Privacy Policy
Akhada is a gym management app for gyms in India, published by Navaye, a sole proprietorship based in Gwalior, Madhya Pradesh ("Navaye", "we", "us", "our"). This policy explains what personal data the Akhada mobile app and this website handle, on what basis, who it is shared with, how long it is kept, and the rights you have over it.
This policy is written to comply with the Digital Personal Data Protection Act, 2023 ("DPDPA") and the Information Technology Act, 2000 and rules made under it. It forms part of, and is governed by, the Akhada Terms of Service. If you do not agree with this policy, do not use Akhada.
1.Scope of this policy
This policy applies to the Akhada mobile application on Android and iOS, and to the Akhada pages on this website (including the account-deletion request page).
It applies to three kinds of users: gym owners (who subscribe to Akhada and run a gym on it), gym staff (whom an owner invites), and gym members (whom a gym enrols).
It does not apply to anything your gym does outside Akhada, to the Apple App Store or Google Play, or to any third-party website or app you reach from a link in Akhada. Those are governed by their own policies.
2.Who is responsible for your data
Akhada has two distinct layers of responsibility, and it matters which one applies to you.
- Records your gym keeps about its members. Your gym decides which members to enrol, what details to record, and how long to keep them. Under the DPDPA the gym is the Data Fiduciary for that data, and Navaye acts as a Data Processor handling it on the gym’s instructions. If you are a gym member, your gym is your first point of contact for access, correction, or deletion of your records.
- Your own account and how you use the app. For sign-in identity, subscription status, crash reports, diagnostics, and support correspondence, Navaye is the Data Fiduciary and is directly answerable to you.
Gyms using Akhada are responsible for obtaining a valid, informed consent (or establishing another lawful basis) from every member whose details they enter, and for giving those members their own notice. Navaye provides the software; it does not decide what a gym collects.
3.Personal data we handle
We handle only what the app needs to work. The categories below are exhaustive as of the date of this policy.
- Sign-in identity. Your Indian mobile number (+91) and a one-time SMS code, processed through Firebase Phone Authentication. We also keep a short-lived log of one-time-code request attempts against a phone number, purely to block abuse and brute-force attempts.
- Account and role. The gym you belong to, your role in it (owner, staff, or member), and a display name.
- Gym profile. Gym name, address, opening timings, contact phone, and an optional gym photo, entered by the owner.
- Member records entered by the gym. Name, mobile number, and optionally date of birth, address line, city, state, PIN code, and a profile photo.
- Membership and money records. Plan templates, plan assignments with start and end dates, discounts, and payment entries recorded by the gym (amount in INR, whether it was cash or online, date, and which staff account recorded it). These are the gym’s bookkeeping records, not payment transactions.
- Point-of-sale records. Items the gym lists for sale, their images and prices, and sales the gym records against them.
- Staff records. Staff mobile number, display name, role, shift timings, and invite or revocation status.
- Training content. Training programmes and day-wise plans a gym creates, and which member each is assigned to.
- Announcements. Announcements a gym publishes to its members, and whether a member has read them.
- Photos. Gym, member, and item photos. Photos are compressed on the device and stripped of EXIF metadata (including any camera-embedded GPS coordinates) before upload.
- Push notification tokens. If you allow notifications, a device token issued by Firebase Cloud Messaging, so the app can deliver your gym’s announcements and membership-expiry reminders.
- Subscription status. For gym owners only: whether the gym is on the free tier or an active, lapsed, or cancelled Pro subscription, its renewal date, and an anonymous subscriber identifier issued by RevenueCat.
- Device and diagnostic data. Device model, operating system version, app version, language, coarse device configuration, crash stack traces, and in-app events such as screen views — collected through Firebase Crashlytics and Firebase Analytics.
- App integrity signals. The app checks, on-device, whether it is running in a tampered environment (rooted or jailbroken device, debugger attached, repackaged binary). On the plan we use, these checks run locally and are not reported to a vendor dashboard.
- Support correspondence. If you email us, we keep your message, your email address, and the phone number you reference, so we can answer and keep a record of the request.
