Privacy policy

1. Who we are

BookerFitness (the website booker.tecnovm64.com/fitness, the Android app and the Wear OS app) is a service of VMNET, the controller of your personal data.

Privacy contact: privacy@tecnovm64.com

2. What data we process

• Recovery email (optional): if you add it, or if your invite came by email or you sign in with Google. It is stored encrypted and only used to send you the “Forgot your password?” link and to tell you if your password changes. You can remove it anytime in Settings.
• Waiting list (if you request an invite): your name, your email and whether you have Android or iPhone. They are stored encrypted and used only to email you the invite. Legal basis: your request. They are deleted when you create your account, if we turn down the request or whenever you ask; if nobody answers it, after 12 months. To stop bots, the form uses Cloudflare Turnstile, which checks browser signals without tracking cookies.
• Account: username, display name, password (stored only as a hash, never in plain text), language, theme and avatar. If you sign in with Google: your email address and your Google account identifier.
• Training: routines, exercises, sets, weights, personal records, notes, body measurements you enter, gyms or places you save, and photos or videos you upload (for example, of the gym whiteboard).
• Training profile (optional): your experience, goal, what you train, how long a session lasts, rough reference lifts, any aches you mark and how you like your sets. It is only used to suggest routines, weights and challenges. You change it in Settings and it is deleted with your account.
• Anonymous routines for suggestions (you can turn it off): from the routines you complete we take only the list of exercises, the reps and the % of load of each set (no name, account or weights) to add variety to the routines the app suggests to everyone. Turn it off in Settings → AI and coach → “Share my routines”.
• Health and activity, only if you turn it on:
  • From Health Connect (Android app): exercise sessions (type, time, duration and title), heart rate during those sessions, calories, distance and sleep (times and stages). Nothing else: we don't read steps, weight, location or routes.
  • From Google Drive (if you link Health Sync): the activity and sleep files in the folder you authorize.
  • From the watch app: heart rate and sessions you record.
• Location, only if you allow it: used on the spot to suggest your gym when you're there and to fill in the address when you add a place. Only while you use the app (never in the background); we compare it and discard it, without storing your location or its history.
• Notifications: your browser's Web Push subscription or your phone's Firebase Cloud Messaging token, and your allowed hours.
• App usage, only if you accept it: events such as opening a routine, saving a set, using the timer or switching screens, with their date, source (web, app or watch) and an internal user identifier.
• Visits to the home page, only if you accept: pages viewed, buttons you tap (for example, downloading the app), demos you try, language, device type and which site you came from, with a random identifier stored by your browser. It isn't tied to any account.
• Technical data: IP address and browser type in server logs, for security (limiting sign-in attempts and blocking abuse).

3. Why we use it, and on what legal basis

We never use your data for advertising, we never sell it, and the app does not collect your phone's advertising ID.

4. Health Connect and Google APIs

The Android app only reads Health Connect: it never writes or deletes anything there. It reads in the background only if you grant that permission, to keep your activity up to date without opening the app: roughly every 30 minutes, when online and not on low battery, it checks for new exercise sessions or nights and sends only those. If nothing is new, it doesn't connect. Without that permission, the app only syncs when you open it.

BookerFitness's use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements.

BookerFitness's use and transfer of information received from Google APIs (Sign in with Google, Google Drive) adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, this data: is only used to show and improve your training features; is not used for advertising; is not sold or transferred except to the providers needed to run the service (section 7) or when required by law; and is not read by any person unless you ask us to (for example, for support), for security, or to comply with the law.

5. Firebase and Google Analytics

• Firebase Cloud Messaging (Google LLC) is used only to deliver notifications to the Android app. Google receives your device token and the notification text. The app does not include Firebase Analytics.
• Google Analytics 4 (Google LLC) is used only if you accept analytics. Our server sends the usage events from section 2 to Google Analytics with a pseudonymous internal identifier: never your name, email or health data. They are sent from our server, so your browser doesn't load Google scripts or store Analytics cookies. Google keeps these events according to the configured retention (14 months at most).
• If you decline analytics, or turn it off later, no usage event is recorded, neither on our server nor at Google.

