SynaptoPrivacy Policy
Version 2.0 · Last updated 14 October 2026
SynaptoFit is a fitness tracker, so most of what you record in it is health data. We only process it with your explicit consent, we show no ads, we use no third-party analytics, and we never sell your data. Deleting your account in the app permanently deletes everything.
1. Who we are
SynaptoFit ("SynaptoFit", "we", "us") is a fitness and gym tracking app operated by Connor Trimble, a sole trader based in the United Kingdom, of 92 Exton Road, Chichester PO19 8BT, United Kingdom.
For the purposes of the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and, where applicable, the EU General Data Protection Regulation ("EU GDPR"), Connor Trimble is the data controller of your personal data.
Contact for anything in this policy: privacy@synaptofit.com. General support: support@synaptofit.com.
2. The short version
- SynaptoFit is a health and fitness tracker, so most of what you record in it is health data — a special category under the GDPR. We only process it with your explicit consent, which you give during onboarding and can withdraw at any time.
- Your data lives primarily on your own phone. A copy syncs to our server so you can restore it and (in future) use features that need it.
- We show no ads, use no third-party analytics or tracking SDKs, and never sell your data. Nobody but the operator has access to the server.
- Deleting your account in the app permanently deletes all of your data from our server.
3. What data we collect
3.1 Account data
- Name, email address, and a password (stored only as a cryptographic hash — we cannot see your password)
3.2 Profile and onboarding data (includes health data)
- Date of birth, biological sex, height, starting weight
- Training goal, experience level, training days per week, session length
- Available equipment and any injuries you choose to disclose (injuries are optional and skippable)
3.3 Data you log while using the app (health data)
- Workouts: exercises, sets, reps, weights, RPE, rest, tempo, cardio time/distance/heart rate; custom exercises and presets
- Nutrition: foods logged, meals, macro totals; meal presets and custom meal sections
- Body: weight entries, body measurements, body-composition metrics (e.g. body fat %), water intake
- Progress photos, if you choose to take or upload them
- Targets you set, logging streaks, and preferences (units, theme, tracked measurements)
3.4 Technical data
- Authentication tokens to keep you signed in; basic server logs (e.g. request timestamps and IP addresses) generated in operating the service and used only for security and troubleshooting
We do not collect your precise location, contacts, advertising identifiers, or any data from other apps. The app requests camera and photo-library permission only for the barcode scanner and progress photos, and the accelerometer is used only to animate the on-screen water jug — motion data never leaves your device.
4. Special category (health) data and your explicit consent
Most data listed in 3.2 and 3.3 is "data concerning health" under Article 9 GDPR. We process it on the basis of your explicit consent (Article 9(2)(a)), which we ask for in a dedicated, separate step during onboarding — not buried in the Terms of Service.
You may withdraw consent at any time in the app or by emailing privacy@synaptofit.com. Because the entire service consists of recording and analysing this data, withdrawing consent means we can no longer provide the service; you may then export your data (on request) and delete your account.
5. Why we process your data (purposes and lawful bases)
| Purpose | Data used | Lawful basis |
|---|---|---|
| Creating and operating your account; syncing and restoring your logged data | Account data; all logged data | Contract (Art. 6(1)(b)); explicit consent for health data (Art. 9(2)(a)) |
| Showing your own trends, targets, streaks and dashboards | Logged data (processed largely on your device) | Contract; explicit consent for health data |
| Safety warnings when a target looks risky (e.g. calorie floors, unsafe weight-loss rates), personalised via an estimate of your energy needs | Profile data + latest weight + the target you set | Explicit consent (Art. 9(2)(a)) |
| Food search and barcode lookup | The search text or barcode only — sent without your name, email or any account identifier | Contract |
| Service emails (e.g. password reset) | Email address | Contract |
| Security, abuse prevention, troubleshooting | Technical data | Legitimate interests (Art. 6(1)(f)) |
| Complying with law | Whatever the law requires | Legal obligation (Art. 6(1)(c)) |
We do not use your data for advertising, profiling for marketing, or automated decisions with legal or similarly significant effects. If future features (such as AI-generated plans or a paid subscription) need new processing, we will update this policy and ask for any additional consent before those features touch your data.
