1. General Information

The following privacy information explains which personal data we collect and what happens to your personal data when you use Fitaino or visit the website fitaino.com. Personal data is any data that can be used to personally identify you. Detailed information on data protection can be found in the following Privacy Policy.

Please note that data transmission over the Internet (e.g. when communicating by email) may have security vulnerabilities. Complete protection of data against access by third parties is not possible.

Responsible entity

K & O Software Solutions UG (haftungsbeschränkt)
Senkelteichstraße 11
32602 Vlotho
Germany
Email: info@ko-software.solutions

Storage Period

Your personal data will remain with us until the purpose for processing the data no longer applies. If you submit a legitimate request for deletion or withdraw your consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, the data will be deleted once these reasons no longer apply.

General Information on the Legal Basis for Data Processing on the Website

If you have consented to this Privacy Policy, we process your personal data on the basis of Art. 6(1)(a) GDPR and/or Art. 9(2)(a) GDPR if special categories of data pursuant to Art. 9(1) GDPR are processed. In the event of express consent to the transfer of personal data to third countries, data processing is also carried out on the basis of Art. 49(1)(a) GDPR. If you have consented to the storage of cookies or access to information on your device (e.g. via device fingerprinting), data processing is additionally carried out on the basis of Section 25(1) TTDSG. Consent may be withdrawn at any time.

If your data is required for the performance of a contract or for taking steps prior to entering into a contract, we process your data on the basis of Art. 6(1)(b) GDPR. This frequently applies to our services when you use our app or website and contractual provisions of the Terms and Conditions apply, or when you have entered into a purchase agreement with us or such an agreement is contemplated.

Furthermore, we process your data where this is necessary to comply with a legal obligation on the basis of Art. 6(1)(c) GDPR. Data processing may also be carried out on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR. Information about the applicable legal basis in each individual case is provided in the following sections of this Privacy Policy.

2. Data Collection and Processing for Contact Requests

If you contact us by email or telephone, your request, including all personal data resulting from it (name, request), will be stored and processed by us for the purpose of handling your inquiry. We will not disclose this data without your consent.

This data is processed on the basis of Art. 6(1)(b) GDPR if your request relates to the performance of a contract or is necessary for taking steps prior to entering into a contract. In all other cases, processing is based on our legitimate interest in effectively handling inquiries addressed to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR), provided that such consent has been requested; consent may be withdrawn at any time.

The data you send to us via contact requests will remain with us until you request its deletion, withdraw your consent to its storage, or the purpose for storing the data no longer applies (e.g. after your request has been fully processed). Mandatory statutory provisions, in particular statutory retention periods, remain unaffected.

3. Data Collection and Processing on the Website

Third-Party Analytics Tools

When you visit the website, your browsing behavior may be statistically analyzed. This is primarily carried out using so-called analytics programs. Detailed information about these analytics programs can be found in the following Privacy Policy. Collection and processing are carried out pursuant to Art. 6(1)(f) GDPR.

Server Logs

For security reasons, we use server logs provided by our infrastructure provider Hetzner, through which we may view the IP addresses and, where applicable, MAC addresses of website visitors. Collection and processing are carried out pursuant to Art. 6(1)(f) GDPR.

4. Data Collection and Processing in the App

Registration/Login Process

During the registration process in the Fitaino app, we collect certain basic information from you. The data collected includes:
- Date of download/registration
- Name
- Email address
- Password (encrypted)
- Gender
- Date of birth
- Height
- Body weight
- Body fat percentage
- Activity level
- Desired weight development
- Dietary preferences
- Allergies
- Training experience
- Available training equipment
- Training preferences (exercises and muscle groups)

All data listed here is entered by yourself and is required to ensure the proper functioning of the app. The data is used, for example, to provide suitable recipe recommendations (e.g. vegetarian or vegan) or to estimate calorie requirements. We use your date of birth to adapt your calorie requirements and your training plan to your age and to apply the app's age rules (use from age 16, public profile from age 18). The data is stored in Germany and may partly be stored in other EU countries.

If you registered using the “Sign in with Google” function, we collect data from your Google account, such as your name and email address. If you registered using the “Sign in with Apple” function, we only collect your email address unless you choose to hide it from us.

Since the data is voluntarily and independently entered during the registration process, the data is collected pursuant to Art. 6(1)(a) GDPR, Art. 6(1)(b) GDPR and Art. 9(2)(a) GDPR.

Further information is available at:
https://policies.google.com/privacy
https://www.apple.com/de/legal/privacy

A prerequisite for completing the registration process is that you agree to our Terms and Conditions and this Privacy Policy.

