Data Policy
Last updated 2 September 2026 · Effective 2 September 2026
What this page is. A technical companion to the Privacy Policy: exactly what FitMap stores, where, for how long, and how to get it out or wipe it. If the two ever disagree, the Privacy Policy governs.
Where each piece of data lives
| Store | Contents | Notes |
|---|---|---|
| Your device (browser storage) | Your full passport, body measurements, growth logs, session state, removed-member list | Cleared by signing out and deleting the app data, or by deleting your account |
accounts | Email, scrypt password hash, verification flag, device session tokens | One record per account |
passports | Your synced passport with measurements removed: profiles, items, sizes, fit notes | Only exists once you turn on sharing/sync |
families | Fit Family membership, roles, invite tokens, which passports and categories are shared | Invite tokens expire after 14 days |
cards | Published share cards: display name, chosen sizes, title, expiry, view count | Public to anyone with the link |
leads | Waitlist emails and the feature requested | Deduplicated per email and source |
What is never stored on our servers
- Body measurements of any kind, including foot length, height, and scan confidence.
- Photographs or camera frames.
- Plain-text passwords.
- Advertising or cross-site tracking identifiers.
Cookies and local storage
FitMap sets no advertising or analytics cookies. The app uses your browser's local storage for strictly necessary purposes: keeping you signed in, holding your passport offline, and remembering preferences such as units. A service worker caches the app so it works without a connection. Clearing site data removes all of it.
We send transactional email only: verification codes, password resets, and Fit Family invites, delivered by Resend from fitmap.one. Invite emails include the inviter's name and chosen role so the recipient knows who is asking. We do not send marketing email unless you asked to be told about a feature.
Retention at a glance
| Data | Kept for |
|---|---|
| Account and synced passport | Until you delete your account |
| Share cards | Until expiry or deletion |
| Unaccepted invites | 14 days |
| Verification and reset codes | 10 minutes, and they are never stored (they are cryptographically signed instead) |
| Server logs | Up to 30 days |
Getting your data, or removing it
- Export: email hello@fitmap.one from your account address and we'll send a machine-readable copy within 30 days.
- Delete everything: Settings → Delete my account. This removes your account, the profiles you manage, your published cards, and your family links, and clears the app's storage on that device.
- Remove one card: republish or ask us to revoke the slug.
- Leave a family: remove the person in Settings, or ask the family lead to remove you. Sharing stops immediately in both directions.
Security practices
- TLS in transit; database access restricted by credentials and network rules.
- Passwords hashed with scrypt and per-user salts; comparisons are timing-safe.
- Email codes are HMAC-signed with an expiry rather than stored, so a database copy reveals no valid codes.
- Sessions are per-device tokens, limited in number and revocable by signing out.
Data residency
FitMap is operated from Toronto, Ontario. Our database and serverless functions run in the United States (AWS US-East via MongoDB Atlas and Vercel). Information stored there is subject to United States law. Body measurements are never uploaded and therefore never leave your device or your country.
Breach notification
If a breach creates a real risk of significant harm, we will report it to the Office of the Privacy Commissioner of Canada and notify affected individuals as soon as feasible, as required by PIPEDA, and will keep a record of every breach for 24 months. Where users in other regions are affected, we will also meet the notification deadlines that apply there.