Privacy Policy.

Effective September 1, 2026 · Supercomplicated LLC

Effective date: September 8, 2026

This Privacy Policy explains how Supercomplicated LLC, a Delaware limited liability company with its principal place of business in Massachusetts ("HeyFitt," "Supercomplicated," "we," "us," or "our") collects, uses, retains, and shares information when you use the HeyFitt website, application, and related services (the "Service"). By using the Service, you acknowledge and, where consent is legally required, consent to the practices described in this Policy. This Policy is a statement of our information practices provided as a notice; it is not a contract and does not create contractual or other legal rights, except to the extent required by applicable law. Capitalized terms not defined here have the meanings given in our Terms of Service.

The Service is for adults only. You must be at least 18 years old to use HeyFitt.

1. Information We Collect

Information you provide to us:

Account information: email address, password, display name, and date or year of birth (used to confirm you are 18 or older).
Profile information: the gyms you list, the hours you train, what you are looking for in a training partner, workout preferences and goals, your bio, and the photos you upload.
Activity content: training logs, workouts, session history, and sessions you arrange with other members.
Communications: messages you exchange with other members through the Service, reports you file, feedback you leave about sessions, and messages you send to us (including support requests).
Trainer applications (if offered): if you apply to be listed as a trainer, your full legal name, phone number, and the certification and insurance documents you upload.

Information collected automatically:

Device and log information: IP address, browser and device type, operating system, device identifiers, language, and referring pages.
Usage information: pages viewed, features used, profiles viewed, searches, session times, interactions with other members' profiles, and similar activity data.
Approximate location: a general location (such as city or region) inferred from your IP address.
Your device's location, used once and not stored: in two places, if you allow it in your browser. During sign-up, to rank the gyms near you; we use the reading to sort the list and discard it. When you post a workout to your gym floor, only if you have turned on "Verify my posts with my phone's location" in your journal settings, to check the distance from your phone to your gyms. We keep the result — whether the post was verified, which of your gyms was nearest, how far away your phone was, and how precise it said it was — and we do not keep the location itself. Phone location is approximate, and verification can fail indoors or when your phone shares only an approximate location. You can turn this off at any time; posts already verified keep their badge.
Cookies and similar technologies: as described in Section 6.

Information from other sources:

From other members: reports, blocks, session feedback, and other information members submit about their interactions with you.
Public sources: we compile gym listings (names, addresses, and related details) from publicly available sources. These listings describe businesses, not our members.

2. How We Use Information

We use the information we collect to:

Provide, operate, maintain, and personalize the Service, including showing your profile to members of the gyms you list and ranking members by shared gyms, hours, and preferences;
Create, maintain, and secure your account, and verify eligibility (including that you are 18 or older);
Enable communications and sessions between members;
Promote safety and enforce our rules, including reviewing reports, reviewing member-to-member messages and other Member Content in connection with reports, suspected violations, and safety concerns, investigating suspected violations of our Terms or the law, moderating content, suspending or banning accounts, preventing banned users from re-registering, and maintaining records of reports, investigations, and enforcement actions;
Respond to your requests and provide support;
Send administrative communications (such as security notices and changes to our terms) and, with the choices described below, marketing communications;
Select the promotions, offers, recommendations, and advertising you see from us, using information we hold about you — including your gyms, your activity, and how you use the Service — and measure how those perform. We do this ourselves and through service providers acting on our behalf. Where the law requires your consent for this use, or requires that we offer you a way to opt out, we obtain that consent or provide that choice first, and information that reveals your health is not used this way without your explicit consent;
Monitor, analyze, and improve the Service; develop new features; perform analytics and research; and create aggregated or de-identified data;
Detect, investigate, and prevent fraud, abuse, security incidents, and other harmful or illegal activity;
Comply with legal obligations, respond to legal process, and establish, exercise, or defend legal claims; and
Protect the rights, property, and safety of HeyFitt, our members, and others.

We may combine information collected from different sources for these purposes. We may use and retain aggregated or de-identified data (which cannot reasonably be used to identify you) for any purpose and indefinitely; we commit to maintaining such data in de-identified form and not attempting to re-identify it except as permitted by law.

