Croco Fit

01 Data controller

Croco Fit is developed and maintained by an independent developer. The data controller for the information described in this policy (app and website) is identified in the Contact section at the bottom of this page.

02 At a glance

• Without an account the app only uses third-party services that you choose or that are needed to offer it for free: Google advertising and, if you turn it on, the AI assistant.
• With an account (optional) the only mandatory data are your e-mail and the account identifier, plus your subscription status.
• Everything else is optional: the notification token (if you give permission), your display name and Croco Pack data (only if you use it) and cloud saving, which needs Pro and your consent by category.
• You can delete the account and the cloud data at any time from the app.

03 Data stored on the device

When you use the app, you voluntarily record information such as:

• body weight and the related date;
• meals, text descriptions, and nutritional estimates;
• workouts performed, exercises, sets/reps, loads, and notes;
• progress photos you choose to take or import from your gallery;
• workout plans and meal guidance created manually or with the AI assistant.

This data is stored in the device's local storage. Only if you create an account, have Pro and give consent, a copy can also be saved in the cloud (see the dedicated section). You can delete the data on your phone at any time: by removing individual entries from the app, or by clearing the app's data or uninstalling it.

04 Optional AI assistant

Croco Fit can generate workout plans, meal guidance, and nutritional estimates using a third-party AI assistant, only if you choose to enable it by entering your own personal API key. You can connect one of:

In this case, the text and content needed to generate a response — for example your workout preferences, a meal description, a progress photo, or data tied to future features — is sent directly from your device to the provider you chose, subject to that provider's own terms and privacy policy.

Your API key is stored only on your device, encrypted, using the operating system's secure keystore (Android Keystore / iOS Keychain). It is never transmitted anywhere else except to the AI provider you chose, to authenticate your own requests.

05 Advertising (Google AdMob)

Croco Fit displays advertising (banner and interstitial ads) provided by Google AdMob, which allows the app to be offered for free. In doing so, Google and its advertising partners may collect and process device identifiers and usage data to show ads, including ads personalized to your interests.

• On first launch, if you are located in the European Union, the EEA, or the United Kingdom, you are shown a consent form (compliant with the IAB TCF / Google UMP framework) to choose whether to accept personalized advertising.
• On iOS you are also asked for App Tracking Transparency authorization before any cross-app data collection for advertising purposes.
• You can review or change your personalized advertising choices from your Google account settings, or from your device's advertising settings.
• Users with an active Croco Fit Pro do not see ads and the consent form is not shown to them.

For details on how Google handles this data: Google's privacy policy and how Google uses data from partner sites/apps.

06 Device permissions

The app may request access to the camera and photo gallery, solely to let you attach a photo to a meal or a progress check-in. Images remain stored locally alongside the app's other data, unless you explicitly choose to share them using your phone's own sharing features. The app may also ask permission to send you notifications (for example reminders): you can deny or revoke it from your phone's settings.

07 Account (optional)

The account is only for optional features (cloud saving, Croco Pack, Pro subscription). To create one you only need an e-mail address: we send you a sign-in code, there is no password. Your e-mail and the account identifier are the only mandatory data to have an account.

• What we store: e-mail, account identifier, Pro subscription status and the date and version of the consents you give.
• Display name: optional, only needed if you use Croco Pack. You can also choose not to be found by search.
• Guest access: in Croco Pack you can join with an invitation code without an e-mail, using a temporary access. To prevent the free guest trial from being reused on the same phone, we keep an irreversible code (a fingerprint with a secret extra value) computed from the device identifier: the plain identifier is not stored. The fingerprint is kept for 12 months, even after the account is deleted. Legal basis: legitimate interest in preventing abuse.
• Sign-in: the e-mail with the code is sent through a delivery provider (see Service providers).
• Deletion: you can delete the account and the cloud data from the app (Account, Delete account). Uninstalling the app does not delete the account; data on the phone is not touched.

Legal basis: performance of the service you request by creating the account.

08 Cloud saving (Pro feature)

With Croco Fit Pro you can save a copy of your data in the cloud, so you do not lose it and can use it on several devices. It is optional and you choose by category:

• workouts, plans, custom exercises, meals and experience points;
• personal data (age, sex, height, weight, energy target, preferences);
• progress photos (only those, and only over Wi-Fi). Meal photos are never saved in the cloud.

This is health data: we store it only with your explicit consent, which you can give or withdraw for each category at any time from Account. If you withdraw a consent you can choose whether to keep or delete the data already saved for that category. Without consent, or without an active Pro, your data stays on the phone only. We record the date and the version of the consent text. Syncing happens after changes and when the app is opened and closed, not continuously.

If the Pro subscription ends, the data already in the cloud stays readable and downloadable for 60 days, but nothing new is added until you renew.

09 Croco Pack (group feature)

Croco Pack lets you train together with other people. If you use it, we process on our servers:

• your display name and, if you pick one, a small profile photo, visible to the other members of your Pack (you can hide it);
• the data you choose to share with the Pack (for example summary figures about your workouts, shared plans and workouts, replies to invitations);
• the Pack activity (joins, results, reactions) and the notifications that come from it: notifications are deleted from the server after 30 days;
• any reports of inappropriate content (for example a profile photo).

Other Pro users can find you only by typing exactly your username or your e-mail, and only if you have not turned search off; they never see your e-mail. You can leave the Pack at any time. Legal basis: performance of the service you request and the sharing choices you make.

