Privacy Policy
Revive Fitness App · Last updated: 15 May 2026 · Effective: 15 May 2026
Revive ("we", "our", or "us") is a fitness application available on Android and iOS.
This Privacy Policy explains what personal information we collect when you use Revive,
why we collect it, how we use and protect it, and your rights over it.
Please read it carefully before using the app.
By creating an account or using any part of Revive, you agree to this Privacy Policy.
If you do not agree, do not use the app.
1. Information We Collect
1.1 Information You Provide Directly
- Account details — name, email address, password (stored as a one-way hash).
- Body stats — date of birth, biological sex, height, current and target weight, body fat percentage, BMI.
- Fitness goals — goal type (lose weight, build muscle, maintain, endurance) and activity level.
- Food logs — meals and snacks you add, including food name, serving size, and macro-nutrient breakdown.
- Workout logs — exercises performed, sets, reps, weight lifted, duration, GPS route, and perceived effort.
- Community content — community names, messages, photos, videos and documents you post, challenges you create (title, duration, daily check-ins) and the notes you write in a challenge notepad. Messages and media are visible to the members of that community. Voice dictation text you choose to share is posted as a normal message.
- Private to-do list — tasks you add in the Community tab. Stored against your account so it follows you to a new device; it is never visible to any other user or community admin.
- Profile photo — if you choose to add one.
- Support messages — if you contact us by email.
1.2 Information Collected Automatically
- Device identifiers — Firebase installation ID, advertising ID (used for ad personalisation if consent is given).
- Usage analytics — screens viewed, features used, session length, button taps (via Firebase Analytics and Amplitude). No individual food or workout content is sent to analytics providers.
- Crash reports — stack traces, device model, OS version, and app version collected by Firebase Crashlytics and Sentry when the app crashes. These reports do not contain health data.
- Push notification token — a Firebase Cloud Messaging token generated on first launch, used only to deliver reminders you have opted into.
1.3 Information From Your Device Hardware
- Camera — used to scan food barcodes, photograph meals for AI nutritional analysis, and take photos or video to attach to community messages. Barcode scanning runs on-device and its frames are never stored or transmitted.
- Microphone & speech recognition — used only while you tap the "Dictate" button in a challenge notepad, to convert your speech to text. Audio is not stored by Revive; depending on your device, speech recognition is performed on-device or by your device's speech service (e.g. Google).
- Photo library — accessed only when you explicitly choose a photo to log a meal. The selected image is sent to Google Gemini for nutritional analysis and then discarded; it is not stored on our servers.
- Location — collected only during an active outdoor workout session when you tap "Start GPS workout". GPS coordinates are used to draw your route and calculate distance/pace. Raw coordinate streams are discarded after the session is saved; only the aggregate route polyline and distance are stored.
- Step count — read from your device's built-in pedometer (Android: Google Fit platform; iOS: CoreMotion/HealthKit) to populate the steps tile on your dashboard.
1.4 Health Platform Data (Apple Health / Google Fit)
With your explicit permission, Revive reads and/or writes the following data categories
through Apple HealthKit (iOS) and the Google Health platform (Android):
| Data type | Direction | Purpose |
|---|
| Steps | Read | Dashboard step counter |
| Active energy burned | Write | Record calories burned during workouts |
Health platform data is processed locally on your device and synced to our servers only to
power your personal dashboard. It is never used for advertising, sold, or
shared with third parties for their independent use.
You can revoke Health permissions at any time in your device Settings.
1.5 Communities, Admin Tracking and Your Control
Communities are groups created by other users. By default a community admin can see only your
name and what you post. An admin can see a summary of your fitness data
(workouts, minutes, calories logged, weight change, streak and your challenge progress)
only if you switch on "Share my fitness report with admin" for that community.
This is off by default and you can switch it off at any time; access stops immediately.
- If you leave a community, the admin stops receiving new data from you. The admin may keep the summary covering the period up to the day you left until they delete it.
- An admin can put your tracking on hold (the summary stops at that date) or permanently delete the tracking record, which removes it entirely.
- Your private to-do list and the notes in your notepad (unless you choose to share them) are never shown to admins or other members.
- You can report or block users and report communities from within the app.
2. How We Use Your Information
- Provide and personalise the Revive service (calorie targets, workout recommendations, meal plans).
- Send push notifications you have opted into (workout reminders, streak warnings, weekly summaries).
- Power AI features via Google Gemini API — your fitness context (goals, recent logs, body stats) is sent to Gemini to generate meal plans, workout suggestions and food-photo analysis. Gemini processes this data under Google's Privacy Policy.
