Privacy Policy

1. Scope and controller

This policy applies to the OnlyFit website at getonlyfit.com and authenticated OnlyFit mobile services operated by Internet Investments Group. It covers the interactive fitness and nutrition plan builder, customer profile, sign-in, and subscriptions purchased on the website or through supported app-store billing. For privacy requests, use our support page. OnlyFit provides general fitness information and is not a healthcare provider. This policy also covers the OnlyFit app on Meta Quest.

2. Information we collect

The categories depend on how you use OnlyFit:

• Account and contact data: first name, email address, email verification and marketing choices, and messages you send to support.
• Quiz and profile data: date of birth or age, selected profile, measurement units, height, current and target weight, fitness goals, activity level, training interests, equipment, schedule, and food preferences. Your choices may also include body-composition and strength estimates or other health-related information.
• Calculated plan data: approximate starting metrics, a saved profile summary, and workout or meal-plan selections generated from your answers.
• Sign-in and security data: session identifiers, one-time sign-in challenge records, revocable mobile access-token records, and information used to limit abusive requests. We store hashes rather than raw sign-in PINs or mobile access tokens.
• Subscription and transaction data: plan or product selected, billing provider, checkout and invoice references for website purchases, store purchase identifiers or verification tokens where a store purchase is linked to your account, payment or entitlement status, paid periods, renewal or cancellation dates, and limited earlier free-test access history. Stripe or the applicable app store receives your payment credentials directly; OnlyFit does not receive full card details.
• Website and attribution data: first-touch campaign parameters such as utm_source and cmp, browser-session information, and page URLs and browser, device, network, or cookie identifiers used by Meta Pixel, Meta Conversions API, Google Tag Manager, or the direct Google Analytics 4 tag. The Meta events described in section 10 also include an event name, time, and ID, and the paid amount and currency of the initial subscription, plus the predicted_ltv field when included.
• Privacy request data: the email address and time included in account-deletion requests, including when the address does not match an account.
• IP address and approximate location: at signup, we save your public IP address in your customer record and use the MaxMind GeoLite City service to estimate your country, region, city, and postal code where available. We save these estimates in your customer record and show them to authorized administrators. They do not establish your exact location or a verified address.

3. Where information comes from

You provide quiz, registration, sign-in, plan, store-purchase and support information. Stripe returns payment and subscription events. The browser provides session and technical data, and campaign links may provide attribution. As you use the website, Meta, Google and Microsoft Clarity may collect technical information across its pages, and OnlyFit sends matching web events to Meta from its server.

For new website plans, Stripe processes three initial installments and then one full-price payment for each renewed period until cancellation. Stripe sends us checkout, invoice, payment, schedule, and subscription status updates. We use those updates to record verified payments, access dates, renewal dates, and billing support. Existing daily-billed plans retain their original billing terms.

Google Play and Apple administer the payment methods, charges, and cancellation settings for subscriptions billed through their respective platforms. You manage or cancel such a subscription in the Google Account or Apple Account used for purchase. A request to delete your OnlyFit account or data is not a substitute for cancellation in the store and does not delete records held independently by the platform; use the platform’s subscription and privacy controls for those matters.

For a subscription purchased through Meta Horizon Store billing, Meta handles the payment method and charges. The Quest app checks subscription access with Meta and may report limited product, purchase, and subscription-status information to your OnlyFit account. OnlyFit does not receive your full payment card details from Meta. Cancel and manage billing in the Meta account used for purchase; deleting your OnlyFit account does not cancel that subscription.

4. Health-related answers and consent

Measurements, activity, body-composition estimates, and some food or training answers can reveal information about health. Quiz progress may remain in your browser session while you complete the assessment. Before creating or updating a stored fitness profile using these answers, OnlyFit asks for explicit health-data consent. That choice is separate from Meta Pixel, Meta Conversions API, Google Tag Manager, and the direct Google Analytics 4 tag described in section 10. With health-data consent, we use the answers to calculate illustrative BMI, energy, water, and training estimates and to tailor general fitness and meal guidance. You may withdraw consent by contacting us; this may prevent us from providing a personalized profile or plan. Withdrawing consent does not undo processing already lawfully completed or remove records we must retain for legal reasons. These estimates are not medical diagnoses or treatment advice.

