Privacy

What we keep, and why

Your account

The rider name you pick, and your password. The password is kept only as a one-way hash, so nobody can read it, us included. That's the whole account: no email, real name, birthday or payment details.

Why: so you're the same rider on every device you sign in on.

How you ride

Your speed, distance, time and climb; whether you run, walk or ride; and your cadence (steps or pedal turns a minute) when something counts it. While you ride, where you are on the game's roads, which is a place in the game's world and never in the real one. Your lifetime totals, your best times on the game's climbs, your training plans and paces, and how far along each quest you are.

Why: it's the game. It's how you level up, how other riders see you on the road, and how the boards are ranked.

Your heart rate

Only when a chest strap, your machine's grips or your Apple Watch is connected. It goes to the game you're riding, your iPhone's Lock Screen and the phone's remote, and nowhere else. The server keeps just the latest reading: for a minute for the game, and up to 12 hours for your Lock Screen. If you play turf, a ride with no workout is judged by your heart when something reads it, so the server keeps how long each stretch kept your heart in its easy zone, never the beats themselves.

Why: so you can see it while you ride. It's never on the boards, and never shown to other riders.

Your character and progress

Your level and points, what you've earned, your character's look and what it wears, the dog or cat that comes along, and where in the world you left off.

Why: so your character comes back as you left them, wherever you sign in.

Fair play

If what a ride says it did looks impossible for the time it took, or a game or a stretch of turf couldn't have gone that way, the server notes it with your account, and the boards leave out times that look impossible until a person has looked.

Why: so the boards are real.

Your purse

The coins the games pay you, and the looks you buy with them in the closet: for each game, which one it was, how you did, how long you played and when; for each look, what it cost. Coins aren't money. Nobody can buy them or cash them in.

Why: coins kept only on a device would be coins anybody could make, so the server keeps them.

Turf, if you play

Turf is off until you turn it on. Then: your best ride this week on each stretch of road you ride end to end, which is how much of it you kept in your own band, as a percent and in seconds (the band is your workout step's; with no workout, your heart's easy zone when something reads it, or else a steady pace round the one you settle into); how long and how far; when; and the colour you paint in. And who holds each stretch this week, and a tally of what you held at the end of each week.

Why: the turf map, where each stretch is held for the week by whoever rode it most cleanly in their own band.

Friends

The riders you add, and the riders who add you. Two riders who've added each other are friends. And whether you let your friends watch you ride.

Why: so you can see when your friends are out, and go and ride with them, or watch.

Watching, and links to watch you

Who's watching you ride right now, and whom you're watching. If you make a link to be watched from a browser: when you made it, for which ride, until when, and whether you stopped it. We keep only a scrambled copy of the link that can't be turned back into one that works; the device you made it on keeps the link itself. Somebody watching through a link needs no account, and we keep nothing about them but a word their browser makes up, for half a minute, to count them.

Why: so friends, family or a coach can follow your ride from another screen, and so you can see who's watching.

Rides you put on or join

A group ride's name (which its host types), its road and time, and who's signed up. In a trainer's class, where each person stands in the room: the trainer can arrange it by when people signed up, by level, with the newest faces at the front, or with friends side by side.

A picture you send to your phone

When you take a picture in photo mode on a TV and send it to your iPhone: the picture, and its name, which says when you took it. Only you can get it, and it goes once your phone has it.

Why: a TV has nowhere to keep a picture for you, so it reaches your phone through our server.

Your iPhone and Apple Watch

• Apple's push token for your iPhone, and the tokens for your Lock Screen's Live Activity: the addresses Apple gives us to reach your phone.
• What you want to hear about: which notifications, your quiet hours and time zone, miles or kilometres, the riders you've muted and the trainers you follow; and whether your iPhone lets notifications show.
• The notifications we've sent you in the last week, and whether you opened them, so we don't send too many.
• What you press on the phone's remote, the Live Activity and your watch, for the game on the big screen to act on.
• Your steps and pace, when your iPhone counts them from your pocket.

Why: so the phone and the watch work with the game, and so the notifications you want reach you.

Your devices

The model of each device you sign in on, like "iPad13,4" or "Apple Watch", and never a name you gave it.

Why: to tell your devices apart, and to show which one is asking to be signed in.

