Gym Ledger

Privacy Policy

Last updated: August 13, 2026

Gym Ledger ("we", "our", or "us") is a gym membership management application. This Privacy Policy explains what information the app collects, how it is used, where it is stored, who processes it on our behalf, and the choices you have. It is intended to be a complete and honest inventory of the app's data behaviour.

1. Information We Collect

We collect the following categories of information:

a) Account Information (via Google or Apple sign-in)

• Name
• Email address
• Your Google or Apple account identifier, and a profile photo URL when your sign-in provider supplies one

b) Gym Profile Information (provided by you)

• Gym name, contact phone number, address
• Optional gym logo image
• UPI ID, GSTIN, and other billing details if you choose to enter them

c) Member Data (entered by you about your gym members)

• Member names, phone numbers, email addresses, optional profile photos
• Subscription plans, durations, amounts, start and end dates
• Payment history and records
• Attendance records and notes added by the gym owner
• Workout plans, completed workout sessions, exercise progress, and rest-timer preferences used in the member portal
• Body measurements such as height and weight, calculated BMI, and water-intake logs that a member chooses to record in the member portal

d) Technical and Diagnostic Data (collected automatically)

• Device model, operating system name, OS version
• App name, app version, and build number
• Push notification device token
• Crash stack traces, breadcrumbs, and non-fatal error reports (via Firebase Crashlytics)
• Performance traces for key flows such as app startup and payment verification (via Firebase Performance Monitoring)
• Device-integrity attestation results from Google Play Integrity on Android and App Attest or DeviceCheck on iOS (via Firebase App Check)

e) Product Analytics Events (collected automatically, via Firebase Analytics)

The app logs the following named events together with limited, non-sensitive parameters such as plan type, member count milestones, payment method, or feature name:

• app_open, onboarding_complete
• member_added, member_count_milestone, member_renewed
• payment_recorded, coupon_applied
• feature_used, whatsapp_sent, report_viewed
• upgrade_screen_viewed, upgrade_started, upgrade_completed, upgrade_cancelled
• bug_report_submitted

Analytics events do not contain member names, phone numbers, or other personal data of your gym members.

f) Payment Data (when you subscribe to a paid plan)

• In app versions that use Razorpay, the checkout receives your email, phone, name, and the subscription amount so that it can render the payment sheet. Current prices are listed on the pricing page.
• After Razorpay returns a successful payment, the resulting Razorpay payment ID, order ID, and signature are stored against your account in Cloud Firestore for verification and refund support.
• We do not see, store, or transmit your card number, UPI PIN, bank credentials, or one-time passwords. Those remain entirely within Razorpay's PCI-DSS compliant flow.
• If you subscribe on Android through Google Play, payment runs entirely inside Google Play Billing. A pseudonymous account token generated by our server is attached to the purchase so that Google Play can tie it to your Gym Ledger account; we receive a purchase token and product identifier back, which our server verifies with Google Play. Your card, UPI, or bank details never reach us.
• If you subscribe on iOS through the App Store, payment runs entirely inside Apple's systems. A pseudonymous account token is attached to the purchase in the same way; we receive Apple transaction information back, which our server verifies with Apple. Your payment details never reach us.

g) Member Photos and Gym Logos

If you upload a member profile photo or a gym logo, the image is stored in Firebase Storage under your account's owner ID (paths member_photos/{ownerId}/ and gym_logos/{ownerId}/). Each owner's images are isolated by Storage security rules so that only that account and the staff members linked to it can read them.

h) Bug Reports and Optional Attachments

If you open Settings → "Report a Bug" and submit a report, the app uploads the following:

• The text description you typed (up to 1,000 characters)
• Any attachments you chose to add: screenshots or photos (up to 5 MB each), short video clips (under 20 MB each), or voice-note recordings (up to 5 MB each)
• Your account email, app version, build number, and device OS information

The attachments are uploaded to Firebase Storage under bug_reports/{your-user-id}/ and a record is written to Cloud Firestore. A copy of the description, device info, and links to the attachments is also written into the mail/ collection, which the Firebase Trigger Email extension uses to forward the report to our support inbox.

i) Fingerprint Check-In Data (only if your gym uses a fingerprint device)

Fingerprint check-in is a Max plan feature. It works with a fingerprint device that your gym buys, owns, and operates at its own premises. If your gym uses one, we handle the following:

• A numeric fingerprint ID that Gym Ledger assigns to a member and stores on that member's record
• Enrolment records showing that a fingerprint was registered for that numeric ID, on which device, and when
• Check-in records created when a member is recognised at the device, including the date, the time, and the device serial number
• Details of the fingerprint device itself: serial number, model, firmware version, status, and when it was last seen online
• Unrecognised check-in records, created when a numeric ID at the device does not match any member in your gym
• The member's name, phone number, membership end date, and card number if used, which are handled so that a check-in can be matched to the right member and the device can show the name and apply the membership expiry

j) Demo Requests From the Website

If you submit the "Book a Demo" form on gymledger.pro, we collect the name and phone number you type into it. This is the only information that form asks for. Nothing else about your visit is recorded with it, and you do not need an account to use it. We use these details for one purpose only: to contact you about arranging a Gym Ledger demonstration.

To manage that conversation, your name and phone number are also stored in our sales CRM, Bigin by Zoho, alongside the copy held in our own systems. Bigin is listed in section 5 and receives nothing beyond those two fields. Your details are not used for advertising and are not passed to anyone else.

Submitting the form is entirely optional. If you would rather not leave your details, you can email us instead using the address in section 12.

k) Anonymous Member Feedback and Freeze History

• If a member sends feedback through the member portal, we collect the feedback text, a rating from 1 to 5, the selected category, and an optional photo. The feedback record and submitted photo do not contain the member's name, phone number, or account identifier, so the gym receives them anonymously.
• To enforce the daily submission limit, a separate server-only record stores the member's account identifier, the gym identifier, the day, and the number of submissions. Gym owners, staff, and members cannot read this rate-limit record. It is deleted when either the member's account or the gym's account is deleted.
• When a membership is frozen or unfrozen, we keep an audit record of the action, its date and time, the freeze window, and, when available, a snapshot of the acting owner's or staff member's account identifier and display name. An automatic action can instead carry no person identifier or name. The gym owner and active staff can read these records.

l) Public Web Check-In

The temporary public check-in page asks for a member's phone number so our server can look for matching member records at that gym. A successful lookup can return a shortened member name and membership status to the unauthenticated browser so the visitor can choose the correct member and complete the check-in.

For abuse prevention and rate limiting, the server also derives a one-way, secret-peppered hash from the visitor's IP address. The raw IP address is not stored or logged by this check-in service. Rate-limit records use a 24-hour window and are marked to expire 24 hours after the latest request.

2. How We Use Your Information

Data category	Purpose
Account information	Authentication, account management, and contact for support
Gym profile	Personalising your experience, populating receipts and invoices
Member data	Subscription tracking, payment records, attendance, expiry notifications, workouts, body-progress views, and water-intake tracking in the member portal
Member photos and gym logos	Rendering member lists, receipts, and the in-app gym header
Push notification device token	Sending membership expiry reminders and operational notifications
Crash reports, performance traces, App Check attestations	Diagnosing crashes, identifying slow flows, blocking abuse from tampered devices
Product analytics events	Understanding which features are used so we can prioritise improvements
Payment data	Processing your paid subscription, verifying the payment with the payment provider, supporting refunds
Bug reports and attachments	Reproducing the issue you reported and following up with you over email
Anonymous member feedback	Showing the gym feedback text, rating, category, and optional photo without attaching the submitting member's identity; a separate server-only identity record enforces the daily limit
Freeze and unfreeze audit records	Showing the gym when a membership was frozen or unfrozen and who performed the action
Public web check-in data	Matching the phone number entered on the check-in page to the correct member, recording the visit, and limiting abuse using a peppered IP-address hash
Fingerprint check-in data	Matching a check-in at your gym's fingerprint device to the right member, showing that visit in attendance, and applying the membership expiry at the device
Demo request details (name, phone number)	Contacting you to arrange a Gym Ledger demonstration, and following up about it

We do not use any of the data above for advertising, profiling, or sale. We do not run advertising SDKs in the app.

3. Data Storage and Security

Your data is processed and stored on Google Firebase (Google LLC), which provides:

• Encryption in transit (HTTPS / TLS) for all network traffic between the app and the server
• Encryption at rest for data stored in Cloud Firestore and Firebase Storage
• Secure authentication via Google or Apple sign-in
• Data centres compliant with industry security standards (ISO 27001, SOC 2, and others published by Google)

Image, video, and audio attachments are stored in Firebase Storage and isolated per account by security rules so that one account cannot read another account's media. Razorpay handles its own card and bank data inside its PCI-DSS environment; we never receive that information. Payments made through Google Play or the App Store are likewise processed entirely inside Google's and Apple's own systems; no payment provider shares card or bank details with us.

