Privacy Policy

1. Data Controller

The data controller is an individual: Yulia Viktorovna Salodkina, self-employed, Tax ID (INN) 701713467261 (Russia).

Contact: support@edelwayfit.com

This Policy is drawn up in accordance with Russian Federal Law No. 152-FZ of 27 July 2006 «On Personal Data» and applies to all users of the Edel Way Fit service regardless of location.

2. General Provisions

This Privacy Policy (the «Policy») describes how Edel Way Fit (the «Service») collects, uses, and protects the personal data of users («you», «User») when using the web service and mobile application.

By registering and checking the consent box in the registration form, you give your consent to the processing of personal data in accordance with this Policy and the Consent to Personal Data Processing. If you do not agree, please refrain from using the Service.

The Service is intended for persons aged 18 years or older.

3. Categories of Data Subjects

• Users who independently register in the Service;
• Athletes added to the Service by a trainer within the coaching feature.

4. Personal Data We Collect

• Identification data: nickname (username), email address;
• Profile data: name, profile photo — if provided voluntarily;
• Training data: workout plans, completed sessions, exercises, working weights and repetitions;
• Body metrics and nutrition data: body measurements, nutrition logs (calories, protein, fat, carbs, steps) — if filled in by the User;
• Progress photos — if uploaded by the User;
• Technical data: IP address, browser/device type and version, operating system — collected automatically upon access to the Service;
• Subscription data: subscription tier, start and expiry dates, promo code used.

Body measurements and nutrition data are processed as fitness metrics for the Service's features; they are not medical or diagnostic data and are not used by us to determine health status. We do not request or intentionally process special categories of personal data (medical diagnoses, biometric data for identification, racial or ethnic origin, etc.). Users should not enter medical diagnoses or other health-condition information into free-text fields.

Payment card details are processed directly by Apple (App Store) or Google (Google Play) and are never accessible to us. We only receive subscription status confirmation. We do not collect geolocation data and do not use advertising or analytics trackers.

5. Purposes and Legal Bases for Processing

• User registration and authentication — legal basis: consent (Art. 9 FL 152-FZ);
• Providing Service functionality: workout plans, progress tracking, trainer interaction — legal basis: performance of a contract (user agreement);
• Sending transactional emails (email confirmation, password reset) — legal basis: consent;
• Account security and fraud prevention;
• Service improvement and customer support.

We do not sell or transfer personal data to third parties for commercial purposes.

6. Processing Operations

We perform the following operations with personal data: collection, recording, organisation, accumulation, storage, refinement (update, modification), retrieval, use, transfer to infrastructure providers (for technical service operation only), deletion and destruction.

7. Storage and Security

Data is stored on servers of the hosting provider Beget (Beget LLC) located in the Russian Federation, in line with the data localisation requirement for Russian citizens (Art. 18 cl. 5 FL 152-FZ). We apply organisational and technical measures to protect personal data from unauthorised access, alteration, disclosure or destruction:

• All data is transmitted over HTTPS/TLS;
• Passwords are stored only as a bcrypt hash; we never have access to original passwords;
• Access to personal data is limited to the Operator, to the extent needed to run the Service;
• Session tokens (JWT) have limited validity (access token — 24 hours, refresh token — 30 days); tokens are removed from the client upon sign-out.

8. Cross-Border Data Transfer

Personal data is stored and processed on servers located in the Russian Federation. The data localisation requirement for Russian citizens (Art. 18 cl. 5 FL 152-FZ) is met.

For transactional email delivery (account verification, password reset) we engage the Russian service RuSenderas a processor (cl. 5 para. 1 Art. 6 FL 152-FZ — performance of a contract). Only the recipient's email address and the content of the service message are shared. We do not ourselves carry out any cross-border transfer of personal data outside the Russian Federation.

9. Retention Periods

• Account and profile data — until account deletion by the User;
• Training data, body metrics, progress photos — until deleted by the User or until account deletion;
• Technical logs (IP addresses) — no longer than 90 days;
• After account deletion, all personal data is immediately and permanently erased.

10. Your Rights

You have the right to:

• Receive confirmation of data processing and information about its scope, purposes and sources;
• Request a copy of your personal data;
• Request correction, blocking or deletion of incomplete, outdated or inaccurately processed data;
• Withdraw your consent to data processing at any time;
• Delete your account and all associated data (Settings → Delete Account in the app);
• Lodge a complaint with Roskomnadzor (Russian data protection authority) or a court.

To exercise your rights, contact us at support@edelwayfit.com. We will respond to requests about the scope and purposes of data processing within 10 business days(Art. 20 FL 152-FZ). Deletion of personal data upon withdrawal of consent will be completed within 30 daysfrom the date of your request (Art. 21 cl. 4 FL 152-FZ).

11. Withdrawing Consent

You may withdraw your consent to the processing of personal data at any time by:

• Sending a request to support@edelwayfit.com;
• Using the «Delete Account» feature in the Settings section of the Service.

Please note that withdrawing consent means we will no longer be able to provide the Service, as data processing is a necessary condition for its operation. Upon receiving your withdrawal request, we will delete your personal data within 30 days(Art. 21 cl. 4 FL 152-FZ).

12. Cookies

The Service uses cookies exclusively for authentication — storing session tokens (access token valid for 24 hours, refresh token — 30 days). Marketing, analytics and advertising cookies are not used.

You may disable cookies in your browser settings; however, this will make signing in to the Service impossible.

13. Third Parties (Infrastructure Providers)

• Beget (Beget LLC), Russia — server and file-storage hosting;
• RuSender (Russian service) — transactional email delivery.

These providers act solely on our instructions and may not use personal data for their own purposes.

14. Changes to This Policy

We may update this Policy. We will notify you of material changes by email or via an in-app notification. The date of the last update is stated at the top of this document.

Continued use of the Service after an update constitutes acceptance of the revised Policy.