FitItIn

Privacy Policy

Last updated: 7 November 2026

This policy covers personal information used by the operator of FitItIn (“we”, “us”) in the mobile app and website. For privacy enquiries or rights requests, contact support@fititin.today. It should be read with our Cookie Policy.

1. Information we use and where it comes from

Basic account information is needed to create and secure your account. Photos, calendar connections and contact discovery are optional. With your device permission, contact discovery reads names and phone numbers from the contacts you allow. Contact names stay on your device and are used to display your contacts and invitation options. The app normalises phone numbers on your device and securely sends those numbers, together with temporary contact references, to FitItIn for matching. The references let the app associate returned matches with your local contacts; they do not contain contact names. We do not upload contact names, addresses, notes or photos, and we do not save or log submitted contact lists or use them for marketing.

You can start contact discovery during setup or through Friends & Contacts settings. Once contact access is granted, opening Add Friend can automatically load quick-add suggestions, labelled “In your contacts”, and refresh them when you return to that screen from device settings. You can also refresh suggestions manually. The app does not continuously scan contacts in the background. Matches are limited to eligible accounts with verified phone numbers whose owners enabled phone discoverability; existing friends and blocked accounts are excluded. Normal name or username search remains available. A contact not appearing in suggestions does not necessarily mean they have no FitItIn account. Matching is rate-limited, but our server necessarily processes the submitted numbers for each lookup; this is not a cryptographic private-set-intersection system.

Adding and verifying your own phone number is optional and is not required to look for friends. If you use phone verification, Twilio Verify processes your phone number, the verification code you submit and delivery/status information to send and check an SMS verification code. Verification does not automatically enable phone discoverability. You control that separate preference in Friends & Contacts settings.

Contact invitation buttons copy an invitation link to your device clipboard for you to send yourself. Other invitation controls may open your device’s sharing interface. FitItIn does not automatically send SMS invitations to your contacts. If you share a link through another app, that app processes the message and recipient information under its own terms and privacy policy.

Group invitation links: we store the intended group, issuing organiser, expiry and revocation status, a token hash for lookup and an encrypted copy of the shareable token. Links normally expire after seven days and can be revoked or replaced. A person holding an active link can preview the group name and image before signing in, without receiving its private member list or calendar details. Accepting a link associates the signed-in account with the group, subject to permissions and group limits. Treat the link as private: anyone you share it with can forward it. The app can retain a pending invitation on the device through login, registration and restarts; the Cookie Policy explains this storage.

If you enable biometric unlock, your device performs the biometric check; FitItIn does not receive your fingerprint or face template.

2. Purposes and legal bases

Where UK or EU data-protection law applies, we use the following bases:

Availability calculations compare schedules to suggest free times. They do not make decisions about you with legal or similarly significant effects.

Beta access and its expiry reminders are service administration under our contract with you. The reminder records are kept with your account to prevent duplicate messages; the original grant dates also let us avoid restarting the gift when beta status is removed and restored. Expiry reminders are subject to your notification preferences and do not enrol you in a paid subscription.

Product analytics

We use first-party server-side activity records to understand whether people join groups, organise plans and return to plan again. Records contain action names, timestamps and minimal account, group, event and invitation-version identifiers. They do not contain calendar titles or descriptions, chat messages, phone numbers, advertising IDs, device identifiers, or location details. No analytics SDK, cookie or local-storage identifier is added. Successful sharing or copying of a group invitation may send a small authenticated measurement request; this records sharing intent, not who receives or opens a message.

Our purpose and legitimate interest is improving the reliability and usefulness of group planning, with minimal collection, restricted access, aggregate reports and an opt-out. Advertising choices remain separate and are not used to enable advertising tracking through these records. You can turn Product analytics off in Account → Privacy & security; this stops associated tracking and deletes records associated with your account. You can also object or request erasure by contacting support@fititin.today. Records are deleted on account deletion and retained for at most 90 days plus the daily cleanup interval. Group deletion removes its associated records. Reports exclude deleted or opted-out records and are not used for individual profiling or marketing.

3. Visibility to other people

Signed-in users can find names, usernames and avatars through user search and profile sheets. Profile sheets include friends and groups counts. Connected users can see friendship status, relevant shared groups and online status. The friends service also returns email addresses to users involved in a friendship or friend request.

Group calendar visibility: events in the group you are viewing and availability results are shared with its members. Other members’ personal and imported events and events in other groups contribute only busy start and end times to that group calendar; their titles, descriptions, locations, event identifiers and other-group memberships are not shared there. You can also see the details of your own personal and imported events. We retain the underlying event data on our servers to calculate availability.

Group members can access the group chat’s existing history, message sender names, replies, reactions and poll votes. Joining later does not restrict a member to messages sent after joining. Mentions do not restrict who can read a message.

FitItIn Support: accounts assigned beta-tester access receive a private chat with the official, verified FitItIn Support account. Only that tester and the official Support account can participate; other testers and group members cannot access it. The chat title includes the tester’s username. The Support account is excluded from ordinary user searches and friend lists. Janet is not available in Support chats, and their contents are not used as Janet conversation context.

Uploaded profile and group images use publicly accessible media links. Anyone with a working link may be able to view or save an image, even if they are not currently in your group. Avoid uploading confidential images.

Other people may keep screenshots, copied text, exports or notifications. Removing content or access in FitItIn cannot recall those copies.

4. Google Calendar

When you connect Google Calendar, we store the connected email address, calendar identifier, encrypted access and refresh tokens, token expiry and last-sync time. We use read-only event access to import event details and calculate availability; this connection does not write changes back to Google Calendar.

A successful connection to a different Google account replaces the previous account’s Google-imported copies in FitItIn while keeping unrelated personal events, calendar-file imports and shared group events. Reconnecting the same account refreshes the supported sync window and preserves older history outside it. An unsuccessful reconnect does not replace the existing connection or its imported copies. Imported Free or declined events do not reserve busy time.

Disconnecting removes the stored connection and stops future syncing, but imported copies remain until you delete them using the calendar controls or delete your account. You can separately revoke access in your Google Account connections. Deleting copies while sync remains enabled may cause them to be imported again.

We do not send Google Calendar event content to advertising SDKs or use it to target advertisements. FitItIn’s use and transfer of information received from Google APIs is subject to the Google API Services User Data Policy, including its Limited Use requirements.

5. Notifications, email and service providers

Janet (AI): ULTRA members can start an optional group activity-planning conversation. To provide suggestions, we send OpenAI the chosen location, activity preference, recommendation intent, group size, names/categories of the last three past group activities and previous suggestions to avoid repeats. We do not send the group’s chat history, member email addresses or unrelated personal calendar records. Information you put into an accepted reply or activity title can be included, so do not provide sensitive or confidential details. Any group member can answer an authorised interaction’s questions; answers and Janet’s messages are visible to the group.

OpenAI processes this limited context using its API. Janet may use Brave Search to find relevant activities, with OpenAI web search as a fallback. Brave receives a short query containing your chosen location, activity preference and recommendation intent, rather than group chat history, member identities or past group activity names. Retrieved snippets are passed to OpenAI as evidence, then discarded from our application memory; we do not store or log raw Brave search responses. Requests disable optional OpenAI Responses API storage, but this does not promise zero provider retention. See OpenAI’s API data controls and Brave Search API information. We retain interaction state, accepted answers, generated suggestions and usage/cost records to provide shared history, prevent duplicate requests and enforce limits; brief caches of validated recommendations reduce repeated searches. AI processing provides the optional feature requested by a member, while abuse-prevention and usage controls support our legitimate interests. Deleting a group removes its linked Janet interactions; contact support for other erasure requests.

Janet’s accepted answers are stored as planning records as well as chat replies. Deleting a chat reply does not undo information already used in a recommendation or automatically remove that planning record. Contact support about further erasure requests.

We use hosting and storage providers to run the service and serve uploaded media, including DigitalOcean services where configured. Resend handles service and support email delivery. Google Firebase Cloud Messaging handles push delivery, with Apple’s push-notification infrastructure used for iOS delivery. Google provides optional sign-in and calendar access. Apple provides optional native iOS sign-in and private email relay; requests to Apple verify credentials and revoke provider authorisation. Verified Apple sign-in attempts expire after ten minutes and are cleaned up by the scheduler; encrypted pending revocation tokens are retried and removed after success or seven days. They contain no retained FitItIn account profile after account deletion. Apple and Google operate the stores used for app distribution and purchases.

Push providers receive device tokens and notification payloads. A chat notification can contain the conversation name (including a group name or Support chat title), sender name and message text or poll question; these can appear on a lock screen depending on device settings. Server-side chat encryption does not hide these previews from the delivery provider or someone who can view your notifications. Email providers process recipient addresses and the content of the service emails they deliver. Muting a chat stops its new-message push notifications, not access to the conversation or processing needed to provide it.

We may also disclose information when necessary to meet legal obligations, investigate abuse or protect people and the service. We do not sell calendar or chat content. Authorised service operators may access information when necessary for support, security or service operation, subject to applicable law and restrictions on Google user data.

6. Advertising and choices

The mobile app includes Google AdMob banner and interstitial advertising. Google’s advertising SDKs can process device, connection, interaction and diagnostic data to deliver, measure and protect advertising services. See Google’s advertising information and Mobile Ads SDK data disclosures.

The app uses Google’s User Messaging Platform for consent choices where required. When applicable, open Settings → Advertising privacy choices to review or change them. Your operating system may offer additional advertising or tracking controls. Refusing personalised advertising does not necessarily remove all advertisements or all processing permitted for their delivery. The Cookie Policy explains device storage separately from website cookies.

7. Retention and deletion

Account records, events and group content are kept while needed to provide the account and shared features, unless you delete them or a different legal or operational need applies. There is no automatic short-term expiry for group conversation history. Brief availability caches are used to reduce repeated calculations; these do not replace the underlying event records.

Deleting your own message clears its body and poll options and removes its reactions and votes from the active service. A marker, sender name and associated message metadata remain. Deleting a group deletes its linked chat and associated active chat records.

You can delete your account in the app or request deletion through our account-deletion page. This removes the account and related records such as personal events and Google Calendar connections. Groups you own transfer automatically to a remaining organiser, or otherwise the longest-standing member; groups without other members are deleted. Shared plans remain with the group. Messages and stored sender names in groups that remain can persist after account deletion. Uploaded media files are not guaranteed to be removed automatically by account deletion. Contact support about retained shared content or images and any further erasure request.

Support correspondence is kept as needed to resolve requests and related disputes. Operational logs use rotating retention settings for troubleshooting and security; security incidents, legal claims and legally required records can need longer retention. Copies in backups, mail systems or other providers’ systems may remain until those systems’ retention or overwrite cycles complete. Removal from the active service is not immediate removal from every backup or third-party copy.

Removing beta-tester access disables access to the Support conversation but retains its history for support continuity; restoring access can restore that history. Deleting the tester’s account removes its linked Support chat from the active service. Contact us about earlier erasure of support correspondence.

Complimentary beta ULTRA grant dates and reminder records remain associated with the account after the gift expires or beta status is removed, to prevent unintended repeat grants and reminders. They are removed with the account from the active service, subject to the backup and legal-retention distinctions above. A beta gift does not replace or expire separately activated paid access.

Encrypting the active chat database does not retroactively encrypt older backups, exports or database recovery records. These may contain earlier plaintext copies until their retention and replacement cycles complete. Encryption does not make retained personal information anonymous or remove your data-protection rights.

8. Security and international processing

We use HTTPS for app communications, password hashing, encrypted storage for verified phone numbers and Google Calendar tokens, and access controls. The mobile app uses platform secure storage for its sign-in token.

Chat encryption: we use authenticated server-side encryption at rest for message text, poll questions and options, vote choices and Janet’s structured recommendation content in the active database. Janet’s stored location and activity-preference answers, saved recommendation results and current recommendation caches are also encrypted. This applies to group chats and beta-tester Support chats. Encryption keys remain on the backend and are not sent to the mobile app or AI providers.

Chats are not end-to-end encrypted. Our servers decrypt content for authorised participants and necessary service operations, including the limited Janet processing described above. Authorised operators may access information where necessary for support, security or service operation; encryption does not prevent that access.

Chat metadata remains outside this content encryption, including sender names and identifiers, conversation and membership records, timestamps, reply references, reaction emojis and who reacted or voted, read markers and mute preferences. Content encryption does not by itself encrypt every database field, uploaded image, server disk, backup or provider-held copy. We limit chat failure diagnostics to operational metadata rather than message text. No service can guarantee complete security.

Our providers can process information outside your country, including in the United States. Transfer locations and safeguards depend on the provider and service configuration. Applicable data-protection law may require adequacy decisions or contractual safeguards for restricted transfers. Contact us for information about the providers, locations and safeguards relevant to your data.

9. Your controls and rights

You can update your profile, manage events and friendships, edit or delete your own chat messages, remove reactions or votes, mute chats, choose reminders and notification settings, disconnect Google Calendar, adjust advertising choices and request account deletion. Store subscriptions must be cancelled separately through Apple or Google; account deletion does not cancel them.

You can revoke contact permission in your device settings to prevent further device-contact lookups, including quick-add lookups when you open Add Friend. Normal name or username search remains available. You can separately turn off phone discoverability or remove your verified number in Friends & Contacts settings. Turning off discoverability prevents future matches; it does not change a friend request already sent or accepted.

Depending on applicable law and the processing concerned, you may have rights to access, correct, erase or obtain a portable copy of your data, restrict processing, and withdraw consent without affecting earlier lawful processing. You may also object to processing based on legitimate interests. Contact support@fititin.today; we may need to verify your identity before acting.

You can complain to the UK Information Commissioner’s Office or your relevant local supervisory authority. You do not have to contact us first to exercise that right.

If a child’s information has been provided without an appropriate legal basis or permission, contact us so we can investigate. We may update this policy as features or practices change; the date above identifies this version, and material changes will be communicated where required.