Privacy Policy

1. Who we are

SweatByte is a fitness platform made up of a member app and website, a gym and trainer admin app, and a mobile app. In this policy "we", "us" and "SweatByte" mean SweatByte. For the personal data you give us directly, we are the Data Fiduciary under the DPDP Act.

Gyms and trainers who use SweatByte are separate businesses. When you join a gym or a trainer, the data they enter about you (membership, attendance, payments, plans) is also handled by them under their own policies. They decide what they ask of you. We provide the tools and store the data on their behalf.

2. Data we collect

• Optional profile details you may add: your city and state, date of birth and mobile number. We ask for them occasionally in the app, never require them, and you can skip or switch the question off. They are used to show local gyms and offers, to set plans for your age, and to let your gym reach you.
• Account: name, email address, phone number, password (stored only as a one-way hash) and, if you use Google sign-in, your Google profile name and email.
• Body and health details you choose to enter: age, sex, height, weight, body measurements, goals, medical conditions such as diabetes or thyroid, allergies, medicines, lab values, pregnancy or breastfeeding status, food habits and lifestyle. Health information is sensitive personal data. We ask for it only to build safer diet and training plans.
• Activity you log: workouts, meals, water, progress entries and attendance.
• Gym records: membership plans, invoices and payment status. We do not see or store your card, UPI PIN or bank login. Payments are handled by our payment gateway.
• Device and usage: IP address, browser or phone model, app version, crash and error information, and a login session cookie.
• Messages: emails and notifications we send you, and what you write to our support.

3. Why we use it, and your consent

We process your data only with your consent or for another purpose the DPDP Act allows, such as providing a service you asked for or meeting a legal duty. We use it to:

• create and secure your account and sign you in;
• run the features you use, including workout tracking, diet plans, progress and gym membership;
• calculate your calorie and nutrient targets and generate diet plans with the SweatByte Nutritionist (see section 4);
• take payments, issue invoices and receipts and keep tax records;
• send service emails and notifications such as receipts, reminders, password reset and security alerts;
• prevent fraud and abuse, fix bugs and improve the product using aggregated or de-identified usage data.

We ask for your consent with a clear notice, in English, Hindi and Marathi, before you tick any box, and we never make you agree to something that is not needed to give you the service. You agree to the Terms and this policy, and confirm you are 18 or older, by ticking two separate boxes when you sign up (or by choosing Continue with Google next to the same notice). Optional things, such as using your health details for the Nutritionist and tips and offers, are off until you turn them on.

We keep a record of what you agreed to, when, and under which version of this policy. You can see it and change any optional choice under Profile, then Privacy and data. Withdrawing is as easy as agreeing. It does not affect processing done before, and some features need certain data to work. If we change this policy in a way that matters, we ask you to read it and agree again.

4. The SweatByte Nutritionist and AI

Diet plans are created with an AI language model provided by OpenAI. To do this we send the details needed for your plan: age, sex, body measurements, goals, food preferences, allergies and health conditions you entered, and any instructions you type. We do not send your name, phone number or email address. All calorie and nutrient figures shown to you are calculated by our own systems from a food database, not taken from the AI.

Because the AI provider processes data outside India, this is a transfer of personal data across borders, which the DPDP Act permits unless the Government restricts a specific country. We ask the provider to handle it under its published business terms and not to use it to train its models, where the provider offers that option. Plans are general guidance and not medical advice (see our Terms).

5. Google user data (Sign in with Google)

You can create an account or log in with your Google account. If you do, SweatByte uses Google Sign-In (OpenID Connect) and requests only these basic scopes: openid, email and profile.

What we receive from Google:

• your Google account's unique identifier (a number called "sub"), used to recognise you the next time you sign in;
• your email address and whether Google has verified it;
• your name and profile picture URL.

How we use it: only to create your SweatByte account, sign you in securely, show your name and photo inside the app, and send you service emails about your account. We use no Google data for advertising, profiling, or to train any AI or machine-learning model.

What we do not access: we do not request or read your Gmail, Google Drive, Google Calendar, contacts, location, search history, or any other Google service data. We never post to your Google account.

Storage and sharing: the data above is stored in our database like the rest of your account data (see section 7 for processors). We do not sell it, rent it, or share it with third parties, except the service providers that host and run SweatByte under our instructions, your gym or trainer where you have joined one, or where the law requires.

