This policy explains what Duo Fit collects, why, and what control you have over it. It applies to the Duo Fit mobile app and website.
Duo Fit is operated by Dot Logics Ltd (Mansion House, Manchester Road, Altrincham, Cheshire, England, WA14 4RW), the data controller for the purposes of UK GDPR. You can reach us at andrew@dotlogics.co.uk.
The short version
- We collect your name, email address and the workouts you log.
- We do not sell your data, show you ads, or track you across other apps and websites.
- There are no analytics or advertising SDKs in the app.
- You can delete your account, and everything in it, from inside the app at any time.
What we collect
Account information
- Name — shown on your workouts and to training partners you connect with.
- Email address — used to sign you in, reset your password, and contact you about your account.
- Password — stored only as a one-way hash. We cannot read it.
- Profile colour or photo — optional, used for your avatar.
Workout data
- Exercises performed, weights lifted, repetitions, and set timestamps.
- Workout sessions, their start and end times, and who took part.
- Saved workout templates.
- Personal bests, which are calculated from the above.
Information about your physical fitness is special category data under UK GDPR. We process it only to provide the app's core function — recording and showing you your own training history — and never for profiling, advertising or any automated decision-making.
Training partners and guests
Duo Fit lets you train with a partner on one phone. You can either connect with another Duo Fit user, or create a guest profile for someone who does not have an account.
A guest profile stores the name you give it, an optional avatar colour, and optionally a gender and contact detail if you choose to add one. It also stores that person's workout data.
If you create a guest profile for someone else, you are responsible for having their permission to record their information. Please do not add a contact detail for another person without asking them first. If someone asks us to remove a guest profile that represents them, we will do so — contact us at the address above.
Technical information
- Session data — when you sign in we store a session record containing your IP address and browser or device user agent. This is how you stay signed in, and it helps us detect suspicious access to your account.
- Server logs — our hosting provider records standard request logs, including IP addresses, for security and troubleshooting.
What we do not collect
Duo Fit does not request or collect your location, contacts, photos, microphone, camera, health records from Apple Health or Google Fit, or any advertising identifier. The app contains no analytics SDK, no advertising SDK, and no third-party tracking of any kind.
Notifications
If you allow notifications, the app schedules them on your device only — for example when your rest between sets is over, or when it is your training partner's turn on a shared phone. These are generated locally. No notification content is sent to our servers or to any third party, and we do not use push notifications for marketing.
You can turn notifications off at any time in your device settings. The app will still work; you simply will not get rest reminders.
Why we are allowed to use your data
Under UK GDPR our lawful bases are:
- Contract — we need your account details and workout data to provide the service you signed up for.
- Explicit consent — for fitness information, which is special category data. You give this by choosing to log workouts, and you can withdraw it by deleting your account.
- Legitimate interests — for keeping the service secure and working, such as session records and server logs.
Who we share it with
We do not sell your personal data, and we never will. We share it only with the service providers needed to run the app:
- DigitalOcean — hosts the application and database.
- ui-avatars.com — generates the initials avatar shown for accounts without an uploaded photo. Your display name is included in the image request. If you would rather not use this, upload a profile photo instead.
- Bunny Fonts (fonts.bunny.net) — serves the app's typeface. It is a GDPR-focused service that does not log IP addresses or set cookies.
Other Duo Fit users see only what you would expect: if you train together, your partner sees your name, avatar, and the sets recorded in the sessions you shared. Your email address is never shown to other users.
We may also disclose information where we are legally required to, or to protect our rights or the safety of others.
Where your data is stored
Your data is stored on servers in the United Kingdom. Where any provider processes data outside the UK or EEA, that transfer is covered by an adequacy decision or by Standard Contractual Clauses.
How long we keep it
- Account and workout data — for as long as your account exists.
- After you delete your account — removed immediately from the live database. Encrypted backups may retain a copy for up to 30 days before they are overwritten on their normal cycle.
- Session records — expire automatically and are cleared when they lapse.
- Server logs — retained for a short period for security and diagnostics.
Your rights
Under UK GDPR you have the right to:
- Access a copy of the personal data we hold about you.
- Correct anything inaccurate — you can edit your name, email and avatar in the app.
- Delete your account and data.
- Restrict or object to how we process your data.
- Portability — receive your data in a machine-readable format.
- Withdraw consent at any time.
Deleting your account
You can delete your account yourself, at any time, from Profile → Delete Account in the app. This permanently removes your account, your workout history, your saved templates, your partner connections, and any guest profiles you created. It cannot be undone.
To exercise any other right, email andrew@dotlogics.co.uk. We will respond within one month.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk.
Security
Traffic between the app and our servers is encrypted with HTTPS. Passwords are hashed with bcrypt and are never stored in a readable form. Access to the production database is restricted to those who need it.
No system is perfectly secure, but if a breach affects your rights and freedoms we will notify you and the ICO as the law requires.
Children
Duo Fit is not intended for children under 13, and we do not knowingly collect data from them. If you believe a child has created an account, contact us and we will remove it.
Changes to this policy
If we change this policy we will update the date at the top of this page. For significant changes affecting your rights we will tell you in the app or by email before they take effect.
Contact
Dot Logics Ltd
Mansion House, Manchester Road, Altrincham, Cheshire, England, WA14 4RW
andrew@dotlogics.co.uk