Privacy Policy

1. Who we are

Sweatbyte is a fitness platform made up of a member app and website, a gym and trainer admin app, and a mobile app. In this policy "we", "us" and "Sweatbyte" mean Sweatbyte. For the personal data you give us directly, we are the Data Fiduciary under the DPDP Act.

Gyms and trainers who use Sweatbyte are separate businesses. When you join a gym or a trainer, the data they enter about you (membership, attendance, payments, plans) is also handled by them under their own policies. They decide what they ask of you. We provide the tools and store the data on their behalf.

2. Data we collect

• Account: name, email address, phone number, password (stored only as a one-way hash) and, if you use Google sign-in, your Google profile name and email.
• Body and health details you choose to enter: age, sex, height, weight, body measurements, goals, medical conditions such as diabetes or thyroid, allergies, medicines, lab values, pregnancy or breastfeeding status, food habits and lifestyle. Health information is sensitive personal data. We ask for it only to build safer diet and training plans.
• Activity you log: workouts, meals, water, progress entries and attendance.
• Gym records: membership plans, invoices and payment status. We do not see or store your card, UPI PIN or bank login. Payments are handled by our payment gateway.
• Device and usage: IP address, browser or phone model, app version, crash and error information, and a login session cookie.
• Messages: emails and notifications we send you, and what you write to our support.

3. Why we use it, and your consent

We process your data only with your consent or for another purpose the DPDP Act allows, such as providing a service you asked for or meeting a legal duty. We use it to:

• create and secure your account and sign you in;
• run the features you use, including workout tracking, diet plans, progress and gym membership;
• calculate your calorie and nutrient targets and generate diet plans with the Sweatbyte Nutritionist (see section 4);
• take payments, issue invoices and receipts and keep tax records;
• send service emails and notifications such as receipts, reminders, password reset and security alerts;
• prevent fraud and abuse, fix bugs and improve the product using aggregated or de-identified usage data.

You can withdraw consent at any time (section 11). Withdrawing does not affect processing done before, and some features need certain data to work.

4. The Sweatbyte Nutritionist and AI

Diet plans are created with an AI language model provided by OpenAI. To do this we send the details needed for your plan: age, sex, body measurements, goals, food preferences, allergies and health conditions you entered, and any instructions you type. We do not send your name, phone number or email address. All calorie and nutrient figures shown to you are calculated by our own systems from a food database, not taken from the AI.

Because the AI provider processes data outside India, this is a transfer of personal data across borders, which the DPDP Act permits unless the Government restricts a specific country. We ask the provider to handle it under its published business terms and not to use it to train its models, where the provider offers that option. Plans are general guidance and not medical advice (see our Terms).

5. Google user data (Sign in with Google)

You can create an account or log in with your Google account. If you do, Sweatbyte uses Google Sign-In (OpenID Connect) and requests only these basic scopes: openid, email and profile.

What we receive from Google:

• your Google account's unique identifier (a number called "sub"), used to recognise you the next time you sign in;
• your email address and whether Google has verified it;
• your name and profile picture URL.

How we use it: only to create your Sweatbyte account, sign you in securely, show your name and photo inside the app, and send you service emails about your account. We use no Google data for advertising, profiling, or to train any AI or machine-learning model.

What we do not access: we do not request or read your Gmail, Google Drive, Google Calendar, contacts, location, search history, or any other Google service data. We never post to your Google account.

Storage and sharing: the data above is stored in our database like the rest of your account data (see section 7 for processors). We do not sell it, rent it, or share it with third parties, except the service providers that host and run Sweatbyte under our instructions, your gym or trainer where you have joined one, or where the law requires.

Retention and deletion: we keep it while your account is active and delete or anonymise it when you delete your account (section 9). You can also remove Sweatbyte's access at any time at myaccount.google.com/permissions. This stops Google sign-in, and you can still log in with an email and password after you set one.

Sweatbyte's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Mobile app permissions

The Sweatbyte mobile app asks for device permissions only when a feature needs them, and you can refuse or withdraw them in your phone settings:

• Camera: only when you choose to take a progress or profile photo. Photos are not saved to your gallery by us.
• Photos and files: to choose a picture you want to upload, such as a profile or progress photo.
• Notifications: to show reminders for workouts and meals that you set up.

We do not collect your precise location, contacts, call logs, SMS or microphone recordings.

7. Who we share data with

We do not sell your personal data. We share it only as follows:

• Your gym or trainer, if you joined one. You can switch off sharing of your health and diet data with them in your settings, where the app offers it.
• Service providers (data processors) who work under our instructions: cloud hosting and storage, our payment gateway, email delivery, Google sign-in and the AI provider named above.
• Authorities, when required by law, a court order or to protect rights and safety.
• A buyer or successor, if the business is sold or merged, with the same protections for your data.

8. Cookies and local storage

We use a secure cookie to keep you signed in and browser storage to remember settings such as your last chosen tab. We do not use advertising cookies or sell data to advertisers. If we add analytics, we will update this policy.

9. How long we keep data

We keep your data while your account is active. You can delete your account yourself at any time (Profile, then Delete my account, in the app or on the website; admins use Your account). Deletion erases your personal data straight away, except what the law makes us keep, such as invoices and payment records for tax and accounting (generally up to 8 years), and data needed to settle a dispute or investigate abuse. Backups are overwritten on their normal cycle.

10. How we protect it

We use encrypted connections (HTTPS), hashed passwords, access controls and encrypted storage of sensitive credentials. No system is perfectly secure. If a breach affects your personal data we will notify you and the Data Protection Board of India as the law requires.

11. Your rights

Under the DPDP Act you may:

• ask for a summary of the personal data we hold and who we shared it with;
• ask us to correct, complete or update it;
• ask us to erase it, and withdraw your consent;
• nominate another person to exercise these rights if you die or cannot act;
• get your grievance addressed (section 14).

Write to hello@sweatbyte.com from the email on your account. We reply within 30 days, and sooner for simple requests. We may need to verify who you are first.

12. Children

You must be 18 or older to create your own account. If you are under 18, a parent or legal guardian must create or approve the account and give consent on your behalf, as the DPDP Act requires. We do not track or target children with advertising. Diet plans for people under 18 do not use weight-loss calorie deficits and should be reviewed by a doctor.

13. Changes to this policy

We may update this policy when our product or the law changes. We will post the new version here with a new date and tell you in the app or by email if the change is significant.

14. Grievance Officer and contact

For any question, complaint or request about your data, contact our Grievance Officer, at hello@sweatbyte.com. We acknowledge complaints within 48 hours and resolve them within 30 days.

If you are not satisfied, you may complain to the Data Protection Board of India once it is operational and you have first raised the matter with us.