Privacy Policy

1. Who We Are

MoveSet is operated by a sole trader trading as MoveSet, based in the United Kingdom. For the purposes of UK GDPR, we are the data controller of your personal information.

To contact us about data protection matters: support@moveset.fit

2. What Data We Collect

Account Information

• Name and email address when you register, or the details shared by Apple or Google if you choose to sign in with them (including Apple's private relay email, if you opt to hide your address)
• If you register with an email and password, your password is stored securely in hashed form by our authentication provider (Google Firebase) — we never have access to it in plain text
• Profile details you choose to provide, including a profile photo

Health & Fitness Data

• Workouts you log, including exercise type, sets, reps, and duration
• Nutritional information you input (meals, calories, macros)
• Bodyweight measurements and progress entries
• Daily step count — read from Apple HealthKit (iOS) or Health Connect (Android) with your explicit permission and shown on your device (see “Health Data” below)

Payment Information

• MoveSet programs are sold as one-time purchases (not subscriptions). Payment is processed by Apple and managed via RevenueCat. We do not store your card details — only transaction identifiers and which programs you have unlocked (your entitlements).

Technical Data

• Device type, operating system, and app version
• Standard service logs and an app-integrity token (Firebase App Check), used to operate and secure the app

3. How We Use Your Data

• To provide the service — powering your calendar, workout logs, nutrition tracking, bodyweight graphs, step count display, and coaching plan access. Legal basis: Contract performance.
• To process payments — unlocking and restoring the programs you buy, via RevenueCat. Legal basis: Contract performance.
• To keep the app reliable and secure — using technical data and service logs to operate the App, fix problems, and prevent abuse. Legal basis: Legitimate interests.
• To communicate with you — sending transactional emails such as purchase confirmations or important account updates. Legal basis: Contract performance / Legitimate interests.
• To comply with legal obligations — retaining records required by law. Legal basis: Legal obligation.

4. Health Data — Special Category

Step count data is read from Apple HealthKit (iOS) or Health Connect (Android) with your permission, processed on your device to display your activity, and is not transmitted to our servers. Data obtained from HealthKit is never used for advertising or market research, never sold, and never shared with third parties — in line with Apple's HealthKit requirements.

5. Third-Party Services

• Google Firebase — our backend platform: account authentication, database (Cloud Firestore), cloud functions, file storage, and app-integrity checks (App Check). Your account and fitness data are stored here, in Google's London (europe-west2) region. Privacy Policy ↗
• RevenueCat — in-app purchase management. Privacy Policy ↗
• Apple HealthKit — step count and health data (iOS only, explicit permission required). Apple Privacy Policy ↗
• Google Health Connect — step count and health data (Android only, explicit permission required). Google Privacy Policy ↗

We do not sell your personal data to any third party.

6. Data Storage & Security

Your account and fitness data are stored in Google Firebase, hosted in the London (europe-west2) region. We use industry-standard security measures including encryption in transit (TLS) and at rest. Access to personal data is restricted to what is necessary to operate the service.

If we become aware of a data breach likely to result in risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours and inform you without undue delay.

7. Data Retention

We retain your personal data for as long as your account is active. If you delete your account, we will delete or anonymise your personal data within 30 days, except where required by law — for example, financial transaction records are retained for 7 years in line with HMRC requirements.

8. Your Rights Under UK GDPR

• Right of access — request a copy of the data we hold about you
• Right to rectification — ask us to correct inaccurate data
• Right to erasure — request deletion of your data
• Right to restriction — ask us to limit how we process your data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — withdraw consent for health data at any time via app settings

To exercise any of these rights, contact us at support@moveset.fit. We will respond within one month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

9. Children's Privacy

MoveSet is not intended for use by anyone under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you via the app or by email before the changes take effect. Continued use of MoveSet after the effective date constitutes acceptance of the updated policy.

11. Contact