Retention and deletion: we keep it while your account is active and delete or anonymise it when you delete your account (section 9). You can also remove SweatByte's access at any time at myaccount.google.com/permissions. This stops Google sign-in, and you can still log in with an email and password after you set one.

SweatByte's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Mobile app permissions

The SweatByte mobile app asks for device permissions only when a feature needs them, and you can refuse or withdraw them in your phone settings:

• Camera: only when you choose to take a progress or profile photo. Photos are not saved to your gallery by us.
• Photos and files: to choose a picture you want to upload, such as a profile or progress photo.
• Notifications: to show reminders for workouts and meals that you set up.

We do not collect your precise location, contacts, call logs, SMS or microphone recordings.

7. Who we share data with

We do not sell your personal data. We share it only as follows:

• Your gym or trainer, if you joined one. You can switch off sharing of your health and diet data with them in your settings, where the app offers it.
• Service providers (data processors) who work under our instructions and contracts: cloud hosting and database, file storage (Amazon Web Services, Asia-Pacific), email delivery, our payment gateway when payments are switched on, Google sign-in and the AI provider named above. Some of these store or process data outside India, which the DPDP Act allows unless the Government restricts a country. You can see the current list in your data copy (Profile, Privacy and data).
• Authorities, when required by law, a court order or to protect rights and safety.
• A buyer or successor, if the business is sold or merged, with the same protections for your data.

8. Cookies and local storage

We use a secure cookie to keep you signed in and browser storage to remember settings such as your last chosen tab. We do not use advertising cookies or sell data to advertisers. If we add analytics, we will update this policy.

9. How long we keep data

We keep your data only as long as we need it for the purpose you gave it for. While your account is active we keep it so the app works. If you stop using the app, we may ask you before removing your data after a long period of inactivity. Server logs are kept for about one year for security. You can delete your account yourself at any time (Profile, then Delete my account, in the app or on the website; admins use Your account). Deletion erases your personal data straight away, except what the law makes us keep, such as invoices and payment records for tax and accounting (generally up to 8 years), and data needed to settle a dispute or investigate abuse. Backups are overwritten on their normal cycle.

10. How we protect it

We use encrypted connections (HTTPS), hashed passwords, access controls and encrypted storage of sensitive credentials. We also check who can see what, keep logs of important actions, limit sign-in attempts and keep software up to date. No system is perfectly secure. If a breach affects your personal data we will tell you, plainly and without delay, what happened, what data was involved, what we are doing and what you can do, and we will report it to the Data Protection Board of India as the law requires.

11. Your rights

Under the DPDP Act you may:

• ask for a summary of the personal data we hold and who we shared it with;
• ask us to correct, complete or update it;
• ask us to erase it, and withdraw your consent;
• nominate another person to exercise these rights if you die or cannot act;
• get your grievance addressed (section 14).

The quickest way is in the app: Profile, then Privacy and data. There you can see what you agreed to and change optional consents, download a copy of your personal data (and the list of who it is shared with), name a nominee, write to the Grievance Officer, and delete your account. To correct your details, edit your profile or ask us.

You can also write to hello@sweatbyte.com from the email on your account. We reply within 30 days, and sooner for simple requests. We may need to verify who you are first.

12. Children

You must be 18 or older to create your own account, and we ask you to confirm it when you sign up. A gym or trainer may add a member under 18 only after recording the consent of that child's parent or legal guardian, as the DPDP Act requires. We do not track or monitor children's behaviour and we do not show advertising to anyone whose date of birth shows they are under 18. Diet plans for people under 18 do not use weight-loss calorie deficits and should be reviewed by a doctor.

13. Changes to this policy

We may update this policy when our product or the law changes. We will post the new version here with a new date and tell you in the app or by email if the change is significant.

14. Grievance Officer and contact

For any question, complaint or request about your data, contact our Grievance Officer, at hello@sweatbyte.com. We acknowledge complaints within 48 hours and resolve them within 30 days. You can also send a complaint from the app (Profile, Privacy and data), and we will give you a reference number.

If you are not satisfied, you may complain to the Data Protection Board of India once it is operational and you have first raised the matter with us.