Fitshala AI — Privacy Policy

Last Updated: October 7, 2026
Effective Date: October 7, 2026

Your privacy matters to us. This policy explains what data we collect, why we collect it, and how we protect it — in plain language.

1. Who We Are

Fitshala AI is a fitness coaching app that helps you build strength training habits. We are based in India and operate under Indian data protection laws.

2. What Data We Collect

Data You Give Us

Data	Why We Need It
Name	To personalise your experience
Phone Number	Account creation & OTP verification
Fitness Goal	To generate your workout plan (Muscle Gain, Fat Loss, Strength)
Experience Level	To set appropriate starting weights and exercise complexity
Pain/Injury Areas	To exclude exercises that may stress flagged body parts
Ache Note	If you choose to describe an ache in your own words, we store that text securely, linked to your account, so our team can review it. It is never used to diagnose or treat you, never shown to other users, and is deleted when you delete your account.
Workout Logs	To track your progress and power the progression engine
Exercise Preferences	To remember your swaps and customisations

Data We Collect Automatically

Data	Why We Collect It
App Usage Analytics	To understand how you use the app and improve it (via PostHog)
Crash Reports	To fix bugs and improve stability (via Firebase Crashlytics)
Device Information	To optimise performance for your device type
App Version	To ensure compatibility and deliver updates
Approximate Location	Your city and country, based on your internet (IP) address. We use this to see where the app is used. We don't store the IP address itself.

Data We Do NOT Collect

Medical records
Biometric data (heart rate, blood pressure, SpO2)
Your precise location (GPS)
Contacts or call logs
Photos or camera data
Financial or payment information

3. How We Use Your Data

We use your data only to:

Generate and adapt your workout plan — your goals, experience, and pain map feed the plan engine.
Track your progress — workout logs power the progression engine and your personal records.
Improve the app — usage data, and any ache note you choose to write, help us understand what works and what doesn't. We don't attach your name, phone number, email or account ID to usage data, and we only look at it across all users, never to see what one person did.
Fix crashes — crash reports help us find and fix bugs faster.
Communicate with you — workout reminders and important app updates (never spam).

We do not use your data to:

Sell to advertisers or third parties
Build advertising profiles
Make medical assessments or diagnoses

4. Where Your Data Lives

Storage	Location	Purpose
Supabase (Cloud)	Hosted infrastructure with Row-Level Security (RLS)	Syncing your workout data across devices
Hive (On-Device)	Your phone's local storage	Offline-first experience — your workouts work without internet
PostHog	Cloud analytics service, servers in the United States	Usage data, stored under a random ID for this app on your phone (it changes when you log out), not under your account
Firebase Crashlytics	Google Cloud	Crash reports only, stored under a random ID for this app on your phone, not under your account

Security Measures:

All data transmitted over HTTPS (encrypted in transit)
Supabase enforces Row-Level Security (RLS) — your data is only accessible to your authenticated account
Server-side auth.uid() injection prevents data spoofing
No data is stored in plain text on our servers

We do not sell your personal data. Period.

We share data only with:

Service	What They Receive	Why
Supabase	Your workout data (encrypted)	Cloud storage and sync
PostHog	Usage events (screens you open, buttons you tap), your phone model, and your approximate location (city and country). Not your name, phone number, email or account ID.	Product analytics
Firebase Crashlytics	Crash reports with your phone model and app version. Not your name, phone number, email or account ID.	Bug fixing

These services act as data processors under contract and may not use your data for their own purposes.

We may also disclose data if required by law (e.g., court order under Indian law).

6. Your Rights (Under DPDP Act, 2023)

As a Data Principal under the Digital Personal Data Protection Act, 2023, you have the right to:

Access — Request a copy of your personal data we hold.
Correction — Request correction of inaccurate or incomplete data.
Erasure — You can ask us to delete your personal data. When you delete your account, your account and the data saved with it are deleted from our servers within 30 days. Usage data and crash reports aren't stored under your account, so they follow the schedule in section 7 instead.
Grievance Redressal — Contact our grievance officer if you have concerns about data handling.
Nominate — Nominate another person to exercise your rights in case of your death or incapacity.

To exercise any of these rights, email us at fitshala.ai@gmail.com with subject line "Data Request".

7. Data Retention

Active Account: Your data is retained as long as your account is active.
Deleted Account: Your account and the data saved with it are deleted within 30 days of account deletion.
Usage Data: Usage data is stored under a random ID, not under your account, so deleting your account does not delete it. It is deleted automatically within 1 year of being collected. Usage data collected by versions of the app older than version 2.10.0 (such as 2.9.1 or 2.9.2) is different. If you had signed up, that data was stored under your account ID. It also includes your internet (IP) address. And if you marked painful body areas during setup, it includes which areas you marked. This older data is also deleted within 1 year of being collected.
Crash Reports: Crash reports are deleted 90 days after they are collected. If you were signed in when the app crashed, crash reports collected by versions of the app older than version 2.10.0 (such as 2.9.1 or 2.9.2) were stored under your account ID.

8. Children's Privacy

Fitshala AI is not intended for children under 18. We do not knowingly collect personal data from anyone under 18. If we learn that we have, we will delete it promptly.

9. Changes to This Policy

When we update this policy:

We'll change the "Last Updated" date at the top.
For significant changes, we'll notify you in the app.
Continued use after changes means you accept the updated policy.

10. Contact & Grievance Officer

For any privacy-related questions or concerns:

Email: fitshala.ai@gmail.com
Subject Line: "Privacy Concern" or "Data Request"
Response Time: Within 72 hours

Grievance Officer (DPDP Act, 2023):

Name: Dheeraj Soni
Email: fitshala.ai@gmail.com

We wrote this policy in plain language because your right to understand how your data is used is just as important as the data itself.