give permission.
• You can access, export, correct and delete your data, and withdraw consent, at any time.

1. Who is responsible

AllinFit, LLC is the controller (the party deciding how and why personal information is processed) for the personal information described here. When a coach uses the Services to manage their clients, the coach decides what to do with their clients' information for their own coaching business and is an independent controller of it; for that use, we act on the coach's behalf as a service provider (processor). See also our Coach Terms.

Contact: support@allinfit.app (subject "Privacy") · AllinFit, LLC (Delaware, USA). In Israel, the Services are also operated by All-In Fit (אולין-פיט), reachable at the same address.

2. Information we collect

2.1 Information you provide

2.2 Information from devices and integrations

• Apple Health / Google Health Connect (only if you enable it): step count and active energy burned. We use HealthKit/Health Connect data only to provide health and fitness features to you; we never sell it, never use it for advertising, and never disclose it to third parties for those purposes.
• Camera, microphone and photo library (only when you use a feature that needs them): to take or upload photos and videos, scan barcodes, or record voice messages.
• Push notification tokens, to send reminders and messages.
• Device and usage data: device model, operating system, app version, IP address, approximate location derived from IP, crash logs, pages and features used, and identifiers used for analytics and, in the mobile app, for measuring our ad campaigns (such as the device advertising identifier, where your device makes it available).
• Cookies and similar technologies on our websites (see Section 9).

2.3 Information from others

• Your coach may enter information about you (for example programs, notes, check-in results).
• Other users may mention you, message you or invite you.
• Sign in with Apple or Google: your name and email (or a private relay email).
• Payment processors and app stores: confirmation of purchases, renewals, refunds and subscription status.

2.4 Content Studio — connected social media accounts

Content Studio is a publishing tool, available only to accounts we have enabled it for, that lets an authorised user upload a video once and publish it to social media accounts they manage. If you use it:

• Connecting an account. You choose which accounts to connect (a Facebook Page and its linked Instagram professional account, a YouTube channel, a TikTok account) and approve the connection on that platform's own consent screen. We never see or store your password for those platforms.
• What we receive and store. The account's public identifiers (ID, name or username, profile picture), the permissions you granted, and the access and refresh tokens the platform issues. Tokens are stored encrypted and are used only to publish the posts you approve and to show their status.
• Videos you upload. The video file is stored in our file storage and, when you publish, is sent to the platforms you selected. The audio is sent to our transcription provider to produce a transcript.
• AI-generated copy. The transcript, the title and any notes you add are sent to our AI provider to draft titles, descriptions, captions, tags and hashtags. Drafts are suggestions: nothing is published until a person reviews and approves it.
• Publishing records. We keep the copy you approved, the scheduled time, the result returned by the platform (for example the post ID or link) and error messages.
• What we do not do. We request only the permissions needed to publish. We do not read your messages, followers or other content on those platforms, and we do not use this data for advertising or to train AI models.
• Disconnecting and deleting. You can disconnect an account at any time in Content Studio, which deletes its stored tokens, and you can delete an uploaded video, which removes the file and its drafts from our systems. You can also revoke our access from the platform itself: Facebook and Instagram (Settings → Business integrations), Google (myaccount.google.com/permissions) and TikTok (Settings → Security → Manage app permissions). Posts already published stay on the platform until you delete them there.

Content Studio uses YouTube API Services. By using it to upload to YouTube you also agree to the YouTube Terms of Service, and your data is handled by Google under the Google Privacy Policy. Content published through the Meta and TikTok APIs is handled by those platforms under their own terms and privacy policies.

3. How and why we use information

We do not use your health data, progress photos or AI conversations to target advertising, and we do not use your personal information to train our own or third-party AI models. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.

4. How we share information

We share personal information only as described here:

4.1. With people you choose. When you connect to a coach or join a coach's team or group, that coach (and, where applicable, their sub-coaches) can see your profile, workouts, nutrition, measurements, photos, check-ins and progress. Content you post to groups, feeds, leaderboards or a public profile is visible to the audience you select. You can disconnect from a coach at any time. When you are a member of a group, another member can ask Alfi (the AI assistant) to build a workout, program or meal plan tailored to you; Alfi uses your profile and targets to do so but does not show them to the group — only the plan itself and the fact that it was adapted for you. You can switch this off at any time in the group settings ("Personal tailoring in this group").