Paid Subscription

For users registered in the app, we record the subscription status (subscription active/inactive) and the type of subscription (monthly or annual). Payment is processed via the Google Play Store or Apple App Store and their respective payment functions.

The data is processed pursuant to Art. 6(1)(b) GDPR.

Further information on the providers’ privacy policies is available at:
https://policies.google.com/privacy
https://www.apple.com/de/legal/privacy

Automatic Data Collection Using Log Files

When installing and using the app, we collect certain data in order to improve the overall user experience. This data includes:
- Operating system
- Device information where applicable, such as the model
- Country
- Login information such as email address, user ID, etc.
- IP address
- Time zone information as well as the time and date of use
- App version

We use this data, for example, to improve our services with regard to security and to ensure their proper functioning. The data is therefore processed pursuant to Art. 6(1)(f) GDPR. Collection of this data is mandatory and there is no option to object.

Information Provided During Continued Use

During continued use of the app, certain data is collected from you. This includes:
General
- Language
- Units (kg/lbs and cm/inches/feet)
- Display mode (dark or light)
- Profile picture
- Friends
- Weekly score
- Rank
- Imported data from Apple Health, Health Connect and Fitbit (general)
- Feedback submitted using the feature in the settings
Nutrition
- Desired weight development
- Meal categories
- Which foods you log
- How often and when you log different foods
- Amount of water consumed
- Calorie requirements
- Recipes you create
- Foods you create
- Barcodes of foods you scan
- Favorite foods
- Images, descriptions and attributes of food analyzed using the AI feature (further information about AI models can be found in Section 5 of this Privacy Policy)
Body Measurement Data
- Weight
- Body fat percentage
- Chest circumference
- Arm circumferences
- Leg circumferences
- Waist
Training
- Training plans, workouts and exercises you create
- Which training plan you select
- Data relating to individual workouts, including set types, number of repetitions, weight, workout duration, rest times, number of sets, date of the workout and notes
- Exercise-related data such as maximum weight, working weight and when the exercise was performed
- Heart rate (if an external tracking device has been connected)
- Training experience, training preferences and your age if you use the AI training plan generator feature (further information about AI models can be found in Section 5 of this Privacy Policy)
Cardio
- Step count
- Distance traveled
- Calories burned
- Cardio activities created
- Cardio activities performed
- Favorite cardio activities

Almost all of the data listed above is essential for the proper functioning of the app. The data is processed solely for the purpose of using the app and in your interest. For example, we use workout data to provide you with recovery recommendations or weight data to adjust your calorie requirements.

General information on the use of app features that use artificial intelligence (AI):
All app features that use AI models and therefore transmit data to GPT models are clearly marked with corresponding notices. These features are not necessary for the proper use of the app. If these features are nevertheless used, the user expressly agrees to the transfer of the data to GPT models from OpenAI within Azure Foundry. Further information can be found in Section 5 of this Privacy Policy and at: https://www.microsoft.com/de-de/privacy/privacystatement

Since the data is voluntarily and independently entered, it is collected pursuant to Art. 6(1)(a) GDPR, Art. 9(2)(a) GDPR and, where applicable, Art. 6(1)(b) GDPR.

Fitbit Integration via the Google Health API

You may optionally connect your Google/Fitbit account to Fitaino in order to automatically import health and fitness data into the app. The connection is established exclusively with your express consent using Google’s secure authentication service (OAuth 2.0). Your Google password is never transmitted to us. The data is retrieved via the Google Health API (health.googleapis.com).

We request read-only access exclusively to the following categories of data:
- Activity and fitness data: steps, distance, energy expenditure (calories), active minutes and recorded workouts
- Health metrics: body weight and body fat percentage

We use this data exclusively to provide you with the corresponding app functions, such as displaying your activity and body data in the app, adjusting your calorie requirements, and providing training and recovery recommendations. The use of data obtained through Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. In particular, this means that we do not use this data for advertising, do not sell it, and do not disclose it to data brokers or advertising platforms. Humans do not receive access to this data unless (a) you have expressly consented, (b) access is required for security reasons (e.g. investigation of abuse), (c) access is required to comply with applicable law, or (d) the data is aggregated and anonymized and used for internal operational purposes.

Processing is based on your consent pursuant to Art. 6(1)(a) GDPR and, because health data is involved, pursuant to Art. 9(2)(a) GDPR. You may disconnect the connection at any time in the app settings; doing so will revoke the access authorization with Google and delete the stored access tokens. In addition, you may revoke access yourself at any time in your Google Account settings at https://myaccount.google.com/permissions. Data that has already been imported will remain as part of your history in your account; you may request its deletion at any time using the deletion functions in the app or by contacting us (see “Your Rights”).