When something goes wrong in the game

The game tells our server about its own errors: what went wrong and where in the game's code, how often, which version of the game it was, and the kind of device and its system. Before it sends one, the game takes out anything that could be somebody's, like names, numbers and email addresses, and the server does it again. When the game crashed, froze, was slow to start or used too much of the device last time, it says so the next time it opens: where in its code, and how long or how much, from Apple's own report of it on iPad, Mac and Apple Vision Pro, and from the system's on Android. We don't keep who sent it or where from.

Why: so we can find what's broken and fix it. It goes to our own server, and nobody else's.

What iFIT's trainers say and type

When a trainer leads a ride, what they say into their microphone and what they type are passed live to the riders in it. They aren't recorded or saved as messages. Our database's change log holds them for 3 days, as it holds every change, and then they're gone. Only a trainer can speak to a ride, and only to one they're leading: the game never uses a rider's microphone.

The waitlist

If you give us your email address on planet-fit.app, we keep it, with when you gave it and, if the link said, where you found us, to tell you when the game opens.

What stays on your device

• Your weight, age and max heart rate. The game asks for your weight and age for heart-rate zones and watts per kilo, and you can give your own max heart rate for the zones. If you choose to show your watts per kilo on the boards, only that number leaves the device, never your weight.
• The riders you've ridden with in group rides, events and classes, so the game keeps them in sight in a crowd. It names them to the server when it asks who's near you, and the server keeps none of it.
• Your ride log: each ride's distance, time, speed, climb and heart rate.
• Your pictures and clips from photo mode, but for a picture you send from a TV to your phone.
• Your machine. The game talks to your treadmill or bike directly, over Bluetooth or your own network.
• Apple Health. Workouts the watch or the iPhone save to Health are yours, in Health, on Apple's terms. The apps ask you first.

The game's Delete from this device, in the ⋯ menu on its first screen, takes your rider and all of this off that device, and signs it out. It doesn't delete your account: see Getting a copy, or deleting it.

What we don't do

• No ads, and no advertising IDs.
• No tracking. Nothing about you is combined with other companies' data, and nothing follows you to other apps or websites.
• No selling or renting your data, to anybody, ever.
• No analytics companies. The game is built with Unity, and Unity's own reporting is switched off, its hardware statistics included, so Unity gets nothing from your device.
• No real-world location. The game's roads are made up, and they're the only place we know you are.
• Nothing from your phone's contacts. Friends are riders you add in the game.

Who sees what

• Every rider signed in to the game sees you on the road while you ride: your rider name, level, character and what it wears, the dog or cat with you, your wave, what you carry for a quest, where you are on the game's roads, how fast you're going, and whether you run or ride; their game is told the kind of device you're on, too. They see your best times on the boards, with your name and level; the rides you put on, with your name; your name on a ride you've signed up for, and where you stand in its class. And your watts per kilo, if you choose to show it.
• If you play turf, every rider signed in can see on the map the stretches you hold this week and held in the last few: your name, your colour, and how much of each you rode in your band.
• Your friends see a little more: when you're out, what you're doing, how far you've come this session, and which way you're taking at a fork. And they can watch you ride from their own screen, following you round the island, unless you say no in Friends. It's on until you do. While anybody watches, the game tells you who.
• Anybody with a link you make can watch you ride in a browser, with no app or account: your rider name and level, what you're doing, where you are on the game's map, your speed, the incline, how far and how long you've gone this ride, which way you're taking at a fork, and your watts per kilo if you show it. Never your heart rate. A link works only for the ride you made it in, four hours at the most, and stops when you stop it, make another, or say no to friends watching. You're told how many are watching from it, but not who.
• A trainer leading a ride sees who's signed up for it, and arranges where they stand in a class. While one of iFIT's trainers leads a live event, anybody signed in can watch them, and so can anybody with the event's link.
• Only you see your heart rate, your training plans, paces and quests, your purse, your own turf rides and weekly tallies, your notification choices, where you left off, who's watching you, and a picture you send to your phone.
• The people who run Planet Fit's server can see what it keeps, to keep it running and to answer what you ask us.
• Harper Fabric, Harper's hosted database service, runs that server and stores the data for us.
• Apple carries our notifications and Live Activity updates to your iPhone.
• Nobody else, unless the law makes us.

