Privacy policy

Fitmore Labs, Inc. ("Fitmore", "we", "us") is a company incorporated in Delaware, USA. We run fitmore.co, a marketplace where fitness, movement and wellness coaches publish professional profiles and clients find them.

We operate the platform from the United States and make it available to people wherever it is lawful for us to do so. This policy explains what personal information we collect, why we collect it, who else sees it, and what you can do about it. It applies to everyone who uses Fitmore, wherever you live.

Fitmore is free. We do not charge coaches or clients to use it, we take no commission, we do not charge for leads, and we do not sell placement in search results. We may introduce fees in future; if we do, we will give at least 30 days notice first, as set out in our Terms of service.

If you have a question about anything here, email privacy@fitmore.co and a person will answer.

What you give us

• Account details. Your name, email address and password. Authentication runs through Clerk, so your password is stored by Clerk and we never see it.
• Your profile, if you are a coach. Your bio, rates, specialties, qualifications, work history, photos and video. This is content you write and publish, and you control what goes in it.
• Location. The city you work in, including latitude and longitude coordinates, so your profile can be shown on a map and found in location searches.
• Your date of birth. We ask for it when you create a coach profile. It confirms you are over 18, which our Terms of service require, and it is what lets clients filter by a coach’s age. Your birthday is never shown on your profile.
• Gender, if you tell us. Entirely optional. It helps you turn up when someone searches for a coach of a particular gender, and nothing else depends on it.
• What you do on the platform. Messages you exchange with other users, reviews you write, profiles you save, and the connections and endorsements you make.

What we collect automatically

• Usage and device data. Your IP address, browser and device type, the pages you view, and how you interact with the platform.
• Cookies and similar technologies. Covered in section 10 below.

We do not ask anyone for health information, and you should not put medical details about yourself or a client into a profile, a message or a review.

• To run the platform. Create and secure your account, publish your profile, show it in search results and on maps, deliver messages, and record reviews, saved profiles, connections and endorsements.
• To power search. Coach profile text, including bios, is sent to OpenAI to generate search embeddings, which is what lets search match on meaning rather than exact keywords. Bios written in other languages are machine-translated so they can be indexed and found in English. The search queries visitors type are sent to OpenAI the same way, to be understood and matched; they are not used to identify you. We also keep a record of the searches people run: the words typed, the filters applied and which profiles came back. No account, IP address or device is attached to it, and any email address, phone number or link typed into a search is removed before it is stored. We use it to see what people look for and where search falls short.
• To answer support questions. If you use the support chat, the messages you type in it are sent to OpenAI to generate the answer. Do not put sensitive personal details into the chat; a human reading your message at privacy@fitmore.co is the better channel for anything private.
• To email you. Sign-in and verification emails, notifications about messages and activity, and occasional service announcements. These are sent through Resend. If you subscribe to our newsletter, those emails record whether they were opened and which links were clicked, so we can see what is worth writing; service and notification emails carry no such tracking. Unsubscribing stops the newsletter and its measurement together.
• To keep the platform safe. Prevent fraud, spam, impersonation and abuse, investigate reports, and enforce our Terms.
• To improve it. Understand which parts of the product get used and where people get stuck.
• To measure advertising. Where you have consented, or where opt-out advertising is permitted and you have not opted out, we measure how our ad campaigns perform.
• To meet legal obligations. Respond to lawful requests and keep records the law requires us to keep.

If you publish a coach profile, it is public by design. Your name, photos, video, bio, city and map location, rates, qualifications, and the reviews clients leave you can be seen by anyone on the internet, whether or not they have a Fitmore account, and indexed by search engines such as Google. That is the point of it: it is the page you share.

So treat your profile as a public document, and do not put anything in it you would not want the world to read. Everything else we hold about you is not public: your email address, date of birth, gender, private messages, saved profiles, and the details of your identity verification are not shown on your profile.

If you take your profile down or delete your account, we remove it from Fitmore, but we cannot remove copies that search engines or other sites have already cached.

Coaches can verify their identity. Verification runs through Stripe Identity: you are handed over to Stripe, and Stripe collects and holds your identity document.

From that process Fitmore stores exactly four things: a Stripe verification session ID, the status of the check, the date it happened, and the legal first and last name Stripe verified. We do not receive or store images of your identity document. What Stripe does with the document is governed by the Stripe privacy policy.

Verification is optional. If you do not want to do it, you can still use Fitmore.

Where a law such as the GDPR or UK GDPR requires us to name a legal basis for processing your information, these are ours:

• Performing our contract with you. Running your account, publishing your profile, delivering your messages, and everything else you signed up for.
• Our legitimate interests. Keeping the platform secure, preventing fraud and abuse, making search work, and understanding how the product is used, where that does not override your rights.
• Your consent. Analytics and advertising cookies, marketing email, and anything else we ask you to opt into. You can withdraw consent at any time.
• Legal obligation. Records we are required to keep and requests we are required to answer.

We do not sell your personal information. We share it in three situations: with other users when that is the point of the feature, with the service providers we use to run Fitmore, and when the law requires it.

With other users

Your public profile is visible to everyone. Messages you send are visible to the person you send them to. Reviews you write are published under your name.

