Privacy Policy

App: FitnesAI · Publisher: FINDPLACE MCHJ · Effective date: 27 April 2026

This Privacy Policy explains how FINDPLACE MCHJ ("we", "us", "our"), based in the Republic of Uzbekistan, collects, uses, stores, and shares personal data when you use the FitnesAI mobile application and related backend services (the "Service"). It also describes your rights and how to contact us.

1. Who we are

FINDPLACE MCHJ is the operator (data controller) of the Service. For any privacy-related question or request, contact us at rakhmatullaevulmas@gmail.com.

2. What data we collect

We collect only the data needed to operate the Service:

• Account & authentication data: your phone number and one-time SMS verification codes used to sign you in.
• Profile and fitness data you provide: training goals, body metrics, training cycles, workouts, exercises, sets, repetitions, weights, rest times, notes, and similar information you enter in the app.
• AI-generated content: analyses, recommendations, and notes produced by AI models based on your fitness data.
• Session data: JWT access tokens used to keep you signed in.
• Technical and usage data: IP address, device and OS information, request timestamps, error logs, and similar diagnostic data automatically generated when you use the Service.

We do not intentionally collect sensitive categories such as precise geolocation, contacts, photos, biometric identifiers, or payment details. We do not knowingly collect data from children under 13.

3. How we use your data

• To create and secure your account and authenticate you via SMS.
• To provide the core functionality of FitnesAI: storing your training data and generating personalized AI-based analyses and recommendations.
• To diagnose errors, prevent abuse, and improve reliability and performance.
• To comply with legal obligations applicable to us in Uzbekistan.

4. Legal basis

We process your personal data on the basis of your consent (given when you create an account and use the Service), the performance of our agreement with you (the Terms of Use), and our legitimate interest in operating and securing the Service. Our processing is conducted in accordance with the Law of the Republic of Uzbekistan "On Personal Data" (No. ZRU-547).

5. Third-party processors and AI providers

To provide the Service we transmit certain data to trusted third-party processors:

• AI providers — OpenAI, L.L.C. and/or Anthropic, PBC: we send your fitness data (cycles, workouts, exercises, metrics) to generate AI analyses and recommendations. These providers process the data outside Uzbekistan (primarily in the United States) under their own privacy and data-processing terms.
• SMS provider — Eskiz.uz (LLC "Eskiz"): we send your phone number and the SMS code text to deliver authentication codes. Eskiz processes data in Uzbekistan.
• Hosting infrastructure — Railway Corp.: our backend servers and PostgreSQL database are hosted on Railway, which provides cloud infrastructure (servers located outside Uzbekistan).

We do not sell your personal data and we do not share it with advertisers or data brokers.

6. International data transfers

Some of our processors (OpenAI, Anthropic, Railway) operate servers outside Uzbekistan. By using the Service you understand and consent that your data may be transferred to and processed in those countries. We rely on the contractual and security commitments these providers make to their customers.

7. Data retention

We keep your account and fitness data for as long as your account exists. SMS verification codes expire within minutes. Diagnostic logs are kept for a limited period (typically up to 90 days) and then deleted or aggregated. When you delete your account, we delete or irreversibly anonymize your personal data within 30 days, except where the law requires us to retain specific records.

8. Security

We use industry-standard measures to protect your data, including encrypted transport (HTTPS/TLS), hashed credentials, signed JWT session tokens, access controls on our infrastructure, and isolated production databases. No system is perfectly secure; if we become aware of a breach affecting your data, we will notify you and the competent authority as required by law.

9. Your rights

You have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion of your account and associated personal data.
• Withdraw your consent at any time (this will require us to stop providing the Service to you).
• Lodge a complaint with the State Personalization Center of the Republic of Uzbekistan or the competent authority.

To exercise any of these rights, email rakhmatullaevulmas@gmail.com from the address or phone number associated with your account. We will respond within 30 days.

10. Children

The Service is not directed to children under 13, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact us and we will delete it.

11. Changes to this Policy

We may update this Policy from time to time. The latest version is always available at this URL. Material changes will be communicated through the app or by other reasonable means before they take effect.

12. Contact

FINDPLACE MCHJ
Republic of Uzbekistan
Email: rakhmatullaevulmas@gmail.com