Loading…
Privacy Policy
Last updated: May 12, 2026
This privacy policy explains what data AivaFit collects, how we use it, your rights, and how we handle data when you delete your account or withdraw consent. We aim to be honest and direct.
What we collect: account info you provide, fitness data you log, photos you scan, AI conversation context, and technical telemetry. We do not sell your data and we do not engage in targeted advertising.
What you control: you can withdraw AI processing consent, request your data export, request account deletion (7-day grace period), and update preferences. These options live in the AivaFit mobile app's Settings section. Web users with a paid subscription can also manage billing through the Stripe Customer Portal at aivafit.com/account. You can always email support@aivafit.com.
1. Who we are
AivaFit ("we", "our", "us") is operated by Waxwing International Inc., a company registered in Canada. This Privacy Policy explains how we collect, use, and protect your personal information when you use the AivaFit mobile application and website (collectively, the "Service"). For questions or to exercise your rights, contact us at support@aivafit.com.
2. What this policy covers
We launch in Canada, the United States, the United Kingdom, Australia, and other low- and medium-friction privacy regimes including Middle East and Asia (excluding strict-regime jurisdictions such as the EU/EEA and Quebec at MVP launch).
Region-specific rights and complaint paths are summarized in Section 15. We comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, the UK Data Protection Act 2018 + UK GDPR + the Privacy and Electronic Communications Regulations (PECR), and the Australian Privacy Act 1988 (Australian Privacy Principles 1-13 + Notifiable Data Breaches scheme).
3. What data we collect
Account credentials: your name, email address, and account credentials.
Health and fitness data: fitness goals, workout history, nutrition logs, body measurements (weight, height, neck, waist, hip circumference), body fat percentage estimates, mood and stress levels, sleep quality, readiness scores, and activity data.
Camera and photos: if you choose to use the AivaPulse Vision body composition feature, the app accesses your device camera to capture front and side photos for body measurement estimation. These images are processed on your device and are not stored on our servers unless you explicitly choose to save progress photos. AivaPulse Vision uses pose detection (skeleton landmarks) for measurement, not face recognition or biometric identification.
Dietary and cultural preferences: food preferences, dietary restrictions, cultural cuisine selections, and lifestyle context.
Payment data: email address and subscription metadata. Payment card details are handled directly by Stripe; we do not store card numbers.
Usage data: app interactions, device information, and crash reports to improve the Service.
4. How we use it
Your information is used to: personalize your workout and nutrition plans, provide AI-powered coaching through AivaPulse, estimate body composition and track progress, process payments, improve our Service, and communicate with you about your account.
We document a specific lawful basis for each processing activity (consent, performance of a contract, or legitimate interest). We do not sell your personal data to third parties. We do not engage in targeted advertising.
6. How long we keep it
We retain different categories of data for different periods, and we do not retain personal information indefinitely. Summary:
- Account credentials, fitness profile, workout history, nutrition logs, AivaPulse conversation history, plan blueprints, and coaching state — retained while your account is active; deleted within 30 days of account closure.
- Payment records — retained per applicable tax law (typically 7 years US, 6 years Canada and UK, 5 years Australia) after account closure. Stripe retains these records per their legal and tax obligations; we cannot override their retention period.
- Crash analytics — retained 90 days, then aggregated.
- Marketing consent records (when applicable) — retained 3 years post-withdrawal as evidence of compliant consent handling.
- Deletion audit log entries — retained 7 years for compliance audit purposes (no personally identifiable content; metadata only).
7. Your rights
You have the right to:
- Access — request a copy of the personal data we hold about you, delivered as a JSON file. Request your data export in the AivaFit mobile app's Settings (when available) or by emailing support@aivafit.com. We respond within 30 days.
- Rectification — correct inaccurate data in the AivaFit mobile app or by emailing support.
- Erasure — request account deletion in the AivaFit mobile app's Settings (when available) or by emailing support@aivafit.com. Deletion is processed within 30 days and cascades through our subprocessors (Stripe, RevenueCat, Firebase Auth) where deletion APIs are available. A 7-day grace period applies before final deletion to protect against accidental requests; you may cancel within that window. In rare cases of vendor API failure, deletion may complete partially; the remaining items are surfaced for manual review and completed within 5 business days. Payment records are retained at Stripe per their legal and tax retention obligations; we cannot override their retention period and do not have access to delete those records ourselves.