5. Data Sharing and Disclosure

We do not sell your personal data and do not disclose it to third parties for advertising purposes. This applies in particular to all Google user data that we receive via the “Sign in with Google” function or the Google Health API (Fitbit integration). Your data is shared, transferred or disclosed exclusively to the following recipients and only to the extent necessary for the respective purpose:

- Hosting and infrastructure service providers (processors): Our server and database infrastructure is operated by Hetzner Online GmbH (Germany). These service providers process data exclusively on our behalf on the basis of data processing agreements pursuant to Art. 28 GDPR and may not use the data for their own purposes.
- Azure Communication Services: We use Azure to send emails such as verification emails. In this process, Microsoft Azure processes, among other things, your email address.
- Analytics service providers: The services listed in the “Analytics Tools and Marketing” section (Grafana, Google Analytics) receive the usage data described there. Health data obtained via the Google Health API is not disclosed to analytics or marketing services.
- OpenAI AI models (Azure Foundry): If you use any of the following features: AI meal analysis, training plan generator, AI coach or AI image generation (food), the associated data is processed by GPT models within Microsoft’s Azure Foundry environment. Use of these Fitaino app features is not required in order to use the app, and users are expressly informed of this processing beforehand. The data is not disclosed by Microsoft to OpenAI and is not used to train AI models. Further information on how Microsoft uses your data is available at:
https://www.microsoft.com/de-de/privacy/privacystatement

These service providers process data exclusively on our behalf on the basis of data processing agreements pursuant to Art. 28 GDPR and may not use the data for their own purposes.

Other recipients include:
- Added friends: The app allows you to add friends and share certain training and nutrition data with them. If you choose to add a friend, you will be expressly informed that some of your personal data will be visible to that friend in summarized form. This includes: profile picture, name, rank, weekly score, steps, weight development, workouts, calories burned, exercise personal bests, training plan, logged calories, carbohydrates, protein and fat. The friends feature is entirely optional and may only be used voluntarily and with explicit consent. This sharing of data with friends may be ended at any time.
- Google and Apple: These providers receive personal data, among other things, during payment processing, when sending push notifications and in connection with similar system functions.
- Authorities and government agencies: Only where we are legally required to do so (e.g. pursuant to a court order).

6. Data Security and Protection Measures for Sensitive Data

To protect your personal data, particularly sensitive health data such as weight, body fat percentage, activity data and training data, we use, among other things, the following technical and organizational measures:

- Encryption during transmission: All data transmissions between the app, our servers and the Google APIs are exclusively encrypted using HTTPS/TLS.
- Secure storage: Your data is stored on servers located in ISO 27001-certified data centers operated by Hetzner Online GmbH in Germany. Access to the database is protected by authentication and access restrictions.
- Secure authentication: The connection to Google/Fitbit is established using OAuth 2.0; we never receive or store your Google password. Access tokens are stored exclusively server-side in an access-restricted database and are never disclosed to third parties. Passwords for your Fitaino account are stored exclusively in encrypted form.
- Data minimization: We only request the minimum necessary read-only permissions from Google and retrieve only the categories of data required for the app’s functionality.
- Access controls: Your data can only be accessed through your own authenticated user account. Internal access to production systems is restricted to the minimum necessary.
- Revocation and deletion: You may disconnect the Fitbit/Google connection at any time in the app (the tokens will then be revoked with Google and deleted by us), and you may request the deletion of your data.

7. Analytics Tools and Marketing

We process some of your personal data in order to customize and improve advertising and marketing. We also use services to analyze usage behavior and other details. Your personal data is processed exclusively to improve our services or for other purposes directly related to our services. In most cases, the data is evaluated and processed only statistically.

Grafana

We use the “Grafana” service provided by Grafana Labs. Grafana collects various data relating to usage behavior in the app and allows this data to be analyzed. If your personal data is transferred by us to Grafana, it is processed and stored in the United Kingdom, for which an adequacy decision is in place. We use Grafana, for example, to analyze usage behavior or error logs. With a few exceptions, such as error logs, the data is mainly evaluated statistically. Grafana offers a wide range of functions that are important for app developers. For example, the data is used to analyze the number of users within the previous month, how much time is spent using particular app functions, the number of app crashes, and other details. We use this data to better adapt the app or marketing campaigns to users.

