Privacy Policy

1. Data Controller

The data controller is an individual: Yulia Viktorovna Salodkina, self-employed, Tax ID (INN) 701713467261 (Russia).

Contact: support@edelwayfit.com

This Policy is drawn up in accordance with Russian Federal Law No. 152-FZ of 27 July 2006 «On Personal Data» and applies to all users of the Edel Way Fit service regardless of location.

2. General Provisions

This Privacy Policy (the «Policy») describes how Edel Way Fit (the «Service») collects, uses, and protects the personal data of users («you», «User») when using the web service and mobile application.

By registering and checking the consent box in the registration form, you give your consent to the processing of personal data in accordance with this Policy and the Consent to Personal Data Processing. If you do not agree, please refrain from using the Service.

The Service is intended for persons aged 16 years or older. Persons under 16 may use the Service only with parental or guardian consent.

3. Categories of Data Subjects

• Users who independently register in the Service;
• Athletes added to the Service by a trainer within the coaching feature.

4. Personal Data We Collect

• Identification data: nickname (username), email address;
• Profile data: name, profile photo — if provided voluntarily;
• Training data: workout plans, completed sessions, exercises, working weights and repetitions;
• Body metrics and nutrition data: body measurements, nutrition logs (calories, protein, fat, carbs, steps) — if filled in by the User;
• Progress photos — if uploaded by the User;
• Technical data: IP address, browser/device type and version, operating system — collected automatically upon access to the Service;
• Subscription data: subscription tier, start and expiry dates, promo code used.

We do not process special categories of personal data (health status, biometric data, racial or ethnic origin, etc.).

Payment card details are processed directly by Apple (App Store) or Google (Google Play) and are never accessible to us. We only receive subscription status confirmation. We do not collect geolocation data and do not use advertising or analytics trackers.

5. Purposes and Legal Bases for Processing

• User registration and authentication — legal basis: consent (Art. 9 FL 152-FZ);
• Providing Service functionality: workout plans, progress tracking, trainer interaction — legal basis: performance of a contract (user agreement);
• Sending transactional emails (email confirmation, password reset) — legal basis: consent;
• Account security and fraud prevention;
• Service improvement and customer support.

We do not sell or transfer personal data to third parties for commercial purposes.

6. Processing Operations

We perform the following operations with personal data: collection, recording, organisation, accumulation, storage, refinement (update, modification), retrieval, use, transfer to infrastructure providers (for technical service operation only), deletion and destruction.

7. Storage and Security

Data is stored on servers of the hosting provider Beget (Beget LLC) located in the Russian Federation, in line with the data localisation requirement for Russian citizens (Art. 18 cl. 5 FL 152-FZ). We apply organisational and technical measures to protect personal data from unauthorised access, alteration, disclosure or destruction:

• All data is transmitted over HTTPS/TLS;
• Passwords are stored only as a bcrypt hash; we never have access to original passwords;
• Data access is restricted to personnel who need it for functional purposes;
• Session tokens (JWT) have limited validity (access token — 24 hours, refresh token — 30 days); tokens are removed from the client upon sign-out.

8. Cross-Border Data Transfer

Personal data is stored and processed on servers located in the Russian Federation. The data localisation requirement for Russian citizens (Art. 18 cl. 5 FL 152-FZ) is met.

The only cross-border transfer relates to transactional email delivery (account verification, password reset), for which we use Resend Inc.(USA). Only the recipient's email address and the content of the service message are transferred to the USA. The transfer is carried out for the purpose of performing the agreement with you (Art. 12 cl. 4 para. 2 FL 152-FZ) and on the basis of your explicit consent given at registration; a cross-border transfer notification is submitted to Roskomnadzor under Art. 12 FL 152-FZ.

9. Retention Periods

• Account and profile data — until account deletion by the User;
• Training data, body metrics, progress photos — until deleted by the User or until account deletion;
• Technical logs (IP addresses) — no longer than 90 days;
• After account deletion, all personal data is immediately and permanently erased.

10. Your Rights

You have the right to:

• Receive confirmation of data processing and information about its scope, purposes and sources;
• Request a copy of your personal data;
• Request correction, blocking or deletion of incomplete, outdated or inaccurately processed data;
• Withdraw your consent to data processing at any time;
• Delete your account and all associated data (Settings → Delete Account in the app);
• Lodge a complaint with Roskomnadzor (Russian data protection authority) or a court.

To exercise your rights, contact us at support@edelwayfit.com. We will respond to requests about the scope and purposes of data processing within 10 business days(Art. 20 FL 152-FZ). Deletion of personal data upon withdrawal of consent will be completed within 30 daysfrom the date of your request (Art. 21 cl. 4 FL 152-FZ).

11. Withdrawing Consent

You may withdraw your consent to the processing of personal data at any time by:

• Sending a request to support@edelwayfit.com;
• Using the «Delete Account» feature in the Settings section of the Service.

Please note that withdrawing consent means we will no longer be able to provide the Service, as data processing is a necessary condition for its operation. Upon receiving your withdrawal request, we will delete your personal data within 30 days(Art. 21 cl. 4 FL 152-FZ).

12. Cookies

The Service uses cookies exclusively for authentication — storing session tokens (access token valid for 24 hours, refresh token — 30 days). Marketing, analytics and advertising cookies are not used.

You may disable cookies in your browser settings; however, this will make signing in to the Service impossible.

13. Third Parties (Infrastructure Providers)

• Beget (Beget LLC), Russia — server and file-storage hosting;
• Resend Inc. (USA) — transactional email delivery.

These providers act solely on our instructions and may not use personal data for their own purposes.

14. Changes to This Policy

We may update this Policy. We will notify you of material changes by email or via an in-app notification. The date of the last update is stated at the top of this document.

Continued use of the Service after an update constitutes acceptance of the revised Policy.