Notice on the processing of personal data
Last updated: 5 October 2026 · version 2026-10
This is a courtesy translation of the Italian privacy notice. If the two differ, the Italian version prevails.
Also in Italiano · Deutsch · Français · Español
This notice explains what data GetFit collects, why, who processes it, for how long and what rights you have. It is written to actually be read: if anything is unclear, write to us.
1. Who processes your data
Data controller: Cobalt Studio LLC
30 N Gould St, Ste R, Sheridan, WY 82801, United States
Contact: help@cobaltstudio.app
GetFit is a product of Cobalt Studio LLC, not a healthcare company. No Data Protection Officer has been appointed because the conditions under which the law requires one do not apply. For any question about your data, write to the address above.
2. What data we collect
Account data. When you sign in with Google we receive your name, email address and profile picture. We neither know nor process your password: authentication happens entirely with Google.
Data you enter. Weight and measurements, workouts with loads and reps, lab reports (text, values and the photo if you upload it), body composition assessments, medications and supplements you say you take, available equipment, free-text notes.
Much of this is health data, which Article 9 of the GDPR protects more strictly. We process it only with your explicit consent, which we ask for in the app, and only to make the app work for you.
Credits. For analysis with artificial intelligence we keep a credit wallet linked to your account: the balance and transactions — welcome credits, purchases, analyses, tokens earned through the game's milestones — and, for each purchase, the order identifier and the amount. Payment takes place on PayPal: card or account details are processed by PayPal, and we only receive the outcome and the amount.
Feedback. If you write to us from the Feedback section, we keep the message together with your user identifier, email address, app version and type of device.
Usage statistics. We count how often you use the app's features — how many workouts, how many weigh-ins, which sections — to understand whether the app is useful. They are counts only: never a value, a lab report or a medication. You can turn them off in Settings, and turning them off deletes them.
Technical data. Our services record the usual operating data — IP address, date and time, type of request — to run the website and detect abuse.
3. Why we process it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Letting you use the app: saving your data, showing you trends and analyses | Performance of the contract (Art. 6(1)(b) GDPR) and, for health data, your explicit consent (Art. 9(2)(a)) |
| Analysing a lab report, a photo or a plan with artificial intelligence, when you ask for it | Your explicit and separate consent, which we ask for before the first analysis (Art. 6(1)(a) and 9(2)(a)) |
| Selling credits and recording purchases | Performance of the contract (Art. 6(1)(b)) and legal obligations on payments and accounting (Art. 6(1)(c)) |
| Usage statistics, replying to feedback, improving the app | Legitimate interest in developing the service (Art. 6(1)(f)); for statistics you can object in Settings |
| Security, abuse prevention, technical logs | Legitimate interest in the security of the service (Art. 6(1)(f)) |
Providing data is optional, but without consent to health data, GetFit cannot work: recording that data is exactly what it is for. Without consent to AI, on the other hand, the app works just the same and the artificial intelligence analyses stay off.
You can withdraw your consents at any time from Settings → ‘Your consents’, and withdrawal does not affect the lawfulness of processing carried out before the withdrawal. If you withdraw consent to health data, the app stops processing it and you can export or delete it.
4. How it is processed, in practice
The lab reports you upload are read on your device: text extraction and value recognition take place in the browser, not on a server.
Analysis with artificial intelligence is optional and started by you. Only in that case, and only if you have given consent, what you have chosen — the text or photo of a lab report, a pack, a piece of equipment or a plan; to regenerate the plan, a summary of weight, workouts, equipment and out-of-range values from the latest lab report — is sent, through our server on Netlify, to Anthropic, which processes it for that single request. Anthropic does not use this data to train its models and deletes it within 30 days; it keeps it longer, up to two years, only if content breaches its usage policies. If you do not use AI analysis, your health data does not reach any provider other than the Google storage described below.
We do not take automated decisions that produce legal effects concerning you. GetFit is not a medical device: it does not make diagnoses, does not prescribe treatments and does not replace your doctor.
5. Who else processes your data
We rely on providers acting as data processors, bound by contract to process the data only on our behalf:
| Provider | What it does | Where |
|---|---|---|
| Google (Firebase Authentication, Cloud Firestore) | Sign-in with Google and storage of your data | The storage is in the European Union (Belgium and the Netherlands). Sign-in data is handled by Google as a global service and may also be processed outside the EU |
| Netlify | Hosting of the website and server functions: the credit wallet and forwarding analysis requests to Anthropic | United States |
| Anthropic | Processes the AI analyses you start, if you have given consent | United States |
Transfers to the United States take place on the basis of the EU-US Data Privacy Framework (Google, Netlify) and of the standard contractual clauses approved by the European Commission (Anthropic, and in the alternative the others).
For the app to work, your browser downloads some libraries from external services: Google (gstatic.com) for Firebase, jsDelivr for charts, PDF reading and text recognition, and from tessdata.projectnaptha.com the data the latter needs. As with any web resource, they receive your IP address and browser type, not your data: lab reports and photos stay on your device.
PayPal processes payment data as an independent controller, under its own privacy notice: we neither see nor keep your card or account details.
We do not sell your data and do not pass it to third parties for commercial purposes. No other GetFit user can see your data: the storage rules only allow access to the account that created it.
6. How long we keep it
As long as you keep your account active. From Settings → Delete my data you can delete, at any time, workouts, weight measurements, lab reports, body composition, medications, equipment, profile, consents and usage statistics: deletion is immediate and permanent.
The following remain, even after deletion: the feedback you have sent, in a form that cannot be changed, because it is needed to reconstruct the issues you reported; credit transactions and purchase identifiers, for obligations on payments and accounting. Usage statistics can also be deleted on their own, by turning them off in Settings. Providers' technical logs follow their own retention policies, in the order of a few weeks; analysis requests sent to Anthropic are deleted by Anthropic within 30 days.
7. Your rights
You can at any time request access to your data, its rectification or erasure, the restriction of processing, object to processing based on legitimate interest and obtain the portability of your data in a machine-readable format.
Some you exercise yourself, without asking anyone for anything: in Settings you'll find Export everything (a JSON file with all your data), Delete my data and Your consents. For the others write to help@cobaltstudio.app.
You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the supervisory authority of the country where you live.
8. Cookies and storage on your device
GetFit does not use profiling cookies and does not show advertising. On your device it only saves what it needs to work: your sign-in session, the app's preferences, the workout you are logging until you save it and a copy of the website's files so it works even with a weak connection. If you go to the payment page, PayPal uses its own cookies under its own privacy notice.
9. Minimum age
GetFit is not intended for people under 16 and we do not knowingly collect their data.
10. Changes
If we change this notice substantially, we will tell you in the app before the change takes effect, and for health data we will ask for your consent again.