Privacy Notice — My PCOS Fit

1. Who we are

This Privacy Notice describes how BYBY FITNESS ("we", "us", "our"), operator of the My PCOS Fit service (the "Service"), collects, uses, and shares your personal data. BYBY FITNESS is the data controller for information collected through the Service. Contact us at privacy@mypcosfit.com.

2. Categories of personal data we collect

Account data — email address, hashed password, account ID.
Cycle & fitness data — self-reported cycle length, period start date, completed workouts, routine preferences.
Usage & device data — pages visited, feature usage, IP address, browser and device identifiers, timestamps, referrer.
Support data — messages you send us and metadata related to them.
Payment metadata — subscription status, plan, and billing period. Card details are collected directly by our payment processor and are never stored on our systems.

3. Purposes and legal bases

Providing the Service (contract): create your account, sync your cycle phase, save routines, track workouts.
Security and fraud prevention (legitimate interests): detect abuse, protect accounts.
Product improvement (legitimate interests): understand feature usage in aggregate.
Customer support (contract / legitimate interests): respond to your requests.
Legal compliance (legal obligation): tax, accounting, and other regulatory obligations.

4. Who we share data with

Merchant of Record — Paddle.com Market Ltd. handles all sales, subscription management, payments, tax compliance, invoicing, and billing support. See Paddle's privacy notice.
Hosting & infrastructure providers (Lovable Cloud / Supabase) — store your account and app data.
Professional advisers — legal, accounting, or auditors when necessary.
Authorities — where required by law, court order, or to protect rights.

5. Data retention

We keep account and fitness data for as long as your account is active. When you delete your account, we delete or anonymise your data within 90 days, except where we must retain records to comply with legal, tax, or accounting obligations (typically up to 7 years for billing records).

6. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or port your personal data, to object to processing, and to withdraw consent. You may also lodge a complaint with your local supervisory authority. To exercise any right, email us at privacy@mypcosfit.com. We respond within one month.

7. International transfers

Data may be processed in countries outside your own. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses or adequacy decisions) to protect your data.

8. Security

We use appropriate technical and organisational measures — encryption in transit, access controls, row-level security on user data — to protect your information. No system is perfectly secure, but we work hard to keep yours safe.

9. Cookies

We use essential cookies and local storage to keep you signed in and remember your preferences. We do not use advertising cookies. If we add analytics cookies in future, we'll update this notice and ask for your consent where required.

10. Changes to this notice

We may update this notice from time to time. Material changes will be notified via the Service or by email.