Privacy Policy

Last updated: 29 July 2026

GymFlow ("we", "our", "us") provides a gym management application used by gym owners, staff, and members to manage memberships, attendance, staff, and payments. This Privacy Policy explains what information we collect, how we use it, and the choices you have.

1. Information We Collect

Account & Profile Information

• Name, email address, phone number, and password (stored securely hashed, never in plain text)
• Profile photo, if you choose to upload one
• Role within a gym (Owner, Manager, Receptionist, or Member)

Gym & Business Information (Gym Owners)

• Gym name, address, contact details, business email/phone, and working hours
• Membership plans and pricing you configure

Membership & Activity Information

• Membership plan, start/end dates, and fee status
• Attendance check-in records (date, time, method — QR scan, self-marked, or marked by staff)
• Payment records you or your gym's staff enter (amount, method, and date) — GymFlow does not store your card, UPI, or bank account details

Device & Notification Information

• A device push-notification token (via Firebase Cloud Messaging), used only to deliver in-app alerts such as fee reminders

2. How We Use Your Information

• To provide core app functionality — managing members, staff, attendance, and payments
• To send fee-reminder and account-related push notifications
• To process gym subscription billing through our payment partner, Razorpay
• To maintain the security and integrity of the platform

We do not sell your personal information, and we do not use your data for third-party advertising.

3. Third-Party Services We Use

• Razorpay — processes gym subscription payments. Card/UPI/bank details are handled entirely by Razorpay and never pass through or are stored on our servers.
• Cloudflare R2 — securely stores profile photos and gym images you upload.
• Firebase Cloud Messaging (Google) — delivers push notifications to your device.

Each of these providers processes data only as necessary to perform the service above, under their own privacy and security commitments.

4. Data Retention

We retain your account and activity data for as long as your account is active. If you or your gym's owner deletes an account, we remove the associated personal data, except where certain financial records (such as payment history) may be retained for a limited period to comply with applicable tax, accounting, or legal obligations.

5. Your Rights

You can access and update most of your information directly within the app (Profile screen). You may also request account and data deletion at any time — see our Account & Data Deletion page for details.

6. Data Security

We use industry-standard measures to protect your data, including encrypted connections (HTTPS), hashed passwords, and role-based access control so users only see data relevant to their role.

7. Children's Privacy

GymFlow is intended for use by gym businesses, their staff, and adult members. It is not directed at children under 13, and we do not knowingly collect personal information from children under 13.

8. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

9. Contact Us