Privacy Policy

Last updated: 7 July 2026

1. Data controller

Buddu Fit ("we", "us") is the data controller for processing your personal data when you use our calisthenics and fitness app (calisthenics.dk). Contact: support@calisthenics.dk.

2. What data we collect

Name, email, password (hashed), login credentials
Fitness data: height, weight, goals, training level, workouts, PRs
Nutrition data: food logs, meals, calorie and macro targets
Images/videos you upload to the AI food scanner and movement analyzer
AI chat history with the AI Coach
Device data: IP address, browser, operating system, language settings
Usage data: pages visited, features used, credits consumed

3. Purpose and legal basis

Account administration (contract fulfilment) — sign-up, login, profile
Delivering the service (contract fulfilment) — workouts, nutrition, AI features
AI analysis (contract fulfilment) — image/video analysis, form feedback, coaching
Security and fraud prevention (legitimate interest)
Product improvement (legitimate interest) — anonymised analytics
Marketing (consent) — only with your explicit consent

4. Recipients / processors

Supabase / Lovable Cloud — hosting, database, auth, storage (EU)
Google (Gemini AI) and OpenAI — AI model inference for the coach, food scanner, plans
Stripe, Inc. — payment processing, subscription management, invoicing and fraud prevention
Legal authorities where required by law

5. Transfers to third countries

Some AI subprocessors (Google, OpenAI) process data in the US. Transfers rely on the European Commission's Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework.

6. Retention period

Account data: until you delete your account
AI uploads (images/videos): 30 days, unless you save them
Payment data: 5 years (Danish bookkeeping law)
Backups: up to 30 days after deletion

7. Your rights (GDPR)

You have the right to:

Access, rectification, erasure ("the right to be forgotten")
Restriction of processing and objection
Data portability (export as JSON)
Withdraw consent at any time
Complain to the Danish Data Protection Agency (datatilsynet.dk)

Send requests to privacy@calisthenics.dk. We respond within 30 days.

8. Security

We use TLS 1.3, encryption at rest, Row Level Security on all user data, hashed passwords (bcrypt/argon2), and separate roles for admin access.

9. Cookies

We use necessary cookies for login/session, which are always active. We also use Google Analytics to understand how the app is used (page views, sign-ups, purchases) — but only if you have actively given consent via the cookie banner. You can withdraw your consent at any time by clearing your cookies or contacting us at privacy@calisthenics.dk.

10. Changes

Changes are announced by email or an in-app banner at least 14 days before taking effect.