Privacy Policy

GymDost Business · Last updated: 25 October 2026

GymDost Business is an app that helps gym owners in India manage their members, plans, payments, attendance and renewal reminders. It is run by Dhaka Co, India (“GymDost”, “we”, “us”). This policy explains what data GymDost Business holds, why, who can see it, how long we keep it, and how to have it deleted.

1. Who this policy covers

• Gym owners and staff who use the GymDost Business app (“you”).
• Gym members whose details a gym records in the app.

For member data, the gym decides what to record and why. Under India’s Digital Personal Data Protection Act, 2023, the gym is the Data Fiduciary and GymDost processes that data on the gym’s behalf, as its Data Processor. For gym owners’ own account details, GymDost is the Data Fiduciary.

2. What we collect and hold

From gym owners and staff

• Account: your name, email address and phone number, and your password. Passwords are stored only as a salted one-way hash combined with a secret key, so nobody, including us, can read them.
• Your gym: gym name, city, phone number, your gym’s UPI ID (used to make the payment QR for members), reminder settings, and the language and message templates you choose.
• Your GymDost subscription: your plan (Basic or Pro), trial and paid-until dates, the amount you paid, the 12-digit UPI reference number (UTR) you type when you pay us, and the status of each payment request. If you were referred by another gym, or refer one, we keep that link and the referral code.
• Security and troubleshooting: when each login last signed in, a hashed session token for each signed-in phone, and the IP addresses behind failed sign-in attempts and new sign-ups, used only to block password guessing and fake accounts. Our hosting provider keeps short-term request logs.

About gym members, as entered by the gym

• Name, phone number, email, gender, date of birth and notes.
• A photo, if the gym adds one with the camera or from the phone’s gallery.
• Membership and personal-training plans, fees, payments (amount, date, method), dues, plan freezes and transfers, attendance check-ins, trainers, trainer commissions and referral rewards.

We do not collect your location, your contacts, your microphone, or anything from members directly. GymDost Business contains no advertising or analytics trackers.

3. How we use it

• To run GymDost Business for the gym: showing members, renewals, payments and attendance, and keeping the gym’s phones in sync.
• Renewal, dues and birthday reminders are made on the owner’s own phone as notifications. Member details are not sent to any messaging service for this.
• To manage the gym’s GymDost subscription: checking the UPI payment you report and extending your plan, applying referral bonus days, and giving support when you ask.
• To keep the service secure and working, for example to stop password guessing or investigate a fault.
• To email you a 6-digit code if you use “Forgot password”, when email sending is switched on.

We never sell personal data, and we never use member data for marketing.

4. Payments

• Paying GymDost: there is no card form and no payment gateway in the app. You pay by UPI, using your own UPI app, to GymDost’s UPI ID, and then tell us the UPI reference number. GymDost never sees your UPI PIN, bank account or card details.
• Members paying the gym: the app can show a UPI QR or link for the exact amount. The member pays the gym’s UPI ID directly in their UPI app. GymDost does not handle that money; the gym records the payment in the app.

5. Who can see it

• Only the gym’s own logins can see that gym’s member data and photos. Other gyms cannot.
• GymDost’s admin tools show each gym’s subscription and usage counts, not members’ names, phone numbers or photos. We look at a gym’s member data only when the gym asks for help, to fix a fault or security problem, or when the law requires it.
• Service providers that handle data for us:
  • Cloudflare, Inc. hosts GymDost’s servers and database, including photos.
  • Expo (650 Industries, Inc.) builds the app and delivers app updates. An update check shares only technical details such as the app version and device type; it receives no gym or member data.
  • Resend sends “Forgot password” emails when switched on; it receives the owner’s email address and the code.
  • Google Play distributes the app if you install it from the Play Store.
• When the owner taps WhatsApp, call or UPI in the app, the phone opens that app with the message, number or amount already filled in. That message is then handled by that service under its own terms.
• We may disclose data if required by law or a lawful order from an Indian authority.

6. Where it is stored and how it is protected

• Data is stored in Cloudflare’s database service, placed in the Asia-Pacific region, and may be processed in other countries where Cloudflare operates.
• The app keeps a copy of the gym’s data on the owner’s phone so it can be viewed offline. The copy is removed from the phone when the owner signs out or deletes the account.
• All connections use encryption (HTTPS). Login sessions use random tokens that we store only in hashed form. Repeated wrong passwords lock sign-in for a while. The login is kept in the phone’s secure storage.

No system is perfectly secure. If a data breach affects you, we will inform the affected gyms and the authorities as the law requires.

7. How long we keep it, and deleting it

• While the gym uses GymDost Business, we keep its data.
• If the subscription ends, the gym becomes read-only. The data is kept so the gym can renew or export a backup. If a gym has had no paid subscription for 12 months, we may delete its data after giving at least 30 days’ notice.
• Deleting your account: in the app, go to Settings → Delete Account and enter your password. Your login is deleted, and if you are the gym’s only owner, the gym and all its members, photos, plans, payments, attendance and subscription records are deleted immediately. If another owner shares the gym, the gym stays with them and only your login is removed. Copies may remain in our backups for up to 30 days and are then removed.
• If you cannot use the app (for example you lost your phone), see how to ask us to delete your account.
• When a gym deletes a member, that member’s details, history and photo are deleted.
• Your own payment to us stays in our bank and UPI statements, which we must keep for tax and accounting. These hold no gym or member data.

8. Your choices and rights

• Gym owners can see, correct, export (Settings → Backup) and delete their gym’s data in the app at any time, and can ask us to correct or delete their own account details.
• Gym members should contact their gym to see, correct or delete their details, or to withdraw consent. We will help the gym respond. If a member contacts us directly, we will pass the request to the gym.
• The app asks for the camera and photos permission only when you add a member photo, and for notification permission to show reminders. You can switch either off in the phone’s settings.

9. Gyms’ responsibilities

Gyms must have a lawful reason and, where needed, the member’s consent to record their details and photo, and must tell members what they record and why. For members under 18, the gym must have the consent of a parent or guardian.

10. Children

GymDost Business is for gym owners and staff, who must be adults. It is not aimed at children, and members do not use it.

11. Changes to this policy

If we change this policy, we will update the date above. For important changes, we will tell gym owners in the app or by WhatsApp or email before the change takes effect.

12. Contact and grievances

For questions, requests or complaints about personal data, contact our Grievance Officer at Dhaka Co:

We aim to reply within 7 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.