Effective Date: May 11, 2026 Last Updated: May 11, 2026
This Privacy Policy ("Policy") describes how FlowFit Gym ("we," "us," "our," or "FlowFit"), operating the FlowFit mobile application and related services (collectively, the "Service"), collects, uses, discloses, and protects your information when you use the Service.
By downloading, accessing, or using FlowFit, you acknowledge that you have read and understood this Policy. If you do not agree with this Policy, please do not use the Service.
We are committed to protecting your privacy and complying with applicable data-protection laws, including the General Data Protection Regulation (GDPR) of the European Union, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), the Personal Data Protection Law of Türkiye (KVKK No. 6698), and other applicable privacy regulations.
Payments are processed exclusively through Apple App Store (StoreKit) or Google Play Billing. We do not collect, store, or process your full payment-card details. We receive only a transaction identifier, subscription status, plan tier, renewal date, and currency from the platform.
If you sign in via Google, Apple, or another OAuth provider, we receive basic profile information (name, email, profile picture) as authorized by you and the third-party provider.
We use your information for the following purposes:
| Purpose | Legal Basis (GDPR) |
|---|---|
| Provide and maintain the Service | Performance of contract |
| Personalize workouts and AI Coach | Performance of contract / Consent |
| Process subscriptions and billing | Performance of contract |
| Send service-related notifications | Performance of contract |
| Improve and optimize the Service | Legitimate interest |
| Prevent fraud and abuse | Legitimate interest |
| Comply with legal obligations | Legal obligation |
| Send marketing (opt-in only) | Consent |
| Conduct analytics | Legitimate interest / Consent |
We do not use your personal data for automated decision-making that produces legal or similarly significant effects without your explicit consent.
We do not sell your personal data. We share your information only in the following limited circumstances:
We engage trusted third-party providers under strict contractual confidentiality and data-protection obligations:
A current list of sub-processors is available upon request via support@flowfitgym.com.
We may disclose information if required by law, court order, or governmental authority, or to protect the rights, property, or safety of FlowFit, our users, or the public.
If FlowFit is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. You will be notified in advance.
For any sharing not described above, we will request your explicit consent.
Your data is stored on secure cloud infrastructure operated by Google Cloud Platform (Firebase) within the European Union (europe-west1, Belgium). AI Coach requests may be processed via AWS Lambda in eu-central-1 (Frankfurt, Germany) within the EU/EEA under our agreement with AWS. AI model providers (for example Google Gemini, OpenAI, or Anthropic) may process prompts outside the EU, including in the United States, where applicable under Standard Contractual Clauses. Some metadata may also be processed in the United States by sub-processors (subject to Standard Contractual Clauses).
We implement industry-standard administrative, technical, and physical safeguards, including:
No system is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
We are required to tell you how long we store your user data and how you can delete it. We retain your personal data and health data only for as long as your account is active to provide the Service.
How to Delete Your Data: You have the right to delete your account and all associated data at any time. You can do this in two ways:
What happens when you delete your data:
Depending on your jurisdiction, you have the following rights:
Under Article 11 of KVKK No. 6698, you have the right to learn whether your personal data is processed, request information about processing, learn the purpose of processing, know third parties to whom data is transferred, request rectification or deletion, and seek compensation for damages arising from unlawful processing.
To exercise any of these rights, email support@flowfitgym.com with the subject line "Privacy Request." We will respond within 30 days. We may need to verify your identity before fulfilling certain requests.
You can also delete your account directly within the app: Settings → Delete Account & Data.
FlowFit is not intended for children under 16 years of age. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at support@flowfitgym.com and we will promptly delete it.
In jurisdictions where the digital age of consent is higher (e.g., 18 in some regions), users below that age must obtain parental consent.
Body measurements, BMI, body fat percentage, heart rate, and similar health-related data may be considered sensitive personal data under GDPR (Article 9), CCPA, and KVKK. We process this data based on your explicit consent and use it solely to provide the personalized fitness features you request.
FlowFit is not a medical device. The Service does not provide medical advice, diagnosis, or treatment. Always consult a qualified healthcare professional before beginning any exercise program, especially if you have underlying conditions.
If you choose to connect FlowFit with Apple Health (iOS) or Health Connect (Android), data flows are governed by the platform's privacy framework.
Data Accessed and Collected: We only access and collect categories you explicitly authorize — specifically steps, heart rate, active energy, blood oxygen (SpO₂), weight, workouts, and sleep-related intervals.
Usage of Health Data: This data is used solely to provide the personalized fitness features you request. Aggregates power in-app Health summaries, and a subset of rolling aggregates (e.g. steps, sleep duration, average heart rate) are included in AI Coach and daily insight prompts to personalize your workout recommendations.
Protection of Health Data: We do NOT sell your Health Data to third parties. We do NOT use your Health Data for advertising, marketing, or cross-context behavioral tracking. Your Health Data is retained only as long as your account is active and is deleted when you request account deletion. You can revoke access at any time through your device settings.
\nThe AI Coach feature uses large language models to generate personalized recommendations. When you interact with the AI Coach:
The mobile app does not use traditional browser cookies. It may use:
If you visit our website (https://flowfitgym.com/), please refer to the website's separate cookie notice.
If you access FlowFit from outside the European Union, your data may be transferred to, stored, and processed in countries other than your own. We ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, to protect your data during international transfers.
FlowFit may contain links to third-party websites or services. This Policy does not apply to those third parties. We encourage you to review their privacy policies before providing any personal information.
We may update this Policy from time to time. Material changes will be communicated via:
The "Last Updated" date at the top of this Policy reflects the most recent revision. Continued use of the Service after changes take effect constitutes acceptance of the updated Policy.
For all privacy-related inquiries, requests, or complaints, please contact:
FlowFit Gym — FlowFit Privacy Team Email: support@flowfitgym.com Website: https://flowfitgym.com/ Address: İstanbul, Türkiye
You may also lodge a complaint with the Turkish Personal Data Protection Authority (KVKK) at https://www.kvkk.gov.tr or with your local supervisory authority within the European Union.
This Privacy Policy was prepared in accordance with App Store Review Guideline 5.1.1, Google Play Developer Program Policies, GDPR, CCPA/CPRA, and KVKK No. 6698.