4.2. With service providers (processors) that help us operate the Services under contracts requiring them to protect the data and use it only for our instructions:

We send AI providers only the information needed to answer the request, through their commercial (paid) API services, under terms that do not permit them to use our customers' data to train their models. Providers may keep request data for a limited period (typically up to 30 days) for abuse and security monitoring.

4.3. For legal reasons: to comply with law, a court order or lawful government request; to enforce our Terms; or to protect the rights, safety and property of our users, the public or All-In Fit.

4.4. Business transfers: in a merger, acquisition, financing, reorganisation or sale of assets, subject to this Policy's protections.

4.5. With your consent or at your direction.

4.6. Aggregated or de-identified information that cannot reasonably identify you.

4.7. With social media platforms you connect (Content Studio). When you publish or schedule a post through Content Studio, we send the video and the copy you approved to the platforms you chose — Meta (Facebook and Instagram), Google (YouTube) and TikTok — using the account you connected. We also use Groq (USA) to transcribe the audio of uploaded videos and Anthropic (USA) to draft the copy.

We do not sell personal information for money. If you accept advertising cookies on our marketing website, Google and Meta receive cookie identifiers and information about your visit to measure and personalise ads, which some U.S. state laws treat as "sharing" or "targeted advertising". This never includes health data, data entered in the app, photos or AI conversations. You can opt out at any time by declining cookies, by using "Your privacy choices" in our Legal Center, or by enabling Global Privacy Control in your browser, which we honour.

In the mobile app, Meta, TikTok and Google receive device identifiers and the install, sign-up, trial and subscription events described in Section 3 so we can measure our ad campaigns; some U.S. state laws may also treat this as "sharing" or "targeted advertising". It never includes health data, data entered in the app, photos or AI conversations. You can opt out at any time with the "Ad campaign measurement" switch in Settings → Privacy & AI, or by resetting or deleting the advertising ID in your device settings.

5. International transfers

We are based in the United States. Our main database is hosted in the European Union (Frankfurt, Germany); some of our providers process data in the U.S. and other countries. Where we transfer personal information from the EEA, UK, Switzerland or Israel, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and UK/Swiss equivalents), the EU-U.S. Data Privacy Framework where a provider is certified, or other lawful mechanisms.

6. How long we keep information

We keep personal information for as long as your account is active and as needed to provide the Services. If you delete your account, we delete or anonymise your personal information within 30 days, except: (a) backups, which are overwritten within approximately 90 days; (b) transaction, tax and consent records we must keep by law (generally up to 7 years); (c) information needed to resolve disputes, prevent fraud or enforce our Terms; and (d) content you shared with others that they have saved. When you disconnect from a coach or delete your account, the coach loses access to your data in the Services; we do not keep a separate coach-side copy. Programs and plans the coach created remain the coach's.

7. Security

We use administrative, technical and physical safeguards, including encryption in transit, access controls, row-level security in our database, and least-privilege access for staff. No method of transmission or storage is 100% secure. If a security breach affects your personal information, we will notify you and the authorities as required by law (including, where applicable, the FTC Health Breach Notification Rule).

8. Your rights and choices

8.1. Everyone. You can view and edit most information in the app; download a copy of your data or ask us for one; delete content or your entire account in Settings; disconnect from a coach; turn off Health integrations, camera, microphone and notification permissions in your device settings; opt out of marketing emails; and withdraw consent (for example to health-data processing or AI features) at any time — withdrawing consent does not affect processing that already happened, but some features will no longer work.

8.2. How to make a request. Use the in-app settings or email support@allinfit.app (subject "Privacy Request"). We will verify your identity and respond within the time required by law (generally 30 days; 45 days under U.S. state laws, extendable where permitted). When you delete data, we also instruct our processors to delete it. You may use an authorised agent where the law allows. If we deny your request, you may appeal by replying to our decision; we will respond to appeals within the legally required period.

8.3. We will not discriminate against you for exercising your privacy rights.

9. Cookies and analytics

Our websites use strictly necessary cookies (for login, security and preferences). Our marketing pages also use analytics and advertising cookies (Google Analytics, Google Ads, Meta pixel) — these load only after you click "Accept" in the cookie banner. If you decline, or your browser sends a Global Privacy Control signal, they are not loaded. You can change your choice at any time with "Your privacy choices" in our Legal Center. The logged-in app and portal do not load advertising cookies. The mobile app uses Firebase Analytics to understand which features are used and to diagnose crashes; it does not receive the values you enter, your photos or AI conversations, and ad personalisation is disabled. The mobile app also includes measurement software from Meta, TikTok and Google that reports installs, sign-ups and subscriptions for our ad campaigns (see Sections 3 and 4); you can switch it off in Settings → Privacy & AI.

10. Children

The Services are not directed to children under 13, and we do not knowingly collect their personal information. Users under 16 may not create an account, and users aged 16–17 need a parent's or guardian's consent. If we learn that a user is under 16, we will delete the account. If you believe a child has given us personal information, contact us.

11. Region-specific information

11.1 European Economic Area, United Kingdom and Switzerland

• Controller: AllinFit, LLC (see Section 1). EU/UK representative: where Article 27 GDPR / UK GDPR requires one, our representative's details will be listed here; until then, EU and UK residents can reach us directly at support@allinfit.app (subject "GDPR") and may always complain to their local supervisory authority.
• Legal bases are listed in Section 3. Health data is a special category of data processed on the basis of your explicit consent (GDPR Art. 9(2)(a)), which you give on a dedicated consent screen separate from our Terms and can withdraw at any time in Settings.
• Your rights: access, rectification, erasure, restriction, data portability, objection (including to processing based on legitimate interests and to direct marketing), and withdrawal of consent.
• Complaints: you may lodge a complaint with your local data protection authority (in the UK, the ICO).
• AI transparency: Alfi is an AI system, and we tell you when you are interacting with it (EU AI Act, Article 50).

11.2 United States

Notice at collection / categories (California and other states). In the past 12 months we collected these categories of personal information: identifiers; customer records; characteristics of protected classifications (age, gender); commercial information; internet or other electronic network activity; approximate geolocation (from IP); audio, electronic and visual information (photos, videos, voice messages); inferences (fitness goals and preferences); and sensitive personal information (account login credentials and health information). Sources, purposes and recipients are described in Sections 2–4. Retention is described in Section 6.

• We do not sell personal information for money. If you accept advertising cookies on our marketing website, we share identifiers and internet activity with Google and Meta for cross-context behavioural advertising (see Sections 4 and 9); you may opt out at any time through "Your privacy choices", by declining cookies, or with Global Privacy Control. In the mobile app, we share device identifiers and install, sign-up and subscription events with Meta, TikTok and Google to measure our ad campaigns; you may opt out at any time in Settings → Privacy & AI. We never sell or share sensitive personal information (including health data), and we do not knowingly sell or share the personal information of consumers under 16.
• We use sensitive personal information only to provide the Services you request and for other purposes permitted by law; we do not use it to infer characteristics about you.
• Your rights (depending on your state of residence, including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana and others): to know/access, correct, delete, obtain a portable copy, opt out of sale/sharing, targeted advertising and profiling, and limit the use of sensitive personal information; and to appeal a denial.
• Washington, Nevada and other consumer-health-data laws: see our Consumer Health Data Privacy Policy.
• California "Shine the Light": we do not disclose personal information to third parties for their direct marketing.

11.3 Israel

• This Policy is intended to provide the information required under the Protection of Privacy Law, 5741-1981, as amended (including Amendment 13). You are not legally obliged to provide personal information; however, an account requires a name and email, and features such as personalised targets, coaching and AI require the related data — without it, those features will not work.
• The purposes, recipients and transfers are described in Sections 3–5. Data may be stored in databases outside Israel, including in the United States, with appropriate safeguards.
• You have the right to access your information and to request its correction or deletion under sections 13–14 of the Privacy Law. You may contact the Privacy Protection Authority with a complaint.

12. Changes to this Policy

We may update this Policy. If changes are material, we will notify you in the app or by email before they take effect and, where required, ask for your consent again. The "Effective date" above shows when it was last updated.

13. Contact us

AllinFit, LLC · Email: support@allinfit.app (subject "Privacy") · Postal address for service provided on request