Effective date: 1 July 2026
Last updated: 1 July 2026
Jurisdiction: India
Supfit ("we", "our", or "us") operates the Supfit mobile application and the website supfitapp.com (together, the "Service"). This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our Service. By creating an account or using Supfit, you agree to this policy.
Medical Disclaimer: Supfit is not a medical device and does not diagnose, treat, cure, or prevent any condition. It provides general fitness and wellness guidance only.
Health data is sensitive. We collect only the data necessary to deliver a world-class personalized health experience. We treat all health data with strict confidentiality and will never sell your personal data or health information to third parties.
1. Who We Are
Supfit is operated as an individual / startup entity based in India. For all privacy-related queries, contact us at privacy@supfitapp.com.
2. Information We Collect
2.1 Account Information
- Full name, email address, and password (hashed — never stored as plaintext)
- Profile photo (optional)
- Date of birth, gender, height, and weight (for fitness personalisation)
- Supfit currently supports a single account type: the individual user.
2.2 Health & Fitness Data
Health Data from Integrations: This version of Supfit does not connect to Apple Health or Google Health Connect. If we add this capability in a future release, this policy will be updated first, and you will be asked for explicit, purpose-bound consent before any sync occurs.
- Workout logs and exercise history you manually enter
- Diet and nutrition records (if you use the diet planning feature)
- Body measurements and progress photos (optional, stored securely)
- Fitness goals and targets you set in the app
2.3 Usage & Technical Data
- App interactions, screen views, and feature usage (for improving the app)
- Device type, OS version, and app version
- IP address and approximate location (city level, for fraud prevention only)
- Crash reports and error logs (anonymised)
2.4 Payment Data
Supfit is currently free to use, and no payments are processed today. If we introduce optional in-app subscriptions in a future release, this policy will be updated first. At that point, purchases will be processed entirely by the Apple App Store (iOS) or Google Play Store (Android); we will not store your credit card or payment details, and will receive only confirmation of subscription status from the respective platform.
3. How We Use Your Information
| Purpose | Data Used |
|---|
| Personalise fitness dashboard and guidance (via Maya) | Health data, goals, profile |
| Send workout reminders and progress notifications | Email, push token, goals |
| Improve app features and fix bugs | Anonymised usage and crash data |
| Prevent fraud and ensure account security | IP address, device info |
| Comply with legal obligations | Account and transaction records |
We do not use your data for advertising, do not sell your data, and do not share health data with any third party except as described in Section 4.
4. How We Share Your Information & AI Privacy
We do not sell, rent, or trade your personal data. We share data only in the following limited circumstances with our authorized sub-processors:
- AI Model Processors (OpenAI): To power Maya AI recommendations, custom meal plans, and workout guidance, de-identified health prompts, dietary preferences, fitness goals, and macro targets are transmitted to OpenAI (via secure server-side API). We NEVER send your exact personal identity or exact numbers to OpenAI. For example, if your age is 28, we convert it into a broad age range (e.g., "26–35"). Similarly, your exact weight and height are converted into generalized weight ranges (e.g., "60–74 kg") and body mass categories. Your real name is replaced with a generic label ("User"). OpenAI processes these de-identified ranges strictly to generate your requested response under strict API data protection agreements where inputs and outputs are not used to train public AI models.
- Service Processors: Cloud database hosting and authentication (Supabase), secure database backups, crash reporting & error monitoring (Sentry), and push notification infrastructure (Expo / FCM / APNs), each bound by strict data protection terms.
- Legal compliance: We may disclose information if required by Indian law, a court order, or a government authority.
- International Data Transfers: Our processors (including OpenAI, Supabase, and Sentry) process data in secure data centers outside your country of residence, including in the United States. Where international transfers occur, we rely on Standard Contractual Clauses and certified processor safeguards to protect your information in transit and at rest.
5. Data Storage & Security
- All data is stored on Supabase servers with encryption at rest (AES-256) and in transit (TLS 1.2+).
- Health data is protected with Row Level Security (RLS) — only you can access your records.
- Account passwords are stored using secure bcrypt hashing.
- Authentication tokens are stored in encrypted device storage (iOS Keychain / Android Keystore via
expo-secure-store).
- Authentication uses short-lived JWTs signed with ECC P-256.
- We conduct regular security reviews of our codebase and infrastructure.
- Supabase infrastructure is hosted in the United States (AWS us-east-1). Cross-border data transfers from India are conducted in compliance with India's Digital Personal Data Protection (DPDP) Act, 2023.
Data Breach Notification: In the event of a security breach affecting your personal information, we will notify you and any applicable regulators without undue delay in accordance with applicable laws (including DPDP Act and GDPR).
6. Data Retention
- Your data is retained for as long as your account is active.
- If you delete your account, all personal data including health records and progress history is permanently deleted from production database systems within 30 days.
- Anonymised, aggregated usage data may be retained indefinitely for analytics.
- Encrypted rolling database backups automatically purge deleted records on a 30-day rolling backup cycle.
- Rate-limiting and security logs are automatically purged after 30 days.
7. Children's & Age Eligibility
Supfit is intended for users aged 18 and older. We do not knowingly collect personal information from children or individuals under 18. If you believe an individual under 18 has provided us with personal information, please contact us at privacy@supfitapp.com and we will delete it immediately.
8. Your Rights
Under India's Digital Personal Data Protection Act, 2023 (DPDPA), you have the following rights:
- Access: Request a copy of the personal data we hold about you.
- Correction: Request correction of inaccurate or incomplete data.
- Deletion: Request deletion of your account and all associated data (within 30 days).
- Withdrawal of consent: Withdraw consent to health data access at any time via Settings → Health Permissions, or via your device's Health app settings.
- Grievance redressal: Lodge a complaint with our Grievance Officer (see Section 11).
To exercise any of these rights, email privacy@supfitapp.com. We will respond within 30 days.
9. Cookies & Tracking
The Supfit mobile app does not use advertising cookies or cross-app tracking. The supfitapp.com website uses only essential cookies required for the site to function. We do not use Google Analytics, Meta Pixel, or any third-party advertising trackers.
10. Third-Party Links
The app may contain links to third-party websites or services (such as fitness articles or nutrition resources). We are not responsible for the privacy practices of those third parties. We encourage you to read their privacy policies before sharing any information with them.
11. Grievance Officer
In accordance with the Information Technology Act, 2000 and the DPDPA 2023, we have appointed a Grievance Officer:
12. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you via a push notification or an in-app banner at least 7 days before the changes take effect. Continued use of the app after the effective date constitutes acceptance of the updated policy.
13. Contact Us
