FIGHTR Privacy Policy

Last updated: 28 October 2026
App: FIGHTR (com.fightr.app)
Operator: Nishant Agrawal
Contact: fightrclubb@gmail.com

At a glance

FIGHTR is for adults. You must be 18 or older to create an account.

1. Who we are

FIGHTR is a fitness, nutrition and skin and hair care tracker with an AI coach. It is operated by Nishant Agrawal. You can reach us at fightrclubb@gmail.com.

2. Data we collect

• Account: your email address and password (the password is stored hashed by our authentication provider). If you sign in with Google, we receive your Google account email, name and profile photo.
• Profile: display name, age (a number, not your date of birth), gender, height, weight, target weight, goal, equipment, experience, training time, occupation, motivation, bio and how you found FIGHTR.
• Health and fitness: workouts, meals, water, body measurements, steps (from the phone's step sensor, Health Connect and manual entries), skin and hair routines, streaks, notes, challenge and rank progress.
• Photos: progress photos (private to your account) and an optional profile or cover photo.
• AI chat: everything you type to the coach, your answers to its questions and the plans it produces.
• Reminders: the reminders you set.
• Club (optional): your Club username, name, bio, link, profile photo and banner; the posts, photos, videos, Arise stories, Aura videos, captions and comments you share; likes, saves, follows, close friends, mutes, blocks and reports; chat messages you send (text, photos, videos and voice messages) and when you read them; who viewed your Arise; and in-app activity in Club (which posts and videos you view, how long you watch, shares and profile visits) used only to order your Feed, Aura and Explore. This activity is first-party and never sold or used for ads.
• Microphone (only when you use it): a Club voice message is recorded only while you hold the record button, and is sent as an audio file to the people in that chat (up to 60 seconds). Voice typing in the AI coach listens only while the listening panel is open and uses your phone's own speech service (for example Google's), which turns your voice into text; FIGHTR receives only the text, never the audio, and stores nothing until you press Send. An Aura voice-over is recorded only while you record it in the Aura editor and becomes part of the video only if you share it. Auto captions for Aura videos are made entirely on your phone: a speech model on the device turns the video's sound into text, and the audio never leaves your phone; only the caption text you keep is published with your video. The speech model (about 57 MB, from the open-source whisper.cpp project, hosted on Hugging Face) is downloaded once, the first time you use auto captions; that download sends no audio or personal data. The app asks for microphone permission the first time you record a voice message, a voice-over or use voice typing.
• Friend challenges and leaderboards (Club, optional): the challenges you create or join (name, goal, dates, members) and, for each challenge day, a summary computed on our server from your own trackers: the number of days you hit the target and the total (steps, litres of water or exercises ticked). Your weekly Chakra and current streak are computed the same way for the friends leaderboard. Whether you show on friends' leaderboards is a setting.
• Club calls (optional): when you start or answer a voice or video call in a Club chat, FIGHTR uses your microphone (and camera for video) only while the call is open. The sound and picture go directly between the two phones, encrypted, and are never recorded or stored by us. We store the call record: who called whom, voice or video, when it started, was answered and ended, and the outcome, shown in the chat as for example "Missed video call" or "Video call · 3:24". To connect, the two phones exchange network details (including their internet addresses) through our server without storing them; during a direct call the other person's phone can see your internet address, as with any internet call. Calls are only possible between people who can already message each other.
• Places, collabs and Notes (Club, optional): if you add a place to a post or Aura video, the text you type is sent to the Photon place search (section 6) and the place you pick is saved with a position rounded to about 1 km, and shown publicly with the post. FIGHTR never reads your phone's location for this. If you invite a collaborator, we store who was invited and whether they accepted; once accepted, both names show on the post and it appears on both profiles. A Note (up to 60 characters) is shown for 24 hours to mutual followers or to your close friends.
• Push notifications (Club): a Firebase Cloud Messaging token for your phone, linked to your account, so we can tell you about likes, comments, follows and messages. It is removed when you sign out or delete your account.
• Technical: IP address and request logs kept by our hosting provider and the providers below, and basic error reports (error type and code, a fatal flag, time and your account id; no chat text, no health values and no stack traces).

We do not collect your device location (Club places are typed by you and rounded to about 1 km), contacts, an advertising ID or payment information. We never record audio in the background. We do not use analytics or advertising SDKs; Firebase Crashlytics is used only to receive crash reports (section 2). Reminders are scheduled on your phone. If you use Club, we store a push notification token for your phone (section 6a).

