Privacy Policy

GymOrigin gym-management app · Effective 22 July 2026

This Privacy Policy explains how GymOrigin ("we", "us", "the app"), operated by Dilip Kumar (sole proprietor), handles information in the GymOrigin gym-management application (package com.gymorigin.app). By creating an account or using the app, you agree to this policy.

1. Who this policy is for

GymOrigin is a tool for gym owners and their staff to run a gym. Two kinds of people are involved:

Account holders — the gym owner and any staff they invite. They create accounts and log in.
Gym members — people whose details (name, phone, photo, plan, payments, attendance) the gym owner enters into the app to manage their memberships. Gym members do not install or log into the app.

For gym members' personal data, the gym owner is the data controller / fiduciary and GymOrigin acts as a data processor that stores and processes it on the gym owner's instructions. Gym owners are responsible for having a lawful basis to enter their members' details.

2. Information we collect

a) Account information (owner & staff)

Name, email address, phone number.
Password — handled by our authentication provider (Supabase Auth) and stored only as a secure salted hash. We never see or store your plain-text password.
Gym/business details you enter: gym name, address, phone.
Role (owner or staff) and staff invite codes.

b) Member information (entered by the gym owner)

Member name, phone number, and optional photo.
Join date, notes, membership plans, and membership start/end dates.
Payment records you enter (amount, date, and payment mode such as cash/UPI/card) — for your own bookkeeping.
Attendance records (which members checked in on which day).

c) Diagnostic information

When the app hits an unexpected error, it records technical details of the fault (the operation that failed, an error message, a timestamp, and the associated account/gym identifiers) so we can fix bugs. This is stored in our own database and is not shared with any third-party analytics or advertising service.

What we do NOT collect: We do not use advertising SDKs or third-party analytics/tracking. We do not collect location, contacts, or device identifiers for tracking. The camera is used only to scan member check-in QR codes and is never used to record or upload video. We do not store card or bank-account numbers — subscription payments are handled manually over UPI/WhatsApp (see §5).

3. How we use information

To provide the core service: authentication, and managing members, plans, memberships, payments, and attendance for your gym.
To send password-reset codes to your email when you request them.
To diagnose and fix crashes and errors.
To operate the manual subscription/billing flow for your use of the app.

We do not sell your data or your members' data, and we do not use it for advertising.

4. Service providers (sub-processors)

Provider	Purpose	Data involved
Supabase	Database, authentication, and file storage (member photos)	All account, member, and diagnostic data above
Google Play	App distribution and updates	Install/purchase data handled by Google
WhatsApp (Meta)	Opens only when you tap to message a member or to contact us for payment; the message content is what you choose to send	Only the phone number and message you choose to send

Each processes data only to provide these services. We do not share data with any other third parties except where required by law.

5. Payments

Your subscription to GymOrigin is paid manually: you contact us over WhatsApp, pay via a UPI QR code we share, and we activate your plan. The app does not collect or store your card, UPI, or bank-account details. Any payment figures shown in the app (for your gym members) are amounts you type in yourself for your own records.

6. Data security

All data is transmitted over encrypted HTTPS connections.
Each gym's data is isolated using database Row-Level Security, so one gym cannot read or modify another gym's data.
Passwords are stored only as secure hashes by our authentication provider.

No system is perfectly secure, but we take reasonable measures to protect your information.

7. Data retention & deletion

We keep your data for as long as your account is active. You can delete your account and all associated data at any time from within the app: Settings → Delete account. This permanently erases your gym, all members, plans, payments, attendance records, your profile, and your login — this action cannot be undone. Staff who delete their account remove only their own access, not the gym's data.

You may also request deletion by contacting us (see §11) or via our web deletion page: gymorigin.in/legal/delete-account.html.

8. Your rights

Subject to applicable law (including India's DPDP Act, 2023), you may:

Access the personal data we hold about you.
Correct inaccurate data (most of which you can edit directly in the app).
Delete your account and data (see §7).
Withdraw consent or raise a grievance by contacting us.

Gym members whose data was entered by a gym should contact that gym owner first, as the owner controls that data.

9. Children's data

GymOrigin is intended for gym owners and staff, not for children. We do not knowingly collect personal data directly from children. Gym owners are responsible for any member details they enter, including obtaining consent from a parent/guardian where a member is a minor.

10. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the "Effective" date above and, where appropriate, notifying you in the app.

11. Contact us

WhatsApp: +91 82095 68325
Email: support.gymorigin@gmail.com