Privacy Policy

1. Introduction

Abhyas ("we," "our," or "us") provides a fitness tracking and workout guidance application. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our application.

This policy applies to the white-label instances of Abhyas provided to gym owners and their members. [GYM NAME] is the data controller for your information under this instance.

This privacy policy complies with the Digital Personal Data Protection Act, 2023 (DPDP Act) of India.

2. Information We Collect

Account Information

When you create an account, we collect:

• Name and email address (via Google OAuth)
• Profile photo (if provided via your Google account)

Health and Fitness Data

To provide personalized workout guidance, we collect and store:

• Date of birth, biological sex, height, and weight
• Fitness level, goals, and exercise preferences
• Equipment availability
• Current and past injuries
• Workout session data (exercises performed, sets, reps, weights, duration)
• Body weight measurements over time
• Yoga video completion tracking
• Breathing exercise session data

Usage Data

We automatically collect:

• Session timestamps and duration
• App preferences and settings
• Device information and timezone

3. How We Use Your Information

We use your information to:

• Generate personalized workout programs based on your profile
• Track your progress and adjust difficulty appropriately
• Prevent exercises that may aggravate existing injuries
• Display your workout history and statistics
• Provide session guidance with timers and rest periods
• Maintain app preferences across sessions
• Improve and optimize the application

4. Data Storage and Security

Your data is stored securely using Supabase (PostgreSQL database) with row-level security policies ensuring users can only access their own data. We implement industry-standard security measures including:

• Encrypted connections (HTTPS/TLS)
• Authentication via secure OAuth 2.0 providers
• Row-level security policies preventing unauthorized data access
• Regular security updates and monitoring

Despite our security measures, no system is completely secure. We cannot guarantee absolute security of your information.

5. Data Sharing and Third Parties

We use the following third-party services:

• Google OAuth: For authentication. Google's privacy policy applies to data they collect.
• Supabase: For database and authentication services. Data is stored in their secure infrastructure.
• Vercel: For application hosting and delivery.
• YouTube: We embed yoga videos from YouTube. YouTube's privacy policy applies when you watch these videos.
• Sentry: For error monitoring and diagnostics. Error reports are sent to Sentry with personally identifiable information scrubbed. Sentry's privacy policy applies to this data.

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

6. Your Rights

You have the right to:

• Access: View all data we have collected about you
• Correction: Update inaccurate information through the Settings page
• Deletion: Delete your account and all associated data through the Settings page
• Data Portability: Request a copy of your data in a portable format
• Withdrawal of Consent: Stop using the app at any time

To exercise these rights, use the account deletion feature in Settings or contact the gym that provided your access to this application.

7. Data Retention

We retain your information for as long as your account is active. When you delete your account through Settings, all your personal data and workout history is permanently and immediately deleted from our systems with no recovery period. This deletion is final and cannot be undone.

Under the DPDP Act 2023, you have the right to request erasure of your personal data, which can be exercised through the account deletion feature in Settings.

8. Children's Privacy

Abhyas is not intended for use by individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that a user is under 16, we will delete their account and data in compliance with the DPDP Act 2023.

9. International Data Transfers

Your data is stored in Supabase's data centers. The specific location depends on your instance configuration (e.g., Mumbai region for the default deployment). By using Abhyas, you consent to the transfer of your information to these locations.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the "Last updated" date at the top of this policy. Your continued use of Abhyas after changes constitutes acceptance of the updated policy.

11. Contact Information

For questions about this Privacy Policy or our data practices, contact: