Privacy Policy

1. Who we are

Nostia Labs ("we", "us") operates Nostos Fit, a fitness and body progress app registered in the Netherlands. This policy explains what personal data we collect, why, how long we keep it, and your choices.

2. Data we collect

2.1 Account and identity

We collect your email address so you can sign in and recover your account. Your password is hashed by our auth provider, and we do not store plaintext passwords. Your display name is shown in your profile. If you set a social username it is used for friend discovery and compare features, and this is optional.

2.2 Profile and body metrics

Your gender and date of birth or age feed peer scoring, body metric formulas, and your profile. Your height and weight feed BMI, body metrics, and your workout and diet targets. Your fitness goal and experience level drive personalization and progression. One rep max (1RM) estimates per exercise drive workout XP, stats, and anticheat peer references. Tape style body measurements support progress tracking and body metrics. Your measurement units preference controls display and input formatting.

2.3 Body scan (optional, sensitive)

The 360° turntable capture is optional and not required to use the app. Before your first scan you must confirm you are 18 or older and consent to camera use in the capture flow.

The camera capture of your body powers segmentation, metrics, and optional display features such as the home turntable, muscle overlay, and workout volume comparisons. From it we derive estimates such as body fat %, skeletal muscle mass, circumferences, and posture and symmetry scores. Processed turntable images (WebP frames) are used for on device display and, when signed in, cloud backup.

On device processing: Pose and segmentation use MediaPipe on your phone. We do not upload raw camera frames to a server for inference.

Cloud storage: When signed in, processed turntable assets and session metadata are stored in Supabase Storage in the European Union (Ireland, eu west 1) under your account.

Social sharing: Your profile visibility is private by default. Body scan display images are shared only if you manually set visibility to friends only or public.

2.4 Activity and health

Workout logs (exercises, sets, reps, weight, RIR, session metadata) build your training history, XP, and stats. Diet logs (foods, macros, meal structure) support nutrition tracking and diet XP. Open Food Facts product lookups (barcode or search queries) are used to resolve items against the food database. Steps and active calories, read via Google Health Connect with your permission, drive activity tracking and walking XP.

2.5 Diagnostics and support

Crash reports and performance data (Sentry, if you opt in) help us keep the app stable, and PII is scrubbed before send. This is on by default in developer builds and off in user and tester builds unless you enable it in Profile then Settings. Optional bug reports (free text you submit) help us support you, and they are scrubbed for emails and tokens. 360° capture failure diagnostics (NDJSON, no raw video) help engineering reliability when a capture fails.

3. How we use data

• Provide and improve the app (sync across devices, restore after reinstall).
• Calculate in app XP, levels, and progress visualizations.
• Operate social and compare features you enable (visibility: private, friends only, or public; private by default).
• Diagnose crashes and capture failures when consented or submitted.

We may use aggregated or irreversibly anonymized diagnostic statistics to improve capture reliability. We do not use identifiable body images from deleted accounts for model training. We do not sell your personal data.

4. Legal bases (EEA/UK users)

Where GDPR applies, we rely on: contract (providing the service), consent (Health Connect, optional crash reporting, 360° capture and camera use), and legitimate interests (security, abuse prevention, aggregated product improvement) balanced against your rights.

Body scan images and derived health related metrics are sensitive. We process them only with your explicit consent in the capture flow and to provide the features you request.

5. Sub processors

6. Retention and deletion

While your account is active we retain your data to provide the service, including progress charts, cloud backup, and restore after reinstall.

When you delete your account in Profile then Settings, or when you request erasure at support@nostosfit.com, we permanently delete your account and identifiable personal data, including workouts, diet logs, steps, social data, and all 360° body images and metrics from our database and cloud storage. This cannot be undone.

Local on device caches are removed when you delete your account or uninstall the app.

Aggregated or irreversibly anonymized statistics that can no longer identify you may remain for product improvement. We do not retain identifiable body images after account deletion.

Crash and diagnostic events in Sentry follow Sentry project retention settings. Short technical backup copies may persist briefly before automatic purge.

7. Security

We use HTTPS, row level security on user tables, secure session storage on Android, and private storage buckets for body assets. No system is 100% secure.

8. Your rights

Depending on jurisdiction you may request access, correction, deletion, portability, or objection. Use Delete account in Profile then Settings, or contact support@nostosfit.com. You may lodge a complaint with your supervisory authority (in the Netherlands: Autoriteit Persoonsgegevens).

9. Children

The app is not directed at children under 16 (or applicable local age). We do not knowingly collect data from children. The 360° capture feature requires users to be 18 or older.

10. International transfers

Some sub processors (such as Sentry when you opt in) may process data outside the European Economic Area. We use appropriate safeguards where required by applicable law.

11. Changes

We will post an updated policy and revise the "Last updated" date and document version. Material changes may be notified in app.

12. Contact

Nostia Labs
KvK 42111839
Netherlands
support@nostosfit.com