Privacy Policy

Last updated: 11 October 2026

1. Who we are

Spotter.fit is operated by Gustavo Serres, an individual sole operator based in Portugal ("we", "us"). For the purposes of the EU General Data Protection Regulation (GDPR), Gustavo Serres is the data controller for the personal data described in this policy.

For anything related to your personal data, contact privacy@spotter.fit.

2. What this policy covers

This policy covers the Spotter.fit marketing site (spotter.fit), the web application (app.spotter.fit) and the Spotter.fit mobile app. It explains what personal data we process, why, who can see it, how long we keep it, and the rights you have over it.

Cookie consent inside the application is managed separately — see the cookie policy in the app, where you can also change your consent choices at any time.

One distinction matters throughout: if you are a client of a personal trainer who uses Spotter.fit, your trainer decides what to ask of you (which check-ins, surveys and measurements to schedule), and we provide the platform that stores and processes those answers. This policy describes what the platform itself does with your data.

3. The data we process

Account and identity data

When you create an account we store your first and last name, email address and, if you choose to provide them, your gender, date of birth and a profile picture. You can sign in with an email and password, with a passkey, or through Google or Apple. If you use Google or Apple, we receive your name and verified email address from them — nothing more. With Apple you can choose to hide your email address; we then receive the relay address Apple creates for you.

Health and fitness data

Spotter.fit is a training platform, so much of what it stores is data about your body and your training. Depending on how you and your trainer use it, this can include:

body measurements — weight, body fat, height, and circumference measurements such as chest, waist, hips, arms, thighs and calves, which can be recorded separately for each side; your trainer can also define up to ten measurements of their own, including ones you answer in free text or on a scale;
check-in photos of your body, taken from up to four angles;
form videos — short clips of you performing an exercise, recorded with their sound, that you attach to a logged session for your trainer to review, and the annotated frames your trainer captures from them;
training logs — the exercises, sets, reps, loads and effort you record, including sessions your trainer records for you in person, and entries you have started but not yet submitted;
habits your trainer sets for you and your daily record against them — for example hydration, sleep duration and quality, nutrition and calorie targets, movement and step counts, recovery and stress, mindset and energy, supplements and rehabilitation exercises, weigh-ins, and lifestyle habits such as limiting or avoiding alcohol;
flags you raise on a session, including pain flags, and the notes you write to your trainer about a given day;
your answers to surveys and questionnaires your trainer schedules;
goals, comments exchanged on a session, and direct messages between you and your trainer;
notes your trainer writes about you (see section 5);
the training insights the platform computes from your logs for your trainer (see below).

Under the GDPR, data concerning health is a special category of personal data. We process it only with your explicit consent (Article 9(2)(a) GDPR). Before you first use the app as a client — or, if you are a trainer, before you first log your own training — a separate screen names this data, who will see it and how to withdraw, and asks you to confirm by ticking a box; we record the date and the version of the text you accepted. Your trainer can record a session for you only while that consent stands. You can still decline to fill in any measurement, photo or survey, and you can withdraw your consent at any time in your account settings. Because the service cannot train you without this data, withdrawing closes your account, as described in section 8; if you also run or work in a workspace, write to privacy@spotter.fit instead and we will erase the data about your own training.

Check-in photos and form videos are stored in private storage and are never publicly accessible; they are served only through short-lived signed links to you and to the staff of the workspace you train in.

Training insights

The platform can analyse the training records of a workspace once a day — the sessions logged, the days scheduled and the flags raised on them — and compute, for each client, indicators that tell the trainer where to look: sessions that stand out from the client's usual pattern, a plateau or a trend in strength, a grouping of clients who train in a similar way, and an estimate of how likely a client is to stop training within the next 30 days. The analysis works on internal identifiers, not on names or email addresses, and runs on our own infrastructure in the European Union. Only the staff of the workspace see the results, and the results decide nothing by themselves: no plan is changed and no message is sent without the trainer's own judgement.

Payments

Paid subscriptions are sold by us and paid through Stripe, our payment service provider. Stripe collects and stores your card details and processes the charge on our behalf — your card number never reaches us. What we store is your subscription status and payment metadata: amounts, tax and discount, currency, dates, the plan, the billing period and Stripe's reference identifiers. The billing details you enter at checkout — your billing address and, if you provide them, a business name and a VAT or other tax identification number — are held in your customer record at Stripe and appear on your invoices. If you cancel a subscription, the reason you select and any comment you add are stored with the subscription at Stripe.

Usage and analytics

With your consent — and only with it — we collect technical telemetry in the web application through Amazon CloudWatch RUM: page load performance, JavaScript errors, page views and the timing of network requests, together with your browser, your device type and the country you connect from. This telemetry is tied to your user identifier, role and workspace, never to your name or email. If you decline analytics in the consent banner, none of it is collected. The mobile app contains no analytics. It uses Sentry for crash reporting: each time the app is used, it sends Sentry a short session record (whether the session ended in a crash), and when it crashes or meets an unexpected error, a crash report (the error and where in the app's code it happened). Both carry the app version, your device model and operating system, and your user identifier — never your name, your email, what you entered or your photos.

Push notifications

If you enable notifications in the mobile app, we store a push token for your device together with its platform and language, and use Expo's push service to deliver notifications; Expo hands each one to Apple's or Google's notification service for your device. A notification says what happened — a message arrived, a plan was assigned, a check-in was completed — and can include the name of the person concerned, the name of a training plan or the title of an announcement. It never carries the content of a message or a comment, a measurement or a photo.

Invitations and email

When a trainer invites you to a workspace, we store the email address they entered, the role they chose for you and the name of the person who invited you, and we send the invitation to that address. The few emails the service sends — invitations, verification codes and password resets — go through Amazon SES.

What the mobile app asks of your device

The mobile app uses your camera, your microphone and your photo library only when you take or choose a photo or a video — a check-in photo, a profile picture, a form video or an exercise demonstration — and asks for permission before sending notifications. It does not read your location, your contacts or the health data held by your device, and it does not track you across other apps or websites.

4. Why we process your data (legal bases)

To provide the service — storing your account, your training data and your workspace memberships, showing them to the people described in section 5, computing the training insights described in section 3, and sending the emails the service relies on: performance of a contract, Article 6(1)(b) GDPR.
Health data specifically — your explicit consent, Article 9(2)(a) GDPR, which the app asks for on a separate screen before you first use it as a client or log your own training, and which you can withdraw at any time in your account settings.
Billing and tax records — charging a subscription is part of the contract, Article 6(1)(b) GDPR; keeping payment and invoice records afterwards is a legal obligation under tax and accounting law, Article 6(1)(c) GDPR.
Security and abuse prevention — server logs and monitoring: our legitimate interest in keeping the service secure, Article 6(1)(f) GDPR.
Analytics — your consent, Article 6(1)(a) GDPR, which you can withdraw at any time in the app's cookie settings.
Push notifications — your consent, Article 6(1)(a) GDPR, which you give when you allow notifications on your device and withdraw in the same place, in your device's settings.

We do not sell your personal data, and we do not use it for advertising.

5. Who can see your data inside Spotter.fit

Spotter.fit is organised in workspaces run by personal trainers. Access follows workspace membership:

The trainers and staff of a workspace you train in can see the training and health data connected to that workspace — your plans, logs, habits, measurements, check-in photos, form videos, survey answers, comments and direct messages, and the training insights computed from them.
You can see your own data. Two exceptions: trainers can keep private coaching notes about their clients, and the training insights of section 3 are computed for the trainer; the app shows neither to the client.
Members of one workspace cannot see data belonging to another workspace.
If a workspace suspends your membership, you lose access to that workspace, while its staff can still read the records you created there.
We, the operator, have no window into your records in the app: our administration console manages workspaces, the exercise catalogue and product news, not client data. Because we run the infrastructure we can technically reach stored data, and we do so only when it is needed to keep the service working and secure, to fix a fault, or to answer a request from you.

