Skip to content
LEGAL

Privacy Policy

VERSION 2.0 · LAST UPDATED: 6 OCTOBER 2026

This Privacy Policy explains what personal information we collect when you use the FitCheck app and website, why we collect it, who we share it with, and what rights you have under UAE law to control how we use it.

By creating an account or otherwise using FitCheck you confirm that you have read this Privacy Policy and accept the practices it describes.

CONTENTS

1 Who we are

2 The personal information we collect

3 How we collect personal information

4 Why we use your personal information

5 Who we share your personal information with

6 Who is responsible for what

7 International data transfers

8 How long we keep your personal information

9 Your rights under UAE law

10 Children

11 How we keep your personal information secure

12 Third-party software components we use

13 Cookies and local storage

14 Changes to this Privacy Policy

15 Contact

1. Who we are

FitCheck is an online platform and mobile app where people in the United Arab Emirates can list pre-loved fashion for sale and buy it. When a listed item is ordered, FitCheck buys it from the person who listed it (the "Lister") and sells it to the person who ordered it (the "Buyer"). Our Terms of Service explain this in full.

Data controller. The data controller for your personal information is FITCHECK - L.L.C - S.P.C, trade licence no. CN-6616252, licensed in the Emirate of Abu Dhabi, United Arab Emirates (the "we", "us" or "FitCheck" in the rest of this document). You can reach our data-protection contact at info@fitcheck.ae.

Our role. FitCheck is the party that buys from Listers and sells to Buyers. We are therefore the controller of the personal information handled in running the platform, including the records of both sides of every sale. Some of the other companies named in this Policy, such as the courier and the banks, also act as independent controllers for their own purposes. See §6.

Governing law. This Policy and any dispute about it are governed by the laws of the United Arab Emirates, in particular UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "UAE PDPL") and any regulations issued under it.

Language. This Policy is published in English. An Arabic version will be available after launch. Once it is published, in case of any conflict between the two versions, the Arabic version prevails for users in the UAE.

2. The personal information we collect

We collect only the data we need to run FitCheck. We have grouped it by category so you can see what each piece is used for.

2.1 Account data

When you create an account we collect:

  • Full name.
  • Email address, used for sign-in, service emails (email verification, password reset, receipts) and important notices.
  • Mobile phone number, given at signup.
  • Password. We never store it in readable form. Authentication is handled by Google Firebase Authentication, which stores only a salted hash.
  • Date of birth, used at signup to confirm you are at least 18 and kept as a record of that age check.
  • Display name. This is public, appears on your listings and orders, and is unique across FitCheck.
  • Your language preference.
  • The time you accepted our Terms of Service and this Privacy Policy, and which version you accepted.
  • Whether you have opted in to marketing messages.

2.2 Profile and style preferences

You may tell us your style preferences so the Discover feed shows clothes you want to see:

  • Identity name (for example "Work" or "Casual"), which is your nickname for a style bucket and not your legal identity.
  • Gender preference for the listings shown to you.
  • Style tags (Minimalist, Athleisure, Streetwear and so on).
  • Budget band.

These are stored against your account and used only to rank what you see in the app. They are never shown to other users.

2.3 Delivery and pickup details

  • Delivery addresses: street, building or villa number, emirate, and optionally a Google Maps link to drop a pin. We do not store post codes because the UAE does not use them.
  • A contact phone number for delivery.
  • If you sell, the address and phone number we give the courier for collection.

You can add, edit or delete saved addresses at any time in Profile, Settings, Addresses.

2.4 Card payment information (Buyers)

FitCheck is card-only, and we have designed payments so that we never see or store your full card details.

  • When you pay, your card data is collected directly by our PCI-DSS-certified payment provider, Stripe. It does not pass through FitCheck's servers.
  • We receive a payment reference and limited details (the result of the charge and, at most, the card brand and last four digits) so we can show you your orders and handle refunds and returns.

2.5 Bank details (Listers)

We pay Listers by bank transfer. To do that we collect and keep:

  • The account holder's name, the IBAN, and the bank name.
  • Any further information we reasonably need to confirm that the account is yours and to prevent fraud and money laundering.
  • A record of each payment we make to you, with the amount, date and reference.

2.6 Listing data (Listers)

  • Photos of the item (up to 5, each up to 5 MB, image files only).
  • Title, description, brand, category, size, condition, season, styles, shipping tier and Listed Price.
  • Your display name, the listing status (active, sold, removed, or under review) and timestamps.
  • The result of our automated screening (see §4) and any notes from a human reviewer.

This data is visible to any signed-in FitCheck user while the listing is active. After a sale we keep the listing record and photos as part of the sales record (see §8).

2.7 Order and activity data

  • Likes (right swipes), listings you passed on, saved searches, Listers you follow, and your cart.
  • Orders: the items, prices, shipping and Buyer Protection Fee, the delivery details you gave, order status, and the delivery events and times the courier reports.
  • Receipts and invoices we issue to Buyers, and the records we keep of each purchase we make from a Lister, including the amounts owed to and paid to the Lister.
  • Reviews you write or receive.

Your likes, cart and order history are private to your account except as set out in §5.2.

2.8 Reports, returns and disputes

  • Reports you submit: the listing or user you reported, the reason you chose, and the time. The reporter's identity is visible only to FitCheck staff.
  • Problem reports on an order and return requests, with the description and the evidence photos you upload.
  • Our decisions and the outcome, courier return details, and any confirmation you send us (with up to three photos) that you have destroyed or handed over an item as we instructed.
  • A Lister's response and evidence where a Buyer has reported a problem with their item.
  • Blocks you place, which are visible only to you.
  • Records of action we take on an account, such as a listing restriction or suspension, and a record of actions our staff take on your account in the admin console.

2.9 Notifications and emails

  • Push notification tokens (Firebase Cloud Messaging) for your devices, so we can tell you about your orders and other activity.
  • The service emails we send you, such as verification, password reset, receipts and purchase records, and a record that they were sent.

2.10 Device and technical data

We collect a limited set of technical data automatically:

  • An App Check attestation token, supplied by Google Play Integrity (Android) or Apple DeviceCheck and App Attest (iOS). It proves your installation is a genuine build of FitCheck and does not identify you.
  • Crash reports (Firebase Crashlytics): the stack trace, the page you were on, device model, operating system and app version, and the time of the crash. Crashlytics installation IDs are not linked by us to your name or email.
  • Short-lived authentication tokens, so you stay signed in.
  • Technical logs kept by our hosting and cloud providers, which include your IP address and device or browser details. For abuse prevention we also keep request counters keyed by a one-way hash of your IP address, not the address itself.

We do not use Firebase Analytics, advertising IDs, or any third-party analytics or marketing SDKs.

2.11 Waitlist and website

If you join the waitlist at fitcheck.ae we collect your email address, the display name you chose to reserve (if any), the time, and your browser's user-agent text (shortened to 300 characters). We use these to hold your display name, to email you when FitCheck launches, and to stop one person reserving many names. We use a one-way hash of your email address as the record key and in the name-reservation index.

Our website requests fonts from Google Fonts, so Google receives your IP address when a page loads. Our website does not use analytics, advertising or tracking cookies or scripts.

2.12 Information we deliberately do not collect

  • Your full payment card number.
  • Government ID documents. If a legal requirement or our banking partners ever require us to verify identity documents before paying you, we will update this Policy and tell you before we ask.
  • Precise GPS location. We use Google Maps links so you can pin a delivery address yourself, but we do not request continuous location access.
  • Microphone or contacts data.

3. How we collect personal information

  • Directly from you, when you sign up, edit your profile, create a listing, place an order, report a problem or join the waitlist.
  • Automatically, through the app and our systems when they run (crash reports, App Check tokens, logs).
  • From our service providers: the payment provider tells us whether a payment succeeded, the courier tells us delivery and return status, and our bank tells us whether a transfer was completed or returned.
  • From other users, in narrow cases: a Buyer's report can name a Lister's item, and a Lister can respond to it.

We do not buy or rent personal data from anyone.

4. Why we use your personal information

#

Purpose

Legal ground under the UAE PDPL

1

Creating and running your account, signing you in, sending service emails

Performance of a contract

2

Showing listings, buying items from Listers, selling them to Buyers, arranging courier delivery and returns

Performance of a contract

3

Taking card payments and paying Listers by bank transfer

Performance of a contract

4

Confirming you are 18 or older

Steps needed to enter a contract with you

5

Detecting and preventing fraud, abuse and money laundering, and screening listings for prohibited, unsafe or counterfeit items

Compliance with legal obligations, and the establishment or defence of legal claims

6

Diagnosing crashes and keeping the service working

Performance of a contract (keeping the service you signed up for working)

7

Handling reports, returns and disputes, recovering amounts owed to us, and enforcing our Terms

Performance of a contract, and the establishment or defence of legal claims

8

Sharing delivery details with the courier and, where §5.2 says so, the Lister

Performance of a contract

9

Keeping accounting, tax, invoice and transaction records

Compliance with legal obligations

10

Responding to lawful requests from UAE authorities, regulators or courts

Compliance with legal obligations

11

Push notifications about your orders and account

Performance of a contract

12

Marketing messages and promotional push notifications

Your consent, which you can withdraw at any time

13

Holding a reserved display name and emailing you at launch (waitlist)

Your consent, given when you joined

Automated screening. New and re-submitted listings are screened automatically before they go live. An AI service reviews the first photo and the listing text and returns a result: approved, needs a clearer photo, does not match its description, prohibited, or uncertain. An uncertain result, and any error in the screening, sends the listing to a person for review and never publishes it automatically. If a listing is rejected or blocked you can ask us to have a person review the decision by emailing info@fitcheck.ae. Apart from this screening, we do not make automated decisions that have legal or similarly significant effects on you.

5. Who we share your personal information with

We share personal information only with the recipients below, and only as far as needed for the purposes in §4.

5.1 Service providers

These companies process data for us under written terms that require them to keep it confidential and to use it only for the services they provide to us:

  • Google LLC (Google Cloud and Firebase). Hosts our database (Cloud Firestore), authentication (Firebase Authentication), file storage (Firebase Storage), server functions, push notifications (Firebase Cloud Messaging), App Check, and crash reporting (Crashlytics). Data is encrypted in transit (TLS) and at rest.
  • Stripe. Our card-payment processor. Your card data goes directly from your device to Stripe. Stripe is a separate controller for your card data and for its own fraud and compliance checks.
  • Aramex. Our courier. We give Aramex the pickup name, address and phone number of the Lister and the delivery name, address and phone number of the Buyer, with an order reference, so it can collect and deliver the parcel. Aramex is a separate controller for that delivery information.
  • Our bank. To pay a Lister we give our bank the Lister's name, IBAN, the amount and a payment reference. The bank is a separate controller for its own regulatory purposes.
  • Anthropic (Claude API). When you create or edit a listing, its first photo and its title, description and category are sent to Anthropic's AI service to screen for prohibited, unsafe or counterfeit content before the listing goes live. Anthropic returns a result and, under its commercial API terms, does not use this content to train its models. This processing may take place outside the UAE (see §7).
  • Email delivery. An email service provider that sends our service emails on our behalf.
  • Website hosting. The providers that host fitcheck.ae and relay waitlist sign-ups to our systems.
  • Professional advisers. Our accountants, tax advisers and lawyers, and, where UAE e-invoicing rules require it, an accredited e-invoicing service provider. All are bound by confidentiality.

5.2 Other FitCheck users

  • A Buyer sees a Lister's display name and the details of the listing. A Buyer does not see the Lister's email, phone, address or legal name.
  • A Lister sees the Buyer's delivery name, delivery address and phone number for an order, so that the parcel can be prepared and handed to the courier. This is hidden once the Buyer has received the item or reported a problem. A Lister must use these details only for that order, keep them confidential, and must not copy them or contact the Buyer outside the app (Terms of Service §9.5).
  • If a Buyer reports a problem with an item, the Lister is told that a problem was reported, the reason and our reasoning, and is given the chance to respond. The Lister is not shown the Buyer's evidence photos.
  • When you like, pass on, follow or report a listing, the Lister is not told.

5.3 Legal and regulatory recipients

We may disclose personal information to UAE government authorities, regulators, law enforcement agencies or courts where:

  • we are required to do so by UAE law, a binding court order, or a properly authorised regulatory request; or
  • we believe in good faith that disclosure is necessary to prevent imminent harm, fraud, money laundering or other unlawful activity affecting our users or the platform.

This includes tax authorities, where we are required to report transaction information.

5.4 Corporate transactions

If we ever sell or transfer the FitCheck business, in whole or in part, your personal information may be transferred to the buyer as part of that transaction. We will tell you in advance, and the buyer will be bound by this Policy or one that is substantially similar.

5.5 Data we never sell

We do not sell, rent, lease or trade personal information to advertisers, data brokers or anyone else for marketing purposes.

6. Who is responsible for what

  • FitCheck is the controller for running the platform: accounts, listings, orders, purchases from Listers, sales to Buyers, payments, returns, reports, blocks, support emails and crash reports.
  • Aramex, Stripe and our bank are independent controllers for the information they handle for their own purposes, as described in §5.1.
  • A Lister who sees a Buyer's delivery details under §5.2 is a recipient of that information, bound by §9.5 of our Terms of Service.

