a9fit Get early access

Privacy

The a9fit privacy policy. Last updated .

It is written to be read. The short version is the stance, and it is built into the product; the long version is the detail, category by category.

The short version

  • Your name never reaches the AI. Names, places, and contacts are scrubbed into tokens on a9fit’s server, before the AI sees a word. The coach coaches the tokens just as well.
  • A food photo is rewritten before it travels. Your phone rewrites the picture first, so the GPS fix, the device model, and the time it was taken don’t travel with it. The model reads it, and a9fit keeps the cleaned copy on your account — it’s in your export, and it goes when you delete.
  • A photo of you is read once, then let go. A form or progress shot goes up for a9fit to read, and a9fit’s end lets it go within a day. Tap Keep and a9fit keeps it on your account instead — in your history and your export. You can switch on face blur in the app; it runs on your phone, and a photo it can’t safely blur isn’t sent. With face blur off, a clip is uploaded exactly as recorded — nothing re-encodes it.
  • You can see what the app touched. A live audit feed in the app shows every access, built from real scrub events — not theater.
  • Export everything, delete everything. Export hands you every row a9fit holds, in one file. Delete erases the account for good — the thread, your plan, the log, every connection, the billing record, and the photos kept with it. There’s no soft version, and it can’t be brought back.
  • This site makes zero third-party requests. No trackers, no analytics beacons, no CDN fonts. Waitlist emails go to us and nowhere else.

What this covers

The a9fit app, this website, the coach desk at app.a9fit.ai, and the coach wherever it reaches you — your calendar, WhatsApp, SMS. a9fit is a Greenmusk product. Write to support@a9fit.com about anything here; the support page is the rest of the help.

What a9fit collects

What you say to the coach
The conversation is the product, so it is kept: what you typed, what the coach replied, and the plan that came out of it. It is how the coach remembers you next week.
Who you are
Your name and email address as your Apple or Google sign-in hands them over, your age from the first conversation, and your phone number if you verify one. Age is plan math, not a demographic: nothing else reads it.
Health and fitness
Weight, height, what you ate, what you lifted, how you slept, how a session went, and any condition or injury you mention. This is health data, it is the reason a coach can coach, and it is treated as the most sensitive thing here.
Photos and video
A plate or a label you photograph, and a picture or clip of you if you send one. The short version above says exactly where each lands and for how long.
What you ate, as numbers
For each plate you photograph, the protein and calories the coach estimated join a running total for that day — numbers only, never the photo, and never a label you scan. The last two weeks are kept, to tune how recovered your muscles are; they go when your account does.
Identifiers
An account id, and a per-install device id. Every cold launch asks Expo for an update manifest and carries that install id with it, which is a third party seeing a device identifier before you have done anything.
What you say to other people
Messages to a match, to a circle, and to a coach you work with through a9fit — a person, not the AI. These are kept so the conversation is there when you come back to it; the section on people below says who can read each one.
Proof of identity
If you verify your identity, a photo of an ID document and a selfie go to Stripe, which checks them. a9fit keeps that you were verified, and a one-way fingerprint of your name and date of birth — enough to stop one person holding two verified accounts, not enough to read either back. The document itself is not kept by a9fit, and once it is checked a9fit asks Stripe to delete it.
Purchases
Which plan you are on, when it renews, and what you have been charged. Your card number is not part of it — Stripe takes the payment and a9fit never sees the card.
How the app behaves
Which screens ran, what failed, how slow it was, and the app and device version behind it. There is no analytics SDK in the app and no event pipe to one: every product number is counted on a9fit’s own server, from data that is already there.
What you write to support
Your message and the address it came from, for as long as it takes to answer it.

What a9fit does not collect

Your precise location. Your contacts. Audio of any kind, because there is no voice route in the product at all. What you browse or search outside the app. Your card number. And no advertising identifier: the app asks for no tracking permission because it has nothing to ask for.

The scrub, and what the AI gets

The coach is a large language model, run for a9fit by an AI provider. Before a word of your conversation reaches it, a9fit’s server replaces the identifying parts — your name, the people you name, your gym, your street — with placeholders, and the model coaches those. It does not get your email, your phone number, your account id, or your billing record. The audit feed in the app is built from those events as they happen. Three providers can be asked: Anthropic writes the coaching today, Google’s model is what reads a plate or a label to say what is on it, and OpenAI is the alternative a9fit can switch the coaching to. Which one answered is a setting, not a change to any of the above — the scrub runs first either way. A smaller model from TypeSafe reads the same scrubbed words for quick judgments — whether a message is something a fitness coach should answer, and what a reaction means — and never sees a photo, a clip or anything about your cycle.

