Privacy Policy

Last updated: November 9, 2026

Beta template. This policy was written in plain English for the free beta, without a lawyer. It hasn't been legally reviewed yet, and will be before Cima Fit charges money or launches widely.

Cima Fit (“we”, “us”) is a workout app that is currently in a free beta, run from the United States. This page explains what we collect when you use it, why, who else handles it, and how you can export or delete it.

1. What we collect

Your account

• Your username and password (we store only a one-way hash of the password, never the password itself).
• Your first name and email address, if you choose to give them. Email is used for password resets.
• When you accepted these policies, and how you found us: the invite or campaign code in the link you followed (for example ?ref= or utm_ tags) and, if you came from a Meta or Google ad and didn't opt out of ad cookies, the click ID that Meta or Google adds to the link (fbclid or gclid). We keep these with your account to see which ads and posts bring people who keep using the app, and we never send them back to Meta or Google. Click IDs are removed after 13 months, and everything is removed when you delete your account.

Your training

• Workouts, plans, exercises, sets, weights, reps and notes you log.
• Preferences such as your goal, experience, equipment, schedule and rest times.
• Injuries or limitations you type in, so workouts can avoid them.
• If you turn on workout reminders: your phone's push address (from its browser's push service), the hour you picked and your time zone, so we can send at most one reminder a day on days you're due to train. Turn them off any time in Profile → Reminders & alerts; deleting your account removes them.

Optional body data

• Bodyweight, measurements and protein you log.
• Body or progress photos you choose to upload.

This information can be sensitive. Only add what you're comfortable with — the core app works without any of it.

Coach chats and feedback

• Messages you send to the AI coach and its replies.
• Feedback and bug reports you send, along with basic device information attached to them (browser, screen size, app version and recent error messages) so we can reproduce problems.

Usage and technical data

• Simple usage events with a timestamp — for example “signed up”, “started a workout”, “finished a workout” — so we can tell whether the app is working for people.
• Your IP address and basic request logs, used for security and rate limiting and kept briefly by our hosting provider.
• A login token stored on your device to keep you signed in, and small bits of local storage (like an unfinished set or the rest timer) so the app keeps working on bad signal.

2. Why we use it

• To run the app for you: build workouts, show last time and your next target, remember your plan and progress.
• To keep your account safe: logging in, password resets, limiting abuse.
• To fix and improve the beta: reading feedback and bug reports, and looking at usage events to find what's broken or confusing.
• To contact you about your account, only if you gave us an email — for example a password reset link or an important change to the beta.

We don't use what you log in the app for advertising, and we don't build marketing profiles about you. The only advertising-related processing is the ad measurement on our public pages described in section 4A.

3. AI features and OpenAI

Some features use AI: the coach chat, building or editing a plan, swapping an exercise, the machine scanner, and photo features such as body check-ins or form checks. When you use one, we send the information that feature needs to OpenAI, which processes it on our behalf as a service provider and sends back the result. Depending on the feature, that can include your goal, equipment, recent workouts, limitations, the message you typed, and — for photo features — the photo itself.

At the time of writing, OpenAI's API terms say data sent through the API isn't used to train their models by default, and may be kept for a limited time (up to 30 days) to monitor for abuse. See OpenAI's policies for details. The core app — picking workouts, logging sets, seeing what to beat — works without AI.

If OpenAI can't answer, text requests (never photos) may go to Perplexity instead, which handles them the same way, as a service provider.

Nothing is sent until you allow it. The app asks the first time you use an AI feature. If you say no, AI features stay off and everything else keeps working. You can turn them on or off any time in Settings → AI features.

4. Who else sees it

We share information only with the services that run the app for us, and only so they can do that:

• Hosting and database providers (for example Render and Neon) that store and serve the app.
• OpenAI, for the AI features you use (see above), and Perplexity as its text backup.
• An email delivery provider, if password-reset emails are turned on.
• Cloudflare, which hosts our website.
• Our team chat service (Slack or Discord), which receives messages sent through the website contact form and, if switched on, a short notice when you send feedback in the app.
• Stripe, if you buy a subscription or AI credits: Stripe takes your payment on its own page, so we never see or store your card number. We keep a record of what you bought (for example, a credit balance and how it was used).

The person running the beta can see account details, training activity, feedback and usage events in an admin view, to support testers and fix problems.

We don't sell or rent your personal information. Nothing you log in the app is shared with advertising companies, and there are no ad or analytics trackers once you're logged in. The only exception is limited to our public pages before you sign up: see section 4A. We may disclose information if the law requires it, or to protect someone's safety.

4A. Ads and cookies on our public pages

We advertise Cima Fit on Meta (Facebook and Instagram), Google and Reddit, but right now our public pages load no ad cookies or ad tags: nothing from your workouts, body data or photos is sold or sent to advertisers. If we turn on ad measurement on our public pages, we will ask first (choose Allow or No thanks), honour Global Privacy Control and Do Not Track, and update this section.

5. How long we keep it

We keep your data until you delete it or delete your account. When you delete your account it is removed from our live database immediately. Copies can remain in our database provider's automatic backups for a short period (days, not months) until they expire. If the beta ends, we'll give notice so you can export your data first.

6. Your choices and rights

• Export: Profile → Your data → Download my data downloads everything as a JSON file.
• Correct: edit your details, preferences and logged sets in the app.
• Delete: Profile → Your data → Delete account (details below, and on Delete your account). It's immediate and permanent.
• Ad cookies: say no in the cookie notice or under Your privacy choices on our public pages; Global Privacy Control and Do Not Track are honoured automatically (section 4A).
• Appeal: if we turn down a privacy request, reply to our answer and ask us to reconsider; a different person will review it and reply within 45 days.
• Ask us: to access, correct or delete your information, or if you have any questions, use Send feedback in the app (Profile → Send feedback).

Depending on where you live (for example California, the EU or the UK) you may have extra legal rights, such as to access, correct, delete or port your data, or to object to how it's used. We honour these requests for everyone, wherever they live.

7. Delete your data

8. Adults only

Cima Fit is only for people aged 18 or older, and isn't directed at children. If we learn that someone under 18 has an account, we'll delete it. Never upload photos of anyone under 18.

9. Security and where data lives

Connections to the app are encrypted (HTTPS), passwords are stored as one-way hashes, and access to the data is limited to running the service. No system is perfectly secure, so please use a password you don't use anywhere else.

This is a US-based beta. Your information is stored and processed in the United States. If you use Cima Fit from elsewhere, your information will be transferred to and handled in the US.

10. Changes and contact

If we change this policy we'll update this page and the date at the top. For significant changes we'll also let you know in the app.

Questions or requests? use Send feedback in the app (Profile → Send feedback).