Privacy policy

Effective date: September 19, 2026 · Last updated: September 19, 2026

1. Introduction

This Privacy Policy explains what information Gymnast ("Gymnast", "the app", "we", "us") collects, why, who can see it, and the choices you have. It covers the Gymnast member app and the Gymnast Business app for gym owners and staff (together, "the Service"), and the gyms, studios and fitness businesses ("Gyms") that use them.

Gymnast works in two ways. You can use it on your own, to plan and log your training. You can also connect it to a Gym, and then the Gym can see some of your information, for example your bookings and check-ins. Section 3 explains who is responsible for what.

By ticking the box that says you agree to this Privacy Policy, and by creating an account or signing in, you confirm that you have read it and agree to the collection and use of your information as described here. If you do not agree, please do not use the Service.

2. Who we are and how to contact us

Gymnast is developed and operated by Debriyon, an independent developer based in Odisha, India.

• Email: debajyotiparker@gmail.com

We answer privacy requests within 30 days, or sooner where the law requires. This address is also our Grievance Officer contact for the purposes of India's Digital Personal Data Protection Act, 2023.

3. Who is responsible for your data

• Information tied to your own login and your own use of the app (your account, your training, nutrition and body logs, your onboarding answers, device tokens, crash reports): we are the data controller.
• Information a Gym records about you (for example a receptionist creating your member profile, recording an in-person payment, or noting an injury): the Gym is the data controller and we act as its processor. We handle that data only to provide the Service, on the Gym's instructions. If you have a question about what a Gym holds about you, please contact the Gym as well as us.

The roles in the app are: Members, Trainers, Managers, Reception staff, Gym Owners, and Gymnast's own administrators. Each role sees only what its permissions allow, and a Gym cannot see another Gym's data.

3A. Your consent

We ask you to tick a box before you create an account or sign in, because using Gymnast means we process the information described in this policy. We record the version of the policy you accepted and when.

Some things need a separate, specific choice, and you make them one at a time:

• Device permissions: camera, location and notifications are each requested only when a feature needs them, and you can refuse or later withdraw them in your phone's settings.
• Optional features: for example creatine tracking is off until you turn it on and accept a warning.

You can withdraw consent at any time by deleting your account (see section 9) or by writing to us. Withdrawing consent does not affect what we did before you withdrew.

4. Information we collect

4.1 Account and sign-in

When you create a login we collect your name, email address, and a password, which Firebase Authentication stores in hashed form. We never see or store your plain-text password. If you sign in with Google, Google shares your name, email address and profile photo with us according to your Google account settings. If phone sign-in is offered, we also collect your phone number. We keep your role, account status, account creation date and last sign-in date.

We may send you a one-time code by email to verify your address, and a password-reset email if you ask for one.

4.2 Your onboarding answers and training plan

When you first open the member app it asks a short questionnaire: your main goal, focus areas, height, weight, target weight, experience level, a recent lift used to estimate your strength baseline, the equipment and place you train, how many days a week you can train, and what usually gets in your way. We use your answers to build your weekly training plan and set personal targets. These answers are saved to your account and are private to you: Gym staff and trainers cannot read them.

4.3 Health and fitness information (sensitive)

Depending on the features you use, the app stores information about your health and fitness: workout sessions, sets, reps and weights; personal records; body weight and measurements; how tired you feel in a fatigue check-in; the meals you log; and your daily water, protein and creatine logs and targets. This is sensitive information. It belongs to your account and is visible to you. If you are connected to a Gym, the Gym's staff can see what their role needs to see, for example a trainer assigned to you can see your workouts and progress. Your onboarding answers in section 4.2 are the exception and stay private to you.

The targets and recommendations the app shows are general guidance based on published training guidelines. They are not medical advice. If a Gym's staff record health notes about you, that is described in section 4.5.

4.4 Live Coach and the camera

The camera is used only when you choose to use it: scanning a QR code, taking a photo of a meal, or running Live Coach, which watches an exercise to count reps and suggest form corrections.

