Privacy Policy

Onestop Fit: Workout Tracker • Last updated: 4 September 2026

This Privacy Policy explains how DCOOS (“we”, “us”, “our”) collects, uses, shares, and protects your information when you use the Onestop Fit: Workout Tracker mobile application (package com.dcoos.onestopfit) and related services (the “App”). By creating an account or using the App, you agree to this Policy.

Health & fitness data. The App is designed to record health and fitness information you choose to enter (such as weight, body measurements, workouts, meals, sleep, and supplements). We treat this information as sensitive, do not sell it, and only use it to provide the App’s features to you.

1. Who we are & how to contact us

The data controller for the App is DCOOS. For any privacy request or question, contact us at admin@dcoos.com.

2. Information we collect

a. Information you provide

Account information: email address, password (stored securely hashed by our authentication provider), and display name.
Profile & health data: gender, age/year of birth, height, current and target weight, activity level, fitness goal, and derived values such as BMI and calorie/water/sleep goals.
Workout data: weekly plans, workout sessions, exercises, sets, reps, weights, rest times, RPE, and progress statistics.
Nutrition data: meals and foods you log, custom foods and ingredients, serving amounts, and calorie/macro information.
Wellness logs: water intake, sleep hours and quality, body-weight entries, and vitamin/supplement intake (including the time taken).
Progress photos (optional): photos you attach to a workout, captured with your camera or chosen from your photo library.
Reminder & app preferences: notification settings, training method preferences, and theme.

b. Purchases

In-app purchase records: the credit bundles you buy, amounts, currency, purchase status, and a purchase/transaction identifier. Payments are processed by Google Play Billing or the Apple App Store and by our purchase provider RevenueCat. We never receive or store your full card or bank details.
Credit balance & usage ledger: your AI-credit balance and a history of credits granted or spent.

c. Information collected automatically

Technical & device data: app version, device model and operating-system version, timestamps, and diagnostic information needed to operate and secure the service.
Purchase/attribution identifiers: our purchase provider assigns an app-user identifier (linked to your account) and may process device identifiers to validate purchases and prevent fraud.

3. How we use your information

To create and manage your account and authenticate you.
To provide the App’s core features: workout planning & tracking, nutrition & calorie tracking, water, sleep, weight, BMI, recovery, supplement logging, and progress history.
To generate AI-powered results you request (see Section 5).
To process in-app purchases, maintain your credit balance, and send you receipts/invoices.
To send you the notifications and reminders you enable, and email verification codes.
To secure the service, prevent fraud/abuse, debug problems, and comply with legal obligations.

4. Legal bases for processing (EEA/UK users)

Performance of a contract — to provide the App and the features you request.
Consent — for optional features such as camera/photo access, push/reminder notifications, and processing of health data you choose to enter. You can withdraw consent at any time.
Legitimate interests — to secure the service, prevent abuse, and improve reliability.
Legal obligation — to keep transaction records and respond to lawful requests.

5. AI features

When you use the optional AI features — “AI Estimate Calories” and “Generate with AI” (workout plan) — the relevant input is sent to our AI provider, OpenAI, to produce the result:

For calorie estimates: the food/ingredient text you type.
For AI plans: your non-identifying fitness stats (e.g., gender, age, height, weight, BMI, goal, equipment, and any focus you enter).

These requests are made through OpenAI’s API. Per OpenAI’s API policies, data submitted via the API is not used to train their models. We do not send your name, email, or contact details to OpenAI. See OpenAI’s privacy policy. The App also offers on-device (non-AI) alternatives that do not send data to OpenAI.

When you use online food search, your search term is sent to the Open Food Facts open database to return matching foods.

6. How we share information & third-party services

We do not sell your personal information and do not share it for cross-context behavioral advertising. We share data only with the service providers (“processors”) that make the App work:

Provider	Purpose	Data involved
Supabase	Cloud backend: authentication, database, and file storage	All account, profile, health/fitness, and photo data
OpenAI	AI calorie estimates & AI workout plans (only when you use them)	Meal text / non-identifying fitness stats
Open Food Facts	Online food search (only when you use it)	Your search terms
RevenueCat	In-app purchase management & receipt validation	Purchase events, app-user identifier, device/purchase identifiers
Google Play Billing / Apple App Store	Payment processing for in-app purchases	Payment handled by the store; we receive only purchase confirmation data
Resend	Transactional email (verification codes, purchase invoices)	Your email address and message content

Each provider processes data under its own privacy policy and our agreements with them. We may also disclose information if required by law, to enforce our terms, or to protect the rights, safety, and security of our users and the service.

7. Permissions the App may request

Camera & Photos: only to capture or attach progress pictures. Optional.
Notifications: to deliver the water, sleep, bedtime, and workout reminders you enable. Reminders are scheduled locally on your device.

You can grant or revoke these permissions at any time in your device settings.

8. Data retention

We keep your information for as long as your account is active or as needed to provide the App. If you delete your account, we delete or anonymize your personal data within a reasonable period, except where we must retain certain records (for example, purchase/transaction records) to meet legal, accounting, or fraud-prevention obligations.

9. Your rights & choices

Depending on where you live (including under the GDPR and the CCPA/CPRA), you may have the right to:

Access the personal data we hold about you.
Correct inaccurate data (you can edit most profile data directly in the App).
Delete your data and account (see Section 10).
Export/port your data.
Object to or restrict certain processing, and withdraw consent.
Not receive discriminatory treatment for exercising your rights.

To exercise any right, email admin@dcoos.com. We will respond within the time required by applicable law.

10. Deleting your account & data

You can request deletion of your account and associated personal data at any time by emailing admin@dcoos.com from your registered email address, or by using the in-app account-deletion option where available. Upon verification, we will delete your account and personal data, subject to the limited retention described in Section 8. Note that purchases and unused credits are non-refundable except as required by law or the applicable app store’s policies.

11. Data security

We use industry-standard measures to protect your data, including encryption in transit (HTTPS/TLS), authentication, and access controls that restrict each account to its own data. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

12. International data transfers

Our providers may process and store data on servers located in countries other than yours, including the United States. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for these transfers.

13. Children’s privacy

The App is not directed to children under 13 (or the minimum age of digital consent in your country, e.g., 16 in parts of the EEA). We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will delete it.

14. Changes to this Policy

We may update this Policy from time to time. We will revise the “Last updated” date above and, for material changes, provide a more prominent notice. Your continued use of the App after changes take effect constitutes acceptance of the updated Policy.

15. Contact us

DCOOS — Onestop Fit
Email: admin@dcoos.com
Web: https://dcoos.com/onestop/privacy