firmo.Privacy Policy
Firmo is a workout tracker built to keep your training data yours. This policy explains what data Firmo handles, where it is stored and the choices you have. It applies to the Firmo app and website.
In short
- Without signing in, your training data stays on your device. It is not sent to us.
- If you turn on cloud sync, we store a copy of your training data and basic Google account details so your devices stay in step.
- No ads, no analytics or tracking, and we never sell or share your data for marketing.
- You can export your data at any time and delete your account and cloud data from Settings.
1. Data stored on your device
Firmo saves your routines, workouts, sets, notes, body-weight entries, goals and preferences in your browser's storage (IndexedDB) on your device. The app also keeps an offline copy of its own files. This data stays on your device unless you turn on cloud sync or export a backup yourself. Clearing your browser's site data removes it.
2. Data we receive when you use cloud sync
Cloud sync is optional. When you choose Continue with Google, we receive and store:
- Account details from Google: your name, email address, profile picture link and Google account identifier. We request only basic profile and email access.
- Sign-in records: the tokens Google issues to complete sign-in, and session records that include the IP address and browser details of the device that signed in. These keep your account secure.
- Your training data: copies of your routines, workouts, notes, body-weight entries, custom exercises, preferences and any workout in progress, with the time each was last changed.
Body weight and training records can reveal information about your health. We process them only because you chose to sync them, and only to provide sync.
Notifications
Rest-timer notifications are created on your device and send nothing to us. If you turn on training-day reminders, your browser gives us a push subscription (a delivery address and keys issued by your browser's push service, such as Google, Apple, Mozilla or Microsoft), and we store it with the weekdays you train and your time zone. No name, account or workout details are attached. Turning reminders off deletes the subscription; we also delete it when the push service reports it has expired.
3. How we use your data
We use your data only to sign you in, store and sync your training data between your devices, keep the service secure and respond to your requests. We do not use it for advertising, profiling, selling, or training AI models.
4. Service providers
We rely on a small number of providers to run cloud sync. They process data on our behalf and only to provide their service:
- Hosting: currently Vercel, which runs the website and receives standard request information such as IP addresses in its logs.
- Database: currently Neon, which stores account and synced data.
- Sign-in: Google, under Google's own privacy policy.
- Notifications: your browser's push service (Google, Apple, Mozilla or Microsoft) delivers reminders; the message contains only a generic training-day prompt.
These providers may store or process data outside India, including in the United States and Singapore. If we change providers, for example to our own servers, we will update this policy.
5. Cookies and local storage
Firmo uses only what it needs to work: a secure sign-in cookie while you are signed in, short-lived cookies during Google sign-in, and browser storage for your data and offline use. We do not use advertising or analytics cookies.
6. How long we keep data
Synced data and your account are kept until you delete them. Sign-in sessions expire after 90 days without use. When you delete your account, your synced records, sessions, linked Google sign-in and account are removed from our database immediately; copies in our database provider's backups are overwritten within their standard retention period. Deleting your account does not remove data stored on your devices; you can remove it from Settings.
7. Your choices and rights
Subject to applicable law, including India's Digital Personal Data Protection Act, 2023 and, where it applies, the EU and UK GDPR, you can:
- Access and take your data: Settings > Export backup downloads everything as a file.
- Correct it: edit any record in the app.
- Erase it: Settings > Cloud sync > Delete account and cloud data.
- Withdraw consent: sign out or delete your account. Firmo keeps working on your device.
- Raise a concern: contact us at firmo.support@gmail.com. We aim to respond within 30 days. You may also complain to your data protection authority.
8. Children
Cloud sync is intended for people aged 18 or over. If you are under 18, use cloud sync only with the consent of a parent or guardian. If you believe a child has signed in without consent, contact us and we will delete the account.
9. Security
Connections are encrypted with HTTPS, sign-in cookies are signed, and each account can access only its own data. No system is perfectly secure, so keep your Google account protected and export backups regularly.
10. Changes to this policy
We will update this page when our practices change and revise the effective date above. For significant changes, we will also let signed-in users know in the app.
11. Contact
Questions or requests about privacy: firmo.support@gmail.com.