Privacy Policy

Version 2026-10-13. This policy explains what personal data the VikaFit mobile app, the website www.vikafit.com and the services behind them ("VikaFit", "we", "us") process, why, for how long, who else receives it and what rights you have. We wrote it to be read, not to be skimmed past: every item below matches what the app actually does.

1. Who is responsible

The controller of your personal data is the operator of VikaFit ("VikaFit"), a sole trader registered in the Slovak Republic, identified at the end of this policy; contact: privacy@vikafit.com.

Contact for everything privacy-related, including requests to see, export or delete your data: privacy@vikafit.com. We answer within one month (Art. 12 GDPR); for complex requests we may extend this by up to two further months and will tell you why.

We are not required to appoint a Data Protection Officer; privacy@vikafit.com reaches the person responsible.

2. The short version

• You can use VikaFit without an account. Signing in is optional and only links your training history across devices.
• We do not sell your data, do not show ads and do not build advertising profiles.
• Privacy settings. Some technologies are needed for the app to work and to keep it stable and secure (Essential, always on). Others run only with your consent, which you give or refuse on the privacy screen when you start using the app and can change at any time in Settings → Privacy settings: Analytics (how the app is used, including Google Firebase Analytics, section 3.4) and Marketing (your phone's advertising identifier, only to measure our own campaigns; on iPhone also Apple's tracking prompt, section 3.4b).
• Crash reports, technical logs and the checking of workouts behind rewards keep VikaFit stable, fair and secure and are always on (sections 3.4a, 3.4c and 5). Questions about them: privacy@vikafit.com.
• Push notifications (news, tips, updates about VikaFit) are sent only if you allow notifications in your phone's system dialog; switch them off at any time in the phone's settings.
• Health data (Apple Health / Health Connect) is read only after you turn the sync on and grant the system permission; it is never used for marketing.
• You can ask us to delete your account and data from Settings in the app, on www.vikafit.com/delete-account, or by writing to privacy@vikafit.com.

3. What data we process

3.1 When you use the app at all (with or without an account)

3.2 If you create an account or sign in

3.3 Health data — only if you turn it on

If you enable Apple Health (iOS) or Health Connect (Android) in Settings → Health sync and grant the system permission, the app may read your heart rate and active energy burned, and write the workouts you finish in VikaFit (with their active energy). The heart rate and energy of your workouts are stored with your training sessions on your phone and, if you are signed in, in your account.

Health data and body measurements are "special categories" of data (Art. 9 GDPR). We process them only with your explicit consent, given when you turn the sync on; you can withdraw it at any time by turning the sync off and revoking the permission in the system settings. Data from Apple Health / Health Connect is never used for advertising, never sold and never shared with third parties except the hosting providers listed in section 6 that store your account data.

3.4 Usage analytics

With your consent (Analytics in the privacy settings) the app sends information about how it is used — for example which screens and workouts are opened, started and finished and where something goes wrong — with the install id, the app and system version, device model, language, time zone and, if you are signed in, your account id, to our servers and to Google Firebase Analytics. We use it to improve the app; never to sell it and never for advertising profiles.

Without that consent Firebase Analytics collects nothing, and the app sends only statistics without the install id or your account, apart from the workout data of section 3.4c (with a key that changes every day, so no history of your use is built). Together with our server logs (section 5) these give us aggregated figures — for example how often a workout or video is requested or how many errors an app version has. This is our legitimate interest in running and improving the service (Art. 6(1)(f) GDPR).

You can give or withdraw your consent at any time in Settings → Privacy settings.

3.4a Crash reports

When the app crashes or hits an unexpected error, it sends a technical crash report to Google Firebase Crashlytics: the error and where in the code it happened, the app version and build, the device model, system version, memory and storage state, the time and a random Crashlytics installation id. It contains no account id, name, email or workouts; if you allowed Analytics, it may also show the last app events before the crash. Crash reports are essential: we need them to keep the app stable and secure (Art. 6(1)(f) and Art. 32 GDPR), and the access to your device they need is strictly necessary for that. They are kept for 90 days. Questions: privacy@vikafit.com.

3.4b Advertising identifier — only with your consent

VikaFit shows no ads. We do advertise VikaFit itself (for example with Google Ads), and to know which of those campaigns bring people to the app we use your phone's advertising identifier (IDFA on iPhone, the Android advertising ID) — only with your consent.

• Only if you agree (Marketing in the privacy settings; on iPhone also Apple's "Allow tracking" prompt). Until then the identifier is not used: Google Firebase Analytics runs with advertising storage and advertising data denied (Google Consent Mode).
• If you agree, Google Firebase Analytics links the usage data of section 3.4 with the advertising identifier so that Google can tell us which of our campaigns led to installs and use of the app. Ad personalisation stays off: we do not build advertising profiles and do not use your data to show you ads anywhere.
• Your choice is recorded like your other consents (section 3.1) and can be changed at any time in Settings → Privacy settings; on iPhone also in iOS Settings → Privacy & Security → Tracking. You can also reset or delete the advertising identifier in your phone's settings.

3.4c Checking workouts

Experience points, levels, streaks, challenges and rewards are given only for real workouts. To protect them against abuse, the app always sends technical data about how a workout went — when its screens were open and for how long, the timer events (start, rounds, completion or early exit) and how they relate to the result sent for the reward — with the install id and, if you are signed in, your account. This is needed for these features to work fairly and for the security of the service (Art. 6(1)(b) and (f) GDPR) and does not depend on the Analytics setting. We use it to detect and stop abuse.

3.5 When you contact us

Your email address and whatever you write to us, to answer you.

3.6 What we do not collect

Precise location, contacts, photos (other than an avatar you choose to upload), microphone, camera, the advertising identifier unless you allow it (section 3.4b), payment data (VikaFit is free), and we do not use cookies or trackers on www.vikafit.com except those you accept in its cookie banner.

