Privacy Policy

This policy describes our data practices. Where consent is required, Ghost asks for it in context before collecting or sharing the relevant data. You can decline or later withdraw optional consent without losing access to unrelated features.

It explains how Ghost Fitness ("Ghost Fitness", "Ghost", "we", "us", "our") collects, uses, shares, and protects information when you use ghostfitness.app and related applications (the "Service").

1. Information We Collect

Account and profile data

When you create an account or accept a client invitation, we collect information such as your name, email address, password (stored hashed), language preference, time zone, profile photo, country, business name, and similar profile details you provide.

Fitness and coaching data

To deliver training workflows, the Service stores content created or submitted in your account or workspace, including programs, workouts, exercises, sets, reps, weights, durations, schedules, notes, check-ins, body metrics, photos, messages between coach and client, goals, and other training-related content.

Nutrition and optional AI meal data

• Nutrition may store meal descriptions, meal photos you upload, meal times, estimated or edited calories and macros, and confirmed food items.
• AI meal estimation is optional.
• The selected AI input may be meal text, a meal photo, or a meal voice recording for transcription.
• Ghost does not include your name, email, Apple Health data, or profile in the OpenAI meal-estimation request.
• Meal photos are stored in private, account-scoped storage so your meal history works.
• Voice recordings are handled for the request and are not intentionally stored by Ghost as durable meal records.

Payment data

Payments for paid plans are processed by third-party payment providers (for example Paddle, Stripe, or similar). We do not store full card numbers or banking credentials on our own systems. We receive limited information such as billing name, country, the last four digits of your card, transaction identifiers, subscription status, and invoice history.

Usage and device data

We automatically collect technical information when you use the Service, including IP address, browser type, device type, operating system, referring pages, pages viewed, actions taken, timestamps, and crash and diagnostic data.

Communications

If you contact us, we keep a record of the correspondence and any information you provide so we can respond and improve the Service.

2. How We Use Information

• to provide, operate, and maintain the Service;
• to authenticate users and secure accounts and workspaces;
• to deliver coach programs and client experiences;
• to process payments, manage subscriptions, and prevent fraud;
• to provide customer support and respond to requests;
• to send service-related notices, security alerts, and product updates;
• to send marketing communications where permitted (you can opt out at any time);
• to analyze and improve features, performance, and reliability;
• to comply with legal obligations and enforce our Terms.

AI meal estimation and transcription

• With your explicit in-app permission, Ghost sends only the meal text, photo, or voice recording you choose, through Ghost servers, to OpenAI, L.L.C. ("OpenAI").
• OpenAI processes text or photos to return estimated foods, calories, protein, carbohydrates and fat, or processes audio to return text for your review.
• Results are estimates, may be wrong, are not medical advice, and are editable. Nothing becomes a confirmed saved meal until you save it.

For methodology, limitations, and published references, see Health Information & Sources.

3. Cookies and Analytics

We and our service providers use cookies, local storage, and similar technologies to keep you signed in, remember preferences, secure the Service, and measure usage. We may use analytics providers to understand aggregate product usage. Where required by law we ask for consent before placing non-essential cookies. You can control cookies through your browser settings; disabling some cookies may affect Service functionality.

4. Sharing With Service Providers and OpenAI

We share personal data only as needed to operate the Service:

• Coaches and clients in your workspace — data created in a workspace is shared between the coach who owns the workspace and the clients they invite, as required for coaching;
• Infrastructure and hosting providers that store and serve data on our behalf;
• Payment providers that process subscription payments;
• Email, messaging, and analytics providers that help us deliver notifications and understand product usage;
• Professional advisors and authorities when required by law, regulation, legal process, or to protect rights, safety, or property.

OpenAI

• Data is sent to OpenAI only after you give in-app permission, and only for nutrition estimation or transcription.
• The data is not used for OpenAI advertising.
• OpenAI states that API inputs and outputs are not used to train its models by default, unless the API customer opts in.
• For eligible text and image endpoints, OpenAI may retain content in abuse-monitoring logs for up to 30 days by default, unless approved alternate retention controls apply.
• OpenAI currently lists no default abuse-monitoring or application-state retention for its audio transcription endpoint.

We require service providers that handle personal data to use it only for the service they provide to us, and to provide the same or equivalent protection required by this policy and applicable rules. We do not sell personal data.

5. Data Retention and Deletion

• Account and product data is retained while your account is active and as reasonably needed for the service and for legal, dispute, fraud and security purposes.
• Saved meals remain until you delete the meal or your account, or where retention is legally required.
• Attached meal photos remain in private, account-scoped storage and are removed with meal or account deletion, subject to limited backup, security and legal retention.
• Meal voice recordings are not intentionally persisted by Ghost after transcription.
• OpenAI processing follows the API retention controls described above.
• Limited backup and security copies may temporarily remain after deletion from active systems.

6. Security

We use administrative, technical, and physical safeguards to protect personal data, including encryption in transit, hashed credentials, access controls, and monitoring. No method of transmission or storage is 100% secure; you should keep your password and account safe.

7. Your Rights and Consent Controls

Subject to applicable law, you may have the right to access, correct, export, restrict, or object to the processing of your personal data, to delete it, and to withdraw consent where processing is based on consent.

• Ghost asks before the first time it shares AI meal input. Choosing "Not now" continues without sharing.
• To withdraw later: Profile → How Ghost uses your data → Turn off AI meal estimates.
• Turning it off blocks future AI estimates and transcription, and Ghost asks again before any later request. It does not delete meals you already saved.
• Individual meals can be deleted in Nutrition.
• In-app account deletion is available.
• For requests you cannot complete in-product, contact o@ghostfitness.app. We may need to verify your identity before responding, and you may lodge a complaint with your local data protection authority.

Where Ghost processes client data on behalf of a coach, the coach is the controller of that data and you should contact them first for rights requests relating to that workspace.

8. Health Information and Sources

Nutrition calculations, calorie and macro targets, recovery context, and other health guidance in Ghost are estimates generated from the information you and your devices provide. They are general fitness and nutrition information, not medical diagnosis, treatment, or personalized clinical advice, and they can be wrong. Always review and edit estimates, and consult a physician or qualified registered dietitian when guidance may affect a medical condition.

Our methodology, limitations, and published references are listed on Health Information & Sources.

9. Children's Privacy

The Service is not directed to children under 13 (or the equivalent minimum age in your country) and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will take appropriate steps to delete it. Coaches must obtain verifiable parental or guardian consent before inviting a minor into a workspace where local law requires it.

10. International Users

Ghost Fitness is operated globally and the Service may be accessed from anywhere in the world. Personal data may be transferred to and processed in countries other than your own, which may have different data protection laws. Where required, we use appropriate safeguards for such transfers.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Effective date" above and, where the changes are material, provide reasonable notice through the Service or by email.

12. Contact

For privacy questions or rights requests, contact us at o@ghostfitness.app.