Privacy Policy

Effective October 27, 2026 · Previous version: July 15, 2026

1. Introduction and scope

ATA IT Services, LLC, doing business as Activate Fitness ("Activate Fitness," "we," "us"), provides the Activate Fitness iOS app, its widgets, and activatefitnessapp.com (together, the "Service"). The Service lets a parent or guardian set up profiles for their children, and lets adults use it for themselves ("Active Mode"), so that physical activity earns screen time.

This policy explains what we collect, why, who receives it, how long we keep it, and the choices and rights you have. It applies to everyone who uses the Service. It does not apply to Apple, Google, or other companies' apps and services, which have their own policies.

If you live in Washington, Nevada, or Connecticut, also read our Consumer Health Data Privacy Policy, which is part of this policy.

2. Who we are

ATA IT Services, LLC, an Indiana limited liability company, is responsible for your information (the "operator" under COPPA and the "controller" under other laws).

• Email: andrew.armour@activatefitnessapp.com
• Phone: +1 (317) 604-9554
• Mail: 1869 S Philadelphia Pass, New Palestine, IN 46163, USA

3. Information we collect

We collect only what the Service needs to work. We describe each category, where it comes from, and why.

A. Parents and adult account holders (from you)

• Email address and password, or Sign in with Apple identifiers (including Apple's private relay address if you choose it). Passwords are handled by Firebase Authentication; we never see them.
• Your Admin PIN, stored only as a salted, one-way hash on our servers.
• Parental consent records: date and time, the child profile it covers, the child's age category, the version of the notice you saw, the method used, your account ID and email, and the app version.
• Anything you send us for support.

B. Profiles (a child's, or your own in Active Mode) (from the parent or adult account holder)

• First name or nickname, age, and an optional photo.
• Whether the profile is for a child or for an adult using Active Mode.
• Settings you choose: step goal, minutes earned per goal, schedules (such as bedtime and school hours), restricted apps and categories, wearable type, the Apple Watch Exercise Ring bonus and its minutes, and the optional "ideal daily screen time" used for goal suggestions.

C. Health and activity data from Apple Health (from the device, only with permission in Apple Health)

• Daily step count.
• If an Apple Watch is selected: exercise minutes, and whether the Exercise ring was closed that day (the Activity ring summary).
• Source and device identifiers (for example, "iPhone" or a wearable app, and which device recorded the steps), used only to decide which steps count: the profile's own phone or chosen wearable. Steps synced from other devices on the same Apple ID are ignored.

Raw Apple Health samples stay on the device. Only derived figures leave it: the daily step total, goals completed, and minutes earned, plus a monthly Impact Report summary (average daily steps, number of active days and, with an Apple Watch, Exercise ring closures, for the month and for the 60 days before the profile started using Activate Fitness). We do not read heart rate, sleep, location from workouts, or any other Apple Health data. To confirm Health access is on, the app checks on the device whether any step data is readable; the result is not sent to us.

D. Screen time and usage of the Service (created as you use it)

• Your restricted-app selection as opaque tokens from Apple's Screen Time framework. We cannot see which apps they represent.
• Screen-time balance, play sessions (start, end, length, and chosen duration for timed "Quick Play" sessions, including sessions started or paused from a widget), minutes used, pauses, schedules in effect, and parent pauses.
• Daily activity history: goals completed, minutes earned, and the step goal at the time. Streaks are calculated from this history.
• Requests a child sends to a parent from within the app (for example, a request to count iPhone steps when a wearable is unavailable), including any short message the child types.

E. Device and technical information (from the device)

• An app-specific device identifier (identifierForVendor) used to pair devices, the device name, and the last time a paired device was active.
• A push notification token, used only to send notifications.
• App version, iOS version, and time zone, and whether the iPhone's Fitness Tracking setting is on (checked on the device only, to help fix step counting; no motion data is read or sent).
• An anonymous technical account ID for child devices (no name, email or phone).
• Crash reports, collected only after a parent has consented and only from adult account holders' devices.

F. Website

• Essential cookies only, and basic server logs (such as IP address and browser type) kept by our hosting and network providers (GitHub Pages and Cloudflare) for security.

What we do not collect: precise location, contacts, photos other than an optional profile photo, browsing history, the content of other apps, the names of apps used, advertising identifiers (IDFA), or biometric data. We do not use advertising or behavioral analytics tools.

