Privacy Policy

Introduction

FUN MANAGEMENT SRL ("we," "our," or "us") operates Memory.fit: the Memory.fit mobile app (the "App"), the Memory.fit MCP server at https://api.memory.fit/mcp ("Memory.fit MCP"), and the memory.fit website. Memory.fit is your own data and memory layer for the AI assistants you choose — for example Claude, ChatGPT and others. It brings your training, sleep, recovery, body and fueling data together in one place, and lets the assistants you connect read it and, if you allow it, write to it.

This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and the rights you have — in particular under the EU General Data Protection Regulation ("GDPR"). We are the data controller for the processing described here.

Information We Collect

1. Account Data

• Email address and authentication tokens (managed via Supabase authentication)
• Full name
• Date of birth and gender
• Country, timezone, and language

2. Health and Fitness Data (Special-Category Data)

Memory.fit is a consumer fitness service. It is not a healthcare provider, health plan or healthcare clearinghouse, and it does not act as a business associate of one, so the data it holds is not "protected health information" under the US Health Insurance Portability and Accountability Act (HIPAA). We still treat all of it as sensitive health data, as this policy describes.

Depending on what you choose to provide or connect, this includes:

• Current weight, target weight, and your weight history over time
• Height, body composition (for example fat-free mass), and body-composition goals
• Completed training sessions, including duration, distance, heart rate, power (watts), calories, and the device or service they came from
• Planned training sessions, including their structure (steps, targets and intensities), and your training thresholds and zones
• Sleep, heart-rate variability (HRV), resting heart rate, recovery, steps, and other daily metrics from connected devices
• Meals and fuel logged by you or by your AI assistants, including any photos attached to them, and the fueling targets and meal plans your assistants set
• Meals and nutrients that nutrition apps you use (for example MyFitnessPal or Cronometer) write to Apple Health or Health Connect: food or meal names, the time, the app they came from, and calories, protein, carbohydrate, fat, fiber, sugar, sodium and caffeine where the app shares them
• Dietary preference, food intolerances, and dietary restrictions
• Injury history, sweat rate, salty-sweater status, and gut-training status
• Wake and sleep times
• Race goals, race dates, and race plans
• Menstrual cycle data, if you allow Memory.fit to read it from Apple Health or Health Connect: period days and flow, cycle starts, spotting, ovulation test results, basal body temperature, and contraception, pregnancy and lactation records; the cycle profile your AI assistant saves (life stage, contraception, typical cycle length, due date, breastfeeding); and what Memory.fit derives from these (cycle day, an estimated phase, and plain signals such as a late period). See "Cycle Data" below
• Blood test results your AI assistants record for you, such as ferritin, hemoglobin or vitamin D, with their units, dates and reference ranges
• A "rest mode" reason you select, such as injury or fatigue
• The memory your AI assistants share: facts, notes and goals they save for you, recommendations and insights they leave you, and documents you share with them

3. Connection and AI-Assistant Data

• For each data source or destination you connect: an identifier for your account there, and the access tokens it issues (stored encrypted)
• If you use the TrainingPeaks sign-in: the encrypted session TrainingPeaks issues after you sign in on its own page. We never receive or store your TrainingPeaks password
• For each AI assistant you connect: its name, the permissions you granted, and the date of your consent. Personal access tokens are stored only as a one-way hash
• An activity log of what each connected assistant read or changed, and when, so you can see it in the App and undo changes

4. Device Permissions

The App asks for the permissions below. Each is optional; the related feature simply does not work if you decline.

• Apple Health (iPhone) or Health Connect (Android): to read your workouts, sleep, heart rate, HRV, weight, the water you log, the meals and nutrients your nutrition apps write there, and, only if you allow cycle tracking, your menstrual cycle data. Memory.fit does not write anything to Apple Health
• Apple Watch workouts (WorkoutKit): to put planned sessions on your Apple Watch, if you turn this on
• Notifications: to send reminders such as in-session fueling reminders and items your assistants leave you

The App does not use your camera, photo library, microphone or location.

5. Subscription and Purchase Data

Subscription status and purchase events are processed by the app store you buy through (Apple App Store or Google Play) and by RevenueCat (subscription management). We do not receive your payment-card details.

6. Usage, Device, and Diagnostic Data

• Product-analytics events describing how the App is used (first-party; see "Analytics" below)
• Crash and error reports (Sentry)

How We Use Your Information

1. Provide the Service: import, store and organize your data; show it to you in the App; run Memory.fit's deterministic calculators (for example fueling calculations and the Fuel Score); and serve your data to the AI assistants you connect, within the permissions you granted
2. Carry out what your assistants do with your permission: save memory and notes, log meals and weight, change your plan, and arrange your Today and Progress screens
3. Send workouts where you ask: deliver planned sessions to the devices and services you turn on (see "Data Sources and Devices")
4. Accounts and security: authenticate you and your assistants, enforce permissions and rate limits, and keep your account secure
5. Subscriptions: operate the free and paid tiers and the referral program
6. Notifications: send push notifications (for example in-session fueling reminders) and, for the waitlist, email
7. Improve and debug: analytics and crash reporting to improve reliability and the product
8. Legal compliance: comply with legal obligations and respond to lawful requests

Legal Bases (GDPR Article 6 and 9)

• Performance of a contract (Art. 6(1)(b)): account creation, providing the Service's features, and managing your subscription
• Explicit consent (Art. 6(1)(a) and Art. 9(2)(a)): all processing of your health and fitness data described above; connecting a data source, a delivery destination, or Apple Health / Health Connect; connecting an AI assistant and sharing your data with it; device permissions; and marketing emails
• Legitimate interests (Art. 6(1)(f)): service security, fraud and abuse prevention (including rate limits on connected assistants), crash and error reporting, and product analytics that do not involve special-category data — balanced against your rights, and always subject to your right to object
• Legal obligation (Art. 6(1)(c)): record-keeping and responding to lawful requests

Your AI Assistants

You decide which AI assistants can use your Memory.fit data. You connect one either by signing in with your Memory.fit account on our consent page ("Sign in with Memory.fit," at memory.fit/oauth/consent) or with a personal access token you create in the App. Either way, you choose its permissions:

• Read (always on): your training, sleep and recovery, body (including blood test results), fueling (including meals from your nutrition apps), profile and goals, and the shared memory and notes — except Strava data, which is never shared, and cycle data, which needs the next permission
• Cycle data (read_cycle, off unless you turn it on): read your menstrual cycle data and cycle profile. Without it an assistant sees none of it
• Remember things (write_memory): save facts, notes and goals
• Log for you (write_log): log meals, weight, check-ins and gym sessions (exercises and sets)
• Change your plan (write_plan, off unless you turn it on): plan, move or remove sessions and adjust day targets. Memory.fit's safety limits still apply, and your own edits always win
• Arrange your Today and Progress screens (write_dashboard): add, move and remove charts and cards in the App, without changing your data or your plan

In-App AI Processing

None. Memory.fit's own features do not use AI: the in-app AI coach, its background AI jobs and the earlier meal photo and voice-note analysis are all switched off, and no AI model runs on your data when your assistants read from or write to Memory.fit. The only AI that sees your data is the assistant you connect, under its own terms.

Data Sources and Devices

You choose which sources to connect, in the App under Settings → Health data. Each connection is made with your explicit consent and can be disconnected at any time.