Your trainer is independently responsible for how they use the information you share with them, in the same way as in any off-platform coaching relationship.

If you connect an AI assistant (such as Claude or ChatGPT) to your account through our MCP connector, that assistant can read and act on your data with exactly your permissions, for as long as you keep the connection. You can revoke a connection at any time under Account → Connected apps. The same applies to the staff of a workspace you train in: an assistant one of them connects to their own account can read the client records that person can read, under the responsibility of whoever connected it.

6. Service providers

We use a small number of processors and recipients to run Spotter.fit:

Amazon Web Services — all hosting and storage, in the eu-west-1 (Ireland) region: authentication (Amazon Cognito), database, file storage, video processing, email delivery (Amazon SES), the training insights analysis (Amazon SageMaker) and monitoring, plus the content delivery network that can serve your media (section 7).
Stripe — payment processing, invoicing and tax calculation for paid subscriptions (section 3).
Google — if you choose to sign in with Google; the notification service that delivers push notifications to Android devices; and exercise demonstration videos hosted on YouTube, which receives your IP address when the preview image of a video is shown to you and when you play the video, embedded in YouTube's no-cookie mode.
Apple — if you choose to sign in with Apple, and the notification service that delivers push notifications to iPhone and iPad.
Expo — delivery of mobile push notifications, if you enable them.
Sentry — crash reports from the mobile app, stored in the European Union (section 3).
AI assistants via MCP — only for connections created by you or by the staff of a workspace you train in (section 5).

7. Where your data lives

Your data is stored in the European Union (AWS region eu-west-1, Ireland). Your private media — check-in photos, form videos, review frames and profile pictures — is served through short-lived signed links, either straight from that storage or through a content delivery network; where the network is used, a file you or your trainer opens is briefly cached at the network location nearest to whoever opened it, which may be outside the European Economic Area. Where a provider processes data outside the European Economic Area — for example when a payment is processed by Stripe, when you sign in with Google or Apple, or when a push notification is delivered through Expo, Apple or Google — the transfer is covered by an adequacy decision of the European Commission or by standard contractual clauses. A connected AI assistant and YouTube content are different: the assistant you chose, your browser or your device connects to that provider directly, under that provider's own terms.

8. How long we keep your data

While your account exists — we keep your data so the service can work.
When you delete your account — deletion is self-service, in the web application and in the mobile app. There is a 7-day grace period during which you can change your mind; at the end of it, or within about two days after, your data — database records and stored media, including check-in photos, your message thread with your trainer and your sign-in account — is permanently and automatically erased, and you receive an email once the deletion is complete. Everything you wrote is deleted too — messages, comments, notes and announcements. What remains: the billing records described below; content you created for a workspace's library, which stays with the workspace, without your name; and a record that the deletion took place, holding identifiers and dates but no content. A workspace of which you are the only member is deleted with your account; if you are the last administrator of a workspace that has other members, you are asked to hand it over or delete it first. The steps are also described on Delete your account.
When a workspace is deleted — an administrator can delete a workspace, with the same 7-day grace period. After it, everything stored in that workspace is permanently erased, including the records and check-in photos of its clients.
When you leave a workspace — or are removed from it, your membership record is kept for about 180 days and then removed. The records you created in that workspace are not erased by leaving: they stay stored with it, and readable by you, until the workspace is deleted, you delete your account, or you ask us to erase them.
Deleted items — individual records you delete inside the app are retained in a soft-deleted state for about 90 days (so mistakes can be undone and references stay consistent), then removed. The photos of a check-in you delete stop being shown to anyone at once, but stay in our private storage until your account or the workspace is deleted.
Form videos — each form video, and each frame your trainer captures from it, is automatically deleted 90 days after it was uploaded — or earlier if you remove the video. This limit does not apply to check-in photos.
Plan downgrades — if a workspace moves to a plan that no longer includes them, its uploaded exercise videos, client form videos, video-review frame captures and direct messages are permanently deleted 15 days after the downgrade, unless the workspace is upgraded back before then.
Invitations — an invitation is deleted 7 days after it was sent; one that was declined or revoked is kept for about 90 days.
Push tokens — removed when you sign out of the mobile app, when your device stops accepting notifications, or after about 180 days without being renewed.
Billing records — payment and invoice records are kept after an account or a workspace is deleted, for as long as tax and accounting law requires — ten years in Portugal. When you delete your account, your name is removed from the payment records we hold; the invoices held in our Stripe account are kept for the same period.
Analytics telemetry — kept for 30 days.
Crash reports — kept for up to 90 days.
Training insights — each day's results replace the previous day's, and are erased with the account or the workspace they belong to. The working files of the analysis are deleted after 90 days; a history of the results, made of internal identifiers and numbers, with no names, is kept for as long as the analysis is in use.
Logs and backups — server logs are kept for up to 3 months. Backups of the database reach back 35 days, so data you erase can persist in a backup for up to 35 days before it is gone for good.

