Privacy Policy
How varzish.fit collects, uses and protects your personal information, and the choices and rights you have.
In short: we collect what we need to build and track your training, nothing is sold, we use no advertising or analytics trackers, injuries you tell us about are optional, you can delete your account in the app at any time, and marketing email is opt-in and off by default.
Contents
- Who we are
- What we collect
- How we use your information, and why
- Health-related information
- Notifications and email
- Who we share it with
- International transfers
- How long we keep it
- Your rights and choices
- Age
- Security
- Website and cookies
- Changes to this policy
- Contact us
1. Who we are
This policy explains how Nabeel Ahmed Moolji, trading as varzish.fit (“varzish.fit”, “we”, “us”) collects, uses and protects personal information when you use the varzish.fit mobile app and the website at fit.varzish.app (together, the “Service”). We are the “controller” of your personal data under the EU and UK GDPR.
Contact for anything in this policy, including requests about your data: support@varzish.app.
2. What we collect
Information you give us
- Account: your email address and a password (stored only as a secure hash), or the identifier Apple or Google gives us when you sign in with them, and your name if they share it. If you use Sign in with Apple’s “Hide My Email”, we only see Apple’s relay address.
- Profile and onboarding answers: sex (you can choose “Prefer not to say”), age range, height, weight, training goal, experience, where you train, equipment, preferred training days and session length, and muscles you want to focus on.
- Injuries or limitations (optional): areas you tell us to “look after”. See section 4.
- Training data: your plans and edits, workouts, sets, reps, weights and effort ratings, saved collections, and notes you add.
- Preferences: notification settings and times, units and your marketing-email choice (with the date you made it).
- Messages you send to support.
Collected automatically
- Device and app: app version, operating system, your time zone, and a push-notification token if you allow notifications.
- Server logs: IP address and request times, kept for a limited period for security and troubleshooting.
- Purchases: Apple or Google process your payment; we never see your card or payment details. Our subscription provider (RevenueCat) gives us your membership status, the product, and its dates.
What we do not collect
We do not collect your precise location, contacts, photos, microphone or camera data, and we do not read data from Apple Health or Google Fit. We use no third-party advertising or analytics SDKs and no advertising identifiers, and we do not track you across other companies’ apps or websites.
3. How we use your information, and why
| What we do | Why (legal basis) |
|---|---|
| Create and secure your account; build, show and update your plans; log and chart your training; provide the free version and memberships | To perform our contract with you |
| Adjust exercise suggestions around the limitations you told us about | Your explicit consent (see section 4) |
| Send workout reminders and other notifications you switched on | Your consent, via the phone permission and settings; you can turn them off at any time |
| Send service emails (sign-in codes, account and billing notices) | Contract, and our legitimate interest in running the Service |
| Send training tips and offers by email | Your consent, only if you ticked the box; you can withdraw it any time |
| Prevent abuse, keep the Service secure, fix faults | Our legitimate interests |
| Meet tax, accounting and legal duties; respond to lawful requests | Legal obligation |
We do not sell your personal information, and we do not use it for advertising profiles. Plans are generated by rules in the app, not by decisions with legal or similarly significant effects on you.
4. Health-related information
If you tell us about an injury or limitation, that can be health-related information, which has extra protection in many countries. It is optional. We use it only to adjust the exercises we suggest, we do not share it except with the service providers that host our systems (section 6), and we do not use it for marketing. By entering it you give your explicit consent to this use. You can change or remove it at any time in Profile, or by deleting your account. varzish.fit gives general fitness information, not medical advice.
5. Notifications and email
Push notifications (such as a workout reminder) are sent only after you allow them on your phone and switch them on in the app. You can change them in Profile → Notifications or in your phone’s settings. Marketing emails are sent only if you ticked the optional box when creating your account or turned the option on in Profile → Account & privacy; every marketing email will contain an unsubscribe link.
Launch waitlist
If you leave your email on fit.varzish.app to hear when the app launches, we keep that email address, the phone you said you use (iPhone, Android or either) and when you signed up. We use it only to send you a welcome email when you sign up and to tell you when the app is available in the App Store or Google Play, and we delete the list after the launch emails go out (and within 12 months at the latest). Every email has a link to remove yourself at once; you can also email support@varzish.app from that address.
6. Who we share it with
We use a small number of service providers (“processors”) who handle data only on our instructions and for these purposes:
| Provider | What for |
|---|---|
| Hetzner (Germany) | Hosting our servers and database |
| Cloudflare | DNS, content delivery and storage for exercise videos and pictures, and forwarding of support email |
| Apple | Sign in with Apple, App Store purchases, and delivery of push notifications (APNs) |
| Sign in with Google and, on Android, Google Play purchases | |
| RevenueCat | Managing subscriptions and membership status |
| Expo (650 Industries) | Routing push notifications to Apple’s service |
| Resend | Sending our emails |
We may also disclose information if the law requires it, to protect people’s safety or our rights, or as part of a sale or reorganisation of the business (in which case this policy’s protections continue to apply). We do not sell personal information or share it for cross-context behavioural advertising.
7. International transfers
Our servers are in the European Union. Some of our providers are based in, or process data in, other countries including the United States. When personal data leaves the EU, UK or your country, we rely on safeguards such as the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework, where available.
8. How long we keep it
- While you have an account: your account, profile, plans and training history are kept so the Service works.
- When you delete your account (Profile → Account & privacy → Delete account): your account and everything in it are deleted from our live systems straight away.
- Backups: we keep encrypted backups. Daily backups are kept for 30 days and monthly backups for 12 months, so a deleted account’s data disappears from backups within about 12 months and is not restored except to recover from a failure.
- Purchase records are kept by Apple, Google and RevenueCat as the law requires.
- Launch waitlist emails are deleted after the launch emails are sent, and within 12 months at the latest.
- Server logs are kept for a limited time; support messages for as long as needed to help you and a reasonable time afterwards.
9. Your rights and choices
Wherever you live, you can ask us to tell you what we hold about you, correct it, delete it, or give you a copy. You can delete your account yourself in the app. Data export is not built into the app yet: email us and we will send you your data in a common format.
If you are in the EU, UK or EEA
You also have the right to object to or restrict processing, to data portability, to withdraw consent at any time (without affecting earlier processing), and to complain to your local data protection authority. We reply within one month.
If you are in California or another US state with a privacy law
You have the right to know the categories and specific pieces of personal information we collect, to delete or correct it, to opt out of the sale or sharing of personal information (we do neither), and not to be treated differently for using these rights. In the last 12 months we collected the categories listed in section 2 (identifiers, profile and fitness data, purchase status, device and usage data) for the purposes in section 3. An authorised agent can make a request for you. We reply within 45 days.
If you are in Pakistan or elsewhere
We honour any additional rights your local data protection law gives you.
To make a request, email support@varzish.app from the address on your account so we can verify it is you. You can also change notifications and the marketing-email choice in the app.
10. Age
The Service is for people aged 18 and over. We do not knowingly collect information from anyone younger. If you believe a child has given us information, contact us and we will delete it.
11. Security
We use encryption in transit (HTTPS), access controls so each account can only read its own data, encrypted backups, and limit who can reach our servers. No system is completely secure, so we cannot guarantee absolute security. If a breach affecting you occurs, we will tell you and the authorities as the law requires.
12. Website and cookies
Our website (fit.varzish.app) sets no cookies and uses no advertising or analytics tools. It loads exercise images from our media server (media.varzish.app) and, if you join the launch waitlist, sends your email to our server.
13. Changes to this policy
We may update this policy. If a change is significant we will tell you in the app or by email before it takes effect. The date at the top shows when it was last changed.
14. Contact us
Nabeel Ahmed Moolji, trading as varzish.fit
Email: support@varzish.app