Privacy policy

1. Who we are

DinFit is published by Fantastic Online Stores Pty Ltd (ABN 39 655 964 784), a company registered in Australia. We decide how and why your personal information is used, which makes us its controller.

Our postal address is 16 Etheridge Ln, Craigieburn VIC 3064, Australia. The quickest way to reach us is by email, at hello@dinfit.app.

In this policy, "we" and "us" mean Fantastic Online Stores Pty Ltd, and "DinFit" means the app, this website and its emails.

2. At a glance

• The app works without giving us your name or email address. It creates an account for you anonymously, and linking Apple or Google is optional.
• Information about your body and your faith is collected only if you choose to enter it, and it is used only to run the features that need it.
• We do not sell personal information, show advertising, or track you across other companies' apps and websites.
• You can export or delete your DinFit data from the app, and write to us about anything else.
• This website sets no cookies and runs no analytics or advertising scripts.

3. The DinFit app

This is what the app collects, and why.

Your account

When you first open the app, it creates an account with a random identifier so your check-ins can be saved and synced. You do not give a name or an email address to do this.

If you choose to link Sign in with Apple or Google, so your garden can follow you to another phone, our database provider stores the account identifier and email address that Apple or Google share, along with any basic profile details they include with the sign-in. The app shows you the email address and uses nothing else from it.

Your profile

What you enter while setting up or in Settings: an optional first name, your goal and pace, the days you train, when your week starts and the units you use, and, unless you skip that step, your sex, birth year, height and weight. The app calculates daily targets from these and stores them with your profile.

Faith settings

If you turn the faith features on: your prayer time calculation method and Asr setting, a hadith setting, whether you fast, and the place used for prayer times with its coordinates and time zone. You pick the place from a list of towns or type coordinates yourself; the app never asks for your device's location. Prayer times are calculated on your phone.

Check-ins and feedback

Each check-in records the day, the pillar (training, nutrition, sleep, or prayer or recharge) and whether it was done. If you send feedback from the app, we store your message, its type and the app version.

Subscriptions

If you subscribe, Apple takes the payment and we never see your card details. RevenueCat, our subscription service, receives your account identifier and the App Store information about your subscription, so the app knows what you have access to.

Usage analytics

To understand how the app is used, it sends events to PostHog: which setup screens were completed, what the subscription screen showed and what happened there, your answer to "How did you find DinFit?", and when the app is installed, updated, opened or closed. Events carry an analytics identifier that is not linked to your account, with your device model, operating system, app version, language and time zone. Values about your body and your faith are removed before an event is sent, and no screen recordings are made.

Analytics is on unless you turn it off, in Settings, then Privacy and data, then Help improve DinFit.

Crash reports

When the app fails, it sends a report to Sentry with the error, where in the app it happened, and your device model, operating system and app version. Reports are not linked to your account. A sample of sessions also sends performance timings.

On your phone

The app keeps a copy of your profile, check-ins and settings on your phone so it works without a connection, and keeps your sign-in in the iPhone keychain. Reminders are scheduled on your phone; we do not send push notifications. Share images are made on your phone and leave it only if you share them.

What the app does not collect

The app does not read Apple Health, your contacts, photos, camera or microphone. It uses no advertising identifier and no advertising or attribution tools, and it sends nothing about you to an artificial intelligence service.

Why we use it, and our legal bases in the EEA and the UK

4. Health and religious information

Some of what the app can hold is sensitive. Your height and weight, and the targets calculated from them, can be health information, and your faith settings reveal religious belief.

• It is optional. You can skip the step that asks about your body, and the faith features are off unless you turn them on.
• It is stored in your account so it can follow you to a new phone, and used only to run the features that need it.
• It is never used for advertising, never sold and never put on a share image.
• We use it on the basis of your explicit consent, which you give by entering it. Turning the faith features off stops the app using them. To remove what is already stored, delete your account in the app or write to us.

One limit you should know about: analytics events record which setup screens were completed, and the prayer screens appear only when the faith features are on, so those events can show that they were turned on. They are not linked to your account, and you can switch analytics off.

5. This website

dinfit.app is hosted by Vercel. To deliver a page, Vercel receives your IP address, your browser's details and the address of the page, and keeps request logs for up to 30 days. Our server code runs in Vercel's Dublin region, and pages are served from the part of Vercel's network nearest to you.

The website sets no cookies and runs no analytics or advertising scripts. Its fonts are served from dinfit.app itself, so loading a page does not contact Google.

If you email us, your message is handled by our email service, Microsoft 365 provided through GoDaddy. We keep it for as long as we need it to help you, and delete it when you ask.

6. Email services that are not open yet

Nothing on dinfit.app collects an email address today. This section describes two services we plan to open, and we will update this policy, and its date, before either one does.

The first is a free, personalised training and nutrition plan, sent by email after a short set of questions. The second is a list for news about the DinFit app, including when it launches. When they open, they will work like this:

• You give your first name and email address. For the plan you also answer questions about your goal, your body, your training and, if you choose, prayer and fasting. The questions that reveal health or religious information will say so, and that the answer is not kept.
• We email you first to confirm your address. Nothing else is sent to an address that has not been confirmed.
• Your answers are used once, to build your plan. They are held encrypted only until you confirm, deleted when you do, and deleted after 7 days if you never do.
• We keep your email address, first name, where you signed up, the consent you gave and when, when you confirmed, your time zone and whether you are still subscribed. We never keep your answers.
• The plan comes with two short notes on using it. News about the DinFit app is sent only if you tick the box for it.
• Every email has a one-click unsubscribe link. When you unsubscribe, we keep only a one-way scrambled form of your address, so that we never email it again.
• Records of which emails were sent are kept for 90 days.

The plan and its two notes are a service you ask for, so we send them to perform that request (Article 6(1)(b)). News about the app is sent with your consent (Article 6(1)(a)). Answers that reveal health or religious information are used with your explicit consent (Article 9(2)(a)).

These services will use Supabase (our database, in Ireland), Resend (to send the emails), Vercel (hosting) and PostHog in its EU region, for anonymous counts of how far people get through the questions, with no email address, no answers and no cookies.

7. Who else handles your information

We use these providers to run DinFit. They handle personal information on our behalf and only for the purposes in this policy, except Apple and Google, which handle sign-in and payments under their own privacy policies.

Every service that receives a request from the app or from your browser also receives the IP address it came from.

We may also disclose information when the law requires it, to protect someone's safety or our rights, or as part of selling or reorganising our business. In that last case, we will tell you before your information becomes subject to a different policy.

8. International transfers

We are based in Australia, and our providers process information in the United States, Ireland, Germany and Singapore. Information from the European Economic Area or the United Kingdom is transferred under the safeguard each provider has in place:

• Supabase, RevenueCat and Vercel: the European Commission's Standard Contractual Clauses, with the UK's addendum, in their data processing terms.
• PostHog, Sentry, Vercel, Resend and GoDaddy: certification under the EU-U.S. Data Privacy Framework and its UK extension.

For people in Australia, we take reasonable steps to make sure overseas recipients handle personal information in line with the Australian Privacy Principles, and we remain accountable for how they do.

9. How long we keep it

10. Deleting and exporting your data

Delete your account

In the app, go to Settings, then Privacy and data, then Delete my account. This permanently deletes your profile, faith settings, check-ins and feedback from our database and from your phone, deletes your account, and revokes Sign in with Apple if you used it.

It does not reach:

• Usage analytics and crash reports, which are not linked to your account and expire as described above.
• Your subscription record at RevenueCat. Write to us and we will delete the record we can find for you.
• An anonymous account left behind on a phone where you signed in to an existing account. Write to us to have it deleted.
• The subscription itself, which keeps renewing until you cancel it in the App Store.

Export your data

In the app, go to Settings, then Privacy and data, then Export my data. You receive a file, in JSON format, with your profile, your check-ins and any feedback you sent; the hadith setting is not included yet. For a copy of anything else we hold, write to us.

11. Your rights

Wherever you live, you can ask us to:

• give you a copy of the personal information we hold about you;
• correct it;
• delete it;
• give it to you in a portable format;
• stop using it for a purpose you object to.

You can withdraw consent at any time, as easily as you gave it, without affecting what happened before. Write to hello@dinfit.app. We will check that the request comes from you, and we reply within 30 days.

12. If you are in the EEA or the UK

The GDPR and the UK GDPR give you the rights above. They also give you the right to restrict how we use your information, and to object to anything we do on the basis of our legitimate interests, including usage analytics and crash reports.

You can complain to a data protection authority, such as the one where you live. The European Data Protection Board lists them, and in the UK it is the Information Commissioner's Office. We would welcome the chance to help first.

13. If you are in Australia

We handle personal information in line with the Australian Privacy Principles.

• You can use the app without identifying yourself: it works with an anonymous account, and a name is optional.
• You can ask for access to your personal information, or for it to be corrected. We respond within 30 days, and if we refuse, we explain why and how to complain.
• To complain, write to us first. We acknowledge a complaint within 7 days and aim to resolve it within 30.
• If you are not satisfied, you can complain to the Office of the Australian Information Commissioner: phone 1300 363 992, or write to GPO Box 5288, Sydney NSW 2001.

14. If you are in the United States

We do not sell personal information or share it for cross-context behavioural advertising, and we have not done so in the past 12 months.

In the past 12 months we have collected: identifiers (an account identifier, an email address if you link Apple or Google, and an analytics identifier); commercial information (your subscription); internet or other electronic activity (usage analytics, crash reports and website request logs); inferences (the targets calculated from your profile); and sensitive personal information you choose to give (health information, religious beliefs, and a place you choose for prayer times). Where each comes from, why it is used and how long it is kept are described above.

We use sensitive personal information only to provide the features you give it for. Residents of California and of other states with privacy laws can ask to know, access, correct, delete or take a copy of their personal information, and will not be treated differently for asking. Write to us; an authorised agent may write on your behalf.

This website does not track visitors over time or across other websites, so there is no Do Not Track signal for it to respond to.

15. Children

DinFit is for people aged 16 and over, and is not directed at children. If we learn that someone under 16 has given us personal information, we delete it. If you think that has happened, write to us.

16. Automated calculations

The app calculates daily targets from your profile, and prayer times from your faith settings, using fixed formulas. These are estimates to help you plan. We make no automated decisions that have legal or similarly significant effects on you.

17. Security

• Information travels between the app, the website and our providers over encrypted connections.
• Our databases are encrypted at rest, and their access rules let each account read only its own rows.
• Your sign-in is kept in the iPhone keychain.
• We collect only what the features need.

18. If something goes wrong

If a breach of personal information is likely to put your rights at risk, we will notify the relevant data protection authority within 72 hours where the GDPR requires it, and tell you without undue delay, where we have a way to reach you, if the risk to you is high. If an eligible data breach is likely to cause serious harm, we will notify the Office of the Australian Information Commissioner and the people affected.

19. Changes to this policy

When DinFit changes how it handles personal information, we update this policy and the date at the top. The email services described above will be covered in full before they open. If a change matters to you, we will also tell you in the app or by email where we can, before it applies.

20. Contact

Fantastic Online Stores Pty Ltd, ABN 39 655 964 784, 16 Etheridge Ln, Craigieburn VIC 3064, Australia.

Email hello@dinfit.app. For a privacy request, it helps to put "Privacy request" in the subject line.