Legal & Privacy • Google Play Verified Compliance

Privacy Policy

Transparent disclosures on how FitFreak collects, processes, and protects personal, gym membership, payment, and biometric access control data across our web platform and Android mobile applications.

Effective: October 30, 2026•Last Updated: October 30, 2026•Version 2.8

Zero Data Monetization

We never sell, rent, monetize, or trade your personal information or gym customer records to third-party advertisers or data brokers.

Strict Tenant Isolation

Each gym facility operates in total database isolation via Row Level Security (RLS). Gym Owner A can never view, query, or edit Gym Owner B's data.

Biometric Privacy Safeguard

Raw optical fingerprint images are never stored in the cloud. Fingerprint minutiae is processed locally on physical ZKTeco / eSSL terminal hardware.

Right to Erasure & Deletion

Complete self-service account and personal data deletion via in-app Settings, or via verified 48-hour email request to our Data Protection Officer.

1. Overview & Scope

This Privacy Policy governs the collection, storage, processing, and transfer of personal information by FitFreak Technologies (“FitFreak”, “we”, “our”, or “us”) through:

The FitFreak Web Platform accessible at fitfreak.in and dash.fitfreak.in.
The FitFreak Android Mobile Application distributed via the Google Play Store.
The FitFreak Biometric ADMS Edge Gateway (bio.fitfreak.in) facilitating physical hardware terminal synchronization.
Automated messaging services delivering transactional billing receipts, fee alerts, and gym notifications via WhatsApp (Meta Cloud API).

By accessing or using FitFreak, you consent to the practices described in this Privacy Policy. If you do not agree with any part of this policy, please do not use our services.

2. Information We Collect

Depending on your relationship with FitFreak (as a gym facility owner, trainer/staff member, or gym member end-user), we collect the following categories of information:

A. Gym Facility Owners & Administrators (Account Holders)

Identity & Contact Details: Full name, registered email address, mobile phone number.
Business Information: Gym/studio name, physical facility address, branding logos, operating hours, and GST/Tax identification numbers.
Configuration Preferences: Currency settings, timezone, biometric hardware serial numbers (SN), and passkey PINs for device security.
Subscription & Billing Records: FitFreak SaaS subscription tier, plan duration, and transaction confirmation IDs. (Note: We do not store raw credit/debit card numbers or UPI PINs; payments are securely processed by authorized payment gateways).

B. Gym Members & End-Users

Personal Identity: Full name, mobile phone number, optional email address, gender, date of birth, emergency contact phone, and residential address.
Membership & Subscription Details: Membership plan name (e.g., Monthly, Quarterly, Annual, Personal Training), admission date, plan expiration date, active/inactive status, and assigned fitness trainer.
Financial & Fee Records: Fee payment history, paid amounts, pending balances, invoice numbers, receipt generation records, and mode of payment (Cash, UPI, Card, Bank Transfer).
Attendance Records: Timestamped entrance and exit logs, daily check-in history, visit frequency, and preferred shift (Morning/Evening).
Profile Photograph: Member admission portrait captured via camera or selected from device storage (solely used for receptionist identification and membership cards).

C. Biometric & Physical Hardware Access Control Data

FitFreak integrates with physical access control hardware (ZKTeco K40 Pro, eSSL, Biomax, and Hikvision ADMS terminals) to operate electromagnetic turnstiles and doors.

Biometric Numeric PIN: A unique numeric code (e.g. 101, 102) assigned to the member in gym memory.
Mathematical Minutiae Vectors: Encrypted mathematical coordinate vectors representing fingerprint ridge intersections.
Hardware Verification Guarantee: FitFreak DOES NOT capture, store, or transmit raw optical fingerprint photographs or photographic fingerprint scans. All biometric matching occurs 100% locally on the terminal's physical digital signal processor (DSP). Cloud synchronization only coordinates alphanumeric PINs and encrypted vector templates strictly to grant or revoke physical turnstile access based on membership fee validity.

D. Device Telemetry & Technical Logs

IP address, device model, operating system version (Android / Windows / macOS / iOS), browser user-agent, and screen dimensions.
Crash reports, latency benchmarks, and application performance diagnostics used strictly for troubleshooting and server stability.