4. How we use information

We use information only to:

• Run the Service: count steps toward goals, award and track screen time, start, pause and end play sessions, apply app restrictions and schedules, and sync paired devices, including when you start or pause screen time from a widget: the tap runs Activate Fitness in the background, which does exactly what the same tap in the app would.
• Show progress features: daily history, the Impact Report, streaks and milestones, widgets, and in-app tips (for example, a reminder when no steps have been recorded by midday).
• Send notifications you or your child expect, such as goal reached, time running low, session over, parent pause, and requests between child and parent. When a parent pauses screen time, the child's device applies the pause the moment the notification arrives; the notification is processed on the device and is not changed or stored.
• Suggest a step goal to a parent once a month at most, but only if the parent turned on "ideal daily screen time." The suggestion compares average daily screen time used with that ideal and with the trend in steps. It is a suggestion only; the parent decides.
• Verify and record parental consent, keep the Service secure, prevent misuse, and fix problems.
• Respond to support requests, and meet legal obligations.
• Email account holders about their account, consent, security and changes to these policies, and occasionally about new features of the Service. We never email children. You can stop feature-update emails at any time by replying “unsubscribe”; account, consent and security emails continue while you have an account.

We do not sell personal information, share it for cross-context behavioral advertising, show ads, build marketing profiles, or use it to train artificial intelligence models.

Automated features such as goal suggestions and streaks never make decisions with legal or similarly significant effects about anyone; a parent or adult always decides.

5. Children's privacy (COPPA notice)

The Service is designed to be set up and controlled by a parent or legal guardian. We comply with the Children's Online Privacy Protection Act (COPPA) for children under 13, and we apply the same protections to all child profiles under 18.

How consent works. A child's device can only be paired with a one-time code created from a parent's signed-in account. Before that code can be created, the parent reviews this notice and gives consent for that child in the app. We record the consent, then send a confirmation email to the parent's account address explaining what was agreed and how to revoke it. A child's device is set up through a shortcut that skips the age question, and never asks the child for an email or other contact details. If anyone enters a birth date on the start screen, it is used only on the device to check age and is not stored or sent to us.

What we collect from or about children is listed in Section 3: profile details the parent enters, daily step and activity figures, screen-time and session records, the restricted-app tokens, requests the child sends to the parent, and device information needed to pair and notify. We collect no more than the Service reasonably needs, and a child cannot use the Service to share information publicly or with other users.

Who receives children's information. Only our service providers that support the Service's internal operations, under contracts that limit their use to providing services to us (see Section 6). We do not disclose children's information to anyone else, and we will ask for separate consent before any disclosure that is not part of running the Service.

Parents' rights. A parent may at any time review the information collected from their child, have it deleted, refuse further collection, or revoke consent. You can delete a child profile in the app (Admin PIN required), unpair a device, or email us. Revoking consent ends the child's use of the Service and deletes their information. When a child turns 18, the parent should remove the child profile, and the former child may ask us directly to delete their information.

5A. Active Mode is adults-only. Active Mode is for adults (18+) using the Service for themselves. It is never offered on a child's device. An adult's own data receives the same protections in this policy.

6. How information is shared

We share information only as follows:

• Service providers. Google LLC (Firebase) hosts our database, authentication, file storage, server functions, push notifications and crash reporting, under Google's Cloud data processing terms. Data is stored in the United States. Google may use the data only to provide services to us.
• Email delivery. Resend, Inc. sends our account, consent-confirmation and update emails. It receives the account holder's email address and the email content, which for a consent confirmation includes the child's first name, and may use them only to deliver email for us. It never receives Apple Health data.
• Website hosting. GitHub, Inc. (GitHub Pages) hosts activatefitnessapp.com and Cloudflare, Inc. provides its network and security services. They receive only website visit data such as IP address and browser type.
• Sign in with Apple. If you choose it, Apple verifies your sign-in and gives us your Apple ID identifier and the email address you choose to share.
• Apple. The Service uses Apple Health (HealthKit), Screen Time (Family Controls, Device Activity, Managed Settings) and Apple's push notification service. Apple processes this under its own terms; Screen Time selections are stored and synced only as opaque tokens that we cannot read.
• Within your family account. Information about a child is visible to the parent account that created the profile and on that child's paired devices.
• Legal reasons. When required by law, court order or legal process, or when reasonably necessary to protect the safety of a person, our rights, or the Service. Where the law allows, we will tell you first.
• Business transfer. If our business is merged, acquired or sold, information may transfer as part of that deal. We will notify you first, the new owner must honor this policy, and we will ask for new consent before children's information is used in any materially different way.

