Privacy policy

Last updated: 1 November 2026

1. Data controller

The controller of personal data is the operator of the FitBreak app, available at fitbreak.eu.

2. What data we collect

While you use FitBreak we may process the following data:

• Registration data: e-mail address, name (when you register or sign in with Google)
• Google Calendar data: names and times of events (read only, and only if you give your consent)
• App settings: preferred language, break interval, choice of voice and other personal settings
• Payment data: handled solely by the Stripe payment gateway; FitBreak does not store card numbers

3. Purpose and legal basis

• Account and service: performance of the contract (Art. 6(1)(b) GDPR).
• Payments and accounting: performance of the contract and legal obligation (Art. 6(1)(b) and (c) GDPR).
• Security and abuse prevention: legitimate interest (Art. 6(1)(f) GDPR).
• Google Calendar and ads with cookies: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
• Coach data sync and the AI coach: your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR), because the data may concern health.

4. Google API – limited use

FitBreak accesses the Google Calendar API strictly in read-only mode (scope: calendar.readonly). The app:

• Reads only the names and the start and end times of events
• Does not modify, delete or create any events
• Does not share calendar data with third parties
• Stores access tokens securely on the server, solely so that access can be renewed

The use of data from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.

5. Data storage and security

• Data is stored in a secure database on the server
• Passwords are hashed (bcrypt)
• Communication runs over HTTPS
• Google access tokens are stored securely and used solely to renew access to the calendar

6. Recipients and transfers outside the EU

We do not sell data. Only these processors receive it, and only as far as necessary:

• WEDOS Internet, a.s. (Czech Republic): hosting and database.
• Google: identity verification (OAuth), reading the calendar, speech synthesis and, if running and you consented, ads.
• Stripe: payment processing.
• Microsoft Azure / Google Cloud: speech synthesis. Only the text of a general line is sent. Sentences from your coach plan use your device's voice and are not sent anywhere.
• OpenAI (USA): only when you use the AI coach and only after your consent, see section 9.

Some recipients are based in the USA. Transfers rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

7. Your rights

You have the right to access, rectify and erase your data, to restrict processing, to data portability, to object to processing based on legitimate interest, and to withdraw consent at any time. Withdrawal does not affect processing before it.

• We delete your account and related data on request sent to the contact in the last section
• You can turn off coach data sync in the Coach screen, which deletes the data from your account
• You can disconnect Google Calendar in the app settings or in your Google account settings
• Complaints: you can complain to the Czech Office for Personal Data Protection (uoou.gov.cz) or your local authority.

We make no automated decisions with legal or similarly significant effects on you. A coach plan is only a suggestion.

8. Cookies and local storage

• Session cookies: needed to keep you signed in.
• localStorage: app settings and the coach plan and diary in your browser.
• Advertising cookies: only if ads are running and you consent in the bar. Refusing is as easy as accepting.

9. Personal coach and AI coach

The coach works with what you enter yourself: your goal, your own words about what you want to change, obstacles, fitness, limits, how you feel and how it is going. This data may concern your health or private life.

• Where it is: your plan and diary are stored on your device only and are not sent to the server.
• Sync between devices: only if you explicitly turn it on in the Coach screen. By doing so you consent to storing this data with your account. Turning it off deletes it from your account and withdraws that consent.
• Deletion: you can delete your plan and diary at any time in the Coach screen, under My data.
• The coach is not a doctor: its rules are general, it does not diagnose and does not replace professional advice.

The AI coach is a paid add-on and an artificial intelligence system. It runs only when you start it yourself:

• What is sent: the text you type in the field, your answers to follow-up questions and, when adjusting, a short outline of the plan. Nothing from the diary.
• To whom: OpenAI (USA) as a processor. Under its contract terms, API data is not used to train models and is deleted within 30 days at the latest.
• What we keep: we do not store your text. We record only the time of the call, token count, cost, outcome and consent version, for as long as the account exists.
• Consent: nothing is sent without ticking the box. Please do not enter health details or names. You withdraw consent by no longer using the AI coach; what was already sent is deleted by the provider within the period above.
• Accuracy: AI suggestions can be inaccurate and you review them before use. Mentions of self-harm are not processed by the AI; a help contact is shown instead.

10. How long we keep data

• Account and its data: for as long as the account exists, then deleted
• Accounting and tax records of payments: for the period set by law, usually 10 years
• Data on your device: until you delete it; the coach diary is trimmed to 180 days

11. Age

FitBreak is for people aged 15 and over. Younger users need the consent of a legal guardian; the subscription and the AI coach are for people aged 18 and over.

12. Contact

If you have any questions about privacy, contact us at the e-mail address given on simonet.cz.