Fitbit

"The Services include features that use precise geolocation data, including GPS signals, device sensors, Wi-Fi access points, and cell tower IDs. We collect this type of data if you grant us access to your location. You can always remove our access using your Fitbit device or mobile device settings. We may also derive your approximate location from your IP address."

Fitbit collects precise location data from multiple sources including GPS, Wi-Fi, and cell towers. Even without explicit permission, they derive approximate location from IP addresses.

"Your device collects data to estimate a variety of metrics like the number of steps you take, your distance traveled, calories burned, weight, heart rate, sleep stages, active minutes, and location. We also collect data about the devices and computers you use to access the Services, including IP addresses, browser type, language, operating system, Fitbit or mobile device information (including device and application identifiers), the referring web page, pages visited, location, and cookie information."

Fitbit collects extensive biometric and health sensor data from its devices, plus detailed information about other devices used to access the service including application identifiers and browsing behavior.

"We work with partners who provide us with analytics and advertising services. This includes helping us understand how users interact with the Services, serving advertisements on our behalf across the internet, and measuring the performance of those advertisements. These companies may use cookies and similar technologies to collect information about your interactions with the Services and other websites and applications."

Fitbit's advertising and analytics partners can collect data about user interactions across multiple websites and applications using cookies and similar tracking technologies.

"We keep other information, like your exercise or activity data, until you use your account settings or tools to delete the data or your account because we use this data to provide you with your personal statistics and other aspects of the Services. We also keep information about you and your use of the Services for as long as necessary for our legitimate business interests, for legal reasons, and to prevent harm."

Exercise, activity, and health data is retained indefinitely unless the user manually deletes it. Additional data may be kept even longer under the broad justification of 'legitimate business interests.'

"These companies may use cookies and similar technologies to collect information about your interactions with the Services and other websites and applications. We also collect data about the devices and computers you use to access the Services, including IP addresses, browser type, language, operating system, Fitbit or mobile device information (including device and application identifiers), the referring web page, pages visited, location, and cookie information."

Advertising partners track users across Fitbit and other websites/applications using cookies and similar technologies. Fitbit also collects device and application identifiers that can be used for cross-service profiling.

"If you choose to delete your account, please note that while most of your information will be deleted within 30 days, it may take up to 90 days to delete all of your information, like the data recorded by your Fitbit device and other data stored in our backup systems. This is due to the size and complexity of the systems we use to store data. We may also preserve data for legal reasons or to prevent harm."

Account deletion is not immediate — it can take up to 90 days, and Fitbit reserves the right to preserve some data indefinitely for legal reasons or to 'prevent harm,' an open-ended justification.

"We will notify you before we make material changes to this policy and give you an opportunity to review the revised policy before deciding if you would like to continue to use the Services."

While Fitbit promises advance notice, the mechanism is essentially continued use equals acceptance — users must stop using the service entirely if they disagree with changes.