Privacy Policy

This policy explains what Follow Fit (the app) and xdumi.com (the website) collect, why, and what you can do about it. It covers both. Where the two differ, it says so. "We" means the operator named above.

1. The short version

• Camera images never leave your device. Nothing you film is uploaded, and nothing is written to storage.
• We keep an account for you (email, password, profile) and a record of the workouts you complete.
• Your body measurements and training goals are stored because you asked the app to use them. They are health-related data and we treat them as sensitive.
• We do not sell your data and we do not run advertising networks in the app.
• You can export or erase everything by emailing us; the app also has a deactivate-account button.

2. Camera and motion data

This is the part most people care about, so it is the most specific.

The camera feed is processed entirely on your device. A pose-estimation model running locally turns each frame into a set of body-landmark coordinates and the frame is discarded from memory immediately. Frames are never written to disk, never cached, and never transmitted to us or to anyone else. Turning the camera off — or denying the camera permission — disables scoring but the rest of the app keeps working.

What can be sent is the numeric output of that estimate. When you finish a workout, the app may include, along with your score, the coordinates of up to 33 body landmarks captured at each scoring checkpoint. These are numbers describing where your joints were relative to one another at a moment in time. They are not an image and cannot be turned back into one. We use them for one purpose: checking and improving the accuracy of the scoring engine.

This upload is optional at the protocol level — the app can report a workout without it — and we will state clearly in the app when it is on. If you would rather we did not keep landmark coordinates at all, email us and we will delete the ones tied to your account and switch them off for it.

3. What you give us

Data	Why
Email address and password	To create and secure your account. Passwords are stored only as a salted hash — we cannot read them.
Display name, avatar choice	Shown in the app.
Gender, age or age band, country, language	To pick suitable workouts and show the app in your language.
Height, weight, body type, target weight, training goals	Health-related. Used to estimate calories and to recommend sessions. Entirely optional — the app works without any of it.
Training preferences (workout types, session length, intensity, elder mode)	To personalise what you are shown.
Time-zone offset	So that "today" in your streak means your today, not our server's.
How you heard about us	Optional. Helps us know where to spend effort.

4. What we record as you use the app

• Each completed workout: which video, score, stars, combo, per-checkpoint grades, estimated calories and duration.
• Daily check-ins and streak counts.
• Which videos and collections you favourite.
• Cumulative totals (sessions, minutes, calories) shown on your profile.
• Referral codes you create or redeem, and who referred whom, so bonuses can be granted.

Calorie figures are estimates produced from your inputs and the workout's intensity. They are not measurements and should not be used for any medical purpose.

5. Purchases and subscriptions

Subscriptions are sold through the Apple App Store and Google Play. We never see your card, bank details or billing address — those stay with Apple or Google. What we receive and store is the purchase receipt or token, the platform transaction identifiers, which plan you bought, and its status and expiry date, so that we can unlock the right features and honour renewals, cancellations and refunds.

6. Technical information

Our servers log the usual things needed to run and secure a service: IP address, request time and path, response status, and a user agent string. These logs are kept short-term for debugging and abuse prevention. We do not build advertising profiles from them.

7. The website

xdumi.com sets one cookie of its own — your chosen language — plus a session cookie if you sign in. If website analytics are enabled, they are noted here and in the cookie banner at that time. Some links to retailers on this site are affiliate links; following one may let that retailer set its own cookies under its own policy.

8. Why we are allowed to hold this (GDPR/UK GDPR)

Purpose	Legal basis
Running your account, delivering workouts, subscriptions	Performance of a contract
Body measurements, training goals and landmark coordinates	Your explicit consent — you enter them, and you can withdraw at any time
Security, abuse prevention, debugging	Legitimate interests
Tax and accounting records for purchases	Legal obligation

Withdrawing consent does not affect processing already carried out, and does not remove your obligation to pay for a subscription period already started.

9. Who else sees it

We do not sell personal data and we do not share it for anyone else's marketing. It reaches other parties only in these cases:

• Apple and Google — to validate purchases and receive subscription status updates.
• Our hosting and infrastructure providers — they store the data on our instruction and may not use it for anything else.
• Where the law requires it — a valid legal order, or to protect someone's safety.
• A future buyer of the business — if Xdumi is ever sold or merged, with notice to you beforehand.

10. Where it is stored

Our servers and backups may be located outside your country. Where data leaves the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses or an equivalent safeguard.

11. How long we keep it

Data	Kept for
Account and profile	Until you ask us to erase it
Workout, check-in and favourite records	Until you ask us to erase them
Body-landmark coordinates	At most 24 months, or until you ask us to delete them, whichever is sooner
Purchase records	As long as tax law requires, typically 7 years
Server logs	Short-term, for debugging and abuse prevention

12. Your rights and how to use them

Wherever you live, you can ask us to show you what we hold, correct it, delete it, give you a copy in a portable format, or stop a particular use. If you are in the EEA or UK you additionally have the right to object, to restrict processing, and to complain to your national data protection authority. If you are in California you may request disclosure and deletion, and opt out of any "sale" or "sharing" — we do neither.

Deleting your account. The app's account screen has a button that deactivates your account immediately: you are signed out and cannot sign back in. To have the underlying records erased as well, email xtc787348856@gmail.com from your registered address and we will complete the erasure within 30 days and confirm when it is done. Purchase records that tax law obliges us to keep are the only exception, and they are stripped of everything except what the law requires.

We answer requests within 30 days and never charge for them.

13. Children

Follow Fit is not intended for children under 13, and we do not knowingly collect their data. Where local law sets a higher age of digital consent, that higher age applies. If you believe a child has given us data, email us and we will delete it.

14. Security

Traffic is encrypted in transit. Passwords are stored only as salted hashes. Access to production data is limited to the people who need it to operate the service. No system is perfectly secure; if a breach ever affects you, we will tell you and the relevant regulator within the time the law allows.

15. Changes

If we change this policy we will update the date at the top, and for anything material we will tell you in the app before it takes effect.

16. Contact

Questions, requests, or complaints: xtc787348856@gmail.com.