- Withdraw consent for AI processing — disable AI-powered coaching and food recognition while keeping your account and workouts (Section 10).
- Data portability — your access export above is provided in a structured, machine-readable JSON format you can transfer.
- Object — for legitimate-interest processing (e.g., crash analytics), contact us to opt out.
Subscription management and account-deletion capabilities ship with the AivaFit mobile app Settings (per the project roadmap); web users with a paid subscription can manage billing today through the Stripe Customer Portal at aivafit.com/account. Region-specific rights are summarized in Section 15.
8. AI processing disclosure
AivaFit uses third-party AI services to power coaching and food recognition. We disclose this clearly per Apple App Review Guideline 5.1.2(i):
- Anthropic (Claude) — receives your fitness story, plan blueprint, and coaching conversations to generate coaching responses.
- Google (Gemini) — receives your fitness story (for structured extraction), plan blueprint (fallback narrative generation), and food images / descriptions (for food recognition).
These services process your data per their published Data Processing Addendums, and we do not authorize use of your data for training. You can withdraw consent for AI processing at any time; see Section 10.
9. Automated decision-making
AivaFit produces fitness recommendations using a deterministic rules engine informed by your data. AI assists with framing and explanation but does not make the underlying training, nutrition, or recovery decisions — those come from auditable rules. None of our automated processing produces decisions with legal or similarly significant effects. You can disable AI assistance via Section 10 at any time without losing access to workouts or other core features.
10. Withdrawing consent
You can withdraw consent at any time:
- AI processing — withdraw AI processing consent in the AivaFit mobile app's Settings (when available; until then, contact support@aivafit.com). When AI consent is withdrawn, AivaPulse coaching is disabled, food logging falls back to manual entry, and onboarding-AI flows return generic plan templates instead of AI-generated reflection. Workouts, history, and other core features continue to work normally.
- All processing — request account deletion (Section 7).
12. Children's privacy
AivaFit is intended for users 18 years of age and older. We do not knowingly collect personal information from children under 13 (per the U.S. Children's Online Privacy Protection Act). If we become aware that we have collected information from a child under 13, we delete that information promptly and terminate the account. If you believe a child has created an account, contact support@aivafit.com.
13. Medical-device posture
AivaFit is not a regulated medical device app. We provide fitness guidance — not diagnosis, prevention, monitoring, or treatment of medical conditions. Our AivaPulse coach explicitly avoids medical advice and refers you to a healthcare provider for clinical concerns. Always check with your doctor before starting a new exercise routine.
14. International data transfers
Your data is stored on servers located in the United States. Our subprocessors operate primarily in the United States. UK and Australian users: your personal data is transferred to the US under our subprocessors' published transfer mechanisms (Standard Contractual Clauses or equivalents). EU residency is not currently available; users in the EU/EEA are not in our launch markets.
15. Region-specific addendums
California (CCPA / CPRA): California residents have the right to know, delete, correct, opt out of sale or sharing, and limit use of sensitive personal information. AivaFit does not sell or share personal information for cross-context behavioral advertising; the "Do Not Sell or Share" opt-out is therefore not applicable. Health and fitness data is sensitive personal information; we limit its use to providing the Service. Contact us at support@aivafit.com to exercise CCPA rights.
Virginia / Colorado / Connecticut / Utah: residents of these states have the rights to access, delete, correct, and opt out of sale or targeted advertising under their respective consumer privacy laws. AivaFit does not engage in sale or targeted advertising. Contact us to exercise these rights.
United Kingdom: UK users have the substantive rights of UK GDPR — access, rectification, erasure, restriction, portability, and objection. Complaints may be lodged with the Information Commissioner's Office (ICO).
Australia: Australian users have the rights of Australian Privacy Principles 12 (access) and 13 (correction). We comply with the Notifiable Data Breaches scheme and notify the Office of the Australian Information Commissioner (OAIC) and affected individuals when an eligible data breach occurs.
Canada: Canadian users have rights under PIPEDA. Complaints may be lodged with the Office of the Privacy Commissioner of Canada.
16. Changes to this policy
We may update this Privacy Policy from time to time. We will notify you of any material changes through the app or by email. Continued use of the Service after changes constitutes acceptance of the updated policy.
17. Contact us
If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us at support@aivafit.com.
Waxwing International Inc.
St. John's, Newfoundland and Labrador, Canada