Privacy policy

Gymcord ("we", "us") operates the Gymcord website, the owner dashboard and the Gymcord member app.

For your own account (your name, phone number or email, and sign-in details) we decide how the data is used. For the records a gym keeps about its members (memberships, payments recorded by the gym and attendance) the gym decides what to record and why, and we process those records on the gym’s behalf. If you have a question about a gym’s records, you can ask the gym or us.

• Account details: your name and mobile number (members), or your name, email address and password (gym owners). Passwords are stored only as a secure hash.
• Gym details that owners enter: gym name, address, city, contact number, opening hours, capacity and membership plans.
• Membership records: which gym you belong to, your plan, start and end dates, and whether your request to join was approved.
• Payment records: amounts, dates, method (for example cash or UPI) and receipt numbers. If your gym accepts online payments, the payment itself is handled by our payment partner; we never see or store your card or bank details.
• Check-ins: the date and time you checked in at your gym, and how (by scanning the gym’s QR code, by your gym scanning your QR code, or entered by gym staff).
• Device and sign-in details: app version, device platform, browser type, and the times you signed in, so we can keep your account secure and support older app versions.
• One-time codes: the codes we text you to sign in. They expire after a few minutes.
• Messages you send us, for example support requests.

• To create and secure your account and sign you in.
• To let gyms manage their members, plans, payments and attendance, and to show members their membership, streaks and check-ins.
• To send the messages the service depends on, such as sign-in codes and, where your gym turns them on, membership reminders.
• To prevent abuse, for example by limiting repeated sign-in attempts.
• To fix problems and improve Gymcord, using aggregated usage figures.
• To meet legal obligations.

We do not sell your personal data and we do not use it for third-party advertising.

Your gym sees the details it needs to run your membership: your name, phone number, plan, payments and check-ins. Other members do not see your phone number.

We use a small number of service providers who process data for us under contract and only on our instructions:

• Hosting and databases (Vercel and our managed database provider).
• SMS delivery for sign-in codes (MSG91).
• Online payments, where a gym accepts them (Razorpay).
• File storage for photos, if you upload any (Cloudflare).

Some providers may process data outside India, with safeguards required by Indian law. We may also disclose data when the law requires it.

The owner dashboard uses one essential cookie to keep you signed in. This public website sets no cookies. We measure visits with Vercel Web Analytics, which is cookie-free and reports only aggregated figures; we strip query strings from every page address before it is recorded.

• Account details: while your account is open. When you delete your account, we remove your name and phone number and the account can no longer be used.
• Payment and check-in records: kept as the gym’s business records even after an account is deleted, without your name, for as long as tax and accounting law requires.
• Sign-in codes: a few minutes. Sign-in sessions: until they expire or you log out.
• Security and server logs: a short period, and we never log passwords, sign-in codes or full phone numbers.

Under India’s Digital Personal Data Protection Act, 2023 you can ask us to:

• give you a summary of the personal data we hold about you and how we use it;
• correct or update it;
• erase it, where we no longer need it for the purpose you gave it for or to meet a legal obligation;
• let someone you nominate exercise these rights if you die or are unable to.

Members can delete their account in the app. For anything else, write to hello@gymcord.io. We will answer within the time the law allows. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.

Gymcord is meant for people aged 18 and over. A member under 18 may use Gymcord only with the consent of a parent or guardian, and their gym is responsible for obtaining it.

We use encrypted connections, store passwords and sign-in codes only as secure hashes, keep each gym’s data separate from every other gym’s, and limit access to the people who need it. No service is perfectly secure, so we will tell you and the authorities about a breach that affects you, as the law requires.

If we change this policy we will update the date at the top. If a change affects how we use your data in an important way, we will tell you in the app or by email before it takes effect.

Questions, requests and complaints about your personal data: hello@gymcord.io. We aim to acknowledge every request within a few working days.