• Apple Health / Health Connect: runs on your device. You choose which data types Memory.fit may read (workouts, sleep, heart rate, HRV, weight, water, nutrition and, if you allow it, cycle tracking), and can change this in your phone's Health settings. Nutrition and cycle apps you use (for example MyFitnessPal, Cronometer, Clue or Flo) reach Memory.fit only this way: Memory.fit reads what they write to Apple Health or Health Connect and never connects to those apps directly. Memory.fit sends nothing back.
• Strava (you sign in with Strava): Memory.fit receives your activities. Strava data is shown only in the Memory.fit app and is never sent to AI assistants, as Strava's API policy requires. If the same workout also reaches Memory.fit from another source, such as Apple Health or your watch, your assistants may see that other copy. Memory.fit sends nothing to Strava.
• Withings (you sign in with Withings): Memory.fit receives your weight and body-composition readings. Memory.fit sends nothing back.
• Oura and Polar (you sign in with each directly): Memory.fit receives sleep, HRV, resting heart rate, recovery, daily activity and workouts. Memory.fit sends nothing back.
• intervals.icu (you sign in with intervals.icu): Memory.fit receives your activities, wellness data and planned sessions; if you turn on workout delivery, Memory.fit sends planned sessions to your intervals.icu calendar.
• TrainingPeaks: either a calendar (iCal) link you paste in, from which Memory.fit reads your planned sessions only; or your own TrainingPeaks sign-in, through which Memory.fit reads your calendar and, if you turn on delivery, writes the sessions your assistants plan. The sign-in is not an official TrainingPeaks integration. You sign in on TrainingPeaks' own page; Memory.fit keeps only the encrypted session, never your password.
• Stridee (platform.stridee.com, Zürich, Switzerland): a data partner that connects Garmin, COROS, WHOOP, Wahoo, Suunto, Zepp and Hammerhead and passes their data — workouts, sleep, heart rate, HRV and other daily metrics — to Memory.fit. If you turn on delivery to Garmin, Memory.fit sends planned sessions to Garmin through Stridee. Stridee acts as our processor (sub-processor) for these connections and hosts data with OVHcloud in the EEA.
• COROS: when you connect COROS, Memory.fit reads your COROS activities and wellness data, and sends your planned sessions to your COROS account if workout delivery is on, through COROS's own MCP service, with one connection. A COROS link made earlier through Stridee (above) keeps working until you disconnect it.

What Memory.fit Sends Out

Only if you turn it on, Memory.fit sends structured planned sessions (steps, durations and targets) to Apple Watch (via WorkoutKit, on your device), COROS, TrainingPeaks, intervals.icu and Garmin (via Stridee). It does not send your health history to these destinations.

Device Data and Attribution

• Data from Garmin devices is labeled with the Garmin device it came from, wherever it is shown, including when your assistants read it.
• Garmin, COROS and the other device makers and services above are independent controllers of the data they hold about you, under their own terms with you. Their terms and privacy policies continue to apply to your use of their devices and services.
• Disconnecting a source stops new imports. Data already imported stays in your Memory.fit account until you delete it or your account.

Who We Share Data With

We do not sell your personal data. We share it with the service providers below, which process it on our behalf to run Memory.fit; with the services and AI assistants you choose to connect; and otherwise only when required by law, to protect our rights, or in connection with a business transfer.

Our Service Providers (Processors)

• Supabase — authentication, database and file storage (hosted in the EU, region eu-west-1); holds your account, profile, health and fitness data, memory and logs
• Google Cloud Run — backend and Memory.fit MCP hosting (region europe-west1, Belgium); processes the same data to run the Service
• Stridee — device data partner for Garmin, COROS, WHOOP, Wahoo, Suunto, Zepp and Hammerhead, and workout delivery to Garmin (Switzerland; hosted with OVHcloud in the EEA); receives the data those connections carry
• Inngest — background jobs (for example importing data from connected sources, workout delivery and reminders)
• Firebase Cloud Messaging — push notifications; receives a device push token and the notification text
• RevenueCat — subscription and purchase management; receives subscription status and purchase events
• Sentry — crash and error reporting; receives diagnostic data about errors
• Hetzner Online (Germany), via Coolify — hosts the memory.fit website and our internal admin tools
• Resend — waitlist and transactional email; receives your email address
• PostHog (EU cloud): product analytics for the App and the website; receives usage events, never health data (see Cookies and Tracking)

Each provider is bound by a data-processing agreement, and its own privacy policy governs its infrastructure.

Services and Assistants You Connect (Independent Controllers)

• AI assistants you connect (for example Claude or ChatGPT) — receive what you grant them (see "Your AI Assistants")
• Strava, Withings, Oura, Polar — send us your data; we send them only what is needed to keep the connection working (for example your access token when we fetch data)
• intervals.icu, TrainingPeaks, COROS, Garmin — receive the planned sessions you choose to send; intervals.icu and TrainingPeaks also send us your data as described above
• Apple and Google — app stores and payments; Apple Health and Health Connect run on your device under your control
• Google, Meta, TikTok and Reddit: on the website only, and only with your Marketing consent, for ad measurement (see Cookies and Tracking)

International Data Transfers

Our primary storage and hosting are in the European Union (Supabase in eu-west-1; Google Cloud Run in europe-west1, Belgium), and the website and admin tools are hosted by Hetzner, a German provider. Stridee is based in Switzerland, which the European Commission recognizes as providing adequate protection, and hosts data in the EEA. Some providers — in particular Inngest, Firebase, RevenueCat, Sentry, and Resend — are established outside the EU, mainly in the United States, so processing by them can involve transfers outside the European Economic Area. For such transfers we rely on appropriate safeguards under Chapter V GDPR, in particular the EU–US Data Privacy Framework where the provider is certified, or the European Commission's Standard Contractual Clauses. You can request more information at privacy@memory.fit.

