Privacy Policy
Last updated: 6 October 2026
FitSync (on the App Store as "Fitbit Sync to Health App") is published by ZamaLabs (Zamalabs Yazılım ve Bilgi Teknolojileri Sanayi Ticaret Limited Şirketi). Questions about this policy: scipio@zamalabs.com.
FitSync does one thing: it copies your own wearable health data into the Apple Health app on your own iPhone. It is a one-way mirror. It reads from Fitbit and from Google Health, and it writes into Apple Health. It never writes back to Fitbit or Google, and it never sends your health data anywhere else.
1. Information collection and use
FitSync acts as a pass-through service. It fetches your Personal Health Record (PHR) data from your connected account and stores it in Apple Health on your device.
We do not store PHR Data from your Fitbit on our own; they're securely stored on your device; they will not be sent to our server. The same is true of every other source FitSync reads, including Google Health.
2. Google Health data
When you choose Sign in with Google inside FitSync, the app requests read-only access to the following five categories of your Google Health data. It requests no write access of any kind and cannot modify anything in your Google Health account.
What FitSync reads:
Activity and fitness: Steps, floors climbed, active and basal calories, workouts, workout distance and cardio fitness (VO2 max), written to the matching Apple Health types.
Health metrics and measurements: Resting heart rate, blood oxygen (SpO2), breathing rate, body and skin temperature, weight, height and body fat percentage, written to the matching Apple Health types. Body mass index and lean body mass are calculated on your device from those values.
Sleep: Sleep sessions and, where your device records them, sleep stages (awake, REM, light, deep), written to Apple Health sleep analysis.
Nutrition: Logged food, calories and macronutrients, and water intake, written to the Apple Health dietary types.
Profile: The date your Google Health account was created. FitSync uses it to know how far back your history goes, so that it stops requesting data from before your account existed instead of asking Google for years of empty days. It is shown to you on the Connected to Google Health screen as "History synced from."
You choose which data types sync in FitSync's Sync Preferences. Turning a type off stops FitSync reading it.
Where your Google Health data goes
Your Google Health data stays on your device. FitSync reads it directly from Google's servers to your iPhone and writes it into Apple Health on that same iPhone. It is not sent to ZamaLabs, is not stored on any ZamaLabs server, and is not shared with any third party.
We specifically confirm that data obtained from the Google Health API is never:
- transferred or sold to any third party, including advertising platforms, data brokers or information resellers
- used for advertising of any kind, including contextual, personalized, interest-based or retargeted advertising
- used for credit, lending or insurance assessment
- used to train any artificial intelligence or machine learning model
- read by any human at ZamaLabs
- used with any product or service that qualifies as a medical device for a regulated purpose
FitSync is not a medical device and must not be used for diagnosis or treatment.
Limited Use
The use of information received from Google Health API and/or Developer Tools will adhere to the Google Health API Developer and User Data Policy (https://developers.google.com/health/policies/health-api-developer-user-data-policy), including the Limited Use requirements.
FitSync's use and transfer of information received from Google APIs to any other app also adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.
3. Fitbit data
FitSync's original and continuing function is to sync data from Fitbit into Apple Health. Fitbit data is handled exactly as Google Health data is: read to your device, written into Apple Health, never sent to a ZamaLabs server, never shared, never used for advertising.
The Fitbit Web API is scheduled to shut down on 30 September 2026. FitSync is adding Google Health as a data source so that syncing continues after that date.
4. Third-party services in the app
FitSync includes the following third-party components. None of them ever receives your health data — not from Fitbit, not from Google Health, not from Apple Health. Health data never enters an analytics event, a crash report, an advertising request or a subscription record.
Google Firebase (Analytics, Crashlytics, Cloud Messaging, Firestore, Remote Config, App Check) — used for anonymous usage statistics, crash diagnostics, push notifications and app configuration. Health data collected: No.
Qonversion — used for managing subscriptions and in-app purchases. Health data collected: No.
Apple — used for app distribution, in-app purchases and refund handling. Health data collected: No.
This is enforced and audited, not merely intended. The complete audit of every third-party SDK call site in the app, and the script that re-checks it, are maintained as part of the app's source and are re-run before each release affecting these components.
5. Data retention and how to delete your data
FitSync keeps as little as possible, and everything it keeps is on your device:
Authorization tokens are stored in your iPhone's Keychain, marked so that they do not sync to iCloud and are not included in device backups. They never leave your device.