If you believe a Lister has misused your delivery details, you can:

  • Block the Lister from inside the app (Product Detail, the three-dot menu, Block).
  • Report the listing or Lister (Product Detail, the three-dot menu, Report Item).
  • Email us at info@fitcheck.ae with the order reference so we can investigate and, where appropriate, suspend the account.

We will cooperate with you and with the UAE Data Office or any other competent authority investigating such a complaint.

7. International data transfers

Some of the providers we rely on, including Google (Firebase), Stripe and Anthropic, are established outside the UAE and may process your personal information in data centres in the European Union, the United States or other countries.

The UAE PDPL allows transfers of personal data outside the UAE in defined ways. Where we transfer your data abroad we rely on one of these:

  • Adequacy (PDPL Article 22): the destination country is recognised by the UAE as providing an adequate level of personal-data protection; or
  • Appropriate safeguards (PDPL Article 23): for other countries, a contract with the recipient that imposes the PDPL's protections (data-processing agreements and standard contractual clauses with Google, Stripe and Anthropic), or another lawful ground under that Article, such as the transfer being necessary to perform our contract with you.

We do not rely on your acceptance of this Policy as the only basis for an international transfer. You can ask us for detail about a specific transfer by emailing info@fitcheck.ae.

8. How long we keep your personal information

We keep personal information only as long as we need it for the purpose we collected it for, plus any period the law requires.

Data

Retention

Account record, profile, style identities

Until you delete your account

Active listings and their photos

Until you remove the listing or delete your account

Listings and photos of items that have sold

With the sales record below, because they are part of it

Sales to Buyers, purchases from Listers, receipts, invoices, payment references and bank-transfer records

7 years from the end of the financial year of the transaction, the longest period UAE tax and commercial law requires

Bank details for payment

Until you change them or delete your account, except that records of payments already made follow the line above

Likes, cart, passes, saved searches, followed Listers

Until you delete your account

Saved addresses and phone number

Until you delete them or your account (addresses on past orders stay in the order record)

Returns and disputes about an order

With the order record, because they form part of it

Reports about listings or users

3 years from submission, or longer if part of an ongoing investigation or claim

Records of staff actions on an account

3 years

Push notification tokens

Until you sign out, delete your account, or the token stops working

Service emails (other than receipts and purchase records)

12 months

Crash reports (Crashlytics)

90 days

Waitlist entries and reserved display names

Until you create an account, ask us to remove you, or 12 months after the app launches, whichever comes first

Marketing opt-ins

Until you opt out

When you delete your account (Profile, Settings, Delete account):

  • Your profile, style identities, saved addresses, likes and cart, saved searches, followed Listers, push tokens, reviews and display-name reservation are deleted, and your sign-in record is removed.
  • Your listings are removed from the app and the photos of items that have not sold are deleted.
  • We keep what the law requires us to keep, as described in §10.1.4 of our Terms of Service: the sales, purchase, payment, invoice and return records above. We delete or anonymise the personal data in those records that we are not required to keep, and we do not use retained records to market to you.
  • Reports you submitted are kept for the period above and, where the investigation no longer needs it, unlinked from your account.
  • Backups containing your data are overwritten on a rolling cycle, typically within 90 days.

9. Your rights under UAE law

Under the UAE PDPL you have these rights in relation to your personal information. They are free to exercise.

  • Right to be informed about what data we hold and how we use it. This Policy is part of how we meet that right.
  • Right of access: to ask for a copy of the personal information we hold about you.
  • Right to receive your data in a portable form: to ask for a machine-readable copy of the information you gave us so you can move it elsewhere.
  • Right to correction and erasure: to ask us to correct inaccurate information, or to delete your information where we no longer need it for the purpose we collected it for, or where you withdraw consent. This right is not absolute, because the law requires us to keep some records (see §8). You can use the in-app Delete account flow for most of it.
  • Right to restrict processing: to ask us to limit how we use your data while a complaint is investigated.
  • Right to stop processing: including processing for direct marketing. You can switch marketing off yourself in Profile, Settings, Privacy and data.
  • Right to object to automated processing: to ask for a person to review an automated decision, such as a listing screening result.
  • Right to withdraw consent at any time, where consent is the legal ground we rely on. Withdrawing consent does not affect processing we did before.
  • Right to complain to the UAE Data Office or another competent supervisory authority.

To exercise any of these rights, use Profile, Settings, Privacy and data, or email info@fitcheck.ae with "Privacy request" in the subject line. We aim to respond within 30 days, and in any case within the time the UAE PDPL and its regulations require. We may ask you to verify your identity first so that we do not release your data to someone impersonating you.

