Privacy Policy

Roonfit · Last updated: 27 July 2026

Roonfit is a health & fitness companion. Your privacy comes first: we run no servers of our own — your health data is processed and stored on your device. The only exception is optional community content (Friend Groups & the Champions Challenge), stored in Google Firebase so other users can see it — and message content is end-to-end encrypted.

Data we handle

• Your profile (name, photo, age, sex, weight, height, activity, step goal) — on device only.
• Health metrics: with permission we read from Health Connect (HR, HRV, sleep, respiration, SpO₂, steps, calories) and process them on device.
• Wearables (optional): when you connect a Bluetooth heart-rate strap, we read live heart rate and R-R intervals locally. Connecting a device is entirely optional and not required for any feature.
• Camera/photos: meal, lab-report and weight-progress photos (optional) — stored on device.
• Location: for prayer times, maps, and GPS workouts — on device, never shared (map tiles request only the viewport from OpenFreeMap).
• Physical activity: step counting during walks.
• Sign in with Google (optional): your name, email, and photo — stored as a local identity, plus a Firebase ID for Friend Groups.

Where data is stored

• On your device by default (local storage and in-app files).
• Sensitive secrets (your AI key, WHOOP tokens) are kept in an encrypted file excluded from backup.
• You can move your data manually via "My data & backups" (export/import a backup file). Health Connect data stays in the Health app.

Community content (optional) — Friend Groups & Champions Challenge

If you use Friend Groups or join the Champions Challenge, that content is stored in Google Firebase (Firestore) so other users can see it: your social identity (username, display name, photo) and leaderboard stats you agree to share (steps/calories). Group messages and direct messages are end-to-end encrypted — no one (not us, not Google) can read them except the members. No health data is ever shared to the community. You can delete your messages, and "Delete account" removes all of it.

Third parties

• Google: Google Sign-In, Firebase (Friend Groups), Health Connect — governed by Google's policy.
• AI provider (optional): if you enable AI with your own key, only the needed input (your metrics summary, a meal/lab image, or your question) is sent to the provider you choose (Gemini / OpenRouter / Groq / Mistral), subject to its policy. Your key stays on device. With AI off, nothing is sent.
• WHOOP (optional): if you connect your own official WHOOP account, we fetch your own data from WHOOP via its official API to display it.
• Open Food Facts (optional): scanning a barcode sends only the barcode number to fetch nutrition facts.
• Public content hosts: animated exercise images (GitHub), supplement brand logos, reciter photos, and Quran audio (mp3quran) are loaded from their services — with no personal data.

What we don't do · Deletion · Children

We don't sell your data, show ads, or use third-party tracking/analytics. You can erase all data from Profile ▸ Delete account and all data — this wipes your device data and (best-effort) your profile, messages, and Champions leaderboard record from the cloud. Roonfit is not directed to children under 13.

Medical disclaimer: Roonfit is an informational fitness and wellness tool, not a medical device, and does not diagnose, treat, cure, or prevent any disease or condition. Always consult a qualified healthcare professional before making any health decision.

Contact: ahmedelfayoume7@gmail.com