Xenitia Privacy Policy
Effective date: 3 September 2026
Last updated: 15 October 2026
Xenitia is operated by Xenitia Limited ("Xenitia", "we", "us", or "our"), based in Auckland, New Zealand.
This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you use the Xenitia application for iPhone, Android and Apple Watch and its related services (together, the "App"). We are subject to the New Zealand Privacy Act 2020. Additional rights may apply depending on where you live, including in the European Economic Area ("EEA"), United Kingdom, and California.
1. Information we collect
1.1 Account and profile information
When you create or use an account, we may collect:
- your email address and account identifier;
- your display name, username, profile photo, biography, profile location, and profile visibility choices;
- authentication information supplied through email sign-in, Sign in with Apple, or Google Sign-In; and
- records of follows, blocks, clubs, challenges, notification preferences, and other account settings.
Passwords used for email sign-in are handled by our authentication provider. We do not receive or store your password in readable form. Apple or Google may provide a relay email address or limited profile information when you choose their sign-in service.
1.2 Workout, fitness, and body information
The App stores information you choose to record or generate while training, including exercises, routines, sets, repetitions, weights, rest periods, duration, training notes, personal records, race or simulation results, scheduled workouts, and training statistics.
You may also choose to record body weight. Progress photos attached to a body weight entry are currently stored only on your device and are not uploaded to Xenitia's servers.
If you use the Apple Watch workout experience and grant Health access, the App may read heart rate and active-energy information during your workout. Workout summaries, including heart-rate series and active energy, may be saved to your Xenitia account and synced through our backend. Xenitia currently does not save completed workouts back into Apple Health.
On Android, optional Health Connect access lets Xenitia read heart rate and active-energy information for a workout and write body-weight entries when you choose to log them. Health Connect permissions are managed on your device. With your permission, a connected Bluetooth heart-rate sensor can also supply workout readings. Saved workout summaries may include these readings and sync to your Xenitia account.
1.3 Content and social activity
If you use social features, we collect content and activity you choose to provide, such as posts, comments, workout shares, photos, profile highlights, likes, follows, club participation, challenges, reports, and blocks. Content you make public or share with a group is visible to the audience indicated in the App. Private workout and account information is not made public merely because you have an account.
1.4 Gym and location information
With your permission, the App uses precise location while the App is in use to find nearby gyms, suggest where you are training, and associate a selected gym with a workout. The App does not create a continuous location history. We may store the gym associated with a workout, gym-presence information needed for features you use, and gym equipment information or photos you choose to submit.
Location access is optional. You can search for or select a gym manually if you do not grant location access.
1.5 Motion captures for rep-detection research
Automatic rep counting processes Apple Watch accelerometer and gyroscope data on your devices. Ordinarily, Xenitia stores the resulting rep counts and workout records rather than the raw sensor stream.
Separately, the App offers an optional setting that allows labelled raw motion captures to be uploaded to Xenitia's private storage and used to train and evaluate rep-detection models. This setting is off unless you enable it. An uploaded capture can include time-series motion measurements and labels linking it to the exercise, set, session, and your account identifier.
You can disable this setting at any time to stop new captures and stop existing captures from being used for future training. You may request deletion of previously uploaded captures by contacting us or by deleting your account.
1.6 Voice commands and on-device AI
On iPhone, if you use voice commands, the App captures audio and uses Apple's on-device speech recognition. Voice recordings and transcripts are not uploaded to Xenitia or sent to a third-party AI service. The workout action produced from a voice command may be saved to your account in the same way as an action entered manually.
Optional AI-assisted features on supported iPhones use a model downloaded to and run on your device. Your workout information is not sent to Google or another hosted AI provider to generate those results. Some generated results, such as an insight narrative, may be saved to your Xenitia account so they remain available across devices. The model-download service may receive ordinary request information such as IP address, request time, and model version.
1.7 Support, safety, and communications
If you contact support, suggest a feature, or report content, we collect the information you submit. This can include your email address, description, screenshots, selected issue category, app version, device model, operating system version, and identifiers needed to investigate the issue. Device details are included only when the support flow says they will be shared.