If you are not happy with our response, you can contact the UAE Data Office directly.

10. Children

FitCheck is intended only for people who are 18 or older, which is the age of full legal capacity in the UAE. We do not knowingly collect personal information from anyone under 18. If we discover that an account belongs to someone under 18, we will delete it and any personal information associated with it as soon as practicable. If you believe a child has given personal information to FitCheck, email info@fitcheck.ae and we will act on it.

11. How we keep your personal information secure

  • Encryption in transit. Traffic between the app and our backend is encrypted with TLS (HTTPS), enforced at the operating-system level on Android (usesCleartextTraffic="false") and by Apple App Transport Security on iOS.
  • Encryption at rest. Firebase encrypts data stored in Cloud Firestore and Cloud Storage at rest.
  • No card data on our servers. Card payments are handled directly by Stripe, and we never receive your full card number.
  • Authentication. We never store passwords. Firebase Authentication stores only a salted hash.
  • App attestation. Firebase App Check checks that requests come from a genuine, unmodified copy of the app.
  • Server-side validation. Every write to our database is checked against a strict ruleset that limits payload size, enforces ownership and rejects malformed data.
  • Least privilege. Each user can read and change only their own data and cannot see other users' email addresses, phone numbers or order history, except as set out in §5.2.
  • Staff access. Access to personal data for support, moderation and finance is limited to authorised staff, and actions taken in our admin console are logged.
  • Backups. Backups are encrypted, access-controlled and overwritten on a rolling basis.
  • No Android cloud backup. The app opts out of Android cloud backup so authentication tokens cannot be taken from a Google account backup.

Records and accountability. We maintain a record of our processing activities, and we will appoint a Data Protection Officer where our processing meets the threshold that requires one. Our current data-protection contact is info@fitcheck.ae.

Breach notification. No system is completely secure. If a personal-data breach occurs that is likely to put your information at risk, we will notify the UAE Data Office and affected users within the time and in the manner the UAE PDPL and its regulations require.

12. Third-party software components we use

Component

Provider

Purpose

Data involved

Firebase Authentication

Google LLC

Sign-in, password handling, password reset

Email, salted password hash, auth tokens

Cloud Firestore

Google LLC

App database

Account, profile, listing, order, report and block data

Firebase Storage

Google LLC

Photo storage

Listing, evidence and confirmation photos you upload

Firebase Cloud Functions

Google LLC

Our server-side logic

Data needed to process orders, payments and emails

Firebase App Check

Google LLC

App attestation

Anonymous device-integrity token

Firebase Cloud Messaging

Google LLC

Push notifications

Device push token

Firebase Crashlytics (and Firebase Sessions)

Google LLC

Crash reporting

Anonymous device details, stack traces, app version, session ID

Stripe SDK

Stripe

Card payment capture

Card data, sent directly to Stripe, and payment tokens

Local notifications

Flutter team

Show notifications on your device

Notification content, kept on your device

image_picker

Flutter team

Camera and gallery access for photos

Photos you choose to attach

url_launcher

Flutter team

Open Google Maps, email and phone links

The link you tap

We do not use Firebase Analytics, Google Ads, the Facebook SDK, the TikTok SDK, or any other advertising or behavioural-tracking technology.

Separately, listing photos and text are sent from our servers to Anthropic's Claude API for screening (see §5.1). This is a server-side service, not software inside the app.

13. Cookies and local storage

The FitCheck mobile app is not a website and does not use HTTP cookies. It stores small amounts of data on your device to remember your preferences (light or dark theme, language, signed-in state, photos pending upload). This cannot be used to track you across other apps or websites.

Our website, fitcheck.ae, does not set analytics, advertising or tracking cookies. It loads fonts from Google Fonts, which means Google receives your IP address (see §2.11).

14. Changes to this Privacy Policy

We may update this Policy from time to time. When we do:

  • We will update the Last updated date at the top of this document and the version number.
  • For material changes, such as a new category of recipient or a new processing activity, we will tell you in-app, and where reasonably possible by email, at least 14 days before the change takes effect.
  • Continuing to use the app after the change takes effect counts as acceptance of the updated Policy. If you do not accept the changes, you can delete your account.

The current version is always available in the app under Profile, Privacy.

15. Contact

Data protection and privacy requests: info@fitcheck.ae

General help and support: help@fitcheck.ae

Operator: FITCHECK - L.L.C - S.P.C | Trade licence no. CN-6616252