FitKobra Privacy Policy & Data Safety Disclosures

1. Data Fiduciary & Controller

The Data Fiduciary responsible for your personal data under India’s Digital Personal Data Protection (DPDP) Act, 2023 and Data Controller under the General Data Protection Regulation (GDPR) is FitKobra Technologies. Our designated Grievance Redressal Officer oversees statutory compliance and responds to Data Subject Access Requests (DSAR).

2. Personal Data We Collect

FitKobra collects only the personal and fitness information necessary to deliver our training and nutrition intelligence services:

• Account Credentials & Profile: Display name, email address, password hashes (managed securely by Google Firebase Auth), date of birth, gender, weight, height, and athletic goals.
• Physical Activity & Fitness Telemetry: Workout logs, exercise repetitions, 3D kinematic form metrics, daily step counts, and active calories.
• Nutrition & Meal Records: Food logs, custom portion weights, daily macro targets, and food imagery captured solely for meal nutrient recognition.
• Voluntary Cardiovascular Vitals: Personal blood pressure logs (systolic, diastolic, MAP) and user-entered tactile pulse cadence measurements following American Heart Association (AHA) palpation protocols.

3. Children & Minor Protection (DPDP Act Sec 9 & COPPA)

FitKobra is strictly built and intended for adult athletes who are at least eighteen (18) years of age. In strict adherence to Section 9 of the DPDP Act 2023 and child privacy rules:

• FitKobra enforces an automated 18+ age gate during account registration and onboarding.
• We do not knowingly collect, process, or retain personal or health data of individuals under 18 years of age.
• FitKobra strictly prohibits behavioral tracking, profile monitoring, or targeted advertising directed at children or minors.
• If we discover that personal data belonging to a minor has been submitted, we will immediately and permanently purge all such records from our databases and authentication infrastructure.

4. Artificial Intelligence & Generative Content Safeguards

FitKobra leverages advanced artificial intelligence (including Google Gemini models) for computer vision recipe recognition and interactive fitness coaching:

• Camera Access (Snap-to-Recipe): Food photos captured during meal scanning are securely analyzed in real-time to estimate nutritional values. Images are processed ephemerally and are never permanently stored or utilized for AI foundation model training.
• Coach Maya Ephemeral Conversations: Chat messages with our AI coach are processed in real-time solely to generate personalized fitness and nutrition advice. Conversations are maintained in temporary device memory during your active session and are never retained in cloud databases or used to train third-party machine learning models.
• AI Biomechanical Animations: Exercise demonstrations and 3D kinematic guides use synthetic athletic figures wearing standard sportswear with zero suggestive content, designed solely for anatomical safety and joint alignment.

5. Purpose Limitation & Data Processing Grounds

Your data is processed strictly under lawful consent (DPDP Act Section 6) and for defined, explicit purposes:

• Calculating personalized Total Daily Energy Expenditure (TDEE), basal metabolic rate, and macro targets.
• Recording workout streaks, activity milestones, and pedometer step achievements.
• Populating optional competitive features (Global Leaderboard) when authorized.

6. Statutory Data Principal Rights (DPDP Act Sec 11/12 & GDPR)

As a Data Principal under Indian law and GDPR, you have complete statutory control over your personal data:

• Right to Access & Summary (DPDP Sec 11 / GDPR Art 15): Request a complete audit report of your personal data and third-party processing disclosures instantly via Profile → Settings → "Export My Data".
• Right to Correction & Completion (DPDP Sec 12 / GDPR Art 16): Modify or correct any personal metric directly in Edit Profile.
• Right to Erasure / Hard Deletion (DPDP Sec 12 / GDPR Art 17): Permanently purge your account, all cardiovascular vitals, meal records, workout history, and leaderboard records via Profile → Settings → "Delete Account". This hard deletion permanently clears all cloud and local storage records.
• Right to Data Portability (GDPR Art 20): Export your entire fitness and health history in standardized, open JSON format.
• Right to Withdraw Consent (DPDP Sec 6(7)): Revoke consent at any time without punitive measures.
• Right to Nominate (DPDP Sec 14): Nominate an individual to exercise your data rights in the event of death or incapacity.

7. Data Security Safeguards (DPDP Sec 8(5))

We employ industry-leading security practices to safeguard your information. All cloud communication is secured with TLS 1.3 encryption, and data stored in Google Firebase is encrypted at rest using AES-256. Authentication nonces and cryptographic identifiers adhere to strict RFC standards.

8. Global Leaderboard & Community Privacy

FitKobra features an optional public Global Leaderboard that displays athletic ranking among authenticated users.

• What is Displayed: Display name, profile avatar (if authenticated via Google), activity points, and daily streak count.
• What is Strictly EXCLUDED: Email address, date of birth, weight, height, health vitals, and nutrition logs are NEVER shared on the leaderboard.
• Leaderboard Opt-Out: You may opt out of the leaderboard at any time by deleting your account via Profile Settings or by emailing fitkobra.ai@gmail.com. Removal takes effect immediately.

9. Cardiovascular Vitals, Sensor Data & Zero Commercialization

FitKobra enforces the highest tier of confidentiality regarding cardiovascular health records:

• Interactive Tactile Cadence Input: Pulse checks are measured through manual user tap rhythm in accordance with American Heart Association (AHA) palpation methods. FitKobra does NOT use the camera sensor, optical lens, or LED flash for pulse acquisition.
• Strict Non-Commercialization Guarantee: FitKobra will NEVER sell, lease, rent, trade, or disclose your blood pressure, pulse, or health logs to advertising networks, health insurance providers, data brokers, or commercial resellers.
• Zero Model Training on Health Vitals: Your vital records are never fed into machine learning algorithms or foundation models.

10. Apple Health & CoreMotion Telemetry Compliance

In strict compliance with Apple App Store Review Guidelines Section 5.1.3 (Health and Health Research):

• Motion and pedometer telemetry obtained through Apple CoreMotion (CMPedometer) is utilized exclusively for personal step goals, workout calorie expenditure, and milestone streaks.
• Motion and fitness telemetry is never transferred to third parties for advertising or tracking purposes.
• Users can view or revoke Motion & Fitness permissions at any time in iOS Settings → Privacy & Security → Motion & Fitness → FitKobra.

11. Third-Party Service Providers (Sub-Processors)

We work with trusted enterprise cloud providers subject to strict data processing agreements:

• Google Cloud & Firebase: Cloud database storage (Cloud Firestore), authentication, and hosting infrastructure.
• Google Gemini AI: Ephemeral meal nutrient analysis and conversational fitness advice.
• Google AdMob: In-app ad mediation and reward video fulfillment (non-personalized, zero tracking on health data).

12. Statutory Grievance Redressal & DPO Contact (DPDP Act Sec 8(9) & 13)

In accordance with the DPDP Act 2023, FitKobra has appointed a designated Grievance Redressal Officer to address all data protection inquiries, statutory objections, and DSAR requests: