Privacy Policy
Last updated: October 13, 2026
Who we are
Whisfit is run by Equival, based in Israel ("we", "us"). This policy covers the Whisfit website, the web app and the iOS app. We decide how your data is used, so we are its "controller". Contact us about privacy, including any request below, at [email protected].
What we collect
Account details: your name and email from Google or Sign in with Apple. Apple may give us a private relay address instead of your real email. Health and fitness data you add: for example weight, body measurements, height, date of birth, sex, meals, workouts, check-ins, notes and progress photos. From Apple Health, only if you allow it: steps, weight, active energy and workouts. With your permission, the app also saves workouts and weight you log back to Apple Health. From a coach, only if you allow it: entries your coach adds to your account. Technical data: your account ID, device and app information, crash and error reports, IP address, time zone, a notification token if you turn on notifications in the iOS app, and how you found us (for example the link you used). Usage analytics, only if you turn them on. Messages you send us. Giving us data is voluntary, but without your account details and health data we can't provide the app.
How we use it and why
We use your data to provide the app and its features (our contract with you, and for health data your explicit consent); to share data with a coach or an AI assistant you choose (your explicit consent); to keep the service secure, prevent abuse and fix bugs (our legitimate interest in a safe, working service); to learn how people find Whisfit (our legitimate interest) and how they use it (your consent, if you turn on usage analytics); to send account and service email (our contract with you, and our legitimate interest in helping you use the app); to send marketing email, only if you opted in (your consent); and to meet legal duties and defend legal claims (legal obligation, and our legitimate interest). The reasons in brackets are the legal bases that EU and UK law ask us to state. We don't sell your personal data, and we don't use your health data for advertising. We don't make decisions about you based only on automated processing that have legal or similarly significant effects on you.
Who we share it with
Service providers that host, store and secure data, send email, deliver notifications, handle sign-in, and report crashes and, if you turn it on, usage. They may use your data only to provide their services to us, and must protect it at least as well as this policy does. Ask us for the current list. Analytics: if you turn on usage analytics (on the website and web app, by accepting the cookie banner), our analytics providers record how you use the website and app, including session recordings. What you type is always masked, and in the apps your data and images are masked too. On the website and web app this includes Google Analytics, and Google may also use this data as its own privacy policy describes. Until the iOS app's next update, the version now in the App Store sends these analytics, under the same off-by-default setting, to Microsoft Clarity instead. Its recordings may not be masked, so they can show what is on your screen, including health data, and Microsoft may also use this data as its own privacy policy describes. Coaches you choose: a coach sees only what you choose to share and can add entries only if you allow it. You can change or stop this at any time in Settings. We don't vet coaches, and a coach is responsible for any copy they make outside Whisfit. AI assistants you connect: if you connect an AI assistant (such as Claude or ChatGPT) and approve its access, we send it the data it asks for to answer you, which can include health data. That provider's own terms and privacy policy apply. If you are a coach, the assistant can also see data your clients share with you. Disconnect it at any time to stop this. Legal and business reasons: when the law requires it, to protect rights and safety, or as part of a merger, sale or reorganization of our business, under this policy.
Where your data is processed
We store your account data in the EU. Our providers may process data in other countries, including the United States and Israel. Where the law requires it, we use safeguards such as the European Commission's standard contractual clauses. Data held in another country can be accessed by its authorities under its laws.
How long we keep it
We keep your data while your account is open. When you delete your account, we delete your data from our live systems. Copies in backups, logs and our service providers' records are deleted later, on their own schedules. We keep some limited records longer only when needed for security, to meet a legal duty, or to handle a dispute.
Your choices and rights
You can delete your account and its data at any time in Settings, and delete single entries. You can turn usage analytics and crash reports on or off in Settings, change what you share with a coach in Settings, and stop service or marketing email with the unsubscribe link in those emails. You can withdraw your health data consent by deleting your account. Withdrawing consent doesn't affect what happened before. You can ask us at [email protected] to access, copy, correct or delete your data, or to object to or restrict its use. We may need to confirm your identity. In the EU, EEA and UK you also have the right to data portability and to complain to your data protection authority. In Israel you have the rights in the Protection of Privacy Law, 5741-1981, including access and correction, and you may complain to the Privacy Protection Authority. In the US, depending on your state, you may have the right to access, correct, delete or get a copy of your data. If we deny a request, you can appeal by replying to our answer, and if the appeal is denied, you can contact your state attorney general. We will not treat you differently for using these rights. Residents of Washington, Nevada and Connecticut: see our Consumer Health Data Privacy Policy.
Consumer Health Data Privacy PolicyCookies and similar technology
The website and web app use analytics cookies and similar browser storage only if you accept them. The cookies can last up to 2 years, and an analytics identifier in your browser's local storage stays until you withdraw consent or clear your browser data. Change your choice at any time from "Privacy choices" on the website or "Share usage analytics" in the web app's Settings. Where the law allows, we also use a cookie-free page counter that does not identify you. If you turn on analytics, our analytics providers may collect information about your use of the website and app over time. We don't respond to browser "Do Not Track" signals.
Age
Whisfit is for adults 18 and over. We don't knowingly collect data from anyone under 18. If we learn that we have, we restrict or delete the account. Contact us if you believe a minor is using Whisfit.
Security
We protect your data with reasonable technical and organizational measures, including encryption in transit. No system is completely secure.
Changes
We may update this policy. We will post the new version here with a new date. If a change is material, we will also tell you in the app or by email before it takes effect.
Contact
Questions or requests: [email protected].