5. Purposes and legal bases

Where data protection law requires a legal basis, the basis depends on the activity and your location. We process only the data relevant to each purpose:

• To create and secure your account, send requested sign-in codes, provide the profile and plans, manage paid access, process subscriptions, and respond to service requests: performance of our agreement with you, or steps you request before entering it.
• To store and use health-related quiz answers for personalized fitness and nutrition guidance: your explicit consent where required for sensitive information. You can decline this choice or withdraw it by contacting us.
• To record your separate preference for optional marketing email: your choice or another basis permitted by applicable law. A web signup campaign requires a separate affirmative choice; essential account and billing messages do not depend on this choice.
• To protect accounts, prevent abuse or duplicate payment processing, maintain service reliability, respond to support and privacy requests, and measure first-touch campaign results: our legitimate interests where that basis is available and balanced against your rights.
• To keep records needed for tax, accounting, payment disputes, lawful requests, and the exercise or defense of legal claims: legal obligations or legitimate interests where applicable.
• To measure visits and advertising results with Meta Pixel and CAPI, Google Tag Manager, direct Google Analytics 4 and Microsoft Clarity: these technologies run automatically across website pages. Section 10 describes the events and providers; section 11 describes applicable privacy rights.

6. Who receives information

We disclose information only for the purposes described in this policy, subject to the services and features you use:

• Stripe receives checkout and payment details and returns transaction and subscription information needed to confirm payment, manage access, and resolve billing issues.
• For supported app-store purchases, we may submit a purchase identifier or verification token to Google Play or Apple to validate the subscription and receive limited entitlement or renewal status. Google Play and Apple independently process payment and account information under their own privacy notices when they bill a purchase.
• Resend receives the destination email address, sign-in message, and delivery information to send a one-time sign-in code requested by you.
• Meta may receive PageView when a visitor-facing website page loads, ViewContent when the quiz opens, QuizStart when its first step opens, Lead after a new account is created, InitiateCheckout when a Stripe Checkout is created, and Subscribe after Stripe confirms the first subscription payment. Browser and server copies share an event ID where both are available; the server sends Subscribe after Stripe confirms payment, and a verified return may also send its browser copy. Google may receive a page_view through the direct Google Analytics 4 tag when a visitor-facing website page loads, technical data when Google Tag Manager loads, and data from tags configured in its container. Meta and Google process information under their own terms.
• Service infrastructure providers and authorized OnlyFit personnel may access information needed to host, secure, maintain, and support the service. We may also disclose information where law requires it or to establish, exercise, or defend legal claims.
• MaxMind receives your public IP address so that its GeoLite City service can return approximate location and postal-code information.

7. Storage and retention

Quiz progress is stored in browser session storage until that session ends or you clear or restart it. Campaign parameters can remain in the server-side browser session; when you create an account, normalized first-touch values are saved in a separate customer-linked attribution record. The customer database stores account details, your consented profile and summary, and subscription and transaction records. We keep personal information while needed to provide your account and service, then only as needed for legal, tax, accounting, security, dispute, or other justified purposes. Retention varies by category and circumstance; we do not promise a single automatic deletion date. Contact us for information about a particular record.

Account-deletion requests sent to support may include the submitted email address and request time for review, even if no matching account exists. Sending a request does not itself verify account ownership or automatically delete the account. We review the request, may ask for reasonable identity verification, and may retain limited records where law or a valid legal claim requires it. To stop future website charges, cancel your Stripe-billed plan in OnlyFit subscription settings before requesting deletion; a deletion request does not cancel billing. To stop charges for a subscription billed through Google Play or Apple App Store/iTunes, cancel in the account used for that store purchase.