2a. Who can see your Club content

Club is optional. New Club profiles start private: only followers you approve see your posts, Arise and Aura videos. If you make your profile public, anyone signed in to FIGHTR can see them. Your username, name and profile photo are visible to signed-in users so they can find you. Arise stories disappear after 24 hours (you keep them in your own archive). Chat messages, including chat photos, videos and voice messages, are visible only to the people in that chat. Club photos and videos are stored privately (Supabase and Cloudflare) and served with short-lived links. Your fitness data, photos and AI chats are never shown in Club unless you post them, with two exceptions you control: in a friend challenge you joined, the other members see your days hit and your total for that challenge (never the underlying workouts, meals or logs); and people who follow you can see your weekly Chakra and current streak on their friends leaderboard, unless you turn off Settings, Friends, "Show me on friends' leaderboards" (hiding Chakra or streak on your Club profile also hides it there). Private accounts appear only to approved followers; blocked people never see you. Content must follow the Club rules; we review reports and may remove content or suspend accounts.

3. How we use it

To run the app, build and adjust your plans, show your Club content to the people you allow, order your Club Feed and Aura, review reports, restore your data after a reinstall, send the reminders you set, protect against abuse (for example per-user AI limits) and fix errors. We do not sell your data, show ads, or use health data for advertising.

4. AI processing by DeepSeek

The AI coach is powered by DeepSeek. When you use it, the app sends to our server function exactly this:

• your chat messages and your answers to the coach's interview questions;
• your profile basics: name, age, gender, height, weight, target weight, goal, occupation and motivation;
• your current plan context.

The function forwards it to DeepSeek (api.deepseek.com) and returns the reply. We do not send your email, account id or photos.

DeepSeek may process this data on servers outside your country, including in China. We have not verified DeepSeek's current retention or training terms; read DeepSeek's own privacy policy, which applies to data sent to it. Please do not type medical conditions, medications or other people's personal details into the chat.

AI replies can be wrong and are not medical advice. See the Health and AI disclaimers. Chat sessions are stored in your account so you can continue them. Deleting your account deletes them from our systems, but not from DeepSeek.

5. Health Connect, watch and step data (limited use)

FIGHTR reads step counts from Health Connect (the READ_STEPS permission), and only after you allow it. We use this data only to show your daily steps and step goals inside the app.

Connected devices (optional). If you tap Connect on Settings > Connected devices, FIGHTR can also read (never write) these Health Connect data types that a watch or another app (for example Samsung Health, Fitbit, Garmin Connect, Mi Fitness or Google Fit) saved there: weight (READ_WEIGHT), sleep sessions and stages (READ_SLEEP), heart rate (READ_HEART_RATE), resting heart rate (READ_RESTING_HEART_RATE), active calories burned (READ_ACTIVE_CALORIES_BURNED) and exercise sessions (READ_EXERCISE). You choose each type in Health Connect's own screen. FIGHTR reads them when the app is open (at most about every 15 minutes, no background job) and uses them only to show them on the Connected devices page, to show watch workouts on your Workout page and add their calories to your daily burn, to show last night's sleep on Home if you switch that on, and to suggest updating your profile weight. This watch data stays on your phone: it is not uploaded to our servers or sent to the AI provider. The only exception is a weight you confirm with "Update profile", which is saved to your account like a weight you type in. Disconnect on that page stops reading and deletes the copy on your phone.

For all Health Connect data (steps and watch data): we do not sell it, do not use it for advertising, credit or insurance decisions, and do not transfer it to others except to run the service (our database host) or when the law requires it. People at FIGHTR do not read it except with your consent, to investigate abuse or security issues, or to comply with law.

Steps are stored in your account as daily totals and hourly buckets. While you have step tracking on, the app reads the phone's step sensor when it is open, about every 15 minutes in the background and after a restart, and may use Google Play services' on-device step recording (that data stays on your phone). No ongoing notification is shown. This needs the activity recognition permission. You can revoke permission at any time in Health Connect or Android settings.

FIGHTR's use of information received from Health Connect adheres to the Google Play User Data policy, including the Limited Use requirements.