With our service providers

Each of these processes data on our instructions, under a contract, and only for what it is listed here to do:

• Clerk — authentication: accounts, sign-in and passwords.
• Supabase — hosts our PostgreSQL database, where platform data lives.
• Vercel — hosts and serves the application.
• Cloudflare R2 — stores images and video, served from media.fitmore.co.
• Stripe — payments for coaches selling digital products, and Stripe Identity for identity verification.
• Mapbox — maps and location search.
• OpenAI — generates the search embeddings that power search, machine-translates non-English bios for indexing, interprets the queries visitors type, and answers support-chat messages. Coach profile text and the text typed into search and the support chat are sent to OpenAI for this.
• Inngest — runs our background jobs: scheduled emails, account-deletion processing, and similar work. Job payloads carry the identifiers needed to do the work.
• Upstash — rate limiting and short-lived caching, which involves request identifiers such as IP addresses and cached search results.
• Google Firebase Cloud Messaging — delivers push notifications to the app when a coach turns them on. It receives the device’s push token and the notification content; tokens for devices that stop responding are deleted.
• Pusher — delivers messages in real time.
• Resend — sends transactional email.
• Sentry — error monitoring, so we can find and fix bugs.
• Google Analytics and Google Tag Manager, and Meta Pixel — analytics and advertising measurement. These load only with your consent where consent is required.

When the law or safety requires it

We may disclose information to comply with a law or a valid legal request, to enforce our Terms, to investigate fraud or abuse, or to protect the rights or safety of our users or the public. If Fitmore is ever involved in a merger, acquisition or sale of assets, information may transfer as part of that, and this policy will continue to apply to it until it is replaced by one you are told about.

Fitmore is operated from the United States, and your information is processed there. If you use Fitmore from somewhere else, your information is transferred to the United States, which may have different data protection laws from your own country.

Where a transfer needs a legal safeguard, we rely on Standard Contractual Clauses with our providers, or on the EU-U.S. Data Privacy Framework where a provider is certified under it.

We keep your information for as long as your account is open, and then only as long as we have a reason to.

• Your account and profile. Kept while your account is open. When you delete your account, your profile comes down and we delete or anonymize your personal information — except the removal record below, if your account was closed for abuse.
• Messages. Kept while the conversation exists. A message you sent stays visible to the person who received it.
• Reviews. Reviews you wrote about a coach may stay published, without your name attached, because removing them would misrepresent that coach record.
• Payment and tax records. Kept for as long as tax and accounting law requires.
• Security and abuse records. Kept as long as we need them to stop the same problem happening again, or to defend a legal claim.
• A record of accounts we have removed. If we close an account for spam or for breaking our Terms, we keep enough to recognise the same person signing up again — an email address, and the fact of the removal. It is the only way a ban means anything, and it is the one part of your data that outlives your account on purpose.

You can delete your account yourself in your account settings, or email privacy@fitmore.co and we will do it.

Wherever you live, and whatever privacy law does or does not apply where you are, you can:

• Ask what personal information we hold about you, and get a copy of it.
• Correct anything that is wrong.
• Delete your account and the personal information attached to it.
• Get your information in a portable, machine-readable format.
• Object to what we are doing with your information, or ask us to restrict it.
• Withdraw consent you have given, including for analytics and advertising cookies and for marketing email.
• Do all of the above without being treated any differently for it.

How to use them

Most of this is self-serve. Edit your profile and account details in your account settings, delete your account there too, change cookie choices on our Cookie policy page, and unsubscribe from marketing email using the link at the bottom of it. For anything else, email privacy@fitmore.co. We aim to answer within 30 days, and we will tell you if we need longer. We may ask you to confirm your identity first, so we do not hand your data to someone else.

Some people have additional statutory rights on top of these, under laws such as the GDPR, the UK GDPR, US state privacy laws, and comparable laws elsewhere. If a law that applies to you gives you a right this policy does not mention, you have it anyway and we will honour it. You can also complain to the data protection regulator where you live, and we would rather you told us first so we can fix it.

We use three categories of cookie and nothing else: essential ones that keep you signed in and the site secure, which are always on; analytics ones that tell us how the product is used; and advertising ones that measure our campaigns.

Where the law requires us to ask first, nothing beyond the essential cookies loads until you agree to it. Elsewhere, analytics and advertising cookies are on by default and you can turn them off whenever you like. We estimate where you are from signals your browser provides, and we are moving towards asking first in any region we cannot positively confirm.

If your browser sends a Global Privacy Control signal, we treat it as an instruction to switch off analytics and advertising cookies, and we do not ask you again. You do not have to do anything else.

Our Cookie policy explains each category, who sets them and how consent works, and you can change your choices there at any time.

We encrypt data in transit and at rest, restrict who on our side can reach production data, keep passwords out of our systems entirely by delegating authentication to Clerk, and keep identity documents out of our systems by delegating verification to Stripe. Less data in our hands is fewer things to lose.

No system is perfectly secure, and we will not pretend otherwise. If we ever have a breach that affects you, we will tell you and the relevant regulator as quickly as the law requires and as clearly as we can. If you think your account has been compromised, email privacy@fitmore.co straight away.

Fitmore is for people aged 18 and over. We do not knowingly collect information from anyone under 18. If you believe a child has created an account or sent us information, email privacy@fitmore.co and we will delete it.

We will update this policy when what we do changes. The date at the top tells you when it last changed. If a change materially affects your rights or how we use your information, we will tell you by email or with a clear notice on the platform before it takes effect, rather than quietly editing the page.

Email privacy@fitmore.co for anything to do with your privacy: questions about this policy, requests to access, correct or delete your information, or a complaint. It reaches the people who run the platform.

Fitmore Labs, Inc. is the data controller for the information described here.