8. Optional email

New accounts have Email updates set to Yes by default, but that setting alone does not enroll them in promotional emails. Website signups must separately tick an unticked marketing choice. Email verification is not required to receive this campaign. Eligible website signups may then receive up to six OnlyFit training, product, and plan emails over several days. We stop the sequence after a purchase, an unsubscribe, or a removed permission. You can turn Email updates to No at any time on our unsubscribe page. The mobile quiz may ask for a separate email choice; that choice does not itself enroll you in the website campaign. Email choices do not control Meta Pixel, Meta Conversions API, Google Tag Manager, or the direct Google Analytics 4 tag described in section 10. Requested one-time sign-in codes and essential account, purchase, and subscription messages are service communications, separate from marketing. Each promotional email includes a free unsubscribe link. Turning Email updates to No does not cancel a paid subscription or stop essential service messages.

Turn off Email updates

9. Cookies and browser storage

OnlyFit uses a necessary session cookie, a language cookie and browser session storage for quiz progress. Website measurement runs automatically. OnlyFit may set _fbp, and _fbc may be created from a valid fbclid; both can accompany Meta CAPI events. See the Cookie Policy.

Read our Cookie Policy

10. Meta, Google and Microsoft Clarity tracking

Meta Pixel, GTM, direct GA4 and Microsoft Clarity load automatically across website pages. Meta Pixel and CAPI send matching PageView when a visitor-facing website page loads, ViewContent when the quiz opens, QuizStart after age selection, Lead after a new account is created, InitiateCheckout after Stripe Checkout creation and Subscribe after Stripe confirms the first paid subscription. Matching copies use the same event ID. The server can send Subscribe without a return visit; a verified return can send its browser copy. GA4 sends page_view on page load. Clarity measures interactions and session playback, with the quiz area and account and support pages masked. Meta CAPI uses IP, user agent, available _fbp and _fbc, and SHA-256 hashes of normalized email and account ID when known; Subscribe includes paid value and currency. Hashing does not make an identifier anonymous. OnlyFit does not add quiz answers, health data, birth dates or saved profile details to Meta event payloads. You can contact us through the support page to exercise applicable privacy rights concerning this tracking.

11. Your choices and privacy rights

You may decline optional email, decline or withdraw health-data consent, and clear browser quiz progress. For website tracking, contact us to exercise any applicable privacy right. Depending on your location, you may also have these rights:

• Request access to or a portable copy of your information, and ask us to correct inaccurate information.
• Ask us to delete information or restrict or object to certain processing, subject to legal exceptions.
• Withdraw consent for processing based on consent and object to direct marketing or certain advertising uses where applicable.
• Complain to a competent data-protection authority if you believe your privacy rights have been infringed.

Request account deletion

12. Processing across borders

Stripe, Resend, Meta, Google, Apple where applicable, and service infrastructure may process information in countries other than yours. The privacy rules in those places may differ. Where applicable law requires a lawful transfer mechanism or safeguards, those requirements apply to the transfer. Contact us for information about the providers and transfer arrangements relevant to your information.

13. Adults only

OnlyFit is intended for people aged 18 or older. The plan builder rejects a date of birth indicating an age below 18. If you believe a minor has supplied personal information, contact us so we can review it.

14. Security

We use technical and organizational measures intended to protect information, including secure account sessions, hashed sign-in challenges and mobile token records, and controls against abusive requests. No online service can guarantee absolute security. Please do not send passwords, card details, or detailed medical records to support.

15. Changes to this policy

We may revise this policy when the service or our data practices change. We will update the date above and provide any additional notice required by applicable law. The version published here describes our current practices.

16. Contact us

For questions about this policy, your information, consent withdrawal, or a privacy-rights request, contact Internet Investments Group through the support page below. Please use the email associated with your OnlyFit account when possible so we can locate your records and verify the request.

We may ask for information reasonably needed to verify that you own the account before disclosing or deleting its data.