Privacy Policy

Draft — last content update 21 Sep 2026. This document has not yet had a lawyer's review; bracketed items below mark real, specific decisions still needed before this is a final, publishable policy. Everything else describes this app's actual, current data practices, verified against the codebase, not generic boilerplate.

1. Who we are

Fynrox ("we," "us," "our") operates the Fynrox fitness coaching app and this website (the "Service"). This policy explains what we collect, why, and what choices you have. Contact us at support@fynrox.com with any questions.

[COMPANY LEGAL NAME], a [ENTITY TYPE] registered in [JURISDICTION], operates the Service.

2. What we collect

Account information. Name, email address, and password (stored as a salted hash, never in plain text) when you create an account.

Health and fitness data. This is a fitness app, so we collect what you log: workouts and exercise sets, body measurements, progress photos you choose to upload, meals and water intake, recovery check-ins (sleep, HRV, soreness, energy), and the goals, medical conditions, and injuries you optionally disclose during onboarding. This is sensitive personal data in many jurisdictions (including under GDPR's "special category data" and similar state health-privacy laws) — we treat it accordingly and do not sell it.

Payment information. We do not store your card, UPI, or bank details ourselves. Payments are processed by Razorpay, and we receive only transaction confirmations (amount, status, a payment reference ID) — see §6.

Coach verification documents. If you sign up as a coach, we collect the credential and identity-verification (KYC) documents you submit for review by our team.

Usage data. Standard technical data — IP address, device/browser type, and app usage events — collected automatically to keep the Service secure and working.

3. How we use it

  • To provide the Service: run your training/nutrition/recovery logs, track your progress, process subscriptions and purchases.
  • To communicate with you: transactional emails (receipts, security alerts) and support responses if you contact us.
  • To verify coach applicants' credentials before they can offer services on the platform.
  • To keep the Service secure (fraud prevention, abuse detection) and to meet legal obligations.

We do not use your health data for advertising, and we do not sell personal data to third parties.

4. Your consent choices

Inside the app's Privacy Settings, you can grant or withdraw consent separately for three real, distinct purposes:

  • Marketing emails — promotional/product emails, separate from transactional emails (receipts, security alerts) you'll always receive.
  • Data analytics — using your usage data to understand and improve the product.
  • Health data processing — using the health/fitness data described in §2 to power features like the AI coach.

Each of these is tracked individually and can be changed at any time; a consent that's never been explicitly decided is treated as "not yet decided," not as silently granted or declined.

5. Your rights: access, export, and deletion

Access and export. You can request a full export of your data from the app's Settings → Security screen at any time. This is a real, self-service feature — it generates a structured export of your onboarding profile, workout sessions and set logs, meal logs, body measurements, program purchases, subscriptions, and reminders directly from your live account data, on demand.

Deletion. You can permanently delete your account and its data from the same screen, after confirming your password. This is irreversible. [SPECIFY: what, if anything, is retained after deletion and for how long — e.g. for tax/legal/fraud-prevention purposes — and how downstream copies of your data (analytics events, backups) are eventually purged; this codebase does not yet automate that downstream purge, which is why every deletion is logged for a human compliance review today, not treated as fully self-executing.]

Correction. You can edit your profile and most logged data directly in the app.

Depending on where you live, you may have additional rights (GDPR, CCPA, India's DPDP Act, or similar) — [JURISDICTION-SPECIFIC RIGHTS LANGUAGE — needs legal review].

6. Who we share data with

  • Razorpay (payment processing) — receives what's needed to process a transaction (amount, your name/email, and payment method details you enter directly with them, never with us).
  • [ADD: hosting provider name once finalized — our infrastructure provider hosts our servers and database.]
  • We do not share your data with advertisers or data brokers.
  • We may disclose data if legally required to (a valid subpoena, court order, etc.).

7. Data retention

[NEEDS A REAL POLICY DECISION.] We retain account and health data for as long as your account is active, plus a limited period after deletion to comply with legal, tax, or dispute-resolution obligations. Coach verification documents are retained for [X years] after an application is decided, per [applicable regulatory requirement]. This codebase does not currently have an automated data-retention/scheduled-deletion system — retention today is a manual/policy matter, not an enforced technical one.

8. Security

We use industry-standard measures to protect your data — passwords are hashed, not stored in plain text; two-factor authentication (TOTP) is available as an optional account security feature; connections to the Service are encrypted in transit; access to production systems is restricted to authorized staff. No system is perfectly secure, and we can't guarantee absolute security.

[FOR REVIEW: coach KYC/credential documents are currently stored as base64 data in the primary database rather than a dedicated encrypted document store — flagged internally as something to revisit before this scales.]

9. Children's privacy

The Service is not directed at children under 16 (or the relevant minimum age in your jurisdiction), and we do not knowingly collect data from them. [NEEDS LEGAL REVIEW for jurisdiction-specific minimum ages, e.g. COPPA's 13 in the US.]

10. International users

[NEEDS LEGAL REVIEW: where is data hosted, and what cross-border transfer safeguards apply if users and servers are in different countries/regions?]

11. Changes to this policy

We'll post any changes here and update the date above. Material changes will be communicated via the app or email.

12. Contact us

support@fynrox.com · [COMPANY MAILING ADDRESS, if required in your jurisdiction]