3. Android Device Permissions Disclosure

In accordance with Google Play Console Developer Policies, the FitFreak Android application requests runtime permissions only when strictly required for user-initiated core features. Each permission and its explicit purpose is disclosed below:

Permission	Android API	Explicit Purpose & Usage
Camera	android.permission.CAMERA	Used strictly when staff or members actively choose to snap an admission profile portrait or scan a gym QR code. The camera is never accessed in the background.
Photo & Media Access	READ_MEDIA_IMAGES / READ_EXTERNAL_STORAGE	Allows selecting an existing member photo from the device gallery or uploading gym logos and workout banner assets.
File Storage & Downloads	WRITE_EXTERNAL_STORAGE / DownloadManager	Required to download and save exported PDF payment receipts, membership admission agreements, and financial CSV reports to your device.
Push Notifications	android.permission.POST_NOTIFICATIONS	Delivers real-time notifications for membership renewals, fee due alerts, daily attendance check-ins, and gym event announcements. Can be disabled anytime in Android settings.
Network & Internet	INTERNET / ACCESS_NETWORK_STATE	Enables secure SSL/TLS communication with encrypted Supabase cloud databases and Cloudflare Edge caching servers.
Device Biometrics	USE_BIOMETRIC / USE_FINGERPRINT	Provides optional, local device fingerprint or face unlock to secure sensitive gym owner financial dashboard tabs.

4. How We Use Your Information

We process collected data under legitimate business interests, contractual necessity, and user consent for the following specific purposes:

Gym Administration: Managing member enrollments, trainer assignments, subscription renewals, inquiry follow-ups, and attendance logs.
Automated WhatsApp Notifications: Transmitting transactional payment receipts, membership welcome guidelines, fee due reminders, and birthday wishes via the Meta Cloud API / Zaptilo WhatsApp Business Platform.
Turnstile Access Control: Automatically enabling physical gym turnstile access upon fee payment, and locking out expired members via encrypted command queues to physical biometric terminals.
Financial Reporting: Calculating gym revenue, monthly collections, pending dues, operational expenses, and profit/loss statements for facility owners.
Platform Security & Auditing: Maintaining tamper-evident audit logs of member modifications, payment deletions, and administrative actions to prevent internal fraud.

5. Strict Multi-Tenant Isolation Guarantee

FitFreak is built on a non-negotiable architectural mandate: Zero Cross-Tenant Visibility.

All operational tables (members, payments, expenses, attendance, staff, inquiries, settings) strictly enforce PostgreSQL Row Level Security (RLS):

CREATE POLICY tenant_isolation ON members USING (auth.uid() = user_id);

Gym Owner A can never view, count, query, edit, or delete Gym Owner B's members or revenue figures under any circumstance. All server actions enforce defense-in-depth security checks matching the authenticated user ID.

6. Third-Party Service Providers & Subprocessors

We partner exclusively with enterprise-grade infrastructure providers that adhere to rigorous security standards (ISO 27001, SOC 2 Type II, GDPR):

Supabase Inc.

Primary encrypted cloud database (PostgreSQL), JWT authentication, and secure asset storage.

Cloudflare Inc.

Global Edge CDN, DNS routing, DDoS defense, and Cloudflare KV for high-speed hardware ping caching.

Meta Platforms / Zaptilo

Official WhatsApp Business Cloud API provider used for delivering transactional receipts and member alerts.

ZKTeco / eSSL Hardware

Local biometric terminals performing on-premise fingerprint verification for electromagnetic turnstiles.

7. Account & Data Deletion Policy (Google Play Compliance)

In compliance with Google Play's User Data & Account Deletion Policy, FitFreak provides a straightforward, complete mechanism for all users to request permanent deletion of their account, personal information, and operational records.

Method A: Self-Service In-App Deletion (Immediate)

Gym owners can delete their entire account directly within the application:

Open the FitFreak web app or Android application and sign in.
Navigate to Settings ➡️ scroll to Danger Zone / Account Management.
Click Delete Account & Purge Data and confirm.

⚡ Automated Cascade Purge: Deleting an account executes an automated cascade wipe across all 14 database tables (members, payments, attendance, staff, expenses, audit_logs, settings) and permanently deletes all stored member photos and PDF files from cloud storage within 60 seconds.

Method B: Web & Email Deletion Request (Within 48 Hours)

If you cannot access your account or if you are a gym member whose details were registered by a gym facility, you may submit a manual data deletion request:

Send an email to: somitrov@gmail.com or truefitfreak@proton.me
Subject line: “Account & Data Deletion Request - FitFreak”
Provide your registered email address, gym facility name, or mobile phone number.

Our Data Protection Officer will verify your identity, execute the complete purge of all associated records across our database and cloud storage, and confirm deletion in writing within 48 hours to a maximum of 30 days.

8. Data Retention Period

We retain personal and gym operational data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy:

Active Gym Subscriptions: Data remains stored and accessible to the gym owner for the duration of their active subscription.
Deactivated Members: Expired gym members remain visible in the gym owner's archived records until the gym owner chooses to delete them.
Audit Logs & Financial Invoices: Payment transaction receipts and tax summaries are retained for up to 7 years solely to satisfy statutory accounting and legal compliance obligations under Indian law.
Backups: Encrypted automated database backups are cycled and purged on a 30-day rolling basis.

9. Data Security & Technical Safeguards

We implement comprehensive organizational and technical security measures to protect against unauthorized access, loss, or alteration:

🔒 Encryption in TransitAll communications flow over modern TLS 1.3 / HTTPS encryption, preventing eavesdropping and man-in-the-middle attacks.

🛡️ Encryption at RestUnderlying databases and storage volumes use AES-256 block-level encryption managed in secure cloud data centers.

🔑 Passkey ProtectionSensitive biometric settings and hardware turnstile triggers are locked behind owner passkey authentication.

⚡ Zero Direct DB AccessPublic clients interact strictly through isolated server actions and RLS policies; direct administrative keys are quarantined.

10. Children's Privacy (COPPA & DPDPA Compliance)

FitFreak is designed as a business-to-business management tool for fitness facility owners and adult gym members. We do not knowingly solicit or collect personal information directly from children under 13 (or under the applicable age of consent in your jurisdiction).

If a fitness center registers a minor for youth sports training or martial arts classes, the gym facility administrator is legally required to obtain verifiable written consent from the minor's parent or legal guardian. If we learn that a minor's personal information has been collected without parental consent, we will promptly purge the data from our systems.

11. User Rights (DPDPA 2023, GDPR & CCPA)

Under applicable data protection laws, including the Digital Personal Data Protection Act (DPDPA 2023) of India and the European Union General Data Protection Regulation (GDPR), you possess the following rights:

Right to Access: You may request a copy of the personal data we hold about you.
Right to Rectification: You may correct inaccurate or incomplete member or gym profile information directly in the dashboard.
Right to Data Portability: Gym owners can export all member lists, attendance records, and payment receipts in CSV format at any time.
Right to Erasure (“Right to be Forgotten”): You may request permanent deletion of your data as detailed in Section 7.
Right to Withdraw Consent: You may revoke consent for WhatsApp automated marketing notifications by unsubscribing or requesting facility administrators to adjust your contact settings.

12. Changes to this Privacy Policy

We may periodically update this Privacy Policy to reflect enhancements in FitFreak features, changes in biometric firmware specifications, or revisions in Google Play Developer Policies. Whenever updates occur, we will revise the “Last Updated” date at the top of this document. For significant modifications, we will notify registered gym owners via in-app dashboard alerts or registered email.

13. Contact Information & Grievance Redressal

For questions, legal inquiries, account deletion requests, or data protection concerns, you may contact our designated Grievance & Data Protection Officer:

Entity: FitFreak Technologies

Designated Officer: Somit Kumar (Data Protection & Grievance Officer)

Official Inquiries Email: somitrov@gmail.com

Secondary Security Email: truefitfreak@proton.me

Platform Website: https://fitfreak.in

Jurisdiction & Location: India

We acknowledge all privacy and data protection grievances within 24–48 hours and resolve verified requests within 15 to 30 business days.