We process this data on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR.
Pursuant to Art. 44 et seq. GDPR, appropriate safeguards for processing the data in the United Kingdom (third country) are provided in the form of the European Commission’s Standard Contractual Clauses.
Further information is available at:
https://grafana.com/legal/privacy-policy/

Google Analytics

We use Google Analytics, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), to analyze your usage behavior on our website. In this process, your usage data together with your IP address is processed and stored in the United States. The IP address is generally shortened in an EU country before it is transmitted to the United States.

We process this data on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR. Pursuant to Art. 44 et seq. GDPR, appropriate safeguards for processing the data in the United States (third country) are provided in the form of the European Commission’s Standard Contractual Clauses.

Further information is available at:
https://google.com/policies/privacy

Push Notifications

We notify you using so-called push notifications if you have given us your consent to do so. Android smartphones generally have a default setting that allows all push notifications, which means that Android users may also receive push notifications from us without giving specific consent; however, these notifications can be disabled in the smartphone settings. When sending push notifications, your name and usage behavior may be processed. To send push notifications, we use Google FCM and Apple APNs and may transmit data such as friends’ names, streak numbers, personal-best weights and similar information to these services. The data is processed wholly or partly in the United States. Pursuant to Art. 44 et seq. GDPR, appropriate safeguards for processing the data in the United States (third country) are provided in the form of the European Commission’s Standard Contractual Clauses.

Further information is available at:
https://google.com/policies/privacy and https://www.apple.com/de/legal/privacy

Marketing Emails

For marketing emails, we process data such as your email address, name or date of birth in order to inform you about offers and similar matters. If you do not wish to receive such emails, you can disable them by clicking “I do not wish to receive marketing emails of this kind” at the bottom of one of the marketing emails you have received. We process this data on the basis of your consent pursuant to Art. 6(1)(a) GDPR.

8. Your Rights

Withdrawal of Your Consent to Data Processing

Many data processing operations are only possible with your express consent. You may withdraw consent you have already given at any time. The lawfulness of data processing carried out before the withdrawal of consent remains unaffected by the withdrawal.

Right to Object to Data Collection in Specific Cases and to Direct Marketing (Art. 21 GDPR)

If data processing is carried out on the basis of Art. 6(1)(e) or (f) GDPR, you have the right at any time, on grounds relating to your particular situation, to object to the processing of your personal data; this also applies to profiling based on these provisions. The respective legal basis on which processing is based can be found in this Privacy Policy. If you object, we will no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims (objection pursuant to Art. 21(1) GDPR).
If your personal data is processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling insofar as it is related to such direct marketing. If you object, your personal data will subsequently no longer be used for direct marketing purposes (objection pursuant to Art. 21(2) GDPR).

Right to Lodge a Complaint with the Competent Supervisory Authority

In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, their place of work, or the place of the alleged infringement. The right to lodge a complaint is without prejudice to any other administrative or judicial remedies.

Right to Data Portability

You have the right to receive data that we process automatically on the basis of your consent or in performance of a contract, either yourself or through a third party, in a commonly used, machine-readable format. If you request the direct transfer of the data to another controller, this will only be carried out where technically feasible.

Access, Deletion and Rectification

Within the framework of the applicable statutory provisions, you have the right at any time to obtain free information about your stored personal data, its origin and recipients, and the purpose of the data processing, and, where applicable, the right to have this data rectified or deleted. A user account can be deleted, among other ways, via the settings in the app. For security reasons, the deletion period is three days. You may contact us at any time regarding this or any other questions relating to personal data.

Right to Restriction of Processing

You have the right to request the restriction of the processing of your personal data. You may contact us at any time for this purpose. The right to restriction of processing applies in the following cases:
1. If you dispute the accuracy of the personal data stored by us, we generally require time to verify this. For the duration of the verification process, you have the right to request restriction of the processing of your personal data.
2. If the processing of your personal data was/is unlawful, you may request restriction of data processing instead of deletion.
3. If we no longer need your personal data but you require it for the establishment, exercise or defense of legal claims, you have the right to request restriction of data processing instead of deletion.
4. If you have lodged an objection pursuant to Art. 21(1) GDPR, your interests and ours must be weighed against each other. As long as it has not yet been determined whose interests prevail, you have the right to request restriction of the processing of your personal data.
If you have restricted the processing of your personal data, such data, apart from being stored, may only be processed with your consent or for the establishment, exercise or defense of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the European Union or of a Member State.

Version: September 2026
Source: www.e-recht24.de (Only applies to certain parts of this privacy policy, with parts of the texts modified)