Your health data is stored by Apple Health, which is controlled by you, not by FitSync.
To remove FitSync's access and data:
1. Disconnect inside FitSync. Signing out revokes FitSync's access token with Google and deletes the stored authorization from your device's Keychain immediately.
2. Revoke at Google. You can independently remove FitSync's access at https://myaccount.google.com/permissions at any time.
3. Delete the health data. Data FitSync wrote into Apple Health belongs to you and is deleted from the Apple Health app (Browse, then the data type, then Show All Data), or by deleting FitSync's sources under Health, Sharing, Apps.
4. Uninstall FitSync. Deleting the app removes all remaining local data, including any stored tokens.
We hold no copy of your health data, so there is nothing for us to delete on your behalf. For any other request — access, correction, or deletion of non-health account data — contact scipio@zamalabs.com.
6. European Union residents
ZamaLabs complies with Regulation (EU) 2016/679 (GDPR). Because health data is processed only on your own device and is never transmitted to us, we are not a controller or processor of your health data. Where we do process personal data (for example a support email you send us), you have the rights of access, rectification, erasure, restriction, portability and objection; exercise them at scipio@zamalabs.com.
7. Data Protection Mechanisms (How we protect your data)
Health data is sensitive, so FitSync is built so that there is as little of it as possible to protect, and so that what exists is protected by the strongest mechanisms iOS provides.
Protection in transit
- All communication between FitSync and Google Health (and, for existing users, Fitbit) uses
HTTPS with TLS. FitSync does not disable or bypass Apple's App Transport Security, and never
sends health data over an unencrypted connection.
- Health data travels only one way: from Google's servers directly to your iPhone. It does not pass
through any ZamaLabs server, because none is involved.
Protection at rest, on your device
- Health data is written only into Apple Health. Apple Health data is encrypted by iOS and is
protected by your device passcode, Face ID or Touch ID, and is unavailable while the device is
locked. FitSync has no copy of it outside Apple Health.
- Google authorization tokens are stored in the iOS Keychain, Apple's encrypted credential store,
with the setting *available after first unlock, this device only*. They therefore do not sync to
iCloud Keychain, are not included in device backups, and cannot be restored onto another device.
- FitSync does not write health data or tokens to log files, analytics events or crash reports.
Access controls and authentication
- FitSync signs you in with Google's OAuth 2.0 flow using PKCE (S256). Your Google password is
entered only on Google's own sign-in page and is never seen by FitSync.
- FitSync's Google credential is an iOS client with no client secret, bound to the app's bundle
identifier. It cannot be used by a server or by any other application to reach your data.
- FitSync requests read-only access. It cannot create, change or delete anything in your Google
Health account.
- iOS asks for your explicit permission before FitSync can write each type of data to Apple Health,
and you can withdraw it at any time in Settings → Health → Data Access & Devices.
Limiting who can see health data
- Third-party components in the app (Firebase, Qonversion) are never given
health data or anything derived from it, and we re-check this before each release affecting these
components (see section 4).
- No ZamaLabs employee or contractor can access your health data, because we do not hold it.
If something goes wrong
- Signing out immediately revokes FitSync's token with Google and deletes it from the Keychain, and
you can revoke access yourself at any time at <https://myaccount.google.com/permissions>.
- If we ever become aware of a security incident affecting personal data we hold, we will notify
affected users and the relevant authorities as required by applicable law.
We review these measures when we change how the app handles Google Health data, and we update this
policy before any such change takes effect.
8. Safety, security, and compliance with law
We may disclose information in our possession where we are required to do so by law, or where disclosure is necessary to protect the safety, rights or property of our users or of ZamaLabs. Because your health data is not in our possession, it cannot be disclosed by us.
9. Refund requests
Where you request a refund through Apple, we may share purchase and usage information with Apple in order to evaluate that request. This does not include health data.
10. Downloading FitSync
FitSync is distributed through the Apple App Store. Apple's own privacy policy governs your use of the App Store and is separate from this policy.
11. Notification of changes
This policy may be updated. The date at the top of this page shows when it last changed. Material changes affecting how Google Health data is handled will be reflected here before they take effect.
12. Disclaimers
FitSync is provided as a data synchronisation tool. It is not a medical device, it does not provide medical advice, and it must not be relied upon for diagnosis or treatment. We make no warranty that the app will be uninterrupted or error-free, and we are not liable for damage arising from its use to the extent permitted by law.