Privacy policy
Last updated: 7 August 2026
FitTools is operated from the United Kingdom by Mathew Beale (“we”, “us”). This policy explains what data the site handles and the choices you have. The short version: the numbers you type into calculators stay on your device unless you make an account, in which case they follow you between your devices until you switch that off; anonymous usage measurement runs on every page (no advertising does), and the one time a file of yours leaves your device — reading a blood test you upload — is spelled out below before you choose the file.
Calculator inputs
All calculations run entirely in your browser. Your inputs (weight, height, measurements and the rest) are not transmitted to us or to anyone else. Results are saved only when you press Save, and by default they are saved on your device alone.
Accounts
An account is optional — the whole site works without one. If you make one we store your email address (which is how you sign in), your date of birth, session records, and a record of any storage choices you have made. There are no passwords: signing in sends a single-use link to your email, valid for fifteen minutes.
Your date of birth is used to work out which features you are old enough for and for nothing else. We do not profile you, do not advertise to you, do not sell or share your data, and do not use anything you enter to train any model.
Syncing your numbers
With an account, what you save is kept in your account so it follows you between devices — calculator results, dashboard vitals, your supplement stack, and (from 18) blood results. This is on by default. One switch on your account page turns it off, which also deletes every copy on our servers and leaves your device’s copy alone. Everything on the site works the same either way.
Uploading a blood test
You can upload a lab report (PDF or CSV) and have the values pulled out of it, so you do not have to type twenty numbers by hand. This is the one place on the site where a file of yours is sent anywhere, so here is exactly what happens.
The file is sent over an encrypted connection to the Claude API, run by Anthropic in the United States, which reads it and returns the values it found. Nothing identifying you is sent with it — not your name, not your email, not your account. The file is held only for as long as that one request takes: it is not written to disk, not logged, not put in a database, and not used to train any model, by us or by them. Nothing happens automatically at any point — every value it finds is shown to you beside the line of your report it came from, and only the ones you tick are saved.
If you would rather not send the file at all, you can type your results in by hand; nothing is lost by doing so.
Preferences stored on your device
The site stores small functional preferences in your browser’s local storage: your unit system (metric or imperial) and, on the plate calculator, your plate inventory. These stay on your device, are not cookies, are sent to no one, and clearing your browser data removes them.
Arcade leaderboard
The arcade games have a leaderboard. Nothing is sent from a game unless you choose to put a score on it: if a run earns a place, you can type a display name and submit it. What we then store is that name, the score, the day it was set and a one-way hash of your IP address that includes the date, used only to keep one entry per player per day and to limit abuse. That hash cannot be reversed to an address and changes daily, so it cannot be used to follow you. There is no account, no email and no link to anything else you have done on the site. If you want an entry removed, contact us with the name and the day and we will delete it.
Analytics and advertising
The site uses Google Analytics 4 to measure how pages are used — which pages are visited, from what kind of device, and how people move between them. It sets measurement cookies for every visitor; we do not currently ask first. This data identifies a browser, not a person, and we never connect it to your name, email or account. You can block its cookies in your browser settings without losing any functionality. No advertising runs on the site; if it is activated in future it will be gated behind a consent banner that defaults to “denied” for UK and EEA visitors.
Sign-in links are sent through Resend, an email delivery service. If we introduce an email newsletter, sign-up will be double opt-in and addresses will be used solely to send what you subscribed to, with a working unsubscribe link in every message.
Who else touches your data
We use a small number of services to run the site, and no others receive anything: Vercel (hosting), Neon (the database holding account data), Resend (sign-in emails) and Anthropic(reading an uploaded blood test, as described above — and only then). Each acts on our instructions only. Everything except the blood-test read stays within the UK or the EEA.
How long we keep things
Account data is kept while your account is active and removed after 24 months of inactivity. You can delete your account at any time from your account page, which immediately and permanently removes your synced documents, consents, sessions and the account record itself. Backups roll over within 30 days.
Your rights
Under UK GDPR you have rights of access, rectification, erasure, restriction, portability and objection. If you have an account you can exercise most of these yourself: your account page exports everything we hold as a single JSON file, lets you switch off syncing (which deletes every server copy), and deletes the account outright. Otherwise, and for any privacy question, get in touch. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk).
See also the cookie policy and terms of use.