Legal
Privacy Policy
Last updated 6 September 2026
WimFIT is a HIIT interval-training app published by DirtyLab. This page covers two separate things: the website you are reading, and the mobile app. It says what we collect, what never leaves your phone, and what you can delete yourself.
Part 1 — The website
Who is responsible
WimFIT is published by DirtyLab, a French sole proprietorship, which is the data controller for everything described on this page. Every request goes through our support page.
The waitlist form
If you join the waitlist, we store your email address, your language (EN or FR), which form you used and the date. It serves one purpose: emailing you at launch. The legal basis is your consent, given when you submit the form. It is stored on Supabase, on servers in the European Union (Paris), and is never sold, rented or shared with advertisers.
Audience measurement on the site
This site loads a cookieless audience counter hosted by DirtyLab (dirtylab.fr/track.js). It counts page views, referrers and country. It sets no cookie, stores no IP address and no personal data — which is why there is no cookie banner here.
Part 2 — The mobile app
Your account is optional
You can train with WimFIT without an account. If you create one, authentication runs on Supabase Auth and we store your email address and a user ID, nothing else. You can sign in with an 8-digit code sent by email, or with Sign in with Apple or Sign in with Google, in which case we receive the email address attached to that account (Apple's private relay address if you chose to hide yours). Your sign-in session is kept encrypted in the iOS Keychain or the Android Keystore.
The WimFIT newsletter (opt-in)
When you set up the app, a checkbox offers to send you WimFIT news by email: new tracks and programs, a few times a year. It is unchecked by default, and nothing is sent unless you tick it. If you do, your email address is added to the newsletter list run by DirtyLab (stored in Airtable), subscribed to WimFIT only. Every email carries a one-click unsubscribe link, and you can ask us to remove you at any time through support, without losing your account.
Subscriptions and purchases
In-app purchases are handled by Apple and Google. We never see your card. To know which features you unlocked, we use RevenueCat, which stores your purchase history and an anonymous app/device identifier. We receive no name, no postal address and no payment details.
Your physical profile and body journal stay on your phone
Gender, weight, age and height, used only to estimate calories burned, and the weight and measurements journal you can keep in Progress, are stored encrypted in the iOS Keychain or the Android Keystore. They never leave your device. No server of ours ever receives them, so we could not hand them over even if asked.
Your workout history
Completed sessions are stored locally on your phone (AsyncStorage) and are not encrypted. We prefer to say so rather than claim that everything is encrypted, which would be false. This history is never uploaded to any server and it disappears when you uninstall the app.
Notifications
Training reminders are scheduled locally by your phone. There is no push token, no notification server, and no way for us to push anything to you through the app.
No analytics SDK in the app
The app embeds no analytics or crash-reporting SDK: no Firebase, no Sentry, no Amplitude, no advertising identifier. We do not know which workouts you run, how long you train, or when you open the app. That is a deliberate product choice, and it is verifiable in the app's list of dependencies.
Part 3 — Retention, age and your rights
How long we keep things
Waitlist email: until the launch email is sent, or until you ask for deletion. Account: for as long as the account exists; delete it and the record is erased immediately. Purchase history: kept by Apple, Google and RevenueCat under their own accounting obligations, which we do not control. Data on your phone: for as long as the app is installed. The newsletter list is a separate system: deleting your account does not remove you from it, use the unsubscribe link in any of its emails.
Minimum age
WimFIT is not intended for children under 16. We do not knowingly collect data from minors. If it happened anyway, write to us and we will erase it.
Your rights
Under the GDPR you can access, correct, export or delete your data, object to a particular use, or withdraw your consent — at any time and free of charge, through our support page. You can also lodge a complaint with your data protection authority; in France, the CNIL.
Deleting your account
You can delete your WimFIT account yourself, from any browser, without installing the app. The page below tells you exactly what is erased and what is not before you confirm anything.
Delete my accountContact
For any question about your data, or to exercise any of the rights above, reach us through our support page. We answer in French and in English.