The App requires an active internet connection to use. When connectivity is lost, the App shows a slim banner and continues to display data already loaded. The App does not offer offline data entry; saving gym data is blocked while it detects no connection. The Cloud Firestore SDK caches your account profile and recent reads locally on the device to keep navigation responsive once you are signed in; this cache is not encrypted separately from Firestore's SDK implementation. App preferences (locale, theme, notification settings) are stored locally using Hive.

Important: If you delete your account, uninstall the App, or clear local storage, all locally cached data on your device is removed. Maintain an active internet connection while using the App.

4. Data Retention

• Active accounts: Data is retained as long as your account is active.
• Deleted accounts: When you delete your account, your Firebase Authentication credentials, Gym Ledger server-side data owned by that account (gym profile, member records, payments, attendance, leads, trainers, plans, expenses, staff links, and bug reports), media linked to that account in Firebase Storage, and local data on your device are permanently erased, subject to the member-held and anonymous-feedback exceptions described below. We keep a minimal UID-keyed deletion tombstone for a short period only to block already-issued sign-in tokens; scheduled cleanup removes it after that safety window. Gym, member, payment, media, bug-report, and orphaned account content owned by the deleting account is not recoverable. If your gym used the member portal, each member keeps their own receipt and membership history for their transactions with your gym. Those records live inside that member's own Gym Ledger account, belong to them rather than to your gym, and are limited to receipt figures plus your gym's name; deleting your account does not remove them. (Razorpay independently retains its own transaction records as described under Payment records below.)
• Local data: All locally cached data (account profile, preferences) is cleared when you delete your account or uninstall the app.
• Bug-report attachments: Bug-report attachments (images, videos, voice notes) are permanently deleted when you delete your account. For active accounts, we also aim to delete them within 90 days of submission; you may request immediate deletion at any time by emailing the address above.
• Bug-report forwarding records: Entries in the mail collection used by the Firebase Trigger Email extension are tagged with your account ID and are permanently deleted when you delete your account (and otherwise after the extension finishes delivery and its cleanup cycle). The original report document in bug_reports/ is deleted with your account.
• Anonymous member feedback: Feedback records and submitted anonymous photos are deleted when the recipient gym owner's account is deleted. If a member deletes their own account, the member-keyed rate-limit record and any stranded pre-submission upload are deleted. A photo already submitted with anonymous feedback is not deleted with the member's account because the submitted copy deliberately carries no member identifier and cannot be linked back without breaking the anonymity promise. It remains with the anonymous feedback until the recipient gym owner's account is deleted.
• Public web check-in rate limits: The check-in service does not store or log the raw visitor IP address. It stores a secret-peppered hash in rate-limit records that use a 24-hour window and are marked to expire 24 hours after the latest request.
• Crash, analytics, performance, and App Check data: Retained according to the default retention settings of each Firebase service. We do not extend these defaults. We do not link these records to individual gym members.
• Payment records: Gym Ledger permanently deletes its own copies of your payment and order records when you delete your account. Razorpay independently retains its transaction records inside its own systems as required by law and its policies; that data is controlled by Razorpay, not Gym Ledger, and is covered by the Razorpay Privacy Policy. Purchases made through Google Play or the Apple App Store are likewise recorded by Google and Apple in their own systems; those records, and the subscription itself, are managed in your Google Play or App Store account. Deleting your Gym Ledger account does not cancel a Google Play or App Store subscription. Cancel it in the store's own subscription settings.
• Member-held records: Where a member has their own Gym Ledger account, receipts we issued to them and their membership summary remain in that member's account after your gym's account is deleted. This is their record of their own payments. It contains no notes, contact details, or other member information from your gym's records.
• Fingerprint check-in data, when you remove a fingerprint or delete a member: We clear the numeric fingerprint ID from the member's record, delete the enrolment records we hold for them, and destroy the encrypted copies of their fingerprint templates. We also queue an instruction telling every fingerprint device that is registered and active for your gym to delete that user, and we keep retrying until a device confirms it. A device can only receive that instruction while it is switched on and connected. The numeric ID itself is deleted rather than held in reserve, so it returns to the pool and may later be given to another member. Each ID records the date it was assigned, which lets us reject check-ins from before that date instead of crediting them to the number's new holder. One case this cannot cover: if the delete instruction never reached a device, because it was permanently offline or had been sold or replaced, a fingerprint still stored on that device could still open that door, and the resulting check-in would be recorded against whoever holds that number now. Clear every fingerprint device at its own keypad when you retire it or pass it on.
• Fingerprint check-in data, when you delete your whole account: The numeric IDs, enrolment records, unrecognised check-ins, and the fingerprint device records are deleted along with everything else. No instruction is sent to your fingerprint devices in this case, because your account and the connection to your devices are removed at the same moment. Clear every fingerprint device yourself before you delete your account. Once the account is gone, Gym Ledger has no way to reach the device, and any fingerprints held on it are yours to remove as the owner of that hardware.
• Enrolment signature: The one-way signature described in section 8 is deleted as soon as the enrolment it belongs to has been reconciled.
• Demo requests: The name and phone number you submit through the "Book a Demo" form are kept for 24 months from the day you send them in Gym Ledger's own systems, and are then deleted automatically. The copy stored in our sales CRM (Bigin by Zoho, section 5) is not on that automatic schedule; we remove it by hand once it is no longer needed. If you ask us to delete your details sooner, we delete both copies. Email the address in section 12.

5. Third-Party Services and Processors

The app uses the following processors. Each one receives only the data needed for its purpose:

Processor	Purpose	Data categories handled
Firebase Authentication	Sign-in via Google or Apple	Email, name, provider account identifier
Cloud Firestore	Primary data store	Gym profile, member, payment, attendance, lead, trainer, plan, expense, workout, body-measurement, water-log, anonymous-feedback, freeze-history, and public-check-in rate-limit records
Firebase Cloud Messaging	Push notifications	Device token, notification payload
Firebase Storage	Media storage	Member photos, gym logos, bug-report screenshots, videos, voice notes, pre-submission feedback photos in feedback_quarantine/, and submitted anonymous feedback photos in gym_feedback/
Firebase Crashlytics	Crash and error reporting	Device model, OS, app version, stack traces, breadcrumbs
Firebase Analytics	Product analytics	Event names and parameters listed in section 1(e)
Firebase Performance Monitoring	App-performance telemetry	Method response times, network latency on key flows
Firebase App Check (Play Integrity, App Attest, and DeviceCheck)	Anti-abuse and device attestation	Android Play Integrity verdict or iOS App Attest/DeviceCheck attestation, plus app identity information needed to validate the request
Firebase Cloud Functions	Server-side payment verification	Razorpay payment ID, order ID, signature; Google Play purchase tokens; Apple transaction information
Firebase Trigger Email extension	Forwarding bug reports to support email	Email payload (description, device info, attachment links)
Razorpay (Razorpay Software Private Limited)	Payment processing for paid subscriptions in app versions that use Razorpay	Email, phone, name, payment amount; card and bank details handled inside Razorpay only
Google Play Billing (Google LLC)	Payment processing for paid subscriptions bought on Android	Payment handled entirely inside Google Play. Google Play receives a pseudonymous Gym Ledger account token that ties the purchase to your account; we receive the purchase token and product identifier for server verification
Apple App Store (Apple Inc.)	Payment processing for paid subscriptions bought on iOS	Payment handled entirely inside the App Store. Apple receives a pseudonymous Gym Ledger account token that ties the purchase to your account; we receive Apple transaction information for server verification
Bigin by Zoho (Zoho Corporation)	Sales CRM used to follow up on website demo requests	Name and phone number submitted through the "Book a Demo" form. Nothing from the app, and nothing about your gym or its members, is sent to Bigin
Gym Ledger device connection service (runs on Google Cloud, Mumbai region)	Passing check-ins and instructions between your gym's fingerprint device and Gym Ledger	Member name, phone number, membership end date, card number if used, numeric fingerprint ID, device serial number, check-in date and time. Name, card number, and membership end date are sent to your own fingerprint device so it can display the member and apply the expiry. Fingerprint enrolment data is handled in memory only and is never written to disk or to cloud storage

Firebase services are operated by Google LLC. Their use of your data is governed by Firebase Privacy and Security and Google's Privacy Policy. Razorpay's handling of payment data is governed by the Razorpay Privacy Policy. Payments made through Google Play are governed by Google's Privacy Policy linked above; payments made through the App Store are governed by the Apple Privacy Policy. Demo-request details held in Bigin are governed by the Zoho Privacy Policy.

We do not sell or rent your personal data, and we do not share it with any third parties other than the processors listed above. There are no advertising, attribution, or fingerprinting SDKs in the app.

