Privacy Policy

1. Who we are

Ditta ("Ditta", "we", "us", "our") is a mobile fitness application that generates personalized training plans.

Ditta is operated by an individual developer. The controller (responsable) of your personal data is:

This Privacy Policy explains what personal data we collect, why, who we share it with, how long we keep it, and what rights you have. It applies to the Ditta mobile application, the website at ditta.app, and our support channels (together, the "Service").

If you do not agree with this Policy, please do not use the Service.

2. Summary

3. Definitions

• Personal data — information relating to an identified or identifiable natural person.
• Processing — any operation performed on personal data.
• Sensitive / special category data — data concerning health, among other categories. It receives heightened protection under Mexico's Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP).
• Processor / subprocessor — a third party processing personal data on our behalf, under our instructions.
• Pseudonymized — data from which direct identifiers have been removed, so that it cannot be attributed to you without additional information kept separately.

4. Personal data we collect

4.1 Account and identity data

Ditta does not offer email-and-password registration. Accounts are created exclusively through Sign in with Google or Sign in with Apple, handled by Supabase Auth.

We receive from the identity provider:

We additionally generate and store: an internal Ditta user ID (UUID), a username, your account creation date, last sign-in date, and account status.

When you create your account from the Ditta sign-in screen, and whenever you accept an updated version in the app, we also keep a record of your acceptance of our Terms of Service and this Policy, including the Consumer Health Data Notice in Section 12: which documents and which version of each, the date and time, your platform (iOS or Android) and the app version. We use it only to show what you agreed to and when.

We never receive, see, or store your Google or Apple password.

4.2 Fitness profile data (collected during onboarding)

The 8-step onboarding flow collects the following, stored across four related records:

a) Training profile

b) Health metrics

c) Training schedule — preferred training days, preferred time of day (Morning / Afternoon / Evening), and session duration in minutes.

d) Available equipment — the equipment you select, or a flag indicating you train without equipment.

Optional fields may be skipped. If you skip them, Ditta will generate your plan using conservative defaults.

4.3 Training activity data

As you use the Service we record:

• Training plans generated for you and the parameters used to generate them
• Sessions started, completed, skipped or abandoned, with timestamps
• Exercises performed, sets, repetitions, loads and rest intervals
• Perceived effort and any feedback you give on a session or exercise
• Streaks, achievements, personal records and progress indicators
• Adjustments the system makes to your plan in response to your adherence

4.4 Subscription and transaction data

We never receive or store your payment card number, bank details, or billing address. All payment processing is performed by Apple (App Store) or Google (Google Play).

4.5 Device and technical data

• Device model, operating system and version, device language and region
• Ditta app version and build number
• IP address, present transiently in server request logs (retained per Section 9)
• Error traces generated by our own backend
• Push notification token — only if you enable notifications and grant the operating-system permission

Ditta does not currently include any third-party analytics, attribution, advertising or crash-reporting SDK. If we add one in the future, we will update this Policy and notify you before it takes effect.

4.6 Communications

If you contact support, submit feedback, or report a bug, we keep your message, your contact details, and any attachments.

4.7 What we do not collect

• Passwords (federated sign-in only)
• Payment card or bank data
• Precise geolocation or GPS coordinates
• Your contacts, photo library, camera or microphone
• Advertising identifiers (IDFA / AAID)
• Biometric identifiers such as fingerprints or face templates
• Data from Apple Health, Google Fit or any wearable device — Ditta does not currently integrate with these platforms
• Racial or ethnic origin, political opinions, religious beliefs, trade union membership, sexual orientation, or genetic data

5. Why we process your data, and our legal basis

The table identifies, under Mexico's LFPDPPP, which purposes are necessary to provide the Service, which are secondary, and which require your express consent.

You may object to processing for secondary purposes at any time (Section 10).

Where we rely on consent, you may withdraw it at any time. Withdrawing consent for health data means we can no longer generate injury-aware or personalized plans, and the core function of the Service will no longer be available to you.

6. Artificial intelligence and OpenAI

Ditta uses artificial intelligence as part of the Service. We want to be precise about what that means.

How it works. The logic that selects your exercises, sets, volume and progression runs deterministically on our own backend, using rules we designed. We use OpenAI's API to generate the natural-language explanations, coaching notes and session summaries that accompany your plan without ever exposing your personal data to them.

What we send to OpenAI. We transmit a pseudonymized version of your training context:

• Goal, experience level and lifestyle factors
• Injury areas
• Body metrics: weight, height, body fat percentage, resting heart rate, gender
• Available equipment, preferred days, preferred time of day, session duration
• Your completed session history and the performance data recorded in it

What we do not send. We do not transmit your name, email address, username, avatar, Google or Apple account identifier, Ditta user ID, IP address, or subscription details. OpenAI receives a training profile that is not linked to your identity.

