Last updated 15 October 2026.
QUESTION 42 LTD ("we") is the controller for the personal data described here.
Questions and data requests go to privacy@question42.co.uk.
What this covers
This policy covers:
- the website at question42.co.uk
- Bodfit, the fitness and movement coach, live at bodfit.expo.app and coming to iOS and Android
- Hopni, the intercity carpooling app for Bulgaria
Purchases of Bitkoinz products on Amazon are covered by Amazon's own privacy notice. We do not receive your payment card number from those orders.
The website
The site does not ask you to create an account. If you email us, we receive your address, your name if you include it, and what you write. We use that to reply, and to keep a record of the conversation. The contact form on the site opens your own email app. It does not send the message to a server of ours.
The lawful basis is legitimate interests (answering a person who wrote to us) and, where you ask us to do work, steps toward a contract.
This website does not use a third-party analytics service, and it does not set advertising cookies. There is no cookie banner, because the site does not set non-essential cookies. Our host may keep ordinary server logs, such as IP address, browser, and the page requested, for security and to keep the site online. We do not use those logs to market to you.
Bodfit
Bodfit is an AI coach for fitness and movement, operated by QUESTION 42 LTD. You sign in with Clerk. Clerk processes the details needed to authenticate you, such as your email address and authentication identifiers. Clerk keeps you signed in on the app, including on bodfit.expo.app, using the cookies or equivalent storage that sign-in requires. Those are not set on question42.co.uk.
What you keep in Bodfit is stored by Convex, which hosts our database and backend. That includes your profile, check-ins, workout sessions and history, equipment inventory, saved places, social posts, and the push notification token for your device.
Health and fitness data can include sleep, energy, where something hurts, and period and cycle tracking. We use it only to coach you. We treat you giving us those details, for that purpose, as your explicit consent (UK GDPR Article 9(2)(a)), alongside the contract to provide the app. We do not use health details for advertising. You can withdraw this by deleting the data or the account.
The camera and your photo library are used to identify equipment. Photos you take or choose for that are stored with your equipment inventory.
Precise location is used only while the app is open, to suggest Home or Gym. We do not keep a history of where you have been. Places you save are stored encrypted.
If you allow notifications, we store the push notification token for that device so Bodfit can send them.
For coaching, and to recognise equipment from a photo, Bodfit sends the content needed for that task to OpenAI. We do not send your password. OpenAI processes that content to return the plan or the recognition.
You can export your data from Settings in the app. To delete the account, and everything associated with it, follow Delete your Bodfit account.
The lawful bases for the rest of the account are contract (providing Bodfit) and legitimate interests (keeping the app reliable).
Hopni
Hopni is an intercity carpooling app for Bulgaria, in Bulgarian and English. You sign in with Clerk, on the same basis as Bodfit. Trip details, requests related to a journey, and messages you send to arrange a ride are stored by Convex.
If you include information about someone else, share only what they would expect for arranging the journey.
The lawful bases are contract (providing Hopni) and legitimate interests (keeping the app reliable and safe to use).
Analytics
The website does not run a third-party analytics tracker. Bodfit and Hopni may store product-usage events, such as a screen being opened, in Convex with your account. We use those events to operate the apps, fix faults, and see which parts are used. We do not sell this data, and we do not use it to build advertising profiles.
The lawful basis is legitimate interests: understanding whether the product works, without a separate marketing use.
Who else handles data
- Clerk, for sign-in on Bodfit and Hopni
- Convex, for the app database and backend
- OpenAI, for Bodfit coaching and for recognising equipment from a photo
- the company that hosts question42.co.uk, for server logs
- our email provider, when you write to privacy@question42.co.uk
We do not sell personal data.
International transfers
Clerk, Convex, and OpenAI are based in the United States. Where personal data leaves the UK, we rely on a transfer safeguard the UK GDPR allows, such as the UK International Data Transfer Addendum to the EU standard contractual clauses.
How long we keep it
- Bodfit account data, including your profile, check-ins, workout sessions and history, health and cycle data, equipment photos and inventory, saved places, social posts, and push tokens: deleted immediately when you delete the account in the app. If you email us because you cannot open the app, we delete it within 30 days of verifying the request. See Delete your Bodfit account. After that we keep nothing, except a record the law requires us to keep, and then no longer than needed.
- Hopni account data, trips, and messages: for as long as the account exists. If you ask us to delete the account, we delete or anonymise it unless the law requires us to keep a record, or we need it to defend a legal claim.
- Emails you send us: while we are corresponding, and for up to two years after the last message, in case you follow up.
- Host logs: for a short security period set by the host. We do not set that period ourselves, and we do not use the logs to identify you for marketing.
Your rights
Under the UK GDPR you can ask us to:
- confirm whether we hold your data, and for a copy of it
- correct data that is wrong
- delete it
- restrict or object to certain uses, including uses based on legitimate interests
- receive a portable copy, where the basis is contract or consent and the processing is automated
Email privacy@question42.co.uk. In the ordinary case there is no fee. We respond within one month. If a request is complex we may extend that by up to two further months, and we will tell you if we do.
You can complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint. The ICO is the UK regulator for data protection. We would like the chance to put something right first, and you do not have to wait for us before you contact them.
Children
The website, Bodfit, and Hopni are not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe we have, email us and we will delete it.
Changes
If this policy changes, we will update this page and the date at the top.
How to reach us
QUESTION 42 LTD
privacy@question42.co.uk