Security

What we do

• Encrypted connections. The app talks to our servers only over HTTPS.
• Your records are yours alone. Database rules let each member read and change only their own health records.
• Sign-in. Sessions use short-lived tokens that refresh automatically, stored in your phone's secure storage (Keychain on iPhone, encrypted storage on Android). We check new passwords against known leaked passwords. You can sign in with Apple or Google instead.
• Our servers. Your data is held by Supabase on Amazon Web Services in the United States, with encryption at rest.
• Server keys stay on the server. The app never contains our private server or AI keys.
• Private health files. Files you attach in coach chat are stored privately and deleted after 90 days.
• Trainers see your data only after you accept them, and lose access when you disconnect.

If something goes wrong

If we find a security incident that affects your information, we'll investigate, fix it, and tell you and the regulators the law requires. For members in Australia that includes the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme; for members in the United States, the Federal Trade Commission and state authorities.

Report a problem

Found a security issue? Email support@qbod.fit with the subject "Security". Please don't test against other members' accounts.