6. Cookies and local storage

BookerFitness does not use advertising or third-party cookies. We only store the following in your browser (localStorage) or on your phone:

You can change your choice at any time in Settings → Privacy.

7. Who we share it with

We don't sell or hand over your data. It is only processed on our behalf, with the minimum needed, by:

• Infrastructure providers (hosting, network and encrypted backups), which store or carry the data without using it for anything else.
• Google services you choose to use: Sign in with Google, Google Drive, notifications and analytics (section 5).
• Resend (Resend, Inc.), which sends our emails (invites, password recovery and security notices).
• Map services, to turn an address into coordinates, or your location into an address when you ask for it.
• Artificial intelligence services, only if you turn them on. AI is optional: you choose whether to use it when you start, and in Settings → AI and coach you can turn it off entirely or per feature (suggested routines, weights per set, coach messages, whiteboard reading and monthly summary). If you use it, they receive only what is needed: the whiteboard photo, your training profile and a summary of your history (exercises, weights, sessions). Never your name or email. With AI off nothing is sent to them and the app runs in predictive mode from your history.
• Authorities, only when required by law.

Some of these services may process data outside your country. In that case appropriate safeguards apply, such as standard contractual clauses.

8. How long we keep it

• Account, training and health data: for as long as you have an account. If you delete it, it's erased from our server immediately.
• Invite requests: until you create your account (immediately) or 12 months at most; if the invite is sent and not used, 44 days after sending.
• Home page visits (only if you accepted analytics): 180 days.
• Usage events: 180 days on our server (and up to 14 months in Google Analytics, if you accepted it).
• Server technical logs: the minimum time needed for security.
• Encrypted backups: what you delete may remain in them until they're replaced; they're never restored to bring back a deleted account.

9. Your rights and how to use them

In Chile you're protected by Law 21.719 on personal data protection (in force from December 1, 2026, replacing the Law 19.628 regime); elsewhere, laws such as the GDPR in the European Union or the LGPD in Brazil. You have the right to access your data, correct it, delete it, take it with you in a standard format, object to or restrict its processing, and withdraw your consent at any time without affecting what was done before.

Write to privacy@tecnovm64.com; we reply within 30 calendar days (extendable once by another 30 if needed, and we'll tell you). In Chile you can complain to the Personal Data Protection Agency; elsewhere, to your local authority.

Two rights you can use yourself, instantly, without writing to us: in Settings → Privacy, "Download my data" (access and portability: everything we store about you in a JSON file) and "Delete my account" (erasure).

You can control it yourself at any time:

• Health Connect: phone Settings → Health Connect → App permissions → BookerFitness.
• Google Drive: BookerFitness → Settings → Disconnect.
• Analytics and health data: BookerFitness → Settings → Privacy.
• Location: phone Settings → Apps → BookerFitness → Permissions, or your browser's site permissions.
• Notifications: BookerFitness → Settings → Notifications, or your system settings.

10. Deleting your account

In the app: Settings → Privacy → Delete my account. You confirm with your password and the account, workouts, photos, PRs, health data, usage events and notification tokens are erased immediately. You can also email privacy@tecnovm64.com with the subject "Delete my account" from the email address linked to your account, or include your username, and we delete it within 30 calendar days.

11. Security

Everything travels encrypted (HTTPS). Passwords are stored as hashes, credentials for external services are encrypted, and on the phone the app's token is encrypted with the Android Keystore. Server access is restricted.

12. Children

BookerFitness is not directed at children under 16 and we don't knowingly collect their data. If you believe a child has given us data, write to us and we'll delete it.

13. Changes to this policy

If we change this policy, we'll publish the new version here with its date. If the change is significant, we'll let you know in the app and, where required, ask for your consent again.