- Display relevant ads via Google AdMob. Ad personalisation requires your consent (shown on first launch). You may opt out at any time in Settings → Privacy.
- Monitor app stability via Firebase Crashlytics and Sentry.
- Understand feature usage in aggregate via Firebase Analytics and Amplitude to improve the app.
- Process subscription payments via Google Play Billing.
- Respond to your support requests.
- Comply with legal obligations.
3. Legal Bases for Processing (EEA / UK Users)
| Processing activity | Legal basis |
|---|
| Providing the core app service | Contract (Article 6(1)(b) GDPR) |
| Health data processing | Explicit consent (Article 9(2)(a) GDPR) |
| Analytics & crash reports | Legitimate interests (app stability & improvement) |
| Personalised advertising | Consent (IAB TCF v2.2) |
| Legal obligations | Legal obligation (Article 6(1)(c) GDPR) |
4. Data Sharing and Third Parties
We do not sell your personal data. We share data only as described below:
| Third party | Data shared | Purpose |
|---|
| Google Gemini API | Fitness context (goals, recent logs, body stats); meal photos (transient) | Meal plans, workout recommendations, food photo analysis |
| Google Firebase | FCM token; crash stack traces; anonymised analytics events | Push notifications, crash reporting, analytics |
| Google AdMob | Advertising ID (with consent); approximate location | Contextual / personalised ads |
| Amplitude | Anonymised usage events (no PII, no health data) | Product analytics |
| Sentry | Crash stack traces, device/OS version | Error monitoring |
| Google Cloud Platform | All account and fitness data (encrypted at rest) | Backend infrastructure (Cloud Run, Cloud SQL, Cloud Storage) |
| Open Food Facts / USDA | Search query text only | Food database lookup |
| Law enforcement / courts | As required by applicable law | Legal compliance |
5. Data Retention
- Your account data and fitness logs are retained for as long as your account is active.
- If you delete your account, all personal data is permanently deleted within 30 days, except where retention is required by law.
- Anonymised, aggregated analytics data may be retained indefinitely (it cannot be linked back to you).
- Crash report data is retained for 90 days by Firebase Crashlytics and Sentry.
6. Data Security
- All data in transit is encrypted via TLS 1.2+.
- All data at rest on our servers (Google Cloud SQL) is encrypted using AES-256.
- Authentication tokens are stored in your device's secure enclave (iOS Keychain / Android Keystore) via
flutter_secure_storage.
- We use short-lived JWT access tokens (15 minutes) and long-lived refresh tokens (30 days) to minimise exposure if a token is compromised.
- No payment card data is stored on our servers. All payment processing is handled by Google Play Billing.
7. Children's Privacy
Revive is not directed at children under the age of 13 (or 16 in the EEA).
We do not knowingly collect personal data from children.
If you believe a child has provided us with personal data, please contact us and we will
delete it promptly.
8. Your Rights
Depending on where you live, you may have the right to:
- Access — request a copy of all personal data we hold about you.
- Rectification — correct inaccurate or incomplete data.
- Erasure ("right to be forgotten") — request deletion of your account and all associated data. You can initiate this from the app at Settings → Profile → Delete Account, or by emailing us.
- Portability — receive your data in a machine-readable format (JSON export available on request).
- Restriction / Objection — object to or restrict certain types of processing.
- Withdraw consent — withdraw any consent you have given (e.g., for personalised ads or health data) at any time without affecting the lawfulness of prior processing.
- Lodge a complaint — with your local data protection authority (e.g., ICO in the UK, your national DPA in the EU).
To exercise any of these rights, email us at privacy@revivefit.app. We will respond within 30 days.
9. California Residents (CCPA / CPRA)
California residents have the right to know what personal information we collect, to delete it,
to opt out of its "sale" (we do not sell personal information), and to non-discrimination for
exercising these rights. To submit a request, email privacy@revivefit.app.
10. International Data Transfers
Our servers are hosted in the United States (Google Cloud, us-central1 region).
If you are located outside the US, your data is transferred to and processed in the US.
For EEA/UK users, these transfers are made under the EU–US Data Privacy Framework and
Standard Contractual Clauses (SCCs) where applicable.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will
notify you via an in-app banner or push notification at least 7 days before the changes take
effect, and update the "Last updated" date at the top of this page.
Continued use of the app after the effective date constitutes your acceptance of the revised policy.
12. Contact Us
If you have any questions about this Privacy Policy or your data, please contact us: