Privacy Policy

This policy applies to the Flexxit mobile app (Android package com.fearless.app), developed and published on Google Play by R00T. It explains what personal data R00T and Fearless Fitness ("we", "us") collect when you use the Flexxit app and our gyms, why we collect it, who can see it, how long we keep it, and the rights you have. It is written to meet Kenya's Data Protection Act, 2019. Fearless Fitness is the data controller.

1. What we collect

Your account

• Your name, phone number and email address, and the gym branch you join.
• Your password. We never store it as you typed it; we keep only a one-way scrambled version (a hash) that cannot be turned back into the password.
• Whether your phone or email was verified with a one-time code, and when your membership was approved.

Health and fitness information

• Your height and weight, and the history of your weigh-ins (entered by you or recorded by staff at the gym).
• Your body mass index (BMI), which the app calculates from your height and weight.
• Your weekly workout and meal plan, the sets you log, and the meals you confirm or swap.
• Your gym visits: when you were checked in and out, and how long each session lasted.
• Progress notes the app creates automatically: attendance, meal-confirmation and progress "flags" that tell your instructor you may need support.

Health information is sensitive personal data. We collect it only because it is what the service does (planning and tracking your training), and only with your consent, which you give when you create your account and can withdraw at any time by deleting your account (section 7).

Technical information

• A notification token for your phone, if you allow notifications, so we can send you reminders. It identifies the app on your device, not you personally.
• The network (IP) address your requests come from, used only to limit repeated sign-in and code attempts. It is kept for about an hour.
• Sign-in tokens that keep you logged in. Your app stores them in your phone's secure storage; they stop working when you log out or change your password.

We do not use advertising or analytics trackers, we do not collect your location, and we do not access your contacts, photos or camera.

2. Why we use it

• To create and manage your membership, including reviewing and approving your sign-up.
• To prepare your workout and meal plans and track your attendance and progress.
• To let your instructor check you in and out, log sessions with you and support you when you fall behind.
• To send you messages you need: sign-up and password-reset codes, approval notices, alerts when your account details change, and reminders from your instructor.
• To keep accounts secure and prevent misuse, for example by limiting repeated failed sign-in attempts.
• To understand how each branch is doing through totals such as member numbers, average session length and retention, which do not identify you.

We rely on your consent (for health information and notifications), on the need to provide the membership you signed up for, and on our legitimate interest in running and securing our gyms. We never sell your data or use it for advertising.

3. Who can see it

• Instructors at your branch see what they need to coach you: your profile, plan, attendance, meals, weigh-ins and flags. Instructors at other branches cannot see your data.
• Gym administrators can see members across all branches to run the business, for example to approve sign-ups or move you to another branch.
• Service providers that process data for us, only as needed:
  • our email provider (currently Google), which delivers codes, notices and reminders sent by email;
  • Expo, and through it Google Firebase Cloud Messaging and Apple Push Notification service, which deliver notifications to your phone;
  • the company that hosts our servers.

Some of these providers store data outside Kenya. Where they do, we use providers that protect it with safeguards appropriate under the Data Protection Act. We may also disclose information when the law requires it.

Staff actions (for example "an instructor approved a member") are recorded in an internal log for accountability. Those records can include your name.

4. How long we keep it

• While you are a member, we keep your account and fitness information so the service works.
• If your membership is deactivated, we keep your information so that you can come back, until you ask us to delete it (section 7).
• If you delete your account, your personal data is erased straight away (section 7). A record that an anonymous member visited on certain days stays, so branch totals remain correct; it no longer identifies you.
• Sign-ups that are never verified with their code are removed after 7 days.
• One-time codes expire after 10 minutes. Records of failed sign-in attempts are kept for about an hour.
• Backup copies of our database are kept for up to 14 days, so data you delete can remain in a backup for that long before it is overwritten.

5. How we protect it

• Passwords are stored only as secure hashes, and connections to our service are encrypted.
• Staff can only see what their role and branch allow, and access is removed immediately when a staff account is deactivated.
• Changing your email or phone number requires your password, and we notify your previous email address when it changes.
• Changing or resetting your password, or logging out, signs you out on every device at once. Repeated wrong passwords and codes are blocked for a while.

No system is perfectly secure. If a breach puts your data at risk, we will notify the Data Protection Commissioner and, where required, you, as the law requires.

6. Notifications and messages

The app asks your permission before sending notifications, and you can turn them off at any time in your phone's settings. Instructors can send you up to two reminders a day. Account messages such as codes and security alerts are sent regardless, because the service needs them.

7. Your rights

Under the Data Protection Act, 2019, you have the right to:

• Be informed about how your data is used. That is this policy.
• Access your data. In the app, open Profile → Your data → Download my data to receive a copy of everything we hold about you, in a portable format (JSON).
• Correct your data. You can edit your details in Profile, or ask us.
• Delete your data. In the app, open Profile → Your data → Delete my account. This erases your personal data straight away and cannot be undone. You can also ask us to do it.
• Object to or restrict how we use your data, and withdraw consent at any time.

To exercise any right, or if you have a question, contact us (section 10). We will respond within the time the law allows. If you are not satisfied with our answer, you can complain to the Office of the Data Protection Commissioner (ODPC), Kenya, at www.odpc.go.ke.

8. Children

The app is intended for gym members aged 18 and over. We do not knowingly collect data from children under 18 without the consent of a parent or guardian. If you believe a child has given us their data, contact us and we will delete it.

9. Changes to this policy

We will update this page when our practices change and show the new effective date at the top. If a change affects you significantly, we will also tell you in the app or by email.

10. Contact us