Privacy Policy.

Who we are

FitKit ("FitKit," "we," "us") is a free companion for people who already use a Fitbit or Pixel Watch. It shows daily activity as a calendar heatmap and home-screen widgets. It is not the official Fitbit or Google Health app. It is not a medical device. There is no paid tier and no advertising in the app.

Operator: Yash Vadaria, Montreal, QC, Canada.
Support: fitbit.kit.feedback@gmail.com

Data the App Store and Play Store require us to list

This table matches the App Store privacy labels and Google Play Data safety form. All of it is linked to your account after you sign in. None of it is used for tracking across other companies' apps or websites. None of it is used for advertising.

• Email address. App functionality. From Google sign-in, to create your account and to reply if you write to support.
• Name. App functionality. From Google sign-in, shown in the app.
• User ID. App functionality and analytics. Your FitKit account id, used to sign you in and to measure whether the same person comes back (PostHog).
• Device ID. Analytics. PostHog uses an install identifier (on iOS this may include the vendor ID) so we can tell the same phone across opens before you sign in. We do not use IDFA or the advertising ID. We do not show an App Tracking Transparency prompt because we do not track.
• Product interaction. Analytics. App opens, sign-in, Fitbit connect, and whether a sync finished. Not your step counts or sleep.
• Health and fitness. App functionality. Steps, distance, calories, active minutes, zone minutes, sleep, and water, read from Google Health so the grids and widgets can fill in. Used only to show that data to you.

Required to use the app: Google sign-in (email, name, user id). Optional: Connect Fitbit (health and fitness). Analytics events are sent in the background and never block the app.

Google user data we access

FitKit uses Google APIs only after you sign in and, separately, after you tap Connect Fitbit. We request these scopes and no others:

• userinfo.email and userinfo.profile. Your Google Account email, display name, profile photo, and Google user id. Used to create your FitKit account and show who is signed in.
• googlehealth.activity_and_fitness.readonly. Daily steps, distance, calories, active minutes, and zone minutes from Google Health (Fitbit-backed data).
• googlehealth.sleep.readonly. Minutes asleep.
• googlehealth.nutrition.readonly. Logged water.

We do not request write access, Google Health settings, ECG, location, contacts, Gmail, Drive, or any other Google data.

How we use this data

We use it only to run FitKit for you:

• Email and profile create the account, keep you signed in, and let us reply if you write to support.
• Google Health read data is fetched so the app and widgets can show your activity grids.
• PostHog events tell us whether the free app is opening, retaining people, and connecting Fitbit.

Our use of data obtained via Google APIs complies with the Google API Services User Data Policy, including Limited Use. We do not use Google user data to develop, improve, or train generalized or non-personalized AI or ML models.

How we share this data

We do not sell personal data. We do not transfer it to data brokers, information resellers, or advertisers. We do not use it for personalized, retargeted, or interest-based ads.

Play Data safety "data shared": we send analytics (user id, device identifier, product interaction, app version, device and OS) to PostHog. We do not share health and fitness values with PostHog or any other analytics vendor.

Processors that run the product:

• Google, for sign-in and Google Health. Their policies apply to data they already hold on your Google and Fitbit accounts.
• Our API host at yashvadaria-apps.com, which stores encrypted account tokens and fetches Google Health on your behalf so the phone can display it.
• PostHog, for product analytics as described above.

We may disclose information if the law requires it. If FitKit were transferred as part of a sale of the project, we would tell you first.

Humans on the operator side may see that an email exists and whether sign-in or Fitbit connection succeeded. They cannot open your step counts or sleep history, because those records are not kept in our database.

How we store and protect it

• Data is encrypted in transit. All API traffic uses HTTPS.
• Google sign-in tokens and Google Health refresh tokens are stored encrypted at rest on our API. We never receive or store your Google password.
• Health numbers are fetched live from Google Health when the app syncs. The API may keep a short in-memory cache (a few minutes) so a refresh does not hit Google twice. That cache is not written to our database.
• Activity history, colors, layout, notes, extra activities you add, and widgets live on your phone.

No app or server is perfectly secure. Anyone with unlocked access to your phone can see the same activity the app shows you. Use a device passcode or biometrics.

How long we keep it, and how you delete it

Account email and encrypted tokens stay on our API while your account exists. In-memory health cache expires in minutes. Product analytics events stay in PostHog for as long as we need them to see whether the free app is working, then we delete or aggregate them.

Both stores require an in-app way to delete the account. In Fitbit Kit: Settings → Delete account. That removes your email and tokens from our API and resets analytics identity on the device.

• Disconnect Fitbit in Settings. Encrypted Google Health tokens are removed from our API. Grids already on the phone stay until you clear them.
• Uninstall the app to remove local activity history from the phone.
• Email fitbit.kit.feedback@gmail.com if you want us to confirm deletion, or if you cannot open the app.

You can also revoke FitKit in your Google Account permissions. After that, FitKit cannot refresh Google Health until you connect again.

Website

This website records page views and store-button clicks in the same PostHog project. We do not collect GPS, contacts, photos, payment details, or an advertising ID from the app or the site. FitKit is free.

What we do not do

• Sell personal data
• Use data for ads, retargeting, data brokers, or tracking as Apple and Google define it
• Build a health warehouse of your Fitbit history
• Use Google APIs to train non-personalized AI or ML models

Children

FitKit is not directed to children under 13. We do not knowingly collect data from them. It is not in Google Play's Designed for Families program. Do not use it if you cannot consent to connecting a Google and Fitbit account.

Health disclaimer

FitKit is an activity companion. The numbers come from your wearable and Google Health and may be wrong or incomplete. Fitbit Kit does not provide medical advice and is not a regulated medical device.

Changes

If how we collect or use personal data changes, we will update this page first. The date at the top is the effective date. Settings → Privacy in the app opens this same URL.

Contact

Yash Vadaria
Montreal, QC, Canada
Product: fitbit.kit.feedback@gmail.com
Founder: yashvadaria.com

You can ask us to access, correct, or delete the account data we hold. Use Settings → Delete account, or email the address above.

See also https://fitbitkit.com/terms.

FitKit is an independent app and is not affiliated with, endorsed by, or sponsored by Fitbit, Google, or Apple.