Privacy policy

1. Who we are

DinFit is published by Fantastic Online Stores Pty Ltd (ABN 39 655 964 784), a company registered in Australia. We decide how and why your personal information is used, which makes us its controller.

Our postal address is 16 Etheridge Ln, Craigieburn VIC 3064, Australia. The quickest way to reach us is by email, at hello@dinfit.app.

In this policy, "we" and "us" mean Fantastic Online Stores Pty Ltd, and "DinFit" means the app, this website and its emails.

2. At a glance

• The app works without giving us your name or email address. It creates an account for you anonymously, and linking Apple or Google is optional.
• Information about your body and your faith is collected only if you choose to enter it, and it is used only to run the features that need it.
• We do not sell personal information, show advertising, or track you across other companies' apps and websites.
• You can export or delete your DinFit data from the app, and write to us about anything else.
• This website sets no cookies and runs no advertising scripts, and its pages send nothing to anyone but us. The free plan's pages count how many people reach each question, with nothing that could tell one visit from another.

3. The DinFit app

This is what the app collects, and why.

Your account

When you first open the app, it creates an account with a random identifier so your check-ins can be saved and synced. You do not give a name or an email address to do this.

If you choose to link Sign in with Apple or Google, so your garden can follow you to another phone, our database provider stores the account identifier and email address that Apple or Google share, along with any basic profile details they include with the sign-in. The app shows you the email address and uses nothing else from it.

Your profile

What you enter while setting up or in Settings: an optional first name, your goal and pace, the days you train, when your week starts and the units you use, and, unless you skip that step, your sex, birth year, height and weight. The app calculates daily targets from these and stores them with your profile.

Faith settings

If you turn the faith features on: your prayer time calculation method and Asr setting, a hadith setting, whether you fast, and the place used for prayer times with its coordinates and time zone. You pick the place from a list of towns or type coordinates yourself; the app never asks for your device's location. Prayer times are calculated on your phone.

Check-ins and feedback

Each check-in records the day, the pillar (training, nutrition, sleep, or prayer or recharge) and whether it was done. If you send feedback from the app, we store your message, its type and the app version.

Subscriptions

If you subscribe, Apple takes the payment and we never see your card details. RevenueCat, our subscription service, receives your account identifier and the App Store information about your subscription, so the app knows what you have access to.

Usage analytics

To understand how the app is used, it sends events to PostHog: which setup screens were completed, what the subscription screen showed and what happened there, your answer to "How did you find DinFit?", and when the app is installed, updated, opened or closed. The setup screens that only some people see send nothing at all, so these events cannot show whether you turned the faith features on. Events carry an analytics identifier that is not linked to your account, with your device model, operating system, app version, language and time zone. Values about your body and your faith are removed before an event is sent, and no screen recordings are made.

Analytics is on unless you turn it off, in Settings, then Privacy and data, then Help improve DinFit.

Crash reports

When the app fails, it sends a report to Sentry with the error, where in the app it happened, and your device model, operating system and app version. Reports are not linked to your account. A sample of sessions also sends performance timings.

On your phone

The app keeps a copy of your profile, check-ins and settings on your phone so it works without a connection, and keeps your sign-in in the iPhone keychain. Reminders are scheduled on your phone; we do not send push notifications. Share images are made on your phone and leave it only if you share them.

What the app does not collect

The app does not read Apple Health, your contacts, photos, camera or microphone. It uses no advertising identifier and no advertising or attribution tools, and it sends nothing about you to an artificial intelligence service.

Why we use it, and our legal bases in the EEA and the UK

4. Health and religious information

Some of what the app can hold is sensitive. Your height and weight, and the targets calculated from them, can be health information, and your faith settings reveal religious belief.

• It is optional. You can skip the step that asks about your body, and the faith features are off unless you turn them on.
• It is stored in your account so it can follow you to a new phone, and used only to run the features that need it.
• It is never used for advertising, never sold and never put on a share image.
• We use it on the basis of your explicit consent, and the app asks for it on the screens that collect it: the screen asking about your body names what it holds as health information, and the screen asking whether you want your prayers in the app names its answer as religious information, each saying what agreeing permits. Skipping the body step, or leaving the faith features off, is a complete answer. Turning the faith features off stops the app using them. To remove what is already stored, delete your account in the app or write to us.

The free plan's health and religious questions are described under The free plan, below: each says so on its screen, and its answers are deleted once your plan is sent.

5. This website

dinfit.app is hosted by Vercel. To deliver a page, Vercel receives your IP address, your browser's details and the address of the page, and keeps request logs for up to 30 days. Our server code runs in Vercel's Dublin region, and pages are served from the part of Vercel's network nearest to you.

The website sets no cookies and runs no advertising scripts, and no page on it sends anything to another company. Its fonts are served from dinfit.app itself, so loading a page does not contact Google. The free plan's pages count which questions people reach, as described under The free plan.

