Privacy policy

FitKliq is gym management software that you install on your own computer. This policy explains what we, the company behind FitKliq, collect about you - the gym owner - when you use this website and the app’s licence service.

It also explains the thing most people want to know first: we do not receive your gym members’ data. That lives in your own Google account and never reaches our servers.

Who we are

FitKliq is operated by AppSphere, Indore, Madhya Pradesh 452001, India ("FitKliq", "we", "us"). For the purposes of India’s Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for the personal data described below, and you can reach our Grievance Officer at /legal/grievance.

For your gym’s member records, you are the Data Fiduciary and we are not involved - see "Data we never receive".

What we collect

When you create a FitKliq account

• Your name and email address, received from Google when you sign in with Google. We ask Google for the openid, email and profile scopes only. We never receive your Google password and we cannot access your Gmail, Drive, Calendar or Contacts from this website.
• Your phone number, and whether you opted in to product emails.
• The date and time you accepted these terms.

About your gym, for billing

• Gym name, city, state; billing name, address and PIN code; GSTIN if you have one.

When you buy a licence

• Your order, the amount, and the prices at the time of the order.
• Your UPI payment reference (UTR), the date and amount you tell us you paid, your payer UPI ID, and a screenshot of the successful payment. We need these to match your payment against our bank statement, because we verify UPI payments by hand.
• The GST invoice we issue, including the billing details above.

When the app activates a licence

• Your licence key and its status.
• A machine hash - a one-way SHA-256 hash of your computer’s machine ID. This is how a licence stays tied to one computer. We cannot reverse it to identify your hardware, and the raw machine ID never leaves your computer.
• Your operating system, the FitKliq app version, and the time of the last licence check.
• Your gym’s internal gym ID, as generated by the app at setup.

When you visit this website

• Cookieless, aggregate page analytics (Cloudflare Web Analytics). No tracking cookies, no advertising identifiers, no cross-site profile. This is why you do not see a cookie banner.
• Our hosting and security provider processes your IP address transiently to serve and protect the site.
• If something breaks, an error report (Sentry) which we configure to strip email addresses, phone numbers, UTRs and licence keys.

We use a cookie or equivalent browser storage only to keep you signed in to your FitKliq account.

Data we never receive

To be exact about this, because it is the point of how FitKliq is built:

• No member or staff records - names, phone numbers, addresses, dates of birth, photos, attendance or payment history of your members.
• No health or medical information collected from your members.
• No fingerprint or biometric data. Fingerprint templates stay on the attendance device.
• No contents of your Google Sheet, your Google Drive, or your Apps Script project.

Your gym’s records are created by the FitKliq app inside your own Google account. The permissions you grant at setup are granted to the app on your computer, not to us, and the resulting Google credential is stored encrypted on that computer only. We hold no copy and cannot read your files. How it works and what access you give FitKliq describe this in detail.

Google API data use - Limited Use

FitKliq’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• Google user data is used only to provide and improve the features you asked for: signing you in to your FitKliq account, and letting the desktop app create and maintain your gym’s own spreadsheets, folders and backend script within your Google account.
• We do not transfer Google user data to third parties except as needed to provide the service, for security purposes, or to comply with applicable law.
• We do not use Google user data for advertising, and we do not sell it.
• We do not allow humans to read your Google user data, unless we have your explicit consent for a specific support request, it is necessary for security purposes or to comply with applicable law, or the data is aggregated and anonymised.

Why we use your data

We do not take automated decisions that have a legal effect on you, and we do not profile you for advertising.

How long we keep it

• GST invoices and credit notes - retained as long as Indian tax law requires (currently at least 6 years from the end of the relevant financial year, and longer if there is a dispute). These are the one record we cannot delete on request.
• Payment screenshots - deleted 90 days after the payment is verified or rejected.
• Account, gym and licence records - kept while your account exists. If you delete your account, we delete them, except for the invoice data above.
• Audit logs of administrative actions - kept for 3 years, because they are how we can show what happened to a licence or a payment.
• Email delivery logs - we store a hash of the recipient address, not the address itself.

Who processes it for us

We keep the list short on purpose:

• Supabase - our database, authentication and server functions, hosted in the Mumbai (ap-south-1) region. Your account, licence and invoice data lives here.
• Cloudflare - hosting of this website, CDN, bot protection and cookieless analytics.
• Resend - sending transactional email (order confirmations, licence activation, renewal reminders).
• Google - only as the identity provider when you choose "Sign in with Google".
• Sentry - error monitoring, configured to scrub personal data.

Each is bound by its own terms to process data only on our instructions. Your account data is stored in India; some of these providers may process limited technical data (such as an IP address at the edge) outside India.

Your rights

Under the DPDP Act you may:

• Access - see what we hold about you. Your account has Export my data, which returns everything in a readable file.
• Correct - fix your name, phone, gym or billing details from your account. Billing details on an already-issued invoice cannot be changed; we issue a credit note and a corrected invoice instead.
• Erase - delete your account from Profile → Delete my account. If you still hold active licences, they run to the end of their paid term and cannot be renewed, and the remaining records are deleted at expiry. Invoices are retained as the law requires.
• Withdraw consent - turn off product emails at any time; it does not affect transactional email about your licence.
• Nominate - nominate someone to exercise your rights if you die or become incapacitated. Write to the Grievance Officer to record a nominee.
• Complain - to our Grievance Officer, and then to the Data Protection Board of India.

We respond to requests within 30 days.

Security

Account and licence data sits behind row-level access rules so one gym owner can never read another’s. Owners cannot write to order, licence or invoice records directly - every change goes through a server function that checks the rules and writes an audit entry. Invoices and payment screenshots are in private storage reachable only through a short-lived link issued after an ownership check. Our licence-signing key lives only in a server secret. Staff accounts with administrative access are an explicit allow-list and require two-step verification.

The data on your own computer is encrypted by the app, and your gym’s Google account security is in your hands - access and risks sets out what you should do about that.

If a breach affects your personal data, we will notify you and the Data Protection Board as the DPDP Act requires.

Children

FitKliq is a business tool sold to gym owners. It is not directed at children and we do not knowingly collect children’s personal data through this website. If your gym enrols members under 18, you are responsible for obtaining verifiable parental consent - the app has features to help, and Your data & the DPDP Act explains your duty.

Changes

If we change this policy we will update the date at the top, and for anything material we will email account holders before it takes effect. Earlier versions are available on request.

Contact

Questions about this policy: support@fitkliq.com. Security reports: security@fitkliq.com. Formal data requests and complaints: Grievance Officer.