We do not sell or rent personal information, and we do not share it with data brokers or advertisers.

7. Apple Health and Screen Time commitments

• Apple Health data is used only to provide the Service's health and fitness features. It is never used for advertising, sold, used for data mining, or shared with third parties except the service providers above.
• We do not store Apple Health data in iCloud.
• Screen Time data is used only to apply the restrictions the parent or adult chose.
• Widgets show information from storage on the device and make no network requests themselves. Their Start and Pause buttons ask the Activate Fitness app to act, which then syncs like any in-app action. Widget and notification content can be seen on the Home Screen or Lock Screen by anyone holding the device.
• On a child's paired device, deleting apps is blocked while restrictions are active, so restrictions cannot be removed by deleting the app. A parent can unpair the device (Admin PIN required) to remove this. Adults in Active Mode can delete apps.

8. Data retention

We keep information only as long as needed for the purpose it was collected, then delete it.

When you delete a profile or account, we delete the related information from our live systems promptly and from backups within 30 days. We may keep the minimum needed to meet a legal obligation, resolve a dispute, or enforce our Terms, and only for that purpose. Pairing codes expire after 10 minutes and are then deleted, and device unpair records are kept for 30 days.

9. Your privacy rights

Wherever you live, you can ask us to:

• Tell you what personal information we have about you or your child, and give you a copy.
• Correct inaccurate information.
• Delete your or your child's information.
• Stop further collection (which ends use of the Service for that profile).

Email andrew.armour@activatefitnessapp.com from your account email. We may need to confirm your identity before acting. We respond within 30 days (45 days where state law allows, extendable once as the law permits). You may use an authorized agent where the law allows. We will not treat you differently for using your rights.

State-specific rights. Residents of California and other U.S. states with comprehensive privacy laws (including Colorado, Connecticut, Indiana, Oregon, Texas, Virginia and others) have these rights by law, plus the right to appeal a denial. To appeal, reply to our decision with "Appeal" in the subject line; if you disagree with the outcome, you may contact your state attorney general. Because we do not sell, share for targeted advertising, or profile, there is nothing to opt out of; we honor opt-out requests anyway.

California notice. In the past 12 months we collected the categories in Section 3: identifiers, personal records, characteristics (age), sensitive personal information (health and activity figures, account login), internet or device activity, and inferences limited to streaks and goal suggestions. We use sensitive information only as permitted to provide the Service. We have not sold or shared personal information, including of consumers under 16.

California “Shine the Light” and minors. We do not disclose personal information to third parties for their own direct marketing. The Service does not let anyone, including users under 18, post content publicly; a parent or the user can ask us to remove any information the user provided, at any time.

Health data. Washington, Nevada and Connecticut residents have additional rights described in our Consumer Health Data Privacy Policy.

10. Users outside the United States

The Service is intended for users in the United States. If you use it from elsewhere, your information is processed in the United States. Where the GDPR or UK GDPR applies, our legal bases are: performing our contract with you, your consent (Apple Health data and children's data), our legitimate interests in security and improving the Service, and legal obligations. You may also object to processing, withdraw consent at any time, and complain to your local data protection authority.

11. Security

We maintain a written information security program for the Service, reviewed at least once a year. Safeguards include encryption in transit (TLS 1.2 or higher) and at rest, server rules that limit each account and device to its own data, hashed PINs, least-privilege access, and vendor security review. No system is perfectly secure. If a breach affects your information, we will notify you and the authorities as the law requires.

12. Cookies, tracking, Do Not Track and Global Privacy Control

The app uses no cookies and no tracking. The website uses only essential cookies. We do not track you across other companies' apps or websites, so we treat Do Not Track and Global Privacy Control signals as already honored.

13. Age and app store signals

Adult features, including Active Mode, are limited to people 18 and older. Where an app store provides an age-range signal or parental-consent status for a user, we use it only to apply the right age protections and to meet legal requirements, and for no other purpose.

14. Changes to this policy

We will post any change here with a new date. For material changes, we will notify account holders by email or in the app before they take effect. If a change expands what we collect from children or how we use or share it, we will ask parents for new consent first.

15. Contact us

ATA IT Services, LLC (dba Activate Fitness), 1869 S Philadelphia Pass, New Palestine, IN 46163 · andrew.armour@activatefitnessapp.com · +1 (317) 604-9554. We respond to privacy requests within 30 days.