Privacy Policy

Last updated · August 3, 2026

This Privacy Policy explains how SD Fitness ("the App", "we", "us"), the official training app of Shontelle DuBois Fitness, collects, uses, and protects your information when you use our mobile application on iOS or Android. We take your privacy seriously: we collect only what the App needs to work, we never sell your data, we never use it for advertising, and the App contains no advertising networks and no third-party analytics or tracking SDKs.

1. Information We Collect

1.1 Information you provide

• Account information — your name, email address, and password when you create an account. Passwords are stored in hashed form by our authentication provider; we never see or store your plain-text password.
• Contact details — an optional phone number, if you choose to add one to your profile.
• Profile and training details — gender, date of birth, height, body weight, your current and goal body-fat figures, your training goals, activity level, and your preferred units (metric or imperial). These are used to select the right programs for you, to estimate calories burned, and to wish you a happy birthday.
• Profile picture — optional. Unlike your progress photos, your profile picture is uploaded to and stored on our servers, so that it appears on your account on any device you sign in from. It is deleted when you delete your account.
• Progress photos — your before & after transformation photos. These are stored only on your device. They are never uploaded to our servers. Sharing a transformation image happens only when you choose to, through your phone's own share menu.

1.2 Information created while you use the App

• Workout activity — the exercises you complete, how long you train, estimated calories burned, and the streaks, stats, and achievement badges built from them, so your progress stays in sync across sessions and devices.
• Hydration logs — water intake you record and your reminder preferences.
• Purchase information — your subscription status, managed through Apple's App Store or Google Play together with our subscription provider (RevenueCat). We never receive or store your credit card details.
• Device information — a basic app-instance identifier and your device model, operating system version, and app version, used to operate your subscription and to diagnose technical problems.
• Diagnostic data — if the App runs into an error, an anonymised crash report and basic performance timing are sent to our error-monitoring provider (Sentry) so we can fix it. This is deliberately configured not to include your name, email address, or IP address, and it is not linked to your account.

1.3 Health data (Apple Health / Health Connect)

If you choose to tap "Connect Health Data", the App asks your operating system — Apple Health on iOS, or Health Connect on Android — for read-only access to the following data types:

• Daily step count
• Active calories burned
• Heart rate (most recent reading)
• Sleep duration (last night)

This data is used for one purpose only: to display your own daily activity on your personal dashboard inside the App. It is not uploaded to our servers, not stored outside your device, not shared with anyone, not sold, and never used for advertising, analytics, marketing, or any other purpose. The App only reads this data — it does not add to or change anything in Apple Health or Health Connect. Connecting health data is entirely optional — the App is fully functional without it — and you can revoke access at any time in Apple Health settings (iOS) or Health Connect settings (Android).

1.4 Camera and photo access

The App requests camera access only when you choose to take a profile picture or a before/after progress photo, and photo library access only when you choose to pick an existing photo. It requests permission to save to your photo library only when you choose to save a transformation image. We never access your camera or photos in the background.

1.5 What we do not collect

To be explicit, the App does not collect any of the following:

• Your precise or approximate location
• Your contacts, calendar, messages, or call history
• Your browsing or search history
• Advertising identifiers such as Apple's IDFA — the App shows no ads, does not track you across other companies' apps or websites, and therefore never asks for App Tracking Transparency permission
• Any biometric, genetic, racial, religious, political, or sexual-orientation information

2. How We Use Your Information

We do not use your data for advertising, we do not sell or rent your data to anyone, we do not share it for cross-context behavioural advertising, and the App contains no third-party advertising of any kind. We do not use your data to train artificial-intelligence models, and we do not make automated decisions that produce legal or similarly significant effects about you.

3. Who We Share Data With

We share data only with the service providers required to run the App, and only the minimum they need:

• Supabase — our secure backend platform that hosts accounts, profile details, workout history, hydration logs, and profile pictures (data hosted in Canada).
• RevenueCat — processes subscription status on our behalf. Receives an app-instance identifier and purchase state; never your name, profile details, photos, or health data.
• Sentry — receives crash reports and basic performance data so we can fix technical problems. Configured not to receive your name, email address, or IP address.
• Apple / Google — handle all payments through the App Store and Google Play under their own terms and privacy policies.

Each of these providers is bound to use the data only to provide their service to us. We may also disclose information if we are legally required to do so, or to protect our rights or the safety of others. We never share your data with advertisers or data brokers, and we would tell you before any change of control resulted in your data being transferred to a new owner.

4. Where Your Data Is Processed

Your account and workout data is hosted in Canada. Some of our service providers process limited data (such as subscription status and crash reports) on servers in other countries, including the United States. Where personal data is transferred outside your country, we rely on the safeguards required by applicable law, such as standard contractual clauses, and on providers that commit to protecting it to an equivalent standard.

5. Data Security

All data transmitted between the App and our servers is encrypted in transit using HTTPS/TLS, and data stored on our servers is encrypted at rest. Access to stored data is restricted through row-level security, meaning your data is accessible only to your authenticated account. Your login session is held in your device's secure hardware-backed storage — the iOS Keychain or the Android Keystore. Passwords are stored only as salted hashes. No system is perfectly secure, but if a breach ever affected your personal data we would notify you and the relevant authorities as required by law.

6. Data Retention

We keep your account data for as long as your account exists. When you delete your account, your personal data — account details, profile, profile picture, workout history, hydration logs, and stats — is permanently deleted from our servers. Progress photos and health data never left your device in the first place; deleting the App removes them. Crash and performance reports are anonymised and are automatically deleted by our monitoring provider after a limited retention period (up to 90 days). We may retain a minimal record of a transaction where tax or accounting law requires it.

7. Deleting Your Account & Your Rights

If you can no longer access the App, you can request deletion by contacting us (see Section 11) from the email address linked to your account, and we will delete it for you.

Depending on where you live, you also have the right to:

• ask us what personal data we hold about you and receive a copy of it in a portable format;
• have inaccurate data corrected;
• have your data deleted;
• object to or ask us to restrict certain processing;
• withdraw your consent at any time — for example by disconnecting health data or turning off notifications — without affecting anything done before you withdrew it;
• complain to your local data-protection authority.

If you are a California resident: we do not sell your personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of. You retain the right to know, delete, and correct your personal information, and we will never discriminate against you for exercising it.

Contact us at the address in Section 11 and we will respond promptly, and in any event within the time limit set by applicable law. We will never charge you for making a request.

8. Children

SD Fitness is intended for adults aged 18 and over. The App is not directed at children, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account, contact us and we will delete it.

9. Notifications

With your permission, the App sends local notifications such as hydration reminders and workout-completion alerts. These are generated on your device and can be turned off at any time in the App or in your system settings.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes we will update the "Last updated" date above and, where appropriate, notify you in the App. Continued use of the App after changes take effect means you accept the updated policy.

11. Contact Us

If you have any questions about this Privacy Policy, how your data is handled, or you would like to exercise any of the rights described in Section 7, contact us at support@shontelledubois.com. This policy should be read together with our Terms & Conditions.