3.7 The website www.vikafit.com

The website works without an account. Our hosting logs the technical request data of each visit (IP address, time, page, browser) for security, kept as described in section 5. All of the site's files, fonts included, come from our own server. Apart from the contact form's bot protection (Cloudflare Turnstile, section 6), nothing is loaded from Google or any other third party unless you accept analytics. Your choice in the cookie banner is stored in your browser's local storage (strictly necessary, no consent needed). Only if you click "Accept", Google Analytics 4 (Google Ireland Ltd.) is loaded to measure visits, using Google Consent Mode with advertising signals always denied; if you decline, it is never loaded. You can change your choice at any time with "Cookie settings" at the bottom of every page.

4. Why we process it (legal bases)

Where we rely on legitimate interests you may object at any time (section 8).

5. How long we keep it

6. Who else receives data (processors and recipients)

We use the following service providers. They process data only on our instructions under data-processing terms, except where noted.

Videos: exercise videos are our content, not your data. When the app plays a video, it is downloaded from one of the storage providers above, which therefore sees your IP address, like any website you open.

The IP-to-location lookup uses an offline database (DB-IP Lite) on our own server — your IP address is not sent to anyone for this.

We may disclose data where the law requires it (e.g. to a court or authority) and to defend legal claims. We never sell personal data. The advertising identifier reaches Google only if you allowed it (section 3.4b), and only to measure our own campaigns.

International transfers. Where a provider processes data outside the EU/EEA, the transfer is based on an adequacy decision (e.g. the EU–US Data Privacy Framework for certified companies) or the European Commission's Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards.

7. Security

Connections are encrypted (HTTPS/TLS); passwords are stored only as salted hashes; video links are signed and expire after a short time; access to servers and the admin panel is restricted and logged; automated abuse protection limits requests. No system is perfectly secure — if a breach affects your data and is likely to put your rights at risk, we will notify the authority and, where required, you.

8. Your rights

You have the right to:

• access your data and get a copy (Art. 15);
• have it corrected (Art. 16);
• have it deleted (Art. 17) — see section 9;
• restrict processing (Art. 18);
• data portability — receive the data you gave us in a machine-readable format (Art. 20); Settings → Export data gives you your training history as a file;
• object to processing based on legitimate interests (Art. 21);
• withdraw consent at any time, as easily as you gave it — Profile → Health sync (health data), Settings → Privacy → Ad measurement (advertising identifier), the phone's notification settings (push notifications) or the website's cookie settings; this does not affect processing before the withdrawal; and object to usage analytics and crash reports by writing to privacy@vikafit.com;
• lodge a complaint with a supervisory authority — in Slovakia the Úrad na ochranu osobných údajov Slovenskej republiky (Hraničná 12, 820 07 Bratislava, www.dataprotection.gov.sk), or the authority of the country where you live or work.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you. Automated abuse protection may temporarily limit requests from an address or device; if that affects you, write to us and a human will review it.

To exercise a right, use the app (Settings) or write to privacy@vikafit.com from the email of your account. We may ask for information to confirm it is you.

8.1 Additional information for users in specific regions

• United Kingdom: the UK GDPR applies with the same rights; you may complain to the ICO (ico.org.uk).
• California and other US states: you have the right to know what personal information we collect (sections 3–6), to delete it, to correct it and not to be discriminated against for exercising your rights. We do not sell personal information. We share the advertising identifier with Google for ad measurement only if you allowed it in the app; switching off Settings → Privacy → Ad measurement is your opt-out of "sharing" under the CCPA/CPRA and similar laws. We do not use sensitive personal information for purposes other than providing the service. Requests: privacy@vikafit.com.
• Brazil (LGPD), Canada (PIPEDA), Switzerland (nFADP), Turkey (KVKK) and other countries: you have equivalent rights to access, correct, delete and port your data and to withdraw consent; write to privacy@vikafit.com.
• Our servers are located in the European Union. If you use VikaFit from outside the EU, your data is transferred to and stored in the EU.

9. Deleting your account and data

You can ask us to delete your account and data at any time:

• In the app: Settings → Account → Request account deletion.
• As a guest: Settings → Privacy → Delete my data — the data on your phone is deleted immediately; the analytics and update records of this install on our server are deleted on request as described below.
• Without the app: follow www.vikafit.com/delete-account or write to privacy@vikafit.com from the email of your account with the subject "Delete my account".

What happens next. Your account is deactivated immediately: you are signed out on all devices and the account can no longer be used. We then review and carry out the request within one month (Art. 12(3) GDPR); where a request is complex we may extend this by up to two further months and will tell you why. When it is carried out, your account, profile, training history, body metrics and achievements are deleted, your identity is removed from analytics and request logs, and backups are overwritten within 30 days.

When we may keep data longer. We may keep specific data, restricted from any other use, for as long as it is necessary to establish, exercise or defend legal claims or to investigate and prevent abuse, fraud or security incidents (for example when an account was used to break the law or attack the service), or where the law requires us to keep it (Art. 17(3)(b) and (e) GDPR; legitimate interests, Art. 6(1)(f)). We record the reason, delete the data as soon as it is no longer needed, and tell you on request which data is kept and why.

We also keep the record that you asked for deletion (date and outcome, without the deleted data) for 3 years, and aggregated statistics that no longer identify you.

10. Age

VikaFit is intended for people aged 16 and over. We do not knowingly collect data of children under 16. If you are a parent and believe your child under 16 uses VikaFit, contact us and we will delete the data.

11. Changes

We will update this policy when the app changes. The version date is at the top. For significant changes we will show a notice in the app and, where consent is needed, ask again.

12. Contact

privacy@vikafit.com