10 Personal trainer (optional feature)

People with an account can be coached by a personal trainer (trainer mode and the «My trainer» section). Trainers are enabled by us: a user cannot become one on their own. The invitation always comes from the trainer, you accept or decline it and you can end the relationship at any time. Your trainer, or a trainer who invited you, never sees your e-mail. If you use it, we process on our servers:

• the relationship between you and the trainer (status, dates) and your display name;
• the workout plans the trainer sends you (with earlier versions) and your reply (accepted or declined);
• the appointments set by the trainer (title, place, date and length) and your replies, including rescheduling requests, which are made by choosing days and time ranges (there are no text messages between users);
• the related notifications (invitations, plans, appointments and reminders), deleted from the server after 30 days.

Your progress reaches the trainer only if you choose to share it, and you can stop at any time. The phone sends a summary: number of workouts (this week, in total and over the last eight weeks), consecutive-day streak, date of the last workout, titles of this week's workouts and the first and last weight recorded. Meals, photos and exercise details are not sent. The summary is deleted when the relationship ends. Trainers are independent professionals: the relationship, agreements and payments between you and the trainer happen outside Croco Fit. Legal basis: performance of the service you request and your consent to share progress.

11 Push notifications

If you give permission and have an account, to send you alerts (invitations, replies to joint workouts, reactions, encouragements) we store on our servers a token of your phone, linked to your account, and the language. Notifications go through Expo's notification service and Google's system (Firebase Cloud Messaging), which deliver them to the phone. Without an account we do not register any token and send you no notifications from our servers: only local reminders, generated by the phone, remain. You can deny or revoke the permission from your phone's settings; the token is removed when you sign out of the account. Legal basis: your consent (the system permission).

12 Croco Fit Pro subscription

Croco Fit Pro is an optional subscription (when available) purchased through Google Play. Payment is handled entirely by Google: we neither see nor store your card details. To manage subscriptions we use RevenueCat, which receives your account identifier and the purchase information (product, start and end dates, renewal status) and passes it to our server to turn Pro on or off. We keep only your Pro status and its dates.

You can cancel at any time from Google Play, Subscriptions section: Pro stays active until the end of the period you already paid for. If you delete your account, the subscription must be cancelled separately in the store. Legal basis: performance of the contract.

13 Service providers

To run the features that need an account we rely on these providers:

These providers process data on our behalf or as independent controllers, under their own policies, and may process it outside the European Economic Area with the safeguards they provide. For advertising and the AI assistant see the dedicated sections.

14 Website and feedback form

This website presents the app and offers a feedback form. Here is what happens to the data:

• Feedback form: if you submit it, we store the message, its type, the rating (if you give one), the language, the system and app version (if you come from the app), the browser used, and your e-mail only if you choose to write it. We use them only to improve the app and, if you left an e-mail, to reply. Legal basis: your consent (voluntarily submitting the form) and our legitimate interest in improving the service.
• IP address: we do not store it in the clear. We only keep an irreversible fingerprint, used to limit mass submissions (anti-spam).
• Retention: messages are deleted automatically after 365 days (or sooner, if you ask).
• Cookies: no analytics or advertising cookies. Only on pages with the form a technical session cookie is used, to protect the form, which is deleted when you close the browser (the exception being cookies YouTube may set if you start the video, see below).
• No external services, except the video: fonts, images and styles are hosted on this website; we use no analytics tools or ad network on the site.
• YouTube video: the home page has the promotional video, hosted by YouTube (Google). Until you press play, no connection to YouTube is made: you only see a preview image hosted on this website. If you press play, the video loads from youtube-nocookie.com (reduced-cookie mode) and YouTube may receive your IP address and technical browser data and set its own cookies, under its own policy. Legal basis: your voluntary action (pressing play).
• Hosting: the hosting provider may log technical access data (such as IP address and time) for security and legal reasons, under its own policy.

15 Retention and deletion

You are in control of your data at any time:

• On the phone: you can delete individual entries from the app; clearing the app's data or uninstalling Croco Fit permanently deletes all data stored on the device (meals, weights, workouts, photos, plans, AI keys).
• Account and cloud: from the app (Account, Delete account) you can delete the account and all data stored on our servers (profile, subscription, synced data, photos, profile photo, Pack membership). Uninstalling the app does not delete the account.
• Trainer: deleting the account also deletes the relationships, plans, appointments and progress summary that concern you; when a relationship ends, the progress summary is deleted.
• Pack notifications: deleted from the server after 30 days. Notification token: removed when you sign out of the account or delete it.
• Guest anti-abuse fingerprint: kept for 12 months, even after the account is deleted.
• For messages sent through the feedback form, what is written in the website section applies.

16 Children

Croco Fit is not directed at children and is not designed to knowingly collect data from anyone under 16. The account and Croco Pack are reserved for people aged 18 or over. If you believe a child has provided data through the app or the website in a way that concerns you, please contact us: you can also ask for the account to be deleted by writing to the contacts at the bottom of the page.

17 Your rights

If applicable in your jurisdiction (e.g., GDPR in the EU), you have the right to access, correct, or delete your data, to restrict or object to its processing, to withdraw a consent at any time and, if in doubt, to lodge a complaint with your data protection authority.

You manage the data on your phone directly from the phone. For account and cloud data you can correct it, choose what to save and delete it from the app (Account); for access, a copy or other requests write to support@crocofit.com. For messages sent through the feedback form you can ask for access or deletion at the same address or through the form choosing "Personal data", describing the message to look for. For data processed by Google (AdMob and other services), by the providers listed above or by the AI provider you chose, the rights set out in their respective policies apply.

18 Changes to this policy

We may update this policy in the future, for example if new features or new legal requirements arise. The "last updated" date at the top of this page always reflects the most recent version.

19 Contact

For any question about this policy or about how data is handled, you can write to: