Privacy Policy

Last updated: 18 October 2026

GymDost is an app that helps gyms manage their members, plans, payments, attendance and renewal reminders. It is run by Rohit Dhaka (“GymDost”, “we”, “us”). This policy explains what data GymDost holds, why, and what control you have over it.

In short: a gym’s member data belongs to the gym. We store it only to run GymDost for that gym. We don’t sell it, show ads, or use tracking tools, and only the gym’s own logins can see it.

1. Who this policy covers

Gym owners and their staff who use the GymDost app (“you”).
Gym members whose details a gym records in GymDost.

For member data, the gym decides what to record and why. Under India’s Digital Personal Data Protection Act, 2023, the gym is the Data Fiduciary and GymDost processes that data on the gym’s behalf, as its Data Processor. For gym owners’ own account details, GymDost is the Data Fiduciary.

2. What we hold

About gym owners and staff

Login email address and password. Passwords are stored only as a salted one-way hash combined with a secret key, so nobody, including us, can read them.
Gym name, city and phone number, and the gym’s reminder settings.
Subscription details: trial, paid-until date, payments made to GymDost, and notes we keep for billing and support.
When each login last signed in, and the IP addresses of failed sign-in attempts, used only to block password guessing. Our hosting provider also keeps short-term request logs for security and troubleshooting.

About gym members, as entered by the gym

Name, phone number, email, gender, date of birth and notes.
Photo, if the gym adds one.
Membership plan, fees, payments and attendance check-ins.

We don’t collect location, contacts, or any data from members directly. GymDost has no advertising or analytics trackers.

3. How we use it

To run GymDost for the gym: showing members, renewals, payments and attendance, and keeping the gym’s phones in sync.
Renewal and birthday reminders are created on the gym owner’s phone as notifications; member details are not sent to any messaging service for this.
To manage the gym’s GymDost subscription, and to give support when the gym asks for it.
To keep the service secure and working, for example to stop password guessing or investigate a fault.

We never sell personal data or use member data for marketing.

4. Who can see it

Only the gym’s own logins can see that gym’s member data and photos. Other gyms cannot.
GymDost’s admin tools show each gym’s subscription and usage counts, not members’ names, phones or photos. We access a gym’s member data only when the gym asks for help, to fix a fault or security problem, or when the law requires it.
Service providers: Cloudflare, Inc. hosts GymDost’s servers, database and photos. Expo (650 Industries) builds and delivers app updates; it does not receive member data.
If a gym owner chooses to contact a member by WhatsApp, phone or email from the app, that message goes through that service under its own terms.
We may disclose data if required by law or a lawful order from an Indian authority.

5. Where it is stored and how it is protected

Data is stored in Cloudflare’s database service, placed in the Asia-Pacific region, and may be processed in other countries where Cloudflare operates.
The app keeps a copy of the gym’s data on the owner’s phone so it can be viewed offline. The copy is removed from the phone when the owner signs out or deletes their account.
All connections use encryption (HTTPS). Login sessions use random tokens that we store only in hashed form. Repeated wrong passwords lock sign-in for a while.

No system is perfectly secure. If a data breach affects you, we will inform the affected gyms and the authorities as the law requires.

6. How long we keep it

While the gym uses GymDost, we keep its data.
If the subscription ends, the gym’s account becomes read-only. The data is kept so the gym can renew or export a backup.
If a gym has had no paid subscription for 12 months, we may delete its data after giving at least 30 days’ notice.
When an owner deletes their account in the app (Settings → Delete Account), the gym and all its member data and photos are deleted straight away if they are the gym’s only owner. Copies may remain in our backups for up to 30 days and are then removed.
When a gym deletes a member, that member’s details, history and photo are deleted.

7. Your choices and rights

Gym owners can see, correct, export (Settings → Backup) and delete their gym’s data in the app at any time, and can ask us to correct or delete their own account details.
Gym members should contact their gym to see, correct or delete their details, or to withdraw consent. We will help the gym respond. If a member contacts us directly, we will pass the request to the gym.

8. Gyms’ responsibilities

Gyms must have a lawful reason and, where needed, the member’s consent to record their details and photo, and must tell members what they record and why. For members under 18, the gym must have the consent of a parent or guardian.

9. Changes to this policy

If we change this policy, we will update the date above. For important changes, we will tell gym owners in the app or by WhatsApp or email before the change takes effect.

10. Contact and grievances

For questions, requests or complaints about personal data, contact our Grievance Officer:

Rohit Dhaka, GymDost
Email: rohitdhaka35@gmail.com
WhatsApp: +91 99921 00021

We aim to reply within 7 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.