Privacy Policy

Fitipot runs real-time team fitness challenges across our mobile apps and website. This policy explains what personal data we collect when you use Fitipot, why we collect it, and the choices you have. By creating an account or recording a ride, you agree to the practices described here.

When you sign up and use your account, we collect:

• Account details — your email address and, for password accounts, a password (we never store the password itself, only a salted scrypt hash). If you sign in with Google, we receive a stable account identifier and the email associated with that Google account instead of a password.
• Profile — optional details you choose to add: first and last name, age, sex, home country and city, club, an avatar image, and a short bio.
• Body weight — optional, and used only to estimate the calories you burn on a ride.

Fitipot is a fitness app, so recording your activity is central to how it works. When you record a ride or take part in a live challenge, the app collects:

• Precise GPS location — your latitude and longitude, sampled frequently throughout a ride to build the route and to verify distance and speed.
• Ride telemetry — speed, distance, duration, elevation, estimated calories, and sensor readings your device provides such as temperature, compass heading, wind, and bike pitch and roll.
• Live challenge progress — while a challenge is running, your distance and speed are sent to our servers every few seconds so team standings can update in real time. These updates are checked for plausibility to keep competition fair.

We collect precise location only while you are actively recording a ride or competing in a challenge. Photos and videos you capture in the app stay on your device and are not uploaded to Fitipot.

When you join a challenge we also process:

• Participation — the team you are assigned to, a display name shown to other participants, and your performance and contribution within each challenge.
• Credits and transactions — your credit balance and a ledger of changes to it (credits entered into a challenge, manual adjustments, and payouts when your team wins).
• Activity stats — totals we derive from your rides and challenges, such as lifetime distance, ride count, average speed, wins, and effectiveness, used for leaderboards and your profile.

You can also take part as a guest without an account. Guest entries are not linked to a personal profile.

To keep accounts secure and the service running, we process:

• Sign-in codes — when you register, log in, or reset a password by email, we temporarily store a one-time code and the IP address the request came from to rate-limit abuse. These records are short-lived and removed once the flow completes.
• Session tokens — we keep only a hashed form of your long-lived sign-in token, never the token itself, so sessions can be refreshed and revoked.
• App and device basics — your platform and app version, used to tell you when an update is available.

• To create and manage your account and profile.
• To record your rides and show your routes, stats, and history.
• To run challenges: assign teams, update live standings, verify activity, and pay out prize pools to winners.
• To secure accounts, prevent fraud, and enforce fair play.
• To operate, maintain, and improve the service.
• To contact you about your account, including sign-in codes.

We do not sell your personal data. We share it only:

• With other users — your display name, team, and challenge performance are visible to other participants and on leaderboards. If you create a public link to a ride, anyone with that link can view it; the link uses a random, unguessable identifier so rides cannot be discovered by guessing.
• With service providers — companies that help us operate Fitipot, such as our hosting and database provider, our email provider (for sign-in codes), and Google (if you choose Google sign-in). They process data on our behalf under appropriate safeguards.
• For legal reasons — when required by law, or to protect the rights, safety, and security of Fitipot and its users.

We keep your data while your account is active. When you delete a ride, it is hidden and no longer synced, though anonymized totals may remain in your lifetime stats. If you delete your account, we remove your account and personal profile; entries you made in past challenges may be retained in an anonymized, non-identifying form for the integrity of those challenges and their results.

To request access to or deletion of your data, contact us at privacy@fitipot.com.

We protect your data with measures including hashed passwords, hashed session tokens, encrypted connections, and server-side validation of activity. No method of transmission or storage is completely secure, but we work to safeguard your information and to limit access to it.

Fitipot is not directed to children below the minimum age required in your country, and we do not knowingly collect data from them. If you believe a child has provided us with personal data, please contact us so we can remove it.

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can edit your profile in the app at any time, and you can disable location permission through your device settings (this will stop ride recording). To exercise any of these rights, reach us at privacy@fitipot.com.

We may update this policy as Fitipot evolves. When we make material changes, we will update the date below and, where appropriate, notify you in the app. Continued use of Fitipot after an update means you accept the revised policy.

Questions about this policy or your data? Email us at privacy@fitipot.com.