Legal

Privacy policy

Last updated 23 October 2026

StreaxFit is gym management software for independent gyms in India. This policy explains what personal data we hold, why, who can see it, how long we keep it and how you can use your rights under the Digital Personal Data Protection Act 2023 (DPDP Act).

Who is responsible for your data

Responsibility is split between us and your gym.

StreaxFit decides how the following is used, so we are its Data Fiduciary: gym staff accounts, our billing with gyms, and how you use the member app (login and session records, app version and your consent record).

Your gym decides to collect your member records, so the gym is their Data Fiduciary and StreaxFit processes them for the gym. These are your name, mobile number, email, address, membership, payments, attendance, the workout schedules gym staff create for you and the workout logs you record against them.

Your own profile is shared. Your gym supplies it, and StreaxFit keeps it when you join another gym, so you do not have to be set up from scratch.

What we hold

  • Name, mobile number and email.
  • Address, if your gym enters it.
  • Membership details and the payments your gym records.
  • Attendance (check-ins).
  • Workout schedules and the workout logs you record.
  • Your username and profile photo, if you add them, and whether you joined your gym's leaderboard.
  • XP, streaks and badges, while they are switched on for you. Never for members under 18.
  • Complaints you send your gym, with any photos and videos you attach.
  • Notifications your gym sends you, and a push token for your phone, used only to deliver them.
  • Login and session records, app version and when you gave consent.

We hold no health data: the height, weight and age you enter in the app stay on your phone. We use your location only at check-in, to see that you are at your gym, and never store it. We do not collect your contacts or advertising ID.

Why we use it

  • To run your gym membership.
  • To track attendance and workouts.
  • To send your complaints to your gym.
  • To show your streaks and badges and, if you join it, your gym's leaderboard.
  • To log you in with a one-time SMS code.

We do not use your data for anything else. We do not sell it and we do not use it for advertising.

Consent

The first time you log in as a member, the app shows a summary of this policy and asks for your consent. We record the version you agreed to and when.

You can withdraw consent at any time by deleting your account. Your app-side data is then removed after the grace period below. Your gym keeps its business records, such as payments, as the law allows.

Who can see it

  • You can see everything we hold about you in your profile.
  • Staff of a gym where you have an active membership can see your name, email, membership and payment records, according to their role.
  • Your full mobile number is never shown to other members.
  • Service providers that help us run the service process data only on our instructions: the SMS provider that delivers login codes, our email provider, our hosting and network providers, and our error monitoring.

Your rights

  • Access: your profile shows every field we hold. For a full export, email [email protected]; we send it within 7 days.
  • Correction: edit your profile in the app. Fields your gym entered are corrected by your gym.
  • Erasure: use "Delete my account" in Profile in the mobile app. Your data is removed after 30 days; logging in again before then restores the account.
  • Grievance: write to our Grievance Officer at [email protected].
  • Nomination: email [email protected] to nominate someone to use your rights for you.

How long we keep it

DataKept for
A deleted account30 days, then removed
A membership after the member leaves2 years for the gym's records, then anonymised
SMS login code records90 days
Audit logs2 years
Payment records8 years, as tax law requires
Complaints and their messages2 years after the complaint closes, then deleted
Complaint photos and videosDeleted with their complaint
Push tokensUntil you sign out, or 180 days unused, then deleted

Security

Data is encrypted in transit. Mobile numbers in SMS login records are stored hashed. Access for gym staff is limited by role.

If a personal data breach happens, we notify the Data Protection Board of India and every affected person, and report cyber incidents to CERT-In as the law requires.

Children

Members under 18 need verifiable parental consent. Gyms confirm that members they add are 18 or older, or that the gym holds that consent.

Grievance Officer

Grievance Officer, StreaxFit. Email: [email protected].

Changes to this policy

When this policy changes, we update the date at the top. If the change affects how we use your data, the app asks for your consent again.