Last updated · August 7, 2026
Privacy Policy
Heads up: this document was drafted as a solid, honest starting point that satisfies Google Play's requirements. Before you publish, have a Brazilian lawyer review it against how your app actually handles data — especially if you start storing health information.
On this page
1. Who we are
FitHub Personal (“the app”) is an independent Android application developed and operated by Make This Work, based in Brazil. For the purposes of the Brazilian General Data Protection Law (LGPD, Law 13.709/2018), we act as controller of the data of trainers who subscribe, and as processor of the data that trainers record about their own clients.
Contact for any privacy matter: support@makethiswork.dev.
2. What we collect
Account data
- Name and email address (used to create and authenticate your account)
- CPF or CNPJ (required by our payment provider to issue a Pix charge)
- Subscription status, billing history and payment identifiers
Content you create
- Client records you enter: name, contact, goals, body measurements, training history
- Workout programs, sets, loads and session logs
Technical data
- Device model, Android version and app version
- Crash reports and anonymous usage events
We do not collect your location, contacts, photos, microphone or any advertising identifier.
3. Why we use it
- To run the service — store your clients and programs, sync across devices, unlock features tied to your plan.
- To bill you — generate Pix charges and release access when payment clears.
- To support you — answer your emails and reproduce bugs you report.
- To improve the app — aggregate, non-identifying usage patterns and crash data.
We do not use your data, or your clients' data, for advertising. We do not sell data to anyone.
4. Legal basis (LGPD)
We process personal data on the basis of performance of a contract (art. 7, V) for everything required to deliver the subscription, legal obligation (art. 7, II) for tax and accounting records, and legitimate interest (art. 7, IX) for security, fraud prevention and product improvement. Where none of these apply, we ask for your consent and you can withdraw it at any time.
5. Who else touches the data
We use a small number of processors, each bound by their own terms:
- Google Firebase (Authentication, Firestore, Storage, Crashlytics) — hosting and authentication.
- Our Pix payment provider — receives your name, email and CPF/CNPJ solely to generate and settle charges. It never receives your clients' data.
- Google Play — app distribution.
No one else receives your data, except where we are legally compelled to disclose it.
6. Your clients' data is yours
When you record information about a client, you are the controller of that information and you are responsible for having a lawful basis to hold it — normally the client's consent. We store and protect it on your behalf, we do not use it for any purpose of our own, and we return or delete it when you ask.
If a client of yours asks us directly to delete their data, we will forward the request to you and support you in fulfilling it.
7. How long we keep it
Account and content data are kept for as long as your account is active. After you delete your account, we erase your data within 30 days, except billing records, which Brazilian tax law requires us to keep for five years.
8. Security
Data is transmitted over TLS and stored in Firebase with per-account security rules, so one trainer can never read another's data. Payment is handled entirely by our payment provider — we never see or store card or banking credentials. No system is perfectly secure, and if a breach affects you we will notify you and the ANPD as the LGPD requires.
9. Your rights
Under the LGPD you may ask us to confirm what we hold, access it, correct it, anonymise or delete it, port it to another provider, or withdraw consent. Write to support@makethiswork.dev and we will answer within 15 days. You can also delete your account yourself, straight from Profile → Delete account in the app — see Delete my account.
10. Children
The app is intended for professional personal trainers and is not directed at anyone under 18. If you record data about a minor client, you are responsible for obtaining consent from their parent or legal guardian.
11. International transfers
Firebase may store data on servers outside Brazil. Google provides contractual safeguards for these transfers, and we rely on them under art. 33 of the LGPD.
12. Changes
If we change this policy in a way that affects you, we will notify you in the app and by email before it takes effect. The date at the top always reflects the current version.
13. Contact
Questions, requests or complaints: support@makethiswork.dev. You also have the right to complain to the ANPD, Brazil's data protection authority.