Matches, circles and coaches

A message to a match is read by the two of you. A message in a circle is read by the people in the circle, and someone who joins sees from the day they joined, not before. A message to a coach you work with is read by you and that coach, for as long as you work together. Nobody at a9fit reads these threads — unless someone reports a message, in which case that message is copied for review. The copy is kept for a year, even if the message itself is gone sooner, and then its words are deleted.

The AI coach joins a circle only if the circle’s organizer adds it, and it reads only when someone mentions it. It then gets the message that asked, what that message replied to, and the last few in the room — scrubbed first, so the people in it are placeholders to the model — along with the circle’s name, scrubbed the same way. It never gets anything from your own thread with the coach, your plan, or your photos.

A coach you work with — a person, not the AI — sees your first name and last initial. They see a summary of your training and food only after you have read its exact words and approved them, and you can take it back at any time. A clip reaches a coach only if you kept it and chose to share it, and the link they open it with lasts an hour. What you and your coach write to each other is people talking to people: it is not scrubbed, and it is not read by the AI.

A notification about a message shows what you choose in the app: nothing but that someone wrote, the sender’s name, or the first line of the message. A reply from the AI coach only ever says that someone wrote.

Who else touches it

Each of these works for a9fit, on a9fit’s instructions, and on nothing else:

  • Anthropic, Google and OpenAI — the models. Anthropic writes the coaching today and reads a photo when it is the one asked; Google’s model is the one that reads a plate or a label, and a photo or clip of you; OpenAI is the alternative the coaching can be switched to.
  • TypeSafe — a small model that makes quick judgments on the scrubbed text of a message, a coach’s reply or a reaction: whether it is a fitness coach’s to answer, and what a reaction means. It never sees photos, clips or cycle data.
  • Supabase — your account, the database, and the private bucket that holds cleaned food photos under your own prefix.
  • Fly.io — the servers the a9fit API runs on.
  • Google Cloud Storage — photos and clips of you, while they are held.
  • Expo — push delivery, and the update manifest every launch asks for. A notification’s text passes through it on the way to your phone.
  • Sentry — crashes and performance, so failures can be found and fixed.
  • Stripe — payments, and the card details a9fit never handles; identity checks, if you verify; and paying coaches.
  • Twilio — the code that verifies a phone number, and nothing else.
  • Resend — the email a9fit sends: a sign-in link, and a coach’s copy of the agreement they signed.
  • Cloudflare — hosts this site and the coach desk, checks that a sign-in on the desk comes from a person, and forwards mail sent to an a9fit address.
  • Google Calendar — only if you connect it, only under the grant you gave, and nothing is written to it without you confirming that card.

WhatsApp and SMS check-ins ride the messaging networks that carry them, so your number and those messages reach the provider that sends them. Nobody on this list is a data broker, an ad network, or an analytics vendor. Your data is not sold, not rented, and not handed over for anyone else’s advertising.

How long it is kept

Your conversation, your plan, your log and your profile last as long as the account does. So do your messages to other people. A photo or clip of you is held for about a day; keeping one holds it for as long as the account does. A cleaned food photo lasts as long as the account. Billing records outlive a deleted account only where a payment processor is obliged to hold them. Everything else goes when you delete, including every message you wrote to anyone. The other person in a conversation keeps what they wrote, and sees you as no longer available; a circle carries on without your messages; and where the AI coach named you in a circle, it now says “a former member”. Your export holds the messages you wrote, not anyone else’s.

What you control

Export everything and Delete everything are both in the Privacy Center in the app, and neither needs to be asked for. Connections are yours to disconnect one at a time. The audit feed shows what was touched and when. Cancelling a plan is two taps and takes nothing away before the month you paid for ends. Deleting is final: there is no soft version and no way back.

Where it is held

In the United States. The API runs in Virginia, the database beside it, and media in a US Google Cloud region. a9fit is available in the United States only today.

Age

a9fit is for 16 and over, and the Peers social tier is 18 and over. It is not built for children and is not offered to them. If you believe a child has an account, write to us and it will be erased.

When this changes

The date at the top is the version. A change that alters what is collected, who touches it, or how long it is kept is said in the app as well, in the coach’s own words, rather than left for you to find here.

Questions

support@a9fit.com, and a person reads it.