6. Where your data lives
- On your device: the app is offline-first. Your logs are stored in a local database on your phone and most screens are computed entirely on-device.
- On our server: a copy of your account and logged data (including progress photos) syncs to a server located in the United Kingdom, so your data survives a lost or new phone. The server is accessible only over encrypted HTTPS connections and only to the operator.
7. Who else sees your data (recipients and processors)
We never sell or rent personal data. The limited third parties involved in running SynaptoFit are:
| Service | What they receive | Role / location |
|---|---|---|
| Apple (App Store / TestFlight) | Standard app distribution data under Apple's own policies; we receive no personal data from Apple beyond aggregate install/crash statistics | Independent controller (global) |
| Google (Google Play) | Standard app distribution and crash diagnostics under Google's policies | Independent controller (global) |
| Open Food Facts / Search-a-licious | Your food search text or scanned barcode only — never your identity | Independent service (EU); open-data project |
| IONOS | Email content if you write to our support or privacy addresses; hosting of this website | Processor (UK/EU) |
| Server hosting | Your synced account and logged data | Currently operated directly by us on our own server in the United Kingdom — there is no third-party hosting company involved. If we move to a managed hosting provider, we will update this policy before the move. |
We may also disclose data if required by law, or to a successor operator if the business is transferred — in which case this policy would continue to apply and you would be notified.
8. International transfers
Your synced data is stored in the UK. Where any limited transfer outside the UK/EEA occurs (for example email infrastructure), we rely on UK adequacy regulations or standard contractual clauses. Food searches sent to Open Food Facts are processed in the EU and contain no identity data.
9. How long we keep data
- Account and logged data: for as long as your account exists.
- Account deletion: deleting your account in the app (Profile → Delete account) permanently and irreversibly deletes all your data from the live database, including progress photos. Residual copies in server backups are overwritten within 30 days.
- Server logs: kept for a short rolling period for security, then deleted.
- Emails to support/privacy: kept as long as needed to handle your request and for a reasonable record thereafter.
10. Security
- All traffic between the app and server is encrypted (HTTPS/TLS)
- Passwords are stored only as salted bcrypt hashes
- Access to the server and database is restricted to the operator, protected by credentialed access, and rate-limited against abuse
- The local database on your phone is protected by your device's own security (passcode/biometrics); session tokens are held in the platform's secure storage
No system is perfectly secure. If a breach occurs that risks your rights, we will notify the ICO and, where required, you, in line with our legal obligations.
11. Your rights
Under the UK and EU GDPR you can, at any time:
- Access a copy of your data
- Rectify inaccurate data (largely self-service in the app)
- Erase your data (self-service: delete your account in the app)
- Restrict or object to processing
- Port your data to another service in a machine-readable format
- Withdraw consent at any time, without affecting prior processing
To exercise a right that isn't self-service in the app, email privacy@synaptofit.com. We respond within one month. You also have the right to complain to the Information Commissioner's Office (ico.org.uk) or, in the EU, your local supervisory authority.
12. Children
SynaptoFit is not intended for anyone under 16. We do not knowingly collect data from under-16s; if we learn we have, we will delete it. Please contact privacy@synaptofit.com if you believe a child is using the app.
13. Users outside the UK and EU
We offer the same protections in this policy to all users worldwide. If you are in a jurisdiction with its own privacy law (for example a US state privacy statute), you may have equivalent rights of access, deletion, correction and portability — exercise them via privacy@synaptofit.com. We do not sell or share personal data for advertising in any jurisdiction.
14. Changes to this policy
We will post any changes here and update the version below. For material changes — especially any new use of health data — we will notify you in the app and, where required, ask for fresh consent before the change applies to you.
15. Contact
Connor Trimble, trading as SynaptoFit
92 Exton Road
Chichester PO19 8BT
United Kingdom
privacy@synaptofit.com · support@synaptofit.com