Your data
fitdb keeps everything in this browser. There is no server copy: back up regularly, especially on a phone.
Back up everything
One .fitdb file: workouts, measurements, face check-ins with photos, settings. Checksummed (SHA-256 per file).
Restore
Pick a .fitdb backup (or the seed exported from the old site). Merge (default) keeps what is already here and adds what is missing; restoring the same file twice adds nothing.
Hevy
The key is stored only encrypted (PBKDF2-SHA256, 600,000 iterations → AES-256-GCM). It is decrypted in memory when you press Refresh, sent only to api.hevyapp.com, then dropped. Sync is incremental: only workouts changed since the last refresh are pulled.