3. What Other Members Can See

Your profile — including your display name, photos, bio, workout preferences, training hours, listed gyms, and training activity you choose to share — is visible to other members of the gyms you list. Your email address and your date of birth or age are not shared with other members and are not visible to them anywhere on the Service. Messages you send are visible to their recipients, and if you choose to include personal information in a communication with another member — such as your email address or age — that information will be visible to the recipient. You disclose such information at your own discretion and risk, and HeyFitt is not responsible for information you choose to share with other members. Trainer-application documents and phone numbers (if applicable) are likewise never shown to other members. Reports and session feedback are not shown to the person they concern.

4. How We Share Information

We share information in the following circumstances:

With other members, as described in Section 3.
With service providers that perform services for us — such as hosting, storage, communications delivery, analytics, security, and customer support — under obligations to protect the information and use it only for the services they provide to us.
With professional advisers, such as lawyers, accountants, and insurers, where reasonably necessary.
For safety and legal reasons: we may disclose information if we believe in good faith that disclosure is reasonably necessary to (a) comply with a law, regulation, legal process, or governmental request; (b) enforce our Terms or other agreements; (c) detect, prevent, or address fraud, abuse, security, or technical issues; or (d) protect the rights, property, or safety of HeyFitt, our members, or any person — including sharing with law enforcement in connection with reports of misconduct or threats of harm.
In a business transfer: in connection with, or during negotiations of, any merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our business, your information may be transferred to the successor or acquirer, subject to this Policy.
With your consent or at your direction.
Aggregated or de-identified information, which we may share for any purpose.

We do not sell your personal information, and we do not share it with third parties for cross-context behavioral (targeted) advertising. Selecting what you see from us using information we already hold — described in Section 2.7 — is not a sale and is not cross-context behavioral advertising: the information stays with us and our service providers, and it is not used to target you on anyone else's site or app. If that ever changes, we will update this Policy first, provide any legally required opt-out (including recognizing the Global Privacy Control browser signal), and obtain any legally required consent.

5. Data Retention

We retain personal information for as long as your account is active and thereafter for as long as reasonably necessary for the purposes described in this Policy. In particular:

Profile, content, messages, and activity data are retained while your account is active. Training logs are retained for as long as you keep them.
Safety, moderation, and enforcement records — including reports, investigation records, enforcement outcomes, and information about suspended or banned accounts (retained in pseudonymized form where practicable) — are retained for up to five (5) years after the relevant account is closed, and longer where needed to prevent banned users from returning, to resolve disputes, or to comply with legal obligations. These records survive account deletion.
After account deletion, we delete or de-identify your personal information within a commercially reasonable period (generally within ninety (90) days), except that we may retain information (a) in the safety and enforcement records described above; (b) as needed to comply with legal obligations, resolve disputes, respond to legal process, enforce our agreements, or establish, exercise, or defend legal claims; (c) in routine backup systems for up to ninety (90) days until those backups are cycled; and (d) as aggregated or de-identified data, indefinitely.
Withdrawn or declined trainer applications: uploaded certification and insurance documents are deleted within ninety (90) days.

Where retention is no longer necessary for these purposes, we delete or de-identify the information.

6. Cookies and Analytics

We use cookies and similar technologies that are necessary to operate the Service (such as keeping you logged in and securing your session), to remember preferences, and to understand how the Service is used so we can improve it. You can control cookies through your browser settings; disabling essential cookies may prevent the Service from working. We use third-party analytics and error-monitoring providers — including Google Analytics and Sentry — which may collect device and usage information on our behalf under contractual limits. For information about how Google uses data from sites that use its services, and available opt-outs, visit https://policies.google.com/technologies/partner-sites.

7. Your Rights and Choices

Account tools. You can access, update, and correct your profile information, and download a copy of your data or delete your account, at any time from your profile settings.

State privacy rights. Depending on where you live (including California, Colorado, Connecticut, Virginia, Texas, Oregon, Montana, and a growing number of other U.S. states with comprehensive privacy laws), you may have the right to: (a) confirm whether we process your personal information and access it; (b) correct inaccuracies; (c) delete personal information; (d) obtain a portable copy; (e) opt out of targeted advertising, "sales" of personal information, and certain profiling (as noted above, we do not sell personal information or use it for targeted advertising); and (f) limit or withdraw consent for certain uses of sensitive information. You may exercise these rights through your account settings or by contacting us at our legal inbox (the address is shown at the end of this page). We will verify your request using information associated with your account, and you may use an authorized agent where the law allows. We may decline or limit a request where permitted by applicable law, including where a statutory exception applies or where we cannot verify your identity. We will not discriminate against you for exercising your rights. If we decline a request, you may appeal by replying to our decision, and if your appeal is denied you may contact your state Attorney General.

Consumer health data. Some information we process — such as workout preferences, training logs, and fitness goals — may be considered "consumer health data" under the laws of certain states (such as Washington's My Health My Data Act). Where those laws apply, we collect and share such data only as necessary to provide the Service you request or with your consent, and you may have additional rights to access, delete, and withdraw consent for that data, exercisable by writing to our legal inbox.

Marketing choices. You may opt out of marketing emails by using the unsubscribe link in any marketing message. We will still send administrative and safety messages.

European Economic Area / United Kingdom. If you use the Service from the EEA or UK, we process your personal data as a controller on the following legal bases: performance of our contract with you (providing the Service), our legitimate interests (such as safety, security, enforcement, and service improvement), compliance with legal obligations, and your consent where required. You may have rights to access, rectify, erase, restrict, and port your data, to object to processing based on legitimate interests, to withdraw consent, and to lodge a complaint with your supervisory authority.

8. Photos and Biometric Information

Photos you upload are displayed to eligible members and used for moderation and safety purposes. We do not use facial recognition and do not create, collect, or derive biometric identifiers or biometric templates (such as faceprints) from your photos.

9. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information, consistent with applicable law (including the Massachusetts data-security regulations, 201 CMR 17.00). However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your password confidential. If a breach affecting your personal information occurs, we will notify you and regulators as required by applicable law.

10. Children

The Service is not directed to, and may not be used by, anyone under 18. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from a person under 18, we will delete it and terminate the associated account. If you believe a minor is using the Service, contact us at our legal inbox.

11. International Users

The Service is operated from the United States, and information is processed and stored in the United States and in other countries where our service providers operate, which may have data-protection laws different from those of your jurisdiction.

11A. United Kingdom and European Economic Area

This Section applies if you are in the United Kingdom or the European Economic Area. It adds to the rest of this Policy and governs where the two differ.

Who is responsible for your data. Supercomplicated LLC, a Delaware limited liability company with its address at PO Box 43, Winchester, MA 01890, United States, is the controller of the personal data described in this Policy. You can reach us at our legal inbox, shown at the end of this page.

Why we are allowed to use your data. We rely on the following lawful bases under Article 6:

Contract — creating and running your account, showing your profile to members of the gyms you list, and enabling sessions and messages between members. We cannot provide the Service without this.
Legitimate interests — keeping the Service secure; preventing fraud, abuse, and banned accounts from returning; moderating content and investigating reports; analysing and improving the Service and developing features; producing aggregated statistics; and establishing, exercising or defending legal claims.
Contract and legitimate interests — sending administrative, security and safety messages.
Consent — sending marketing messages, and selecting the promotions, offers and advertising you see. You may withdraw consent at any time.
Legal obligation — keeping records we are required to keep, and responding to legal process.

Where we rely on legitimate interests, we have considered your interests and rights and concluded ours do not override them. You may object at any time — see your rights below — and we will stop unless we have compelling grounds that override your objection, or we need the data to establish, exercise or defend legal claims.

We do not collect data about your health. HeyFitt asks for no health information and has no field for one: no injuries, conditions, medications, body measurements, heart rate, or medical history. What you log is the exercise, the sets, the reps, and the weight on the bar — which is a record of what you lifted, not a record of your body. Together with the gyms you list and the hours you train, that is lifestyle information, and we do not treat it as special category data under Article 9.

If that ever changes we will ask first. Should we introduce a feature that collects information about your health, we will obtain your explicit consent before collecting it, say so in this Policy before we start, and never use it to select advertising or offers without a separate explicit consent.

Health information your trainer records is your trainer's, not ours. If you work with a trainer through HeyFitt for Trainers, they may record intake answers, injuries or body metrics about you. Your trainer is the controller of that information and we process it only on their instructions. Exercise your rights over it with them; our Trainer Privacy Policy sets out our role, and its Section 5 is the data processing agreement that governs it.