AI assistants and other services you connect may process your data outside the EEA under their own terms; that transfer happens because you chose to connect them.

Data Retention

• Account, profile, health and fitness data, and the memory your assistants save are retained while your account is active, so you and your assistants can use your history (for example weight trends)
• The activity log of what your assistants read or changed is kept for 90 days
• When you delete your account, your personal data is deleted, subject to residual copies removed in the ordinary course of backup cycles and to any retention required by law
• Diagnostic and analytics data are retained for limited periods set with each provider
• You can ask us to delete specific data at any time (see "Your Rights"). Copies already held by an AI assistant or service you connected must be deleted with that provider

Your Rights

Under the GDPR you have the right to:

1. Access: obtain a copy of your personal data
2. Rectification: correct inaccurate or incomplete data
3. Erasure: have your personal data deleted
4. Restriction: limit how we process your data
5. Portability: receive your data in a structured, commonly used, machine-readable format
6. Objection: object to processing based on legitimate interests
7. Withdraw consent: withdraw any consent at any time, without affecting the lawfulness of processing before withdrawal — including your explicit consent to health-data processing and to sharing with an AI assistant (disconnect it in Settings → AI agents)
8. Not to be subject to solely automated decisions producing legal or similarly significant effects. Memory.fit makes no such decisions

To exercise any of these rights, contact us at privacy@memory.fit. We will respond within the timeframes required by the GDPR.

Data Security

We use technical and organizational measures to protect your data, including:

• Encryption of data in transit (HTTPS/TLS) and at rest
• Separate encryption of the access tokens and sessions issued by the services you connect
• Token-based authentication for you and for every connected assistant; personal access tokens are stored only as a one-way hash
• Per-assistant permissions and rate limits, and access controls limiting who and what can reach your data

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Treat a personal access token like a password: anyone who has it can use your Memory.fit data within its permissions until you revoke it.

Children

Memory.fit is not intended for children under 16, and we do not knowingly collect personal data from them. If you believe a child under 16 has provided us with personal data, contact us at privacy@memory.fit and we will delete it.

Push Notifications

With your permission, we send push notifications (for example in-session fueling reminders and items your assistants leave you) via Firebase Cloud Messaging. You can turn them off at any time in your phone's notification settings.

Analytics and Tracking

• Product analytics run on PostHog (EU cloud), our processor. The App records events tied to your account that describe how it is used, for example that onboarding was finished. Events never carry health data. This data is not sold, and the App shares it with no advertising network.
• We do not track you across other apps or websites. The App does not use an advertising identifier (such as Apple's IDFA), does not show Apple's App Tracking Transparency prompt, and contains no advertising or attribution SDK.
• We do not record your screen. The App contains no session-replay or screen-recording technology.
• Sentry collects crash and error reports so we can fix problems.
• The memory.fit website asks before it uses any analytics or advertising cookie. See Cookies and Tracking on memory.fit below.

Deleting Your Account and Data

You can delete your account and its data at any time in the App: You → Settings (cog) → Privacy and data → Delete account (step by step: memory.fit/delete-account). Deletion starts at once. You can also ask by emailing privacy@memory.fit from the email address linked to your account; we action verified requests within 30 days. Deletion removes your personal data as described under "Data Retention" and ends every connected assistant's access. Data you already shared with an AI assistant or another connected service must be deleted with that provider. Deleting your account does not cancel an app-store subscription — manage that in your Apple ID or Google Play account settings.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated policy here and update the "Last Updated" date, and for significant changes we will notify you in the App or by email. Where a change requires new consent — for example a new use of health data — we will ask for it before the change applies to you.

Contact Us

For any questions about this Privacy Policy or our data practices, or to exercise your rights: