payFit
Last updated 22 September 2026
payFit decides whether you trained, and takes money from a balance you funded when you didn't. That is a lot of trust to ask for, so this page is specific rather than reassuring.
If you enter your email address on the payFit website, it is sent to our Supabase project and stored so we can send you occasional product and release updates. It is not used for advertising and is not sold or shared with data brokers.
The list is separate from the app. Your email is not connected to a check-in photo, workout, balance, payment method or other in-app information. The public website can add an address to the list, but cannot read the list.
Supabase processes the email and basic request metadata as our hosting service. We keep the address until you ask us to remove it or the list is closed. To remove yours, email privacy@payfit-app.com from the address you joined with.
A photo is how you clear a day. When you check in, payFit saves that photo inside its own private storage on your phone and records that a check-in happened for that date.
The photo is never uploaded. Nobody at payFit reviews it, no automated system inspects it, and it is not attached to any payment. It exists so that you can look back at your own evidence.
It is also not added to your photo library, and it is excluded from iCloud and iTunes backups — so a photograph of your home gym does not end up in a backup you never thought about. It is stored with iOS file protection, which keeps it encrypted whenever your phone is locked.
How long we keep it: until you delete it or delete the app. There is no expiry and no copy anywhere else, because there is nowhere else. Deleting payFit removes every check-in photo with it.
payFit asks for camera access to take these photos. If the camera is unavailable, it can use a photo you choose from your library instead; only the photo you pick is used.
With your permission, payFit reads workout records from Apple Health — the start time, end time, type of activity, and which app or device recorded it. Workouts recorded on a paired Apple Watch reach payFit the same way, because they sync into the same Apple Health store.
payFit does not read heart rate, steps, sleep, body measurements, cycle tracking, nutrition, or any other category in Apple Health.
Workout data is stored on your device only, inside the app's private storage, protected by iOS file encryption. It is not transmitted to us or to anyone else. We cannot see your workouts.
In line with Apple's requirements, health data is never used for advertising or marketing, never sold, and never disclosed to third parties for advertising or data-mining purposes. It is not stored in iCloud.
App Store builds do not write workouts or any other information to Apple Health.
payFit works from a balance you fund in advance. A missed day is taken from that balance rather than charged to your card at the time. The balance is your money: you can withdraw whatever is left at any point, and it is refunded to the card that funded it.
Your authoritative balance and statement are stored in payFit's account database, with an encrypted local cache on your device. We store the amount and date of each top-up, withdrawal, missed-day deduction, and restoration so the balance survives reinstalling the app. We do not receive the workout or photo used to judge a day.
When you add a card, the details go to our payment processor, which returns a token — a reference that permits a top-up without exposing the card number. Stripe stores the card against a customer record. payFit's server stores the Stripe customer and payment-method references; the app stores the card brand, last four digits, expiry date, and token in the device Keychain.
We never store your full card number or security code. They are not written to disk and are discarded as soon as the processor has them.
Stripe receives the amount, currency, account references, and payment metadata needed for wallet top-ups and withdrawals. A missed day deducts the prefunded wallet and does not trigger a separate card charge. Stripe does not receive your workouts, photos, goals, or other health information.
Beta builds may run payments in a sandbox mode that moves no real money. Where sandbox mode is active, the app says so.
During setup payFit asks what you are training for, roughly what you weigh, what you would like to weigh, where you train and what kind of training you do. Every one of those questions is optional, and the weight questions can be skipped outright.
This is stored on your device and shown only back to you. It is not uploaded, not used for advertising, and not shared with anyone.
payFit uses Sign in with Apple to protect and recover your wallet. Apple provides a stable account identifier and, depending on your Apple choice, your real or private-relay email address. We store those on our server for authentication and account support. Your name is stored on your device for the greeting and is not uploaded by payFit. You may explore without signing in, but signing in is required before funding or arming a stake.
payFit Pro is billed by Apple through your Apple Account. Apple handles the payment; payFit never sees your Apple Account details. Managing or cancelling a subscription is done in the App Store, under Settings › your name › Subscriptions.
Settings, detailed workout results, goals, profile answers, and check-in evidence stay on your device. The server receives only the account and wallet records described above.
payFit uses Amplitude to understand how the app is used: which screens people reach, where they abandon setup, and whether a feature earns its place. Amplitude is the only third party that receives anything about your use of the app.
What Amplitude receives. Named events for things you do — a screen opened, onboarding finished, a stake armed, a wallet funded, a subscription started, a payment that failed — together with the settings that describe your account: your plan, your stake amount and currency, how many days a week you intend to train, which permissions you have granted, your wallet balance, your current streak, and the goal and activities you chose during setup.
What Amplitude never receives. No health data, of any kind. Not workouts, not minutes, not heart rate, and not your weight — the app reports only whether you gave it a weight, never the number. No check-in photo and nothing derived from one. No card number, no email address, no name. These are not omissions we intend to keep an eye on: an event in payFit can only carry values from a fixed, reviewed list of fields, and the build fails if anyone adds one that looks like health or identity data.
Events are tied to a random identifier created when you install the app, and to your account once you sign in, so that one person does not appear in the data as two. Amplitude does not use any of it to advertise to you, and none of it is sold or given to a data broker.
This website. payfit-app.com counts visits with Cloudflare Web Analytics. It sets no cookies and does not follow you to other sites: it records which page was opened, the site that linked to it, and the browser, device type and country, and reports them to us only as totals. It is separate from the app and is never joined to your account.
payFit advertises on TikTok, and uses TikTok's measurement SDK to tell whether an ad actually led to anything. This is tracking in Apple's sense of the word, which is why iOS asks your permission before any of it happens — and why the honest answer to "does payFit track you?" is now yes, if you allow it.
If you decline the prompt, no advertising identifier is read and TikTok cannot connect you to an ad. The app behaves identically either way; nothing is withheld, and you are not asked twice.
What TikTok receives. Six things happening, and one number: that an account was created, that setup finished, that a card was added, that a stake was armed, that a subscription started, and that a wallet was funded — the last carrying the amount and currency, because that is the number an advertiser bids against. Plus your account identifier, so one person who installs twice is counted once.
What TikTok never receives. No health data — not workouts, not minutes, not your weight, not even whether you cleared a given day. No check-in photo. No card number, email address or name. And no properties beyond that single purchase amount: an advertiser learns that a purchase happened and what it was worth, and nothing whatsoever about the person who made it. This is enforced in the code by a fixed list of six events that carry no other data, and by tests that fail the build if anything health-derived is added to it.
Nothing here changes the promise above: health data is never used for advertising or marketing, never sold, and never disclosed to a third party. That is a condition of using Apple Health at all, and it is kept by making the code incapable of sending it.
If you allow notifications, payFit sends reminders while you can still clear the day, and a plain note afterwards if a wallet deduction occurred. Notifications are scheduled on your device; their contents are not sent to a server.
Delete account and data in Settings is available in the app. You must first withdraw any remaining wallet balance. Deletion revokes payFit's Sign in with Apple authorization, deletes the Stripe customer and saved payment method, invalidates account sessions, and removes photos, settings, profile, and history from the device.
Deleting the app removes its device files — including every check-in photo — but it does not delete the server account or withdraw a balance. Reinstalling and signing in recovers the server wallet. Revoking payFit's access in the Health app stops it reading workouts immediately.
Withdraw your balance before deleting the app if you want the remaining money back; deleting the app does not withdraw it for you.
Completed payment and wallet transaction records may be retained in pseudonymous form where required for accounting, fraud prevention, disputes, and legal compliance. Deleting your account does not reverse a completed top-up, withdrawal, or settled missed-day deduction.
payFit is not directed at children and is not intended for anyone under 18. We do not knowingly collect information from children.
If this policy changes in a way that affects what payFit reads or what leaves your device, we will say so in the app before the change takes effect.
Questions about this policy, or about data payFit holds: privacy@payfit-app.com.