FitShoe

Privacy Policy

Version 2026-10-01 · Effective October 1, 2026

This policy explains which data FitShoe processes, what for, with whom we share it and how you exercise your rights. It applies to the app and to these pages. It follows the Brazilian General Data Protection Law (LGPD, Law 13,709/2018) and, for people in the European Union, the General Data Protection Regulation (GDPR).

1. Who is responsible

The party responsible for processing the data (the controller, under the LGPD and the GDPR) is Alpha Tech — Douglas dos S. Silva, a sole proprietor (empresário individual), CNPJ 37.595.093/0001-54, based in Araraquara/SP, Brazil. Channel for questions and data subject requests: contatofitshoe@alphatechdev.com.br.

2. Which data we process

• Account: e-mail; password (we keep only an irreversible cryptographic digest, the Argon2id hash, never the password itself); language, country, shoe size system, units and preferred shoe fit (men's, women's or both); whether the e-mail was verified; a referral code for the account (and, if sign-up includes the code of whoever referred you, the link between the two accounts); creation and update dates.
• Session: the session identifier and the access renewal codes, and the single-use codes to verify the e-mail and reset the password. Of these codes we keep only the cryptographic digest.
• Account e-mails: the e-mails we send you about your account (e-mail verification and password reset): your e-mail address and the content of the message, which carries a single-use link. They are sent and stored by Lark (see section 4).
• Consents: for each document (Terms, Privacy and Health Data), the version, the language, whether it was accepted or withdrawn, and when.
• Photos: the photos you take (of your feet, of the inner side of the foot, of the sole of a worn shoe, of a shoe, or of its label or box) are processed on the spot and are not kept.
• Measurements and Foot Passport (health data): for each foot, the length, the width, the paper type used, whether you adjusted the corners of the sheet, and the measurer version. In the Passport: toe shape, whether there is a bunion, arch type, instep height, stride type (if you sent the sole), the complaints you declare yourself (plantar fasciitis and shin splints), the main use you choose, the confidence of the analysis, a descriptive summary written by the AI about the shape of the foot and how shoes fit, the AI model used, and the dates.
• Store checker: on each use, whether it was by photo of the shoe, photo of the label or box, or search by name; the recognized shoe (brand, model and confidence), the fit score, the verdict, the recommended size and the date.
• Credits and purchases: the balances, the statement (reason, amount, balance afterwards and date) and, for each purchase, the store (App Store or Google Play), the product, the amount and currency (when the store reports them), the country, the transaction code, the dates, whether it was a test purchase and whether it was refunded. We do not receive your card or other payment details.
• App usage: events from a closed list (for example: opening the app, completing sign-up, starting or confirming a measurement, opening the store, completing a purchase), with the platform (iOS, Android or web), the app version, a random installation identifier (which does not identify the device), the country of the account (when you are signed in) and the time on the device. These events have no free text, e-mail, measurements, complaints or shoe names. Before sign-in they are anonymous; with a session open, they are linked to the account. We do not use a third-party analytics tool for this.
• Technical data: the IP address of the connection, used in the server's memory only to limit abuse (a limit of requests per minute) and not written to our database; technical operation logs, with the account identifier, the operation and the result, without photos, measurements, passwords or e-mails; and the record of each call to the AI (model, volume processed, cost, result and duration), linked to the account while it exists.
• On your device: the app keeps the session renewal code in the system's secure store (Keychain on iOS, Keystore on Android), and the language and the random installation identifier in the app's storage. The app does not write photos to a file: they stay in the device's memory while you use the screen.

3. What we use the data for, and the legal basis

• Creating and maintaining your account and authenticating you (account, session and account e-mails): performance of the contract (LGPD art. 7, V; GDPR art. 6(1)(b)).
• Measuring the foot, building the Passport, recommending shoes and using the Store checker (photos, measurements and Passport): your specific and prominent consent for health data (LGPD art. 11, I; GDPR art. 9(2)(a)). Without it we do not provide these parts. See the health data notice.
• Selling and delivering credits, returning credits and handling refunds (purchases and statement): performance of the contract.
• Understanding how the app is used and improving it (usage events): legitimate interest (LGPD art. 7, IX; GDPR art. 6(1)(f)).
• Security, preventing abuse and fraud, and controlling AI cost (technical data): legitimate interest.
• Complying with legal obligations and defending rights: legal obligation and regular exercise of rights (LGPD art. 7, II and VI; GDPR art. 6(1)(c) and (f)).

4. With whom we share

• Anthropic (Claude), in the USA: receives only the photos, with fixed text instructions, when you use the Complete Foot Analysis (3 or 4 photos) or the Store checker by photo (1 photo). We do not send your e-mail, the account identifier, the measurements or the complaints with them. It returns the reading of the photos, which we use to build your Passport or to identify the shoe.
• RevenueCat, in the USA: manages credit purchases. It receives an internal code for your account (which is not your e-mail) and the purchase data, and tells us when a purchase is confirmed or refunded. When you delete your account, we ask it to erase your record.
• App Store (Apple) and Google Play (Google): process the payment under their own terms and privacy policies.
• Lark (Lark Technologies), e-mail service: sends and stores the account e-mails (e-mail verification and password reset). It receives your e-mail address and the content of the message, which carries the single-use link. We do not send photos, measurements or health data by e-mail.
• Photo measurement: the service that measures the foot is ours and runs on our infrastructure. It does not send the photos to third parties.
• Hosting: the provider of the server where the API and the database run, which processes the data only to provide us the service.
• Authorities: when the law or a court order requires it.
• We do not sell or rent personal data, and there is no third-party advertising in the app.

5. International transfer

Anthropic and RevenueCat are in the United States, and Lark (Lark Technologies) processes the account e-mails outside Brazil. So, when you use the Complete Foot Analysis, the Store checker by photo, or buy credits, and whenever we send an account e-mail, data about you is sent outside Brazil (and, if you are in the European Union, outside the European Economic Area). For the photos, this transfer is part of the health data consent you give us; for the account e-mails, it is necessary to perform the contract (e-mail is how you verify the address and reset the password). Where the law requires it, we rely on mechanisms such as standard contractual clauses for the transfer.

6. How long we keep it

• Photos: we do not keep them. They are discarded after the measurement or the reading.
• Measurements and Foot Passport: until you withdraw the health data consent or delete the account. A new analysis replaces the previous Passport.
• Account, consents, credit statement, purchases, Store checker records and usage events: until you delete the account, when they are erased with it. The anonymous events from the installations you used with your account are also erased.
• AI cost and usage records: after the account is deleted, they have no link to you.
• RevenueCat: we ask for your record to be erased when you delete the account; if the request fails, we repeat it until it confirms. Apple and Google keep their own purchase records, under their policies.
• Account e-mails: Lark stores the e-mails it sends on our behalf, under its own rules. They carry no photos, measurements or health data, and the single-use link is valid for 30 minutes (password reset) or 7 days (e-mail verification). Deleting the account in the app does not erase these e-mails automatically; to have them erased, ask by e-mail (see section 7).

7. Your rights

Under the LGPD (art. 18), you can ask for: confirmation that we process your data; access; correction; anonymization, blocking or deletion of unnecessary data or data processed in breach of the law; portability; deletion of data processed with your consent; information about whom we share it with; information about the possibility of not consenting and its consequences; withdrawal of consent; and review of decisions made solely by automated processing. If you are in the European Union, the GDPR gives equivalent rights: access, rectification, erasure, restriction of processing, portability, objection and withdrawal of consent at any time (without affecting what was done before), as well as lodging a complaint with the data protection authority of your country.

• In the app: you correct your preferences under Account; withdraw the health data consent (this erases your measurements and your Passport); and delete the account (this erases everything).
• By e-mail: for other requests, write to contatofitshoe@alphatechdev.com.br with your account e-mail. We may ask for confirmation that the request is yours. We reply within the periods set by law.

8. Security

We protect the data with technical measures such as: the password kept only as an Argon2id hash; session and single-use codes kept only as a cryptographic digest; communication with our servers over an encrypted connection (HTTPS) and account e-mails sent over an encrypted connection (STARTTLS); access to the database with an application user that has no permission to change its structure; and the session renewal code in the device's secure store. No system is completely secure. If an incident occurs that may cause you a relevant risk, we will notify you and the authority, as the law requires.

9. Minors

FitShoe is for people over 18 and does not knowingly collect data from minors. If we learn that an account belongs to a minor, we will delete it.

10. Cookies and tracking

These pages use no cookies or scripts. In the app, there is no third-party advertising or ad trackers, and the app does not follow you across other apps or websites.

11. Changes to this policy

We may update this policy. Each version has a number and an effective date, at the top of this page. When there is a new version, the app asks for a new acceptance.

12. Contact and complaints

Reach us at contatofitshoe@alphatechdev.com.br. You can also complain to the National Data Protection Authority (ANPD) in Brazil, or to the data protection authority of your country. See also the Terms of Use.