Who OpenAI is and what they do with your data. OpenAI, L.L.C. (United States) acts as our processor under OpenAI's API terms and data processing agreement. Under those terms:

• API inputs and outputs are not used to train OpenAI's models by default;
• API data may be retained by OpenAI for a limited period (currently up to 30 days) for abuse and misuse monitoring, and is then deleted;
• OpenAI is contractually bound to confidentiality and security obligations and may not use the data for its own purposes.

Automated decision-making. We do not use AI to make decisions producing legal effects concerning you, or similarly significantly affecting you. Training recommendations are suggestions you are free to accept, modify or ignore.

Limitations. AI-generated content can be inaccurate, incomplete or inappropriate for your circumstances. It is general fitness information — not medical advice, diagnosis or treatment. See the Health and Safety Disclaimer in our Terms of Service.

Free-text fields. Where the Service allows free-text input, do not enter medical records, government identification numbers, financial details, or information about other people.

7. Who we share your data with

We do not sell your personal data. We share it only in the situations below.

7.1 Service providers (subprocessors)

Each provider is bound by a written data processing agreement, may process your data only on our documented instructions, and may not use it for its own purposes.

Ditta does not use any advertising network, data broker, attribution provider, or third-party analytics service.

7.2 Other disclosures

• Legal requirements. Where we are required to disclose data by law, court order, or a valid request from a competent authority. We will notify you unless legally prohibited from doing so.
• Protection of rights. Where necessary to investigate, prevent or act on suspected fraud, security incidents, violations of our Terms, or threats to anyone's safety.
• Business transfer. In connection with a sale, merger or transfer of the Service or its assets. We will notify you in advance, and your data will remain subject to this Policy or an equally protective one.
• Professional advisors. Lawyers and accountants bound by professional confidentiality obligations.
• With your consent. For any other purpose you specifically authorize.

7.3 What we do not do

• We do not sell personal data, and have not in the preceding twelve months.
• We do not share personal data for cross-context behavioral advertising, and have not in the preceding twelve months.
• We do not disclose health-related data to advertisers, data brokers, insurers or employers.
• Your profile, workouts and health data are never publicly visible. Ditta has no social, sharing or leaderboard features.

8. International transfers

The controller is located in Mexico. The Service is available worldwide except where stated in Section 8.2, and several of our subprocessors are located in the United States. Your personal data will therefore be transferred outside your country of residence.

8.1 Users in Mexico

Transfers to our providers are carried out in accordance with the LFPDPPP. Where the transfer is necessary to fulfil the legal relationship between you and us or to maintain the Service, we rely on the corresponding statutory exceptions; otherwise we obtain your consent. Our providers are contractually bound to the obligations we assume under this Policy.

8.2 Availability in the EEA and the United Kingdom

The Service is not offered to individuals located in the European Economic Area or the United Kingdom. We do not target those regions, and they are excluded from our App Store and Google Play distribution territories. If you are located in the EEA or the UK, please do not create an account or use the Service.

9. How long we keep your data

9.1 Account deletion — how it works

You may delete your account at any time from Profile → Account → Delete Account, or by writing to hi.ditta.app@gmail.com, opens in a new tab.

1. Immediate deactivation. When you confirm deletion, your account is deactivated at once. Your profile, plans and history become inaccessible, and we stop generating new content and sending notifications.
2. 30-day recovery window. If you sign in again with the same Google or Apple account within 30 calendar days, the deletion request is automatically cancelled and your account and all associated data are restored exactly as they were. No further action is required from you.
3. Permanent erasure. If you do not sign in within those 30 days, all of your personal data is permanently and irreversibly deleted from our production databases. This cannot be undone. Residual copies in encrypted backups are overwritten within 30 days thereafter.
4. Limited exceptions. We may retain, only for the periods stated above: transaction and billing records required by Mexican tax and accounting law; records necessary to establish, exercise or defend legal claims; and anonymized or aggregated data that can no longer be associated with you.
5. ⚠️ Your subscription is separate. Deleting your Ditta account does not cancel your paid subscription. Subscriptions are billed by Apple or Google and must be cancelled separately in your App Store or Google Play account settings. If you do not cancel there, you will continue to be charged.

You do not need to give a reason, and we will not make deletion conditional on anything.

10. Your rights

10.1 If you are in Mexico (LFPDPPP — ARCO rights)

You have the rights of Acceso, Rectificación, Cancelación y Oposición (ARCO), together with the right to revoke your consent and to limit the use or disclosure of your data.

Requests must be sent to hi.ditta.app@gmail.com, opens in a new tab and must include: your name and a contact address for our reply; documents evidencing your identity, or your representative's authority; a clear description of the data concerned; and any documents supporting the request. We will respond within the period established by the LFPDPPP and, where the request is well founded, give effect to it thereafter.

If you believe your rights have not been respected, you may file a complaint with the Secretaría Anticorrupción y Buen Gobierno (SABG), which assumed the data protection functions of the former INAI under the LFPDPPP in force since 21 March 2025.

10.2 If you are in California (CCPA/CPRA) or another U.S. state

You have the right to know what personal information we collect and how we use it; to request its deletion; to request correction; to opt out of the sale or sharing of personal information (we do neither); to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights. You may use an authorized agent, subject to verification.