Content reports include the reported item, reason, time, and identifiers needed to investigate and prevent abuse. We do not reveal a reporter's identity to the reported user.
1.8 Technical information
Our servers and service providers may automatically process IP address, request time, authentication and security events, device or push-notification token, and similar technical information needed to operate, secure, and troubleshoot the service.
Xenitia does not currently include a third-party advertising SDK or a third-party product-analytics SDK. If you choose to share diagnostics with app developers through Apple, Apple may provide crash or performance information to us under your Apple privacy settings.
2. How we use information
We use personal information to:
- create, authenticate, maintain, and secure accounts;
- provide workout logging, device sync, statistics, routines, rep counting, HealthKit- or Health Connect-supported workout summaries, gym features, and social features;
- deliver notifications and service communications you request;
- provide support and investigate technical problems;
- filter, review, and respond to potentially objectionable or abusive content;
- prevent fraud, spam, security incidents, and misuse;
- improve the App and, only with separate opt-in consent, train and evaluate rep-detection models using raw motion captures;
- comply with legal obligations and enforce our Terms and Conditions; and
- establish, exercise, or defend legal claims.
We do not sell personal information. We do not use fitness, HealthKit, Health Connect, precise location, or raw motion information for third-party advertising, and we do not track users across other companies' apps or websites for advertising.
Legal bases for EEA and UK users
Where the GDPR or UK GDPR applies, our legal bases depend on the feature and information involved:
- Contract: providing the account, workout, sync, and social services you request.
- Consent or explicit consent: optional HealthKit access, precise location, microphone and speech access, raw motion capture uploads, notifications, and other processing where consent is required. You may withdraw consent through the relevant App or device setting without affecting earlier lawful processing.
- Legitimate interests: securing and improving the service, preventing abuse, providing support, and moderating content, balanced against your rights.
- Legal obligation and legal claims: complying with law and protecting legal rights.
Where information qualifies as health or other special-category data, we rely on explicit consent or another basis permitted by applicable law.
3. Content moderation
The App applies automated, rule-based screening to some text submitted for social features. We may also review content after it is reported. At present, Xenitia does not send user-generated content to OpenAI or another external AI moderation provider.
Moderation records are used to assess reports, enforce community rules, protect users, identify repeated abuse, and meet legal obligations. Decisions may result in content removal, feature restrictions, suspension, or account termination. You may contact us if you believe we made a mistake.
4. When we disclose information
We disclose personal information only as needed for the purposes in this Policy, including to the following service providers:
| Provider or service | What it does and information involved | Main processing location |
|---|---|---|
| Supabase, hosted on Amazon Web Services | Authentication, database, private file storage, data synchronisation, and server functions. Processes account data and the App data you save. | Sydney, Australia (ap-southeast-2) and provider support locations |
| Apple | App distribution, Sign in with Apple, push notifications, MapKit gym search, and device frameworks such as HealthKit and Speech. Information depends on the feature and your Apple settings. | Global infrastructure |
| Android distribution through Google Play, push notifications through Firebase Cloud Messaging, Google Sign-In when selected, and retrieval of gym-brand website icons. Information may include app and device diagnostics, push tokens and notification payloads, selected sign-in information, and ordinary request metadata. Health Connect permissions are managed on your Android device. | Global infrastructure | |
| OpenStreetMap Overpass service | Gym discovery and enrichment, including requests from the Android app for places in the search area. Requests may include the search area and ordinary request metadata. We do not intentionally send your account identity to this service. | Germany and service infrastructure |
| Slack | Operational alerts for support requests and content reports. A support alert may contain the email, description, device details, and request identifiers you submit; moderation alerts omit the reporter's identity. | United States and global infrastructure |
| Xenitia model-download and web hosting services | Delivery of on-device model files and public web content; may process IP address and request metadata. | Provider infrastructure |
We require service providers to protect information appropriately and process it only for the contracted purpose.
We may also disclose information when reasonably necessary to comply with law, a court order, or a lawful government request; investigate or prevent harm, fraud, or security incidents; enforce our Terms; protect rights and safety; or complete a merger, acquisition, financing, or sale of assets. If ownership changes, this Policy will continue to apply until users are notified otherwise.
