Privacy
Floth is privacy-first by design: you train under a nickname, your location is only ever an approximate area, and we do not sell your data.
1. Who is responsible for your data
Floth is a product of AIX Foundry (aixfoundry.co.uk), a brand of Thing That Matters Ltd — the data controller. Registered in England and Wales, company number 11081268. For any privacy question or request, contact [email protected].
2. What we collect
Account: your email address and a nickname (you train under a nickname, not your real name). Profile: approximate home area, chosen activities, preferred training time, goals, streaks and session totals, an optional short bio, and optionally your gender, birth year, phone number and an emergency contact name and number. Activity: sessions you record, rooms you join, high-fives, and messages you send. Health: if you connect Apple Health or Health Connect, we read workouts, steps, active energy, exercise minutes and distance, and you may enter your current and target weight. Technical: a push notification token, app and device diagnostics, and error reports.
3. Health data — the special category
Health and fitness data is “special category” data under UK GDPR Article 9. We process it only with your explicit consent, given when you connect a health app or enter a weight, and only to show your own progress and to let Flo plan around what you have already done. You can disconnect a health source at any time in Devices, and you can delete the data. We never sell it, never use it for advertising, and never share it with other members or with partner gyms.
4. Location
Your location is stored and shown to others only as an approximate area — a postcode district such as “BR6”, which covers thousands of addresses. We never store or display your exact address. If you allow precise location, the coordinates are used at that moment to fetch local weather (via Open-Meteo) so Flo can plan around rain or heat, and are not retained.
5. Why we can use your data (lawful bases)
Contract: to give you an account and the core features you asked for. Consent: for health data, precise location, push notifications and marketing email — each is optional and each can be withdrawn. Legitimate interests: to keep the service safe and working, prevent abuse, and fix errors. Legal obligation: where the law requires us to keep or disclose records.
6. Who we share it with
We do not sell your personal data and we never have. We use a small number of processors who handle data on our instructions: Supabase (database and authentication, hosted in the EU), LiveKit (live audio and video rooms — audio is not recorded or stored), Expo (push notification delivery), Amazon Web Services (service emails, hosted in the UK), Sentry (error diagnostics), Open-Meteo (weather and geocoding), and Anthropic and Google (AI text generation for Flo). Some of these are outside the UK; those transfers rely on the UK International Data Transfer Addendum or equivalent safeguards.
7. What Flo, our AI companion, is given
To write you a message or plan your week, Flo is given: your nickname, your chosen activities, your approximate home area, your streaks and session totals, your preferred training time, any event you have told it about, and — where you have set them — your goal, your current and target weight, and a summary of workouts synced from your watch or health app (activity type, distance and minutes, plus your daily step count). Weight is used to estimate calories. Your health data — weight, synced workouts and step count — is only ever included if you have explicitly turned on “Let Flo use my health data” in Settings. That setting is OFF by default. With it off, Flo plans normally but never receives any of it. With it on, that data is sent to our AI providers, Anthropic and Google, to generate the text, and you can withdraw it at any time. Flo is NOT given your email address, phone number, emergency contact, gender, birth year, or your precise location. Flo’s messages are generated, not written by a person. Our providers do not use your data to train their models, and you can turn Flo’s notifications off at any time.
8. Other people’s data
If you add an emergency contact, you are giving us someone else’s name and phone number. Please make sure they are happy for you to do that. We use it only if there is a genuine safety concern arising from your use of Floth.
9. How long we keep it
We keep your account data while your account is open. If you delete your account, your profile, sessions, messages and health data are deleted or irreversibly anonymised within 30 days, except where we must keep something to meet a legal obligation. Error diagnostics are kept for up to 90 days.
10. Your rights
Under UK GDPR you can ask us for a copy of your data, correct it, delete it, restrict or object to how we use it, or receive it in a portable format. Where we rely on consent, you can withdraw it at any time without affecting what came before. Email [email protected] and we will respond within one month. If you are not satisfied you can complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113).
11. Age
Floth is for people aged 16 and over. We confirm age at sign-up and enforce it on our servers, not just in the app. If we learn that someone under 16 has created an account, we delete it.
12. Demo accounts
So that a new member does not open an empty app, some areas show profiles and rooms run by Floth itself. These are clearly labelled with a “Floth” badge, they cannot message you and you cannot message them. They are ours, not other members, and we do not pretend otherwise.
13. Security
Data is encrypted in transit. Access to your rows is enforced at the database level, and sensitive fields — including your phone number, emergency contact, weight, gender and birth year — are blocked from client access entirely and readable only by our servers.
14. Changes
If we change how we use your data in a material way, we will tell you in the app before it takes effect. The date at the top of this notice always shows when it last changed.
Questions? [email protected]