Privacy Policy

WeTrackFit is software used by gyms and fitness studios (our "customers") to run their business. This creates two distinct relationships:

• For a gym owner and their staff, WeTrackFit is the data controller of the account they create with us (their sign-up details, billing status and support messages).
• For a gym's members, the gym is the data controller and WeTrackFit is a data processor — we store and process member information on the gym's instructions, on the gym's behalf. If you are a member, please also read your gym's own privacy notice, and direct requests about your data to your gym.

Account information you give us when you sign up or use the Service:

• Your name, business/gym name, email address and phone number.
• Business address and branch details, and (if you provide them) tax details such as a GSTIN.
• Login credentials — passwords are stored only as salted hashes, never in plain text.
• If you choose "Sign in with Google", Google tells us your name and verified email address. We do not receive your Google password or anything else from your Google account.

Your own tracking, if you use WeTrackFit as a member without a gym: your workout and diet plans, workout and food logs, water, steps, weight, height, body measurements and goals. If you link your account to a gym, your gym can see this tracking (including what you logged before joining) and give you plans; if you leave, your tracking stays with you and the gym keeps the records it already has.

Phone features you allow, used only when you use them:

• Location — when you start a walk or jog, to measure the distance (we save only the distance and time, never your route).
• Camera — when you scan a QR code or take a photo. We keep only the photos you choose to save.

• To provide, operate and secure the Service and your account.
• To process your WeTrackFit subscription and send service and billing notices.
• To provide customer support and respond to your requests.
• To keep an audit log of actions for security, integrity and dispute resolution.
• To detect, prevent and investigate fraud, abuse and security incidents.
• To improve the Service and develop new features, using aggregated or de-identified information wherever possible.
• To comply with legal obligations.

We do not sell your personal information, and we do not use member data for advertising.

Where India's Digital Personal Data Protection Act, 2023 (DPDP) applies, we process personal data on the basis of your consent, to perform our contract with you, and for the legitimate uses the law permits (such as keeping the Service secure and meeting legal duties). For member data, the gym is responsible for having a lawful basis and, where required, for obtaining member consent.

We share personal information only in these limited situations:

• Service providers who help us run the platform — for example cloud hosting and email delivery — under contracts that require them to protect the data and use it only to provide their service to us.
• Within your own gym — data is isolated per gym using database row-level security, and staff see only what their role allows. One gym can never see another gym's data.
• Legal and safety — when required by law, court order or lawful government request, or to protect the rights, safety and property of WeTrackFit, our customers or the public.
• Business transfers — if WeTrackFit is involved in a merger, acquisition or sale of assets, data may transfer as part of that deal; we will notify you of any change in who controls your data.

• Encryption in transit (HTTPS/TLS). Data is stored with Amazon Web Services in Mumbai, and especially sensitive fields such as trainer notes about members and staff bank details are additionally encrypted by the app.
• Strict tenant isolation — each gym's data is separated at the database level so it cannot leak to another gym.
• Access controls and role-based permissions, plus optional two-factor authentication.
• An audit log of sensitive actions, which gym accounts can add to but cannot edit or delete.
• Passwords stored only as hashes; failed-login lockouts to resist guessing.

No method of transmission or storage is perfectly secure, but we work hard to protect your information and to notify you and the authorities where the law requires it.

We keep personal information for as long as your account is active and as needed to provide the Service. When a member deletes their account, they are signed out at once, and 30 days later their personal details, body measurements, notes, food logs, chats and photos are permanently erased. Payment and invoice records the gym must keep for tax and accounting are kept, without the member's name. Gyms can also remove member records from within the app. When a gym owner asks us to close their gym's account, we close it and, within 30 days, erase the personal details of its owner, staff and members, keeping only the bills and payment records the law requires.

Records kept only for running the Service are removed automatically:

• Sign-in sessions: 30 days after they end.
• Read notifications: after 90 days.
• Email and webhook delivery logs: after 180 days.
• Unfinished sign-ups: after 90 days.
• The security audit log: kept for 2 years in the Service, then moved to archive storage.

Subject to applicable law, you can:

• Access the personal information we hold about you.
• Correct information that is inaccurate or incomplete.
• Export your data. Members use Profile > "Download my data" in the member app; gym owners export their gym's data from Settings.
• Delete your account. Members use Profile > "Delete my account" in the member app; gym owners and staff use My profile > "Delete your account"; anyone can use the public request form at /delete-account.
• Withdraw consent, or nominate someone to exercise your rights, where the law provides for it.
• Complain to the Data Protection Board of India if we have not resolved your complaint.

Gym owners can exercise these rights from within the app or by emailing us. If you are a member of a gym, please contact your gym first, since they control your record; we will support them in fulfilling your request.

The Service is used by gyms that may enrol members under 18. The gym records the date of birth, and for a member under 18 it must record a parent or guardian's consent (a signed form) before the member can use the app, as the DPDP Act requires. Members under 18 are not shown streaks or similar nudges. WeTrackFit does not knowingly collect personal data directly from a child through a public sign-up. If you believe a minor's data has been provided without proper consent, contact us and we will help address it.

The Service is hosted on cloud infrastructure located in India (Mumbai region). Two service providers process limited data outside India: Resend (email delivery, United States) receives the address and content of the emails we send, and Sentry (error reports, United States) receives technical details of errors, with personal data removed. If you choose "Sign in with Google", Google confirms who you are. We use these providers only under contracts that require them to protect the data.

We may update this policy from time to time. When we make material changes, we will update the "Effective" date above and, where appropriate, notify you in the app or by email. Continued use of the Service after an update means you accept the revised policy.

For any question about this policy or your personal data, or to make a privacy request, contact us at wetrackfit@gmail.com with "Privacy" in the subject. We acknowledge requests within 48 hours and resolve them within 30 days, and always within the time the law requires.

Grievance officer (DPDP Act): wetrackfit@gmail.com

WeTrackFit