9. Cookies and data stored on your device

The application uses a small set of cookies and browser storage:

Name	Purpose	Lifetime
spotter.consent	Remembers your cookie consent choices	180 days
spotter.locale	Your language	1 year
spotter.tz	Your device timezone, so calendars render correctly	1 year
Sign-in cookies (Amazon Cognito)	Keeping you signed in	1 year, or until you sign out
spotter.ws.*	Remembers which workspace you last used	1 year
cwr_s, cwr_u	Analytics session and visitor identifier (only with your consent)	30 minutes / 30 days
__stripe_mid, __stripe_sid	Set by Stripe on the billing pages to prevent payment fraud	1 year / 30 minutes

The web application also uses your browser's local storage for a copy of the workout log you are filling in (so a lost connection does not lose your entries; the copy is cleared once the log is submitted), for small interface preferences and, if you accepted analytics, for the analytics credentials. The marketing site you are reading now sets no cookies. It keeps one item in your browser's local storage — the language you last chose.

The mobile app keeps on your device what it needs to work: your sign-in tokens — the long-lived one in the device's secure keychain —, your language and theme, your push token, the logs, surveys and check-ins you have started but not yet submitted, and a cache of images you have viewed. What you have not yet submitted stays on the device, also after you sign out, until you submit it; removing the app removes everything it stored.

You can review and change your consent at any time in the cookie policy page of the app.

10. Your rights

Under the GDPR you have the right to:

access the personal data we hold about you, and receive a copy;
correct inaccurate data;
erase your data ("right to be forgotten") — largely self-service through account deletion;
restrict or object to processing;
receive your data in a portable format;
withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, email privacy@spotter.fit. We will respond within one month.

We take no decision about you by automated means alone that would have a legal or similarly significant effect on you (Article 22 GDPR). The training insights of section 3 inform a human trainer; they decide nothing themselves.

You also have the right to lodge a complaint with a supervisory authority — in Portugal, the CNPD (Comissão Nacional de Proteção de Dados, www.cnpd.pt), or the data protection authority of your own country of residence.

If you live in Brazil, the Lei Geral de Proteção de Dados (LGPD) gives you corresponding rights, which you exercise in the same way, by writing to privacy@spotter.fit. You may also complain to the Autoridade Nacional de Proteção de Dados (ANPD, www.gov.br/anpd).

11. Children

Spotter.fit is not directed at children. You must be at least 16 years old to create an account.

12. Changes to this policy

When this policy changes in a way that matters, we will update the date at the top and, for significant changes, notify you in the app. Earlier versions are available on request.

13. Contact

Questions about this policy or about your data: privacy@spotter.fit.