6. Who we share data with

Only with service providers acting for us:

• Supabase: database, sign-in, file storage and server functions.
• DeepSeek: the AI coach (section 4).
• Google: Google Sign-In, if you choose it.
• USDA FoodData Central and Open Food Facts: the food text you search for, and your IP address.
• Cloudflare (R2 storage and Workers): stores the photos, videos and voice messages you share in Club (posts, stories and chats) in a private bucket, and serves preset avatars and banners. Club files are only handed out through short-lived links after our server checks who may see them. Your IP address is visible to Cloudflare when files load.
• Google Fonts: font files may download on first use, which shows your IP address to Google.
• Google Firebase Cloud Messaging: delivers Club push notifications (section 6a).
• Your phone's speech service (usually Google): only if you tap the microphone in the AI coach. It receives your voice under its own terms and returns text to the app.
• incompetech.com and Hugging Face (downloads only): when you preview or add a song from the Aura music library, your phone downloads it from incompetech.com (Kevin MacLeod's free CC BY music); the first time you use auto captions, it downloads the speech model from Hugging Face. Like any website, they see your phone's internet address. No account data, audio or video is sent to them.
• Photon by komoot (place search, OpenStreetMap data): only when you search for a place to add to a Club post or Aura video. It receives the text you type and your phone's internet address, and returns matching places. No account data is sent.
• Google STUN servers and Metered "Open Relay" (calls only): during a Club call, your phone asks Google's public STUN servers for its own internet address. If the two phones cannot reach each other directly, the call's encrypted sound and video may pass through Metered's free Open Relay TURN server, which cannot decrypt them. Both see your internet address.

6a. Club push notifications

When someone likes, comments on or replies to your post, follows you, mentions you, sends you a message, invites you to a friend challenge, passes you in one, or when a challenge you are in finishes, our server asks Google Firebase Cloud Messaging to show a notification on your phone. Google receives your push token and the notification text, for example "@sam liked your post" or "@sam: Sent you a message". Message text is never sent to Google. People you muted or blocked do not trigger pushes. You can turn Club notifications off in Android settings (FIGHTR, Notifications, Club). The token is deleted when you sign out or delete your account.

Exercise and recipe links open in your browser or the YouTube app when you tap them. If you share an image through the Android share sheet, that is your choice and goes to the app you pick. We may also disclose data when the law requires it or in a business transfer. We never sell it.

Profile and cover photos are served from a storage address that is not login-protected: anyone who has the exact link can open it. Progress photos are private and use short-lived links.

7. Storage and security

Data is stored on Supabase. It is encrypted in transit (HTTPS). Row-level security means you can only reach your own records. Server secrets never reach the app, and AI requests are rate-limited per account. A copy of some data is cached on your phone. You can turn on an optional biometric lock for the AI section; we never receive biometric data. No system is perfectly secure.

8. Retention

We keep account data until you delete it or your account. Error reports and AI usage counters are tied to your account; error reports older than 90 days and AI usage counters older than 7 days are purged. Firebase Crashlytics keeps crash reports for 90 days. Backups age out under our hosting plan. Data sent to AI and food-search providers follows their policies. A photo you delete is removed from storage. Photos, videos and voice messages you sent in Club chats are deleted with your account. A small amount of old AI chat text from an earlier version of the app may remain in an archive table until your account is deleted.

9. Your rights and choices

In the app you can edit your profile, delete individual photos, reset your progress, change reminders, revoke permissions, turn off crash reports and delete your account permanently (Settings, Delete Account Permanently, type DELETE).

There is no in-app data export. To ask for a copy of your data, or to correct it, email fightrclubb@gmail.com; we will reply within 30 days. If you cannot open the app, email us from your account address or use the delete account page to ask for deletion.

Depending on where you live (for example under GDPR, UK GDPR, India's DPDP Act or California law) you may have rights to access, correct or erase your data, to withdraw consent and to complain to a regulator. Our grievance contact is fightrclubb@gmail.com.

10. Children

FIGHTR is for people aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a child has registered, email fightrclubb@gmail.com and we will delete the account.

11. International transfers

Your data may be processed in countries other than yours: the Supabase region of our project (to be confirmed), DeepSeek (including China), Google and Cloudflare. By using these features you accept this processing.

12. Changes

We will update the date above when this policy changes and tell you in the app or by email about material changes.

13. Contact

Nishant Agrawal, fightrclubb@gmail.com