1. What it covers
This policy applies to the myfitnessclient.com website, the web application and the MyFitnessClient apps for iOS and Android. The controller is Vasco José Cardoso Correia, sole trader, tax identification number (NIF) 262045630 (contact details in section 7). It covers cookies and similar technologies: local storage in the browser or on the device, identifiers and measurement pixels.
2. The rule
We only store or read information on your device without asking for consent when this is strictly necessary to transmit a communication or to provide the service you requested (Article 5 of Law no. 41/2004). Everything else depends on your prior consent, given by category. Refusing does not prevent you from using the website.
3. Categories
Essential (always active): session, security, anti-bot protection, language, your cookie choice, operation of the app and performance measurement during the visit, without a persistent identifier.
Statistics (with consent): Google Analytics 4 (Google), to count visits to the public website, and our own record of your visit to the public pages: the pages you open, clicks, scrolling, the field you are typing in (not what you type) and the mouse path, without the content of the pages. This record makes it possible to replay the visit schematically and is linked to your account if you are signed in. Google may process data in the USA, under the EU-U.S. Data Privacy Framework.
Ad measurement (with consent): OpenAI's and Meta's measurement pixels and, if you create a professional account, the sending of the registration event to OpenAI and Meta from our server, with your email and account identifier hashed (SHA-256), your IP address, your browser and, for Meta, the browser and click identifiers (_fbp and _fbc), to find out whether the registration resulted from one of our ads on ChatGPT, Facebook or Instagram. We also store the source of the visit (campaign parameters and ad click identifiers) and the code of the partner in the link you followed, where it gives you no benefit. For collecting this data and sending it to Meta, we are joint controllers with Meta Platforms Ireland Limited, which then processes it as an independent controller, including to optimise the delivery of our ads. OpenAI and Meta may process data in the USA. We do not show advertising on the website.
Third-party content: the booking calendar (Calendly) only loads when you click to open it; YouTube and Vimeo videos appear in the signed-in areas and in the Help Center. When they load, those services receive your IP address and may store data on your device, in accordance with their own policies.
4. List of cookies and storage
| Name | Provider | Purpose | Duration | Category |
|---|---|---|---|---|
| accessToken, refreshToken | MyFitnessClient | Signed-in session (inaccessible to scripts) | 15 minutes / 30 days | Essential |
| mfc_instance | MyFitnessClient | Identifying this browser installation in order to replace an earlier sign-in to the same account (not used for tracking) | 1 year | Essential |
| g_oauth_*, g_pending_*, g_signup_return, g_link_result, g_2fa_session | MyFitnessClient | Sign-in and registration with Google and the two-factor step | Up to 15 minutes | Essential |
| a_oauth_* | MyFitnessClient | Sign-in and registration with Apple | Up to 10 minutes | Essential |
| previewToken | MyFitnessClient | Preview of the client app by the professional | Up to 15 minutes | Essential |
| mfc_logout_pending, mfc-auth-transition | MyFitnessClient | Signing out securely and synchronising tabs | Up to 30 days / session | Essential |
| locale, mfc-lang | MyFitnessClient | Chosen language | 1 year | Essential |
| mfc_ref, mfc_aff | MyFitnessClient | Code of the invitation or partner in the link you followed, where it gives you a benefit on registration, to apply it and to record who brought you | 30 days | Essential |
| __cf_bm, cf_clearance, _cfuvid | Cloudflare | Anti-bot protection and Turnstile | Up to 30 minutes, or as set by Cloudflare | Essential |
| mfc-cookie-consent (local storage) | MyFitnessClient | Storing your choice, the version and the date | Until you change it | Essential |
| Local and session storage of the app (theme, workout state, drafts, device, notices seen, offline use) and service worker | MyFitnessClient | Operation of the app and the notifications you asked for | Until you sign out (account data) or until you clear your browser data (preferences, device and notices seen) | Essential |
| mfc.perf.sid (session storage) | MyFitnessClient | Grouping performance metrics and usage analysis during the visit to the tab, without a persistent identifier | Until you close the tab | Essential |
| _ga, _ga_<id> | Statistics for the public website | 2 years | Statistics | |
| mfc.activity.did (local storage) | MyFitnessClient | Identifying the device in the record of clicks and navigation, only with consent | Until it is deleted | Statistics |
| __oppref, __obref | OpenAI | Click on the ChatGPT ad and browser identifier for measurement | 30 days / 365 days | Ad measurement |
| _fbp, _fbc | Meta | Browser identifier and click on the Facebook or Instagram ad, for measurement | 90 days | Ad measurement |
| mfc_src | MyFitnessClient | Source of the visit (campaign, click identifiers and referring site), linked to the account if you create a professional account | 30 days | Ad measurement |
| mfc_aff | MyFitnessClient | Code of the partner in the link you followed, where it gives you no benefit, to record through which partner you arrived | 30 days | Ad measurement |
In the mobile apps, the session is stored in the device's secure storage and the coaching content in an encrypted local copy for offline use, which may remain on the device after you sign out and is deleted when you delete your account in the app or uninstall the app. The apps do not use ad measurement or advertising tracking.
5. Signed-in areas
In the professional's dashboard and in the client app we do not use Google Analytics or ad measurement. We record navigation and actions on the platform to fix errors and improve the service, as described in the Privacy Policy (sections 2.8 and 3); you can object via [email protected]. Without your consent to statistics, the device identifier used in this analysis is not stored in the browser. In the mobile apps, this analysis stores no device identifier.
6. Managing and withdrawing consent
You can accept all, refuse the non-essential ones or choose by category in the cookie notice. You can change or withdraw your choice at any time through “Cookie settings”, in the website footer, or through the button below. When you withdraw consent, we delete the cookies in that category that the browser allows us to delete. We ask for your choice again when we add a purpose. You can also block or delete cookies in your browser settings, although this may affect how the website works. Withdrawal does not affect the lawfulness of processing already carried out.
For more information about the processing of your data, see the Privacy Policy.
7. Contact
Do you have questions about cookies?
- Email: [email protected]
- Phone: +351 917 890 026 (call to a Portuguese mobile network)
- Address: Rua de Campezinhos, 27, Lomba, 4600-663 Amarante, Portugal