Privacy Policy

• Account and profile data (name, email address, your weekly goal settings and preferences) — to create and secure your account. Legal basis: performance of our contract with you.
• Google sign-in data — if you sign in with Google, Google shares your email address, name, basic profile details and a user identifier with us so we can authenticate you. We never receive your Google password.
• Founding member profile details (first name, date of birth, city, country, and gender if you choose to give it — gender is optional and may be left blank or set to "prefer not to say") — used for account administration, confirming Founding Beta eligibility including the 18+ age requirement, personalising the app (for example greeting you by first name), improving the service, and aggregate, de-identified reporting on who the programme reaches. We do not use gender to change your goals, coaching or motivational messaging. These details are never shown on public pages or to other members. Legal basis: contract performance and our legitimate interest in running an eligible, well-understood programme; where you provide optional gender information, your consent.
• Weekly evidence review records (the screenshot you upload, a cryptographic hash of that file so exact duplicate uploads can be detected, the file type and size, the week range and total you report, review status, review notes and an audit trail of changes) — used to review weekly submissions fairly and to detect duplicate or manipulated evidence. Legal basis: contract performance and our legitimate interest in preventing fraud and abuse.
• Fitness and step evidence (weekly step totals you enter, and screenshots you upload from your own health or wearable app such as Apple Health, Fitbit, Garmin, Samsung Health or Oura) — to verify weekly submissions and determine reward eligibility. We do not connect to your wearable account; you choose what to upload. Depending on where you live, this may count as health related information, so we collect your explicit consent through a separate, unticked consent checkbox before checkout and, for existing members, before your first future wearable submission. We use this evidence only to verify your weekly goal, administer rewards, prevent misuse and maintain required records. We never use it for advertising, unrelated profiling or direct marketing, and wearable screenshots, step totals and related evidence are never sent to PostHog, Meta Pixel, Google Analytics or any other advertising or analytics tool. You can withdraw your consent at any time through Rewards Help. Withdrawal stops us assessing future wearable submissions and providing related rewards, and does not affect processing already completed.
• Consent evidence record (the exact consent version and text you were shown, the Privacy Policy version, the date and time in UTC, the source flow or campaign and your country) — kept as an append only record so we can demonstrate that consent was given. This record contains no wearable data.
• Baseline evidence and goal history (your reported previous 7-day average steps, the supporting screenshot and its cryptographic hash, review status and reviewer notes, plus each daily step goal assigned to you, its three-week block dates, the reason for each change and any goal-change request you send us) — used to set a fair starting goal, to keep an accurate and auditable record of the goal that applied to each week, and to review change requests. Goal history is kept as an append-only record so past weeks cannot be rewritten. Legal basis: contract performance and our legitimate interest in running the programme fairly.
• Goals, history and progress (daily and weekly goals, streaks, badges, submission history, reward records) — to run the accountability programme. Legal basis: contract performance.
• Payment and subscription metadata from Stripe (subscription status, plan, price, period dates, customer and subscription identifiers, country, and the last few digits or card brand where Stripe provides it) — collected only if you later actively choose a paid membership, to give you access to paid features. We never receive or store your full card number or CVC. No payment data is collected for the complimentary first 30 days, which need no card. Legal basis: contract performance.
• Referral data (who referred whom, referral status, and the verified submissions that unlock a referral voucher) — to operate the referral benefit and check eligibility. Legal basis: contract performance and legitimate interests in preventing abuse.
• Support messages — to answer your questions. Legal basis: legitimate interests in supporting our members.
• Device and technical data (pages viewed, approximate device, browser and operating system, IP address, timestamps, error and security logs) — for security, fraud prevention, and improving the product. Legal basis: legitimate interests.
• Marketing preferences — to send product updates where you have opted in. Legal basis: consent, which you can withdraw at any time.

• Service providers / subprocessors — hosting, database, authentication, analytics and support tooling, acting on our instructions.
• Stripe, our payment processor, only if you later actively choose a paid membership — for taking payment, storing card details securely, managing that subscription and the billing portal, and fraud prevention. Stripe also processes some payment data as its own controller under its privacy policy. Accountably Fit Pty Ltd remains the seller and stays responsible for the membership.
• Reward voucher fulfilment providers — when a voucher is issued, a third-party voucher fulfilment provider receives only what is necessary to deliver that voucher.
• Professional advisers (legal, accounting) and authorities where required by law.

We do not sell your personal data.

Our providers may process data outside your country, including outside the UK/EEA. Where that happens we rely on appropriate safeguards such as adequacy decisions or Standard Contractual Clauses.

We keep account, profile and membership data (including first name, date of birth, city, country and any optional gender you provide) while your account is active and for up to 24 months afterwards, except where a longer period is required for tax, accounting or legal purposes (typically 7 years for transaction records). Uploaded weekly screenshots are kept only as long as needed to review the relevant week and handle any query or appeal about it, and are then deleted; the review record and file hash may be kept for up to 24 months so duplicate or repeated abuse can still be detected. If you ask us to delete your account, we delete or de-identify your profile details within 30 days, other than records we must keep by law. Aggregate reporting derived from these details is de-identified and cannot be linked back to you.

The consent evidence record may be kept while your account is active and for up to 24 months afterwards, or longer only where reasonably necessary to establish or defend a legal claim or where the law requires it.

Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing of your personal data, to receive it in a portable format, and to withdraw consent. UK/EEA residents may also lodge a complaint with their supervisory authority. We respond to requests within one month. Contact us through the app to exercise any of these rights.

To withdraw your wearable activity data consent, use Rewards Help. We will stop assessing future wearable submissions and providing related rewards. Withdrawal does not affect processing already completed.

We use appropriate technical and organisational measures, including encryption in transit, access controls, and row-level database security, to protect your data. No system is perfectly secure, but we take this seriously and review our controls regularly.

We use essential cookies and local browser storage to keep you signed in and to remember your session. If you later actively choose a paid membership, our payment provider sets cookies necessary for that checkout. You can clear or block cookies in your browser settings, though essential cookies are needed for sign-in to work.

We include the Google Ads measurement tag so we can understand, at an aggregate level, whether our advertising reaches people. It runs with Google Consent Mode v2 and starts in denied mode, in which no advertising or analytics cookies are set; Google may still receive limited cookieless consent-status or measurement pings. A banner lets you choose “Allow measurement” or “Reject”, with no preselection and no effect on your access to the service. If you allow measurement, Google Ads measurement storage and signals may be used for aggregate reporting; ad personalisation stays denied permanently. You can change your choice at any time using “Cookie settings” in the footer.

We never send wearable activity data, step totals, health information, complaint or support messages, email addresses, names, payment details, voucher data or other member identifiers to Google. We do not use personalised advertising, enhanced conversions, remarketing or customer matching.

Accountably Fit is for adults only. You must be 18 or over to create an account, and your date of birth is checked at sign-up. We do not knowingly collect personal data from anyone under 18; if we learn we have, we will delete the account and its data. A parent or guardian can contact us to request deletion.

We will update this notice as the product develops and will note the date of the latest change above. For any privacy question, or to exercise your rights, use Rewards Help or the in-app help in your Accountably Fit account.