Public or group-visible content is disclosed to other users according to the sharing and visibility settings you choose.
5. International processing
We are based in New Zealand, while providers may process information in Australia, the United States, Germany, and other locations. Those locations may have different privacy laws from your home country. Where required, we use contractual or other safeguards for overseas disclosures, consistent with Information Privacy Principle 12 and applicable GDPR transfer requirements.
6. Retention
We retain account information and App data while your account is active and for as long as reasonably necessary to provide the service. More specifically:
- private workout, body, HealthKit-derived summary, social, and account data is retained until you delete it or delete your account, unless a shorter period applies;
- raw motion captures are retained only while needed for the consented model training and evaluation purpose, and are no longer used for future training after consent is withdrawn;
- reports, blocks, support records, and relevant evidence may be retained after account deletion for as long as reasonably necessary to protect users, respond to the request, prevent repeated abuse, resolve disputes, or comply with law;
- security and operational logs are retained for a limited period determined by their security and troubleshooting purpose; and
- de-identified statistics that can no longer reasonably identify you may be retained for research, measurement, and service improvement.
When account deletion is completed, we delete or de-identify associated personal information from active systems unless retention is legally required. Residual encrypted backup copies may remain temporarily through the ordinary backup lifecycle and are not restored for ordinary product use.
We use purpose and legal necessity—not an unsupported fixed number of days—to determine retention. You may contact us for more information about the period applicable to a particular record.
7. Your choices and rights
- Account deletion: You can initiate deletion in Settings → Account → Delete Account. This deletes the account rather than merely deactivating it. You can also request account or specific data deletion by email, without reinstalling the App. That page explains ownership verification, what is deleted, and retention exceptions.
- Access and correction: You may request access to or correction of personal information we hold about you.
- Data copy: You may request a copy of your information by contacting us. The App does not currently provide a self-service export tool.
- Content and profile controls: You can delete content and change available sharing, profile, club, notification, and blocking settings in the App.
- Device permissions: You can withdraw location, microphone, speech, notifications, motion, Bluetooth, and Health permissions in the App or your device settings. Some features will stop working without the related permission.
- Raw motion consent: You can disable raw motion capture in the App to stop new uploads and future model-training use.
New Zealand users may complain to the Office of the Privacy Commissioner at privacy.org.nz if they are dissatisfied with our response.
EEA and UK users may also have rights to erasure, restriction, objection, data portability, and withdrawal of consent, and may complain to their local data protection authority. These rights may be subject to lawful exceptions.
California residents may have rights to know, correct, delete, and receive a copy of personal information. Xenitia does not sell personal information or share it for cross-context behavioural advertising.
To exercise a privacy right, contact privacy@xenitia.app. We may need to verify your identity. We will respond within the period required by applicable law, including generally within 20 working days for access and correction requests under the New Zealand Privacy Act 2020.
8. Security
We use technical and organisational safeguards appropriate to the information we process. These include encrypted network connections, provider-managed encryption at rest, access controls, private storage buckets, authentication, and database row-level security. No security measure is perfect, and we cannot guarantee that information will never be lost, misused, or accessed without authorisation.
If a privacy breach has caused or is likely to cause serious harm, we will notify affected people and the New Zealand Privacy Commissioner when required.
9. Children and young people
Xenitia is a general-audience fitness service and is not directed to children under 13. We do not knowingly collect personal information from a child under 13. If you believe a child under 13 has provided personal information, contact us at privacy@xenitia.app and we will investigate and take appropriate steps, including deleting the information when required.
If you are not legally able to make your own decisions about use of the App or the processing of your information, use the App only with the involvement and permission of a parent or legal guardian. We encourage parents and guardians to help young people understand their privacy and sharing choices.
10. Changes to this Policy
We may update this Policy as the App, providers, or law changes. We will post the revised Policy and update the date above. If a change materially affects how we use personal information, we will provide additional notice through the App or by email where appropriate and seek consent where required.
11. Contact
Xenitia Limited
Auckland, New Zealand
Privacy: privacy@xenitia.app
Support: support@xenitia.app