Where your data goes. HeyFitt is operated by a United States company, and the personal data described in this Policy is collected by us directly and held in the United States. The United States is not the subject of a UK or EU adequacy decision.

Where we pass data to service providers who process it for us — our hosting, database, email and payment providers, listed in Section 4 — we engage them under written contracts that meet Article 28 and, where those providers process data outside the UK or EEA, that incorporate the Standard Contractual Clauses and the UK International Data Transfer Addendum. You may ask us which safeguards apply to a particular provider by writing to our legal inbox.

We do not claim an adequacy decision or certification we do not hold, and we will say so in this Policy if that changes.

How long we keep it. Section 5 sets out our retention periods. In short: while your account is active; ninety (90) days after you delete it, for most data; up to five (5) years for safety, moderation and enforcement records; longer where the law requires it or where we need it to establish, exercise or defend legal claims. Aggregated and anonymised data, which no longer identifies you, is kept indefinitely.

Your rights. You have the right to:

Be told what we do with your data — this Policy;
Access your data and get a copy of it — available immediately at any time from your profile, which downloads a machine-readable JSON file;
Correct data that is wrong or incomplete — through your profile settings, or by asking us;
Erase your data — available at any time from your profile. Deletion runs after a thirty (30) day period during which you can change your mind, which exists to protect against accidental and coerced deletion. Section 5 describes the narrow categories we keep afterwards and why;
Restrict how we use your data, while a dispute about its accuracy or our grounds is resolved;
Object to processing we base on legitimate interests, and — absolutely, with no exception and no reason required — to direct marketing;
Port your data to another service, in a structured, commonly used, machine-readable format — the same export as (2);
Withdraw consent at any time, where we relied on it;
Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not make such decisions.

Exercising any of these is free and we will respond within one month. We may extend that by two further months for complex requests, and we will tell you if we do. We may ask you to verify your identity.

Complaining. If you think we have handled your data wrongly, please tell us first — we would rather fix it. You also have the right to complain to a supervisory authority at any time, and you do not have to come to us first. In the United Kingdom that is the Information Commissioner's Office (ico.org.uk, 0303 123 1113). In the EEA it is the authority in the country where you live, work, or where you think the problem happened.

Automated decisions and profiling. We rank and order what you see — which members appear on your gym's floor, and in what order — using the information described in Section 1. This is not a decision producing legal or similarly significant effects about you, and it does not decide whether you may use the Service.

12. Third-Party Links

The Service may link to third-party websites, including gym websites. This Policy does not apply to third-party sites, and we are not responsible for their privacy practices.

13. Google Account Data

Where you choose to import a client list from Google Sheets, HeyFitt requests access to your Google account under the `drive.file` scope. That scope is per-file: it grants access only to the specific file you select in Google's own file picker, and gives us no ability to see, list, or open anything else in your Google Drive.

What we do with it:

Your browser exports the selected spreadsheet once, at the moment you import it, and sends us its contents as a file — the same way it would send a spreadsheet you had saved to your computer. We obtain the names and email addresses it contains, and nothing else about your Google account.
We use that information for one purpose: to create the client records you confirm on the review step, and to send the invitations you ask us to send.
The access token Google issues stays in your browser. It is used there to export the one file you selected, and it is never sent to our servers — so we hold no credential for your Google account and no ongoing connection to it. A later import requires you to select a file and grant access again.
We do not retain a copy of the spreadsheet. What persists is only the client records you chose to create, which are governed by the rest of this Policy.
We do not sell this information, use it for advertising, or use it to train generalised artificial-intelligence or machine-learning models.
We do not transfer it to others except as described in Section 4, and never for advertising purposes.

You can review and revoke HeyFitt's access to your Google account at any time at https://myaccount.google.com/permissions.

HeyFitt's use and transfer of information received from Google APIs to any other application adheres to the Google API Services User Data Policy, including the Limited Use requirements.

14. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will provide notice (for example, by email or in-product notice) and update the effective date above. Your continued use of the Service after changes take effect constitutes acknowledgment of the updated Policy.

15. Contact Us

Supercomplicated LLC (operator of HeyFitt)

PO Box 43, Winchester, MA 01890

Our legal inbox The HeyFitt legal inbox address, shown as an image so it cannot be harvested

Shown as an image, not as text, to keep it out of the hands of address harvesters. Type it into your mail client to reach us.