Privacy Policy

1. Who we are

Vitroo ("we", "us", "our") is the data controller for the personal information we process when you use the Vitroo app and related services (the "Service"). You can reach us at legal@vitroo.fit.

2. What we collect

Account information: the email address or phone number you sign in with, your display name, optional bio and avatar, and a unique account ID we generate.

Training data: the workouts you log, your timings, scores and PRs, the metadata of any photos or videos you upload (size, duration, captured timestamp where present), and any notes you attach.

Health and ability profile: information you choose to provide such as height, weight, injuries, ability ratings, and Hyrox/CrossFit history.

Social data (when you opt to share): posts, comments, likes, follows, and the audiences you select.

Device and diagnostic data: device model, OS version, app version, language, timezone, crash logs, and basic analytics about feature usage. We do not collect contact lists, precise location, or advertising identifiers.

Communications: messages you send to our support inbox and the metadata about that conversation.

3. How we use it

To operate the Service — sign you in, sync your data across devices, render your training history, and personalize your experience.

To provide AI-assisted features — when you ask Vitroo to analyze a workout image or video, we send the relevant media to a model provider strictly to compute the result. We do not allow the provider to use your media to train their models.

To keep the Service safe — detect and prevent fraud, abuse, and security incidents.

To communicate — verification codes, security alerts, and (only with your consent) product updates.

To improve the Service — aggregated, de-identified analytics about which features are used.

4. Legal bases

Where the EU GDPR or similar laws apply, we rely on: (a) performance of our contract with you (Section 6(1)(b)) to operate the Service; (b) legitimate interests (6(1)(f)) to keep the Service secure and to improve it; (c) your consent (6(1)(a)) for optional features such as marketing emails; and (d) legal obligation (6(1)(c)) when required by law.

5. Sharing

We do not sell your personal information.

We share data with service providers under contract who help us operate the Service — for example, cloud hosting, email delivery (Resend), SMS delivery, and AI inference. These providers may process your data only on our instructions and are bound by confidentiality and security obligations.

We may disclose information if required by law or to protect the rights, safety, or property of users or the public.

In a merger, acquisition, or sale of all or part of our business, your information may be transferred — we will notify you and require any successor to honor this policy.

6. International transfers

Your information may be processed in countries other than your own. Where required, we use approved transfer mechanisms (such as Standard Contractual Clauses) and apply appropriate safeguards.

7. Retention

We keep your account data as long as your account is active. When you delete your account, we delete or anonymize your personal information within 30 days, except where we are required to retain it (e.g. for tax or legal-claim purposes), in which case we keep only the minimum needed.

Verification codes are kept only as long as needed to complete sign-in. Backup copies may persist for up to 90 days before they expire.

8. Your rights

Subject to your local law, you may have the right to access, correct, export, restrict, object to, or delete the personal information we hold about you, and to withdraw consent at any time.

You can exercise most of these rights directly in the Me tab. For anything you cannot do in-app, email legal@vitroo.fit and we will respond within 30 days.

If you are in the EU/EEA or UK, you also have the right to lodge a complaint with your local data protection authority.

9. Children

The Service is not directed at children under 16 (or the equivalent minimum age in your country). We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

10. Security

We use industry-standard safeguards — encryption in transit (TLS), at-rest encryption for sensitive fields, scoped access controls, and routine security review. No system can be perfectly secure; we cannot guarantee absolute security but we will notify you promptly of any incident affecting your data, as required by law.

11. Changes

When we make material changes to this policy, we will notify you in-app or by email at least 14 days before the changes take effect.

12. Contact

For privacy questions or requests, write to legal@vitroo.fit.

Contact

Questions about this document? Write to legal@vitroo.fit.