What we collect
- Your account: email address, name, a password (kept only as a salted hash — we never store it in the clear), and the sign-in and security settings you choose.
- Coaching: plans, sessions, results, check-ins, nutrition targets and messages between a coach and their athletes.
- Services you connect: Strava activities, Instagram posts, calendar events, and Apple Health or Google Health Connect (see Health data below) — only after you connect them.
- Health and fitness data, only if the athlete allows it on their phone: workouts, steps, distance, heart rate, resting heart rate, heart-rate variability, calories burned, sleep, and food logged in other apps (energy, protein, carbohydrate and fat). It is read from Apple Health on iPhone or Google Health Connect on Android — with the athlete’s permission, also in the background and from their earlier history — so completed sessions tick themselves off and the coach sees the athlete’s training load, recovery and nutrition.
- Payments: your plan and subscription status from our payment provider. We never see or store card numbers.
- Your town: if you add it to your profile (otherwise the city of your device’s time zone), to look up the weather on your training days.
- Devices: a notification token if you turn on notifications; when you were last active.
- How a coach found us: the link or ad that brought you to AZFit, stored with your account when you sign up.
Why
To provide AZFit, keep accounts secure, bill paid plans, answer support requests, and — only if you allow marketing cookies — measure our ads.
Coaches and their athletes
In a coach’s workspace the coach decides what to collect from their athletes; AZFit processes that data on the coach’s behalf and for no other purpose.
Health data
We use health and fitness data only to run the coaching the athlete signed up for: to complete planned sessions, to show the athlete and their coach training load, recovery and nutrition, and to write Zoobia’s notes. We never sell it, never use it for advertising, and never share it with anyone except the athlete’s own coach and the providers below that process it for us. An athlete can switch off access at any time in Apple Health or Health Connect, and deleting their account deletes it.
Who helps us run AZFit
- Cloudflare — hosting the web app.
- Resend — sending sign-in, email-confirmation and password-reset emails.
- Railway — running our servers and database.
- Paddle.com — taking payment for paid plans as the Merchant of Record.
- Google Firebase — delivering notifications to the AZFit app on Android.
- Sahha — reading health and fitness data from Apple Health and Google Health Connect, only when the athlete connects it.
- Anthropic — the AI model behind Zoobia, our AI agent: its weekly reads and workout notes, on paid plans, and only for athletes who have said yes in the app (Today, or Training profile → Zoobia). It then receives the training, recovery and nutrition figures each read needs, under terms that do not allow it to use them to train its models. Without that yes, reads come from AZFit’s own engine and nothing is sent to Anthropic; the switch can be turned off at any time.
- MET Norway and OpenStreetMap — the weather forecast for an athlete’s training days, so fluid and salt advice fits the heat. Only a town name and coordinates rounded to about 10 km are sent — never a name or an exact location.
- Stripe — only when a coach connects their own account to take payment from athletes; that payment is between the athlete and the coach.
- Meta — only if you allow marketing cookies, to measure our ads.
- Strava and Instagram — only when you connect them.
Cookies
AZFit keeps you signed in with storage in your browser that the app needs to work. The only other cookie is Meta’s ad cookie on AZFit’s own pages, and only if you choose “Allow”. Coaches’ sites and athletes’ apps never carry it.
Keeping and deleting
We keep your data while your account is open. You can delete your account yourself, in the AZFit app or on the web: tap your name, then Delete account, and type DELETE to confirm. The account and everything in it — profile, training history, health data synced from your phone, nutrition, messages and, for a coach, the coaching site — are deleted straight away, and a coach’s AZFit plan is cancelled so nothing is billed again. Only what the law requires us to keep is kept (billing records, held by Paddle). If you can’t sign in, write to privacy@azfit.app from the account’s address and we delete it within 30 days. For a copy of your training data, write to the same address.
Your rights
Depending on where you live, you can ask to see, correct, delete or move your data, object to how we use it, and withdraw consent at any time. Write to privacy@azfit.app; you can also complain to your data protection authority.
Security
Email-and-password sign-in with email confirmation, optional two-step authenticator codes, encrypted connections, and connection tokens sealed at rest.