Last updated: 27 September 2026.

1. Who we are

FitQuest is operated by RETHYN LTD, who is the data controller for the personal data described here and decides how and why it is processed.

2. What we collect and why

  • Account data (email, password credentials or the Apple/Google account you sign in with, display name) — to create and secure your account. Legal basis: performance of our contract with you.
  • Hero and body profile (age, gender, height, weight, activity level, goal pace) — to calculate your personalised calorie and macro targets. Legal basis: contract performance.
  • Optional life-stage settings (whether you are pregnant, your trimester, and whether you are breastfeeding) — only if you choose to switch them on in Goals, and solely to adjust the calorie, calorie target and macro guidance shown inside your account. They are optional, private account data: never used for advertising or marketing, never included in analytics events and never made public. You can change or remove them at any time in Goals, and they are deleted with the rest of your data if you delete your account. FitQuest does not diagnose or provide medical care. Legal basis: your explicit consent, given when you switch a setting on.
  • Activity data (food and training logs, product barcodes you scan, steps, quests, habits, Boss attempts, Vault ledger) — to provide the tracking features and your progress history. Legal basis: contract performance.
  • Connected health and fitness data — only if you choose to connect. In the iPhone app, FitQuest reads your daily step count from Apple Health; in the Android app it reads daily steps from Health Connect, including in the background once you allow it so quests can update. Steps are the only health data read, and FitQuest never writes to Apple Health or Health Connect. If you connect Strava we read your activities (read-only). You can disconnect at any time and the game keeps working with manual entry.
  • Camera — used only while you scan a food barcode. The barcode is read on your device; no photos or video are stored or uploaded. Only the barcode number is sent to look the product up.
  • Notifications — if you allow them, we store a push token for your device so we can send reminders you have switched on.
  • Product analytics — simple in-app usage events (which screen, coarse counts, platform, app version) to decide what to improve. They never contain your email, name, food, weight, calories or step counts, and you can switch them off in Account settings. We do not use advertising or third-party tracking tools. Legal basis: legitimate interests.
  • Purchases — your plan, status and renewal dates, and the reference numbers our payment providers give us, so the right features unlock. We never receive your card details.
  • Technical data (IP address, device and app information, error logs) — for security, fraud prevention and keeping the service working. Legal basis: legitimate interests.
  • Support messages and feedback — to answer you and improve the app. Legal basis: legitimate interests.

Health-related information such as weight, steps and optional life-stage settings is special category data; we process it on the basis of your explicit consent, given when you enter it or connect a health source, and you can withdraw it by disconnecting, deleting the data or deleting your account. Health and fitness data is never used for advertising or marketing and is never sold.

FitQuest is for adults aged 18 and over. We do not knowingly collect data from anyone under 18.

3. Who we share it with

  • Hosting, database and infrastructure providers who run the app on our behalf.
  • Stripe, for Quest Pass subscriptions bought on our website: payments, receipts and invoicing.
  • Apple (App Store) and Google (Google Play), and RevenueCat, which confirms store purchases for us, for Quest Pass subscriptions bought inside the iPhone or Android app, where offered.
  • Apple and Google push notification services, to deliver notifications you have switched on.
  • Apple and Google, when you choose to sign in with your Apple or Google account.
  • Open Food Facts, when you look up a barcode or product (we send the barcode or search term only).
  • Strava, only if you choose to connect it.
  • Map search: some quests offer a "find a class near me" button that opens an ordinary map search in your browser or maps app. FitQuest does not read or store your location.
  • Professional advisers such as legal and accounting, and authorities where required by law.

We do not sell your personal data.

4. International transfers

Some providers process data outside the UK/EEA. Where that happens we rely on adequacy decisions or Standard Contractual Clauses with appropriate safeguards.

5. Retention and deleting your account

We keep your data for as long as your account is active. You can delete your account yourself at any time from Account settings, or at fitquestxp.co.uk/delete-account. This removes your profile, logs, progress, connected-app access and notification tokens straight away, and cancels a Quest Pass bought on our website. Billing records held by Stripe are retained where the law requires them for tax or accounting. A Quest Pass bought through the App Store or Google Play must be cancelled in your store account, and Apple or Google keep their own purchase records.

6. Your rights

Under UK GDPR you have the right to access, rectify, erase, restrict or port your data, to object to processing, and to withdraw consent at any time. Email us at hello@fitquestxp.co.uk and we will respond within one month. You can also complain to the Information Commissioner's Office (ico.org.uk).

7. Security

We use appropriate technical and organisational measures, including encryption in transit, hashed credentials and row-level database rules so that your logs are only readable by your own account.

8. Cookies and local storage

We use essential cookies and browser storage to keep you signed in and to remember your preferences. We do not use advertising cookies. You can clear these at any time in your browser settings, though signing in will be required again.