We collect the sensitive personal information described in Section 4.2 and use it only to provide the Service you requested. We do not use or disclose it for any purpose that would trigger the right to limit under the CCPA.

10.3 How to exercise your rights

• Deletion and most corrections: directly in the app, from the Profile tab.
• Everything else: email hi.ditta.app@gmail.com, opens in a new tab with the subject line "Privacy Request".

We verify your identity by confirming control of the email address associated with your account, and may request additional information where the request concerns health data. We respond within 30 days, extendable where permitted by law and with notice to you. Exercising your rights is free unless a request is manifestly unfounded or excessive.

11. Age requirement

The Service is intended solely for adults aged 18 or over. You may not create an account or use the Service if you are under 18.

We do not knowingly collect personal data from anyone under 18. If we learn that we have, we will delete the account and the associated data promptly. If you believe a minor has provided us with personal data, contact hi.ditta.app@gmail.com, opens in a new tab.

12. Consumer health data notice

(This section is also published as a standalone notice at ditta.app/consumer-health-privacy, as required for residents of Washington State and other jurisdictions with consumer health data legislation.)

This notice forms part of this Policy. When you accept this Policy on the Ditta sign-in screen, you also accept this notice and consent to the collection and use of your consumer health data as described below. If you do not consent, do not sign in.

Categories of consumer health data we collect: body weight, height, body fat percentage, resting heart rate, gender, injury history, self-reported lifestyle and activity level, and exercise activity data including sessions performed, loads, repetitions and perceived effort.

How it is collected: directly from you, through the onboarding flow and through your use of the Service. We do not obtain health data from third parties, from affiliates, or from any wearable or health platform.

Why we collect it: solely to generate, adapt and explain your personal training plan, to filter exercises that may be unsuitable given your injuries, and to display your progress.

Who we share it with: only the processors listed in Section 7.1, and only for the purposes stated there. We do not sell consumer health data. We have never sold it and we do not offer it for sale.

Your rights: you may request confirmation of whether we collect, share or sell your consumer health data; a list of the third parties with whom we share it; deletion of it; and withdrawal of your consent to its collection and sharing. Send requests to hi.ditta.app@gmail.com, opens in a new tab. We will honour deletion requests, including by directing our processors to delete the data, within the timeframes required by applicable law.

How to withdraw consent: email hi.ditta.app@gmail.com, opens in a new tab, or delete your account in the app. Withdrawing consent means the Service can no longer generate a personalized plan for you.

Appeals: if we decline a request, you may appeal by replying to our decision. If your appeal is denied, you may contact your state Attorney General.

13. Security

We implement technical and organizational measures appropriate to the risk, including:

• Encryption in transit (TLS 1.2 or higher) between the app, our backend and our providers;
• Encryption at rest for the database and backups;
• Row Level Security policies in PostgreSQL, so each account can only access its own records;
• Federated authentication only — we never store passwords;
• Pseudonymization of data sent to our AI provider (Section 6);
• Least-privilege access controls, with multi-factor authentication on all administrative accounts;
• Segregation of production and development environments, with no production personal data used in development;
• Vendor due diligence and written data processing agreements with all subprocessors.

No system can be guaranteed to be completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent authority within 72 hours where required, and notify you without undue delay where the risk is high.

14. Automated decision-making and profiling

We use algorithmic profiling to build and adapt your training plan: your goal, experience, injuries, equipment, schedule and past adherence determine the exercises, volume and progression you are given.

This profiling does not produce legal effects concerning you or similarly significantly affect you. You may override any recommendation, change your profile at any time, and skip or substitute any exercise.

15. Cookies and similar technologies

The Ditta mobile app does not use cookies. It uses local device storage to keep you signed in and to cache your plan for offline use. That storage is cleared when you sign out or uninstall the app.

The website at ditta.app does not use cookies.

16. Changes to this Policy

We may update this Policy to reflect changes to the Service or to legal requirements.

• We will always update the "Last updated" date above.
• Whenever we publish a new version of this Policy, we will notify you inside the app and ask you to review and accept the new version. We keep a record of that acceptance (Section 4.1).
• For material changes — a new purpose for health data, a new category of recipient, the addition of analytics or advertising technology, or an integration with Apple Health or Google Fit — we will notify you at least 30 days in advance by in-app notice and, where we have a usable address, by email.
• Where a change requires your consent under applicable law, we will request it before the change takes effect. Continuing to use the Service after a non-material change takes effect means you accept the updated Policy.

Previous versions are available on request.

17. Contact

• Privacy enquiries and rights requests: hi.ditta.app@gmail.com, opens in a new tab
• General support: hi.ditta.app@gmail.com, opens in a new tab
• Postal address: Carretera Santiago Ocoyoacac, Edo de Méx, México

You may also lodge a complaint with your data protection authority:

• Mexico: Secretaría Anticorrupción y Buen Gobierno (SABG)
• California: California Privacy Protection Agency, or the Office of the Attorney General