• Live Coach analyses your movement on your device. Camera frames and the body-position points detected from them are not saved and are not sent to us or anyone else. After a set, only a small summary is saved to your account: the exercise, number of reps, and a simple quality rating for each rep.
• Meal photos are kept on your device only. They are not uploaded.
• QR scanning reads the code and discards the image.
• The app does not record audio.

4.5 Information a Gym records about you

If you are a member of a Gym, its staff can create and maintain a profile for you. That can include your name, contact details, photo, date of birth, gender, address, membership plan and dates, payment totals and balance, assigned trainer, rewards points, an emergency contact's name and phone number, and health or injury notes. The Gym is responsible for having the right to collect this, including any consent needed for health notes.

4.6 Bookings, check-ins and activity at your Gym

When you book a class or session we record the booking, its status, the access type you used (membership, class pack, day pass or drop-in), and any waitlist position. When you check in, by scanning your Gym's poster or showing your member QR code, we record the check-in time. Your first name and score may appear on your Gym's leaderboards and challenges. Reviews you write about a Gym, class or trainer may be shown to that Gym and to other people browsing it.

4.7 Location

With your permission, the app uses your device location for two things: gym self-check-in, where it checks briefly that you are within the distance your Gym has set of its check-in spot, and finding gyms near you. We do not keep a history of where you have been. If you decline, you can still check in by QR code where the Gym allows it and search for gyms by name.

The gym-finder map is drawn using map tiles fetched from OpenStreetMap. Fetching tiles sends your device's IP address and the area of the map you are viewing to that service.

4.8 Photos and files

If you choose a profile or Gym photo, the picture you select is uploaded to Google Cloud Storage. Gym Owners can also import and export spreadsheets and PDFs; those files are processed on the device and used only for the Gym's own records.

4.9 Payments

When a payment is recorded in person (cash or cheque), the Gym records the amount, method, date and receipt number. When an online payment is available, for example a Gymnast Go plan or a Gym's own plan, it is handled by Razorpay, an RBI-authorised payment gateway. Razorpay collects your card, UPI or net-banking details directly, and we never receive or store them. We receive only an order ID and a signed confirmation that the payment succeeded.

4.10 Device, notifications and diagnostics

• Notifications: we store a push-notification token for your device (Firebase Cloud Messaging) and your Gym's notification topic so that reminders and announcements reach you. Workout and water reminders you set are scheduled on your device.
• Crash reports: Firebase Crashlytics collects crash reports and basic device details (device model, operating system version, app version) to help us fix problems.
• App attestation: Firebase App Check (Play Integrity on Android) confirms to our servers that a request comes from a genuine copy of the app. It exchanges device-integrity signals with Google.
• Fonts: the app downloads its typeface from Google Fonts, which means Google receives your IP address when it does.

We do not use advertising SDKs, we do not show adverts, and we have switched off collection of your device's advertising ID. The only usage diagnostics we collect are the crash reports described above.

4.11 Business, staff and prospect information (Gymnast Business)

Gym Owners and Managers can record staff details (contact details, role, specialisation, employment status, join date and salary), prospect ("lead") details, expenses and equipment. These are visible only to the roles at that Gym who need them. A Gym can also publish a public profile (name, description, address, photos, opening hours, price range and class timetable) that anyone browsing gyms can see. Partner companies that sell to Gym Owners have their own business accounts and catalogues.

5. How we use information

We use information to:

• provide and run the Service: your account, training plan, logs, bookings, check-ins, billing and messages;
• let Gyms manage their members, staff, leads and payments;
• calculate points, streaks, badges and leaderboards;
• send reminders and announcements you have asked for or that your Gym sends;
• verify identity, protect accounts and prevent fraud and abuse;
• provide support, and diagnose and fix problems;
• comply with the law and enforce our terms.

We do not sell your personal information. We do not use your health, fitness or nutrition data for advertising. We do not make automated decisions that have legal or similarly significant effects on you.

6. Legal bases (EEA and UK)

If you are in the European Economic Area or the United Kingdom we rely on: performance of a contract (providing the Service); legitimate interests (security, fraud prevention and improving the Service); consent (for example health information you choose to log, device permissions and optional features); and legal obligation (for example financial record-keeping).

7. Who we share information with

• Within your Gym: staff at your Gym see the information their role needs. A receptionist may see contact and payment details, and a trainer sees the workouts of members assigned to them.
• Service providers: Google Firebase and Google Cloud (Authentication, Firestore, Cloud Storage, Cloud Functions, Cloud Messaging, Crashlytics and App Check), Google Sign-In, Google Fonts and Play Integrity; OpenStreetMap for map tiles; and Razorpay for online payments. They process data for us under their own security and confidentiality terms.
• Legal reasons: if the law, a court or a government authority requires it, or to protect the rights, property or safety of Gymnast, our users or others.
• Business changes: if Gymnast is involved in a merger, acquisition or sale of assets, information may transfer as part of it, and we will tell you.

We do not sell, rent or trade personal information.

8. Where your data is stored

Our providers may store and process data in data centres outside India, including in the United States and other places where Google operates. Where the law requires, we and our providers use appropriate safeguards for those transfers.

9. Keeping and deleting your data

We keep your information while your account is active, and afterwards only for as long as needed for legal, tax and accounting duties, resolving disputes and enforcing agreements.

You can delete your account yourself in the app (Profile, then Delete my account), or by following the instructions at gymnast.co.in/delete-account. Deleting your account removes your personal data, including your profile, training, nutrition and body logs, and unlinks you from your Gym's member record. Records a Gym is required to keep for its own business, such as payment receipts, stay with the Gym. Backups are cleared on our normal schedule. A Gym Owner can delete a member's, staff member's or lead's record at any time.

10. Security

• Role-based access, so each person sees only what their role allows.
• Separate data for each Gym, enforced by server-side security rules.
• Encryption in transit (TLS) and encryption at rest by our cloud provider.
• Firebase App Check, so requests come from the genuine app.
• Signature verification on payment confirmations.
• Optional two-step sign-in (an authenticator app) for Gym Owner accounts, which control a Gym's revenue and members.

No system is completely secure, so we cannot guarantee absolute security.

11. Your rights

Depending on where you live, you may have the right to access your data; correct it; delete it; restrict or object to certain processing; receive it in a portable format; and withdraw consent. To use any of these, write to debajyotiparker@gmail.com. Where a Gym entered the data, we will help the Gym respond.

• EEA and UK: you may also complain to your local data protection authority.
• California: you may ask what personal information we collect, use and disclose, and ask for correction or deletion. We do not sell or share personal information as defined by the CCPA/CPRA, and you will not be treated differently for using your rights.
• India (DPDP Act, 2023): you may ask for a summary of your personal data and how it is processed, ask for correction, completion, updating or erasure, nominate another person to exercise your rights if you die or become unable to, and complain to us and, if it is not resolved, to the Data Protection Board of India.

12. Children

Gymnast is intended for people aged 18 and over. If you are under 18, please use it only with the knowledge and permission of a parent or guardian. Gyms that enrol members under 18 are responsible for getting a parent's or guardian's verifiable consent before entering the minor's information. We do not knowingly collect personal data from children under 13, and we never use anyone's data for advertising or behavioural tracking. If you believe a child has given us personal data inappropriately, email us and we will delete it.

13. Cookies and the web

The Gymnast websites use only the cookies and local storage needed to keep you signed in and to make pages work. We do not use advertising cookies.

14. Third-party links

The app can open other services, for example WhatsApp to message a Gym, or a payment provider's page. Those services have their own privacy policies, and we are not responsible for them.

15. Changes to this policy

We may update this policy as the Service or the law changes. We will change the "Last updated" date. If a change is material, we will ask you to review and accept the new version, and we record which version you accepted.

16. Contact us

Questions, requests or complaints about this policy or your data:

• Email: debajyotiparker@gmail.com