Our TikTok profile links to dinfit.app/tt, which sends you straight on to the App Store. Each visit to that link adds one to a daily count that holds nothing about you: no cookie, no identifier, nothing stored in your browser. As on the rest of the site, a scrambled form of your IP address is used for 2 days only to limit repeated requests.

If you email us, your message is handled by our email service, Microsoft 365 provided through GoDaddy. We keep it for as long as we need it to help you, and delete it when you ask.

6. The free plan

The free plan is a personalised training and eating plan, sent by email after a short set of questions. This is how it works:

• You answer one question at a time: your age; whether any of four health situations applies to you; which plan you want and your goal; for an eating plan, your sex, height, weight, how active your week is and how you eat; for a training plan, your training days, experience, session length, equipment and preferred time; whether your plan should work around prayer or fasting; then your first name and email address.
• If you are under 18, or one of the health situations applies to you, no plan is built and your answers are not sent to us.
• Until you send them, your answers are kept only in that browser tab. They are cleared when you send them, and when you close the tab.
• When you send them, your answers, name and address are encrypted and stored for up to 7 days, in a form we can open only with the link in the email we then send you. That email asks you to confirm your address. Nothing else is sent to an address that has not been confirmed.
• When you tap Send my plan on the page that link opens, we build your plan from your answers, email it to you as a PDF attached to that email, and delete your answers. If you never confirm, everything you sent is deleted after 7 days.
• We keep your email address, first name, where you signed up (the community link you came from, if any; for a link in one of our articles, only that it was an article, not which one), the version of the consent you gave and when, when you confirmed, your time zone and whether you asked for news about the app. We never keep your answers, and we never keep your plan.
• The plan comes with two short notes on using it, three days and five days later. News about the DinFit app is sent seven days later, and only if you tick the box for it.
• Those later emails are handed to our email service at the moment your plan is sent, to be sent on those days. We keep a scrambled form of your address with each one, so that we can take them back.
• Every email has a one-click unsubscribe link. When you unsubscribe, we delete your details, take back anything not yet sent, and keep only a one-way scrambled form of your address, with the version and dates of the consent you had given, so that we never email you again and can show that you had agreed.
• If an email to you permanently fails, or you report one as spam, we stop in the same way and keep the same scrambled record. We are told this by our email service, which tells us the address and nothing else about you.
• Records of which emails were sent, and of any still to be sent, with a scrambled form of the address, are kept for 90 days.

Health and religious answers

Three questions reveal health or religious information: whether a health situation applies to you, your height and weight, and whether your plan should work around prayer. Each says so on its screen, and answering it is your explicit consent to the use it names. They are used to decide whether a plan suits you and to build it, and they are deleted as described above.

What we count

When a plan is sent, we add one to a monthly count for each answer you chose, so we can see which plans, goals and features people want. The counts are not linked to your name or address. We look at them only for past months, and only where at least 10 people chose the same answer. Your prayer answer is counted, as its screen says. Your height, weight, health answer and diet are never counted. After your plan is sent you can also answer one optional question about what would help you most next, which is counted in the same way. We also count which question screens were reached, which is how we see where people stop. Those counts hold no answers, so we read them as they come in.

How we see where people stop

The free plan's pages send us, and nobody else, the list of question screens you reached. It is sent once, when you leave the page, and it holds nothing but the names of those screens. There is no cookie, nothing is stored in your browser, and there is no code or identifier of any kind: we cannot tell one visit from another, or today's visit from yesterday's. All we do with it is add one to a monthly count for each screen.

Our server also counts, in PostHog in its EU region, each confirmation email and plan sent and each unsubscribe, with the link you came from (for one of our articles, which article and where on the page) and the country your connection came from, and nothing that identifies you. Those counts are made by our server rather than by your browser, and PostHog receives nothing from the pages you visit.

Why we use it, and our legal bases in the EEA and the UK

The free plan uses Supabase (our database, in Ireland), Resend (to send the emails, in the United States), Vercel (hosting) and PostHog in its EU region.

7. Who else handles your information

We use these providers to run DinFit. They handle personal information on our behalf and only for the purposes in this policy, except Apple and Google, which handle sign-in and payments under their own privacy policies.

Every service that receives a request from the app or from your browser also receives the IP address it came from.

We may also disclose information when the law requires it, to protect someone's safety or our rights, or as part of selling or reorganising our business. In that last case, we will tell you before your information becomes subject to a different policy.

8. International transfers

We are based in Australia, and our providers process information in the United States, Ireland, Germany and Singapore. Information from the European Economic Area or the United Kingdom is transferred under the safeguard each provider has in place:

• Supabase, RevenueCat and Vercel: the European Commission's Standard Contractual Clauses, with the UK's addendum, in their data processing terms.
• PostHog, Sentry, Vercel, Resend and GoDaddy: certification under the EU-U.S. Data Privacy Framework and its UK extension.

