Privacy Policy

• From X when you sign in: your X account ID, username, display name and avatar URL. We request read-only access and cannot post for you. The X access token is used once and revoked; it is not stored.
• Your community profile: handle, display name, avatar, bio and interests that you choose.
• Content you create: posts, comments, votes, club and challenge activity, and media you upload.
• Fitness data you log: workouts, sets, notes, goals, challenge check-ins and personal records.
• FIT AI data: your questionnaire answers and your conversations with the assistant, if you opt in.
• Wallet data, if you link one: the public address, the time ownership was verified, and token balances read from the public blockchain.
• Technical data: session records, a one-way hash of your IP address for rate limiting and security logs, and your browser's user-agent string.

Every member signs in with X. You then choose whether other members see your X username and avatar (public identity) or a handle and avatar you pick (anonymous identity).

For anonymous members, the X identity is stored in a separate private record that is never included in profile pages, posts, search, notifications, share links, image file names or data shown to other members. Wallet addresses are never shown publicly in either mode.

Anonymity has limits we cannot control: what you write or upload can identify you, and blockchain transactions are public. If you switch from public to anonymous, we remove the X details from your profile, but we cannot erase what others already saw.

• To run the service: show your feed, record your training, operate challenges and leaderboards.
• To keep the community safe: rate limiting, spam and abuse detection, moderation and appeals.
• To check membership eligibility when token gating is switched on, using public blockchain data for the wallet you linked.
• To produce aggregate, non-identifying statistics about how the product is used. We do not use third-party advertising or tracking scripts.

We share data only with the services needed to operate FITCOIN:

• X Corp., to authenticate your sign-in.
• DeepSeek, our AI processor for FIT AI. When you use FIT AI, your questionnaire answers and your message (and, only if you separately consent, a photo you submit for analysis) are sent to generate a reply. Your X identity, handle, wallet and profile are never sent. Post or comment text you ask to translate is sent the same way, without the author's or your identity.
• BNB Smart Chain RPC providers, to read public token balances for a linked wallet address. The address is public blockchain data.
• The hosting and storage infrastructure chosen by the operator of this deployment.

Fitness and health-related information is treated as sensitive. Workout notes, AI conversations and questionnaire answers are private to you. Free-text limitations and AI messages are encrypted at rest. Administrators cannot browse your health information in the admin console.

We do not ask for precise location. Images are re-encoded on upload, which removes embedded metadata such as GPS coordinates; videos are re-packaged with their metadata removed.

FITCOIN is not a healthcare provider and makes no claim of compliance with health-sector regulations such as HIPAA.

• Visibility: choose who can see your profile, workouts and progress, and whether you appear on leaderboards.
• Consent: FIT AI and photo analysis are opt-in and can be withdrawn at any time in Settings → Privacy.
• Export: download a complete copy of your data as JSON from Settings → Account.
• Deletion: delete your account from Settings → Account. This permanently removes your profile, content, fitness data, AI conversations, wallet links and uploaded media.
• Block and mute other members, and control mentions and notifications.

• Account data is kept until you delete your account.
• Sessions expire after 30 days; expired sessions and used wallet-verification nonces are purged daily.
• Photos submitted for AI analysis are deleted from our storage immediately after the request.
• Uploads never attached to a post are deleted after 24 hours. Notifications are kept for 90 days.
• Security and administrative audit logs contain no health data and are retained to investigate abuse.
• Backups are encrypted and rotated on the operator's schedule; deleted data leaves backups as they expire.

Connections use HTTPS. Sessions use secure, HTTP-only cookies. Sensitive fields are encrypted at rest with authenticated encryption. Linking a wallet never involves your seed phrase, private key, a transaction or a token approval. No system is perfectly secure; if we learn of a breach affecting you, the operator will notify you as the law requires.

FITCOIN is for adults aged 18 and over. We do not knowingly collect data from minors, and FIT AI declines to coach anyone who indicates they are under 18.

If this policy changes materially we will announce it in the app before the change takes effect.