Privacy Policy

Effective date: August 8, 2026

Carlsbad Fitness ("Carlsbad Fitness," "we," "us," or "our") is operated by EO VITA Inc, a California corporation. This policy explains what we collect through the Carlsbad Fitness mobile app, why, who we share it with, and the choices and rights you have.

We wrote this to be read. If anything is unclear, contact us at privacy@carlsbadfitness.com.

1. The short version

We read fitness data from Apple Health, with your permission, to calculate activity points.
We never use your health data for advertising, and we never share it with third parties for their own purposes.
We use your precise location only at the moment you tap "check in," never in the background.
We show other members your display name, rank, and score on leaderboards. You can turn that off.
We do not sell your personal information, and the app shows no ads. To measure whether our own ads on other platforms brought you here, the iOS app includes the Meta (Facebook) SDK; it can use your device's advertising identifier only if you allow the iOS tracking prompt, and it never receives your health, activity, points, name, or email (Section 7).
You can export or delete everything, from inside the app.

2. Who this applies to

Carlsbad Fitness is available to people 16 and older. We do not knowingly collect personal information from anyone under 16. If we learn that we have, we delete it. If you believe a child under 16 has given us information, contact privacy@carlsbadfitness.com.

Some features, including prize promotions if and when we offer them, are limited to members 18 and older.

3. What we collect

3.1 Health and fitness data (Apple Health)

With your permission, and only for the categories you allow, we read from Apple Health:

Workouts, including type and duration
Heart rate during workouts
Heart rate variability
VO2 max
Distance and active energy

How this is processed. Your raw heart rate samples are read and scored on your device. Individual heart rate readings are not uploaded to our servers. What we upload is the result: your weekly totals, including "intensity minutes," meaning minutes during a workout when your heart rate was above a set threshold.

Workout timing is a separate, optional permission. If you turn on workout verification, we additionally upload the start and end time of each workout, along with its type and computed minutes. We use this only to confirm that a venue check-in lines up with a real workout, which is how we keep the rewards program honest. This is off by default and you can turn it off at any time.

You can enable or disable each category of health sharing individually inside the app.

3.2 Location

We request location access while you are using the app only. We never collect your location in the background, and we never track your movements.

Location is used in two places:

The Clubs map, to show your position relative to nearby businesses.
Check-in, at the moment you tap the check-in button. We compare your reported position to the venue's location on our server to confirm you are there.

What we store for a check-in. Each check-in attempt records the coordinates and accuracy your device reported, the distance our server computed, the venue, and the time. We keep this for attempts that fail or that we flag as suspicious as well as for successful ones, because that record is how we detect and prevent fraud in a program where points convert to real rewards. We do not show internal review flags to members.

3.3 Account and profile

Email address and password, or, if you use Sign in with Apple, the identifier Apple provides. If you use Apple's private relay, we receive a relay address.
Your name, and a display name you choose for leaderboards
Date of birth, used to determine your age bracket for fair competition and to enforce the minimum age
Gender, used for leaderboard segmentation
Neighborhood, used for local leaderboards and nearby recommendations
A profile photo, if you add one
Your device's time zone, used to attribute activity to the correct week

3.4 Activity in the app

Your points ledger: every award and redemption, with its reason
Streaks, weekly scores, division standing, and leaderboard position
Check-in history
Teams you join or create, and friend connections
Rewards you claim and their status
Referrals you send or receive
Notification preferences
Support messages you send us

3.5 Technical data

A push notification token, if you enable notifications, which identifies your device
Device and app version information
Crash and error diagnostics, through our error monitoring provider, with personal details filtered out before transmission
App integrity attestation data (a device-generated public key and identifier used to confirm requests come from a genuine, unmodified copy of our app). This is not personal information about you and is not used to identify or track you.
Usage events, such as completing sign-up or onboarding, connecting Apple Health, or a sync failing, recorded in our own database so we can understand how the app is used. These never contain health values, names, or email addresses.

3.6 Information about other people

If you refer someone, we collect the contact information you provide for them in order to send the invitation. We use it for that purpose and do not add them to marketing lists. Please only share contact details of people who would welcome the invitation.

4. Why we use it

Purpose	What it relies on
Calculating your activity points and streaks	Health and fitness data
Ranking you on leaderboards and in divisions	Activity data, age bracket, gender, neighborhood
Confirming presence at a venue when you check in	Location, workout timing (if enabled)
Detecting and preventing fraud in the rewards program	Check-in records, attestation, activity patterns
Issuing and fulfilling rewards	Points ledger, claims, identity
Sending notifications you have opted into	Push token, preferences
Support	Your messages and account details
Keeping the app working and secure	Technical and diagnostic data
Legal compliance	As required

We do not use your health or fitness data for advertising or marketing, and we do not use it to build advertising profiles. This is both our policy and a requirement Apple places on apps that read from HealthKit.

5. What other members can see

If you participate in leaderboards, other members can see your display name, your rank, and your score, within the leaderboards you appear on (overall, your age bracket, your gender, your neighborhood, your team, and your friends).

They cannot see your real name, your email, your date of birth, your workouts, your heart rate, your location, your check-in history, or any other health data. Our systems are built so that this information is not accessible to other members, not merely hidden in the interface.

You can opt out. Turning off leaderboard visibility removes you from every public leaderboard and from division competition. You keep earning points, streaks, and rewards normally.

Team members can see contributions within their team. Friends you connect with can see each other on a friends leaderboard.

6. Who we share with

We do not sell your personal information. The only advertising-related technology in the app is the Meta ad measurement SDK described in Section 7, and it can use your device's advertising identifier only if you allow the iOS tracking prompt.

We share limited information with:

Partner businesses, when you claim a reward or check in at their venue. They receive what they need to honor a reward and confirm a visit. They do not receive your health data, your location history, or your contact information unless you choose to share it with them directly.

Service providers who operate the app on our behalf, under contracts limiting them to that purpose: our cloud database and authentication provider, Apple (for Sign in with Apple, push notifications, and app integrity attestation), our error monitoring provider, and our app build and delivery provider.

Meta, for ad measurement only, as described in Section 7. Those events never include your health or activity data, your points, your name, or your email.

Legal and safety, if required by law or to investigate fraud, protect our members, or protect our rights.

A successor, if the business is acquired or merged, in which case we will notify you and this policy will continue to apply until updated.

7. Advertising measurement (Meta SDK)

Carlsbad Fitness shows no ads. We do, however, run ads for Carlsbad Fitness on other platforms, such as Facebook and Instagram, and we need to know whether those ads actually bring new members to the app. For that one purpose, the iOS app includes the Meta (Facebook) SDK for ad measurement.

What is sent. When the app is installed or opened, the SDK reports an "app install" or "app activate" event to Meta so an install can be matched to one of our ads. These automatic lifecycle events are the only things sent. We log no custom events.
What is never sent. Your health and activity data, your points, your name, and your email are never sent to Meta. Nothing from Apple Health ever reaches an advertiser.
The advertising identifier is your choice. The first time you land on the Home screen after setting up your account, iOS shows its standard tracking prompt. Only if you tap Allow can the app read your device's advertising identifier and include it in those events. If you decline, the identifier is never read.
If you decline. Ad measurement falls back to Apple's SKAdNetwork and AdAttributionKit, which report only aggregate, anonymous install counts. Nothing in that path identifies you or your device.
Changing your mind. You can change your choice at any time in the iOS Settings app, under Privacy and Security, then Tracking.

8. Prize promotions

We have built the ability to run contests and prize promotions and may enable them in the future. When we do:

Entry is free. You will never be able to buy points, and no purchase will ever improve your odds or your standing.
Contests are decided by measured activity, meaning skill, not by random chance, unless a specific promotion states otherwise and follows applicable sweepstakes rules.
Each promotion will have published official rules stating eligibility, prize value, dates, and how winners are chosen.
Prize promotions are limited to members 18 and older.
If we award prizes totaling 600 dollars or more to you in a year, US tax law requires us to collect tax information from you and report the amount.

9. How long we keep it

We keep your information while your account is active.

Health, workout, and activity data: deleted when you delete your account or clear your activity history.
Check-in records, including failed and flagged attempts: retained while your account is active for fraud prevention, and deleted with your account.
Points ledger: our ledger is append-only and cannot be altered, which is what makes point balances trustworthy. When you delete your account, ledger entries are de-identified so they no longer connect to you.
Support messages: retained for a reasonable period for service and legal purposes.
Diagnostics: retained on a short rolling window by our monitoring provider.

10. Your choices and rights

In the app, under Account, you can:

Turn each category of health sharing on or off, including workout verification
Turn leaderboard visibility on or off
Manage notification preferences
Export your data, receiving a machine-readable copy of what we hold
Delete your account, which removes your personal information as described above

You can also revoke Health and Location permissions at any time in iOS Settings.

By contacting us at privacy@carlsbadfitness.com, you may request access, correction, deletion, or a copy of your information. We may need to verify your identity first. We will not treat you differently for exercising any privacy right.

11. California residents

If you are a California resident, you have the right to know what we collect and why, to access a copy, to correct inaccurate information, to delete it, and to limit use of sensitive personal information. You may use an authorized agent.

The categories we collect are described in Section 3. Health information and precise geolocation are treated as sensitive personal information under California law. We use them only to provide the features described in Section 4, and not to infer characteristics about you.

We do not sell personal information and we do not share it for cross-context behavioral advertising. We have not done so in the preceding twelve months.

To exercise these rights, use the in-app controls or contact privacy@carlsbadfitness.com.

12. Security

We protect your information with encryption in transit, access controls that restrict each member's data to that member, and server-side enforcement of those controls rather than relying on the app alone. No system is perfectly secure, and we cannot guarantee absolute security.

13. Changes

We may update this policy. When we make a material change, we will update the effective date and, for significant changes, ask you to review and accept the updated policy the next time you open the app.

14. Contact

EO VITA Inc Attn: Privacy 2868 Trails Lane, Carlsbad, CA 92008

privacy@carlsbadfitness.com