6. Your Rights

Under India's Digital Personal Data Protection Act (DPDP) 2023 and other applicable laws, you have the right to:

• Access your personal data stored in the app
• Correct inaccurate information via the app's settings
• Delete your account from Settings at any time — this permanently erases the account and data linked to it, subject to the specific retention exceptions in section 4, with no separate request needed
• Withdraw consent by deleting your account or contacting us
• Request a copy of your data in a portable form by contacting us

7. Third-Party Personal Data

As a gym owner, you enter personal data of your gym members into the app. By doing so, you confirm that:

• You have obtained appropriate consent from your gym members to store and process their personal information
• You are responsible for informing your members about how their data is being used
• You will comply with applicable data-protection laws regarding your members' data
• You will review screenshots, videos, and voice notes before sending them in a bug report, and remove or blur member personal information when it is not needed to reproduce the issue
• Where you use fingerprint check-in, you have given each member a clear notice, obtained their consent before enrolling their fingerprint, kept a record of that consent, and offered QR or manual check-in as an alternative so that fingerprint check-in remains optional for them
• You will remove a member's fingerprint access promptly when they withdraw consent or ask for it, including from any fingerprint device you own that is offline, retired, or replaced

8. Fingerprint Check-In (Max Plan)

This section applies only if your gym is on the Max plan and has connected a fingerprint device. If your gym does not use one, nothing in this section applies to you.

How it works

The fingerprint device is hardware your gym buys, owns, and operates. A member registers a finger on the device. The device stores the fingerprint on itself and gives it a numeric ID. Gym Ledger links that numeric ID to the member's record, so a check-in at the device is recorded against the right person.

What Gym Ledger stores, and what it does not

Gym Ledger stores the numeric ID, the record that an enrolment happened on a given device, the check-in date and time, and the device's own details. Gym Ledger does not store fingerprint images, and does not store a fingerprint template that could be reused to recognise anyone. The fingerprint stays on your gym's device.

When a finger is registered for the first time, the enrolment reaches our connection service and a one-way signature is calculated from it and stored briefly. Its only purpose is to tell one enrolment apart from another so the same finger is not recorded twice. It is calculated with a secret key, it cannot be turned back into a fingerprint, it cannot be used to identify or match anyone, and it is deleted once the enrolment has been reconciled. Nothing else derived from the fingerprint is kept.

How the data travels

Your fingerprint device sends its records over the internet to Gym Ledger's connection service, which runs on Google Cloud in the Mumbai region. That link between your device and our service is a direct connection that is not encrypted in transit today. We are working to secure it. Everything after that point, between our service and Gym Ledger's databases, uses encrypted connections, and stored data is encrypted at rest.

Who can see it

The gym owner and every active staff account of that gym can see the fingerprint IDs, the enrolment status, the device records, and the check-ins. The separate biometric staff permission controls who can change or remove an enrolment, not who can view these records. This data is not visible to other gyms, and it is never used for advertising, profiling, or sale. A member who has their own Gym Ledger account can see their own check-ins, including which of them were recorded at the fingerprint device.

Consent

The gym decides to use fingerprint check-in and decides which members to enrol. Under India's Digital Personal Data Protection Act 2023, the gym is the Data Fiduciary for its members' data and Gym Ledger acts as its Data Processor. Before enrolling any member, the gym must give that member a clear notice and obtain their consent, which must be free, specific, informed, unconditional, and unambiguous, and the gym must keep a record of it. Fingerprint check-in must always be optional. Gym Ledger also provides QR check-in and manual check-in, so a member who does not wish to give a fingerprint can still be marked present.

Member rights and removal

A member may withdraw consent and ask for their fingerprint access to be removed at any time, and may do so without ending their membership. The gym removes the member's fingerprint ID in the app. Gym Ledger then clears the numeric ID, deletes the enrolment records it holds, and instructs every registered device to delete that user. Section 4 sets out retention and deletion in full, including what happens when a whole account is deleted. Because the device belongs to the gym, keeping it connected so that removal instructions reach it, and clearing any device that is offline, retired, or replaced, is the gym's responsibility.

9. Children's Privacy

Gym Ledger is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take steps to delete that information.

10. Data Breach Notification

In the event of a data breach that affects your personal data, we will notify affected users within 72 hours as required by applicable law, and take immediate steps to mitigate the breach.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes (new processors, new data categories, new retention windows) will be reflected on this page along with an updated "Last updated" date. Continued use of the app after changes constitutes acceptance of the revised policy.

12. Contact Us

If you have any questions or concerns about this Privacy Policy, please contact us at:

Email: admin@gymledger.pro