Where it lives

On Harper Fabric, on two servers in the United States, one in the east and one in the west. Each keeps a full copy, so the game keeps going if one is down. Nothing we keep is stored outside the US, wherever you ride from.

The apps talk to the server over encrypted connections, and passwords are kept only as hashes. A backup we take ourselves is kept private, and in the US.

How long we keep it

Most of it lasts while you ride, and goes by itself after you stop.

• Your progress (level, totals, character, where you left off): a year after you last ride or sign in.
• Best times on the boards and your purse: while you ride, and they go with your progress.
• Turf: your rides and who holds each stretch, six weeks; your weekly tallies, a year. Turning turf off deletes your rides and the stretches you hold at once.
• Friends: a year after whoever made the add last opened their friends.
• Training plans, paces and quests: two years after they last changed.
• A device's sign-in: a year after it was last used. Signing out ends it at once.
• Your iPhone's push token: 60 days after the app last opened. Your notification choices: a year after the app last opened. The notifications we sent you: a week.
• What's live (where you are on the road, your heart rate, what's on the big screen, your Lock Screen, who's watching you): from 30 seconds to 12 hours.
• A link to watch you: four hours from when you made it, stopped or not. An iFIT trainer's event link lasts until a while after the event.
• A picture on its way to your phone: until your phone saves it or you throw it away, and six hours at the most.
• Your account: until you delete it.
• Your waitlist email: until you ask us to take it off.
• The game's errors: 30 days after each last happened.
• Our database's change log holds every change for 3 days. Our server keeps counts of what it does, like how many riders are riding at once, with nobody named in them, for a year.
• Our server's logs say what it did and what went wrong, with no rider named in them. Our host keeps them, with no set end.
• Our own backups: now and then, before we change how the server stores things, we copy what lasts (accounts with their password hashes, progress, friends, purses and the rest) to put back if something goes wrong. We clear old copies as we take new ones, and aim to keep none longer than 30 days. Our host keeps no backups of our data, so these are the only ones.

Getting a copy, or deleting it

To delete your account, sign in and choose Delete account: in the game, in the ⋯ menu on its first screen; in the iPhone app, in Settings. You type your password again, so nobody who picks up a device you're signed in on can do it for you.

It takes your account and everything kept with it off our servers at once: your progress, best times, friends, plans, paces and quests, your purse, your turf (a stretch you held is open again), your links to watch you, the rides you put on, pictures waiting for your phone, and every device's sign-in, so every device you're signed in on is signed out. Your rider name is then free for anybody to take. What lingers: our change log for 3 days, other riders' notification history that names you for a week, notifications already on other people's phones, and a backup we took before you deleted until we clear it, which we aim to do within 30 days (if we ever put one back, we delete you again).

For a copy of everything we keep about you, or to have it deleted if you can't sign in (say you've forgotten your password), write to us at support@planet-fit.app with your rider name. We'll check the account is yours first, so nobody can ask for somebody else's, and tell you when it's done.

And at any time, on your own:

• Sign out of the game or the iPhone app, and that device's sign-in ends at once.
• The game's Delete from this device takes your rider off that one device, rides and all, and signs it out. Your account stays.
• Watching: in the game's Friends, say No to Let friends watch you ride, and no friend can watch you and no link of yours works. Stop link ends a link at once.
• Turf: turn it off in the game's Settings, under Games. Your turf rides and the stretches you hold are deleted at once; your past weeks' tallies stay, for you alone.
• Notifications, Health and Motion & Fitness can be turned off in your iPhone's Settings, or in the Health app.
• Waitlist: write to us and we'll take your address off.

Children

Planet Fit isn't for children under 13, and we don't knowingly keep anything about them. If you think a child under 13 has an account, write to support@planet-fit.app and we'll delete it.

Changes to this page

When what we keep changes, this page changes first: the date at the top, and a line here.

• 12 October 2026: our server's logs, which no longer name you, and our host, which keeps no backups of our data.
• 12 October 2026: friends watching your ride, and links to watch it; your purse; turf; the dog or cat with you, and your wave; where you stand in a class; the riders you've ridden with; your own max heart rate; what the game says when it froze or was slow; and our own backups.
• 12 October 2026: a picture you send from a TV to your phone.
• 12 October 2026: first published.

Questions

Anything about your data, or this page: support@planet-fit.app.