Privacy
Last updated 29 July 2026
Fitoutly is a desktop and mobile application, not a cloud service. That shapes this notice: most of what you do never leaves your machine, because there is nowhere for it to go.
Who is responsible
The controller is Peter Laszlo E.V. (sole proprietor), Hungary. Questions, or any request under the rights below: hello@fitoutly.com.
What stays on your own device
These never reach us:
- Your projects — rooms, products, quantities, notes. They are files you save yourself.
- Your exported documents — PDFs and Word files are written locally.
- Your studio details and logo — stored with your settings on the device.
- Preferences — language, units, theme.
- Extraction quality notes — when the app reads a product page poorly it records that locally so the rules can be improved. This is never transmitted.
What we do hold
| Data | Why | Where |
|---|---|---|
| Email address, and a display name if you enter one | To have an account, so a licence can follow you between devices | Firebase Authentication (Google) |
| Which licence you hold and when it expires | To unlock the full version wherever you sign in | Cloud Firestore (Google) |
| Purchase and billing data | To sell you a licence and issue the invoice | Paddle — see below |
That is the whole list. There is no analytics in the application, no usage tracking, and no profile of how you work.
Requests that leave your device
Reading a product page
When you paste a shop link in the desktop or mobile application, your device fetches that page directly from the shop. It does not pass through our servers, and we never learn which products you specify. The shop sees an ordinary web request from your connection, as if you had opened the page in a browser.
In the browser version this is not possible: a web page may not fetch another site directly. There the request is relayed by our server, which therefore sees the address you pasted. It reads the page, returns the product details to you, and keeps nothing — the address is not written to a log, a database or a file, and it is gone as soon as the answer is sent.
Files you attach to a card
Drawings and documents you attach are never uploaded to us. The file stays where you put it — your own Google Drive, Dropbox, iCloud, Box or server. What the consignment holds is the link, saved in your own project file on your own device. We do not host, copy, scan or back up your documents, and we have no way to open one.
So that the consignment can show a file name rather than a long address, the application may fetch the page the link points to and read its title. In the desktop and mobile applications that request goes straight from your device to the storage provider. In the browser version it is relayed by our server under the same terms as above: read once, nothing retained.
Who can open an attached file is decided entirely by the sharing settings you choose at your storage provider. We neither grant nor restrict that access, and passing on an exported consignment is your decision, not ours.
Fonts for PDF export
The export typefaces ship inside the application, so exporting normally involves no network request at all. Only if a bundled font file is missing does the app fall back to fetching it from the public jsDelivr CDN — at that moment your IP address is visible to jsDelivr. No project data is sent in either case.
Licence check
While online, the application periodically confirms your licence is still valid. This carries your account identifier and nothing about your work.
Processors we use
| Who | For what |
|---|---|
| Google (Firebase) | Authentication and licence records |
| Google (Analytics) | Visitor statistics on this website — only with your consent, see the cookies section below |
| Paddle.com Market Ltd | Merchant of record: payment, tax, invoicing. Paddle is an independent controller for the purchase and holds your billing data under its own privacy notice. |
| Netlify | Serving this website |
| jsDelivr | Font files during PDF export — fallback only, when a bundled font is missing |
Some of these operate outside the EEA. Transfers rely on the European Commission's standard contractual clauses or an adequacy decision.
This website — cookies and tracking
By default this site sets no cookies. Web typefaces are served from this site itself, there is no advertising, no pixel and no fingerprinting. One optional thing asks your permission first:
Google Analytics — visitor statistics, so we can see which pages are read. It loads only after you press Accept on the cookie notice; until then, and always after Decline, not a single analytics request leaves your browser. IP anonymisation is switched on.
| Cookie | Set by | Purpose | Lifetime |
|---|---|---|---|
_ga | Google Analytics | Distinguishes visitors | 2 years |
_ga_* | Google Analytics | Keeps session state | 2 years |
You can change your answer at any time via the Cookies link in the footer. Withdrawing consent stops analytics from the next page load, and you can clear the cookies themselves in your browser.
Paddle — our payment provider, in two distinct roles.
In the checkout, Paddle sets a small number of cookies that are strictly necessary to take the payment and prevent fraud. Those are essential, they appear only in the checkout itself, and they need no consent.
Separately, we load Paddle.js on this page, which in turn
loads Paddle Retain (public.profitwell.com). Retain is what
lets Paddle recover a subscription payment that fails because a card has
expired. It can set its own identifiers on Paddle's domains, which is why
it is not treated as essential here: it loads
only after you press Accept, exactly like analytics, and never
after Decline. Both are governed by
Paddle's
privacy notice.
The web server keeps ordinary technical access logs (IP address, time, requested page) for security and error diagnosis, retained briefly by our hosting provider and not used to build profiles.
How long we keep things
- Account and licence: while your account exists. Ask us to delete it and both go.
- Purchase records: Paddle keeps these as long as tax law requires, independently of us.
- Webhook delivery log: the identifiers of processed purchase events, so the same one is not applied twice.
Your rights
Under the GDPR you may ask for a copy of your data, correct it, have it deleted, restrict or object to processing, and receive it in a portable form. Write to hello@fitoutly.com and we will answer within one month.
You can close your account yourself, in the app: your name in the header → Account → Delete account. It takes effect immediately and needs no email to us.
Deleting your account removes your licence record — including a perpetual licence. We will say so before acting, not after. It does not cancel a running subscription: an App Store subscription is cancelled in Apple's settings and a card subscription on the Paddle portal, and neither can be stopped from our side.
You may also complain to a supervisory authority. In Hungary this is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH).
Legal basis
- Performance of a contract — account, licence, purchase.
- Legal obligation — tax and accounting records.
- Legitimate interests — preventing licence abuse and keeping the service working.
Children
Fitoutly is a professional tool and is not directed at children.
See also our terms and refund policy.