For people in Australia, we take reasonable steps to make sure overseas recipients handle personal information in line with the Australian Privacy Principles, and we remain accountable for how they do.

9. How long we keep it

10. Deleting and exporting your data

Delete your account

In the app, go to Settings, then Privacy and data, then Delete my account. This permanently deletes your profile, faith settings, check-ins and feedback from our database and from your phone, deletes your account, deletes your subscription record at RevenueCat, and revokes Sign in with Apple if you used it.

It does not reach:

• Usage analytics and crash reports, which are not linked to your account and expire as described above. Deleting your account starts a new analytics identifier, so nothing counted afterwards can be joined to what came before, but events already sent cannot be called back.
• The subscription itself, which keeps renewing until you cancel it in the App Store.

Export your data

In the app, go to Settings, then Privacy and data, then Export my data. You receive a file, in JSON format, with your profile, your faith settings, your check-ins and any feedback you sent. For a copy of anything else we hold, write to us.

11. Your rights

Wherever you live, you can ask us to:

• give you a copy of the personal information we hold about you;
• correct it;
• delete it;
• give it to you in a portable format;
• stop using it for a purpose you object to.

You can withdraw consent at any time, as easily as you gave it, without affecting what happened before. Write to hello@dinfit.app. We will check that the request comes from you, and we reply within 30 days.

12. If you are in the EEA or the UK

The GDPR and the UK GDPR give you the rights above. They also give you the right to restrict how we use your information, and to object to anything we do on the basis of our legitimate interests, including usage analytics and crash reports.

You can complain to a data protection authority, such as the one where you live. The European Data Protection Board lists them, and in the UK it is the Information Commissioner's Office. We would welcome the chance to help first.

13. If you are in Australia

We handle personal information in line with the Australian Privacy Principles.

• You can use the app without identifying yourself: it works with an anonymous account, and a name is optional.
• You can ask for access to your personal information, or for it to be corrected. We respond within 30 days, and if we refuse, we explain why and how to complain.
• To complain, write to us first. We acknowledge a complaint within 7 days and aim to resolve it within 30.
• If you are not satisfied, you can complain to the Office of the Australian Information Commissioner: phone 1300 363 992, or write to GPO Box 5288, Sydney NSW 2001.

14. If you are in the United States

We do not sell personal information or share it for cross-context behavioural advertising, and we have not done so in the past 12 months.

In the past 12 months we have collected: identifiers (an account identifier, an email address if you link Apple or Google or use the free plan, and an analytics identifier); commercial information (your subscription); internet or other electronic activity (usage analytics, crash reports and website request logs); inferences (the targets calculated from your profile); and sensitive personal information you choose to give (health information, religious beliefs, and a place you choose for prayer times). Where each comes from, why it is used and how long it is kept are described above.

We use sensitive personal information only to provide the features you give it for. Residents of California and of other states with privacy laws can ask to know, access, correct, delete or take a copy of their personal information, and will not be treated differently for asking. Write to us; an authorised agent may write on your behalf.

This website does not track visitors across other websites, and the free plan's analytics tell visits apart for a day at most, without cookies, so there is no Do Not Track signal for it to respond to.

15. Children

DinFit is for people aged 16 and over, and is not directed at children. If we learn that someone under 16 has given us personal information, we delete it. If you think that has happened, write to us. The free plan is written for adults: if you tell it you are under 18, no plan is built and your answers are not sent to us.

16. Automated calculations

The app calculates daily targets from your profile, and prayer times from your faith settings, using fixed formulas. The free plan is built from your answers by fixed rules, and is not built if you are under 18 or a health situation applies to you, which points you to a qualified professional instead. These are estimates to help you plan. We make no automated decisions that have legal or similarly significant effects on you.

17. Security

• Information travels between the app, the website and our providers over encrypted connections.
• Our databases are encrypted at rest, and their access rules let each account read only its own rows.
• Your sign-in is kept in the iPhone keychain.
• Free plan answers are encrypted with a key that also needs the link in the email we send you.
• We collect only what the features need.

18. If something goes wrong

If a breach of personal information is likely to put your rights at risk, we will notify the relevant data protection authority within 72 hours where the GDPR requires it, and tell you without undue delay, where we have a way to reach you, if the risk to you is high. If an eligible data breach is likely to cause serious harm, we will notify the Office of the Australian Information Commissioner and the people affected.

19. Changes to this policy

When DinFit changes how it handles personal information, we update this policy and the date at the top. If a change matters to you, we will also tell you in the app or by email where we can, before it applies.

20. Contact

Fantastic Online Stores Pty Ltd, ABN 39 655 964 784, 16 Etheridge Ln, Craigieburn VIC 3064, Australia.

Email hello@dinfit.app. For a privacy request, it helps to put "Privacy request" in the subject line.