4.What we never collect
The following are outside Akhada by design, not merely unused today:
- Aadhaar numbers, PAN, driving licence, voter ID, passport details, or images of any government identity document.
- Biometric data of any kind, including fingerprints and face templates.
- Your location. The app does not request or use device location permissions, and photo EXIF data is stripped before upload.
- Card numbers, UPI IDs, bank account details, or any payment credential. Subscription billing happens entirely inside Apple’s or Google’s systems; we never see or receive payment instrument details.
- Your contacts, call logs, SMS contents, photos outside those you deliberately pick, or any other app’s data.
- Health or medical records, diagnoses, or fitness-tracker measurements.
- Passwords. Akhada has no password to steal — sign-in is by one-time code only.
We do not sell, rent, or trade personal data. We do not use it to train machine-learning models. There is no third-party advertising in Akhada and no advertising identifiers are collected.
5.Why we handle it, and on what basis
Under the DPDPA we process personal data on the basis of your consent, or where the Act permits a "legitimate use" such as data you have voluntarily provided for the purpose in question. Specifically:
- To sign you in and route you correctly — to verify your phone number and take you to the right gym and role. Basis: consent, given when you enter your number and request a code.
- To deliver the service — to store and display member, plan, payment, staff, training, and announcement records for your gym. Basis: performance of the service you or your gym asked for, on the gym’s instructions.
- To send notifications — gym announcements and expiry reminders. Basis: consent, given through the operating system notification permission, which you can withdraw at any time.
- To manage subscriptions — to know whether a gym is entitled to Pro features. Basis: performance of the subscription contract.
- To keep the service secure — one-time-code rate limiting, app-integrity verification, and abuse prevention. Basis: legitimate use for security and prevention of fraud.
- To fix and improve the app — crash diagnostics and aggregate usage analytics. Basis: consent for optional diagnostics, and legitimate use for keeping the service functional.
- To meet legal obligations — to respond to lawful requests, and to retain records where a law requires it.
We do not use your personal data for any purpose incompatible with the ones above. We do not carry out automated decision-making or profiling that produces legal or similarly significant effects.
6.Consent, and how to withdraw it
Where we rely on your consent, you may withdraw it at any time, and withdrawing is as easy as giving it. The consequence of withdrawal is limited to the feature it relates to.
- Notifications — turn them off in your device settings for Akhada. The app keeps working; you simply stop receiving pushes.
- Photos — do not add one, or ask your gym (or us) to remove an existing one.
- Diagnostics and analytics — email us at [email protected] and we will disable analytics and crash collection for your account.
- The service as a whole — withdrawing consent to phone-number sign-in means you can no longer use Akhada; request deletion at navaye.com/akhada/delete-account.
Withdrawal is not retrospective: it does not make unlawful anything we did lawfully before you withdrew.
8.Where your data is stored and processed
Akhada’s database and photo storage are hosted on Supabase infrastructure in a region we select, and authentication, messaging, analytics, and crash reporting run on Google Firebase infrastructure. Some of these providers operate globally, so your personal data may be stored or processed on servers outside India.
The DPDPA permits such transfers except to countries the Central Government restricts by notification. We do not transfer personal data to any restricted territory, and we will change providers or regions if a notification requires it.
Wherever it is processed, your data remains subject to this policy and to the contractual obligations we impose on our processors.
9.How we protect it
We take the security safeguards the DPDPA requires of us. These include:
- Encryption of all data in transit (TLS), and encryption of data at rest by our hosting providers.
- Row-level security in the database, so every read and write is checked against the gym and role recorded in your signed-in session — access control is enforced by the server, not by the app.
- Sign-in that never involves a password, with one-time codes issued by Firebase, an India-only country allowlist, and rate limiting on code requests.
- App integrity attestation (Firebase App Check), so our backend rejects requests that do not come from a genuine, unmodified copy of Akhada.
- Session tokens held in the device’s hardware-backed secure storage (iOS Keychain, Android encrypted storage).
- On-device tamper detection that warns you when the app is running in a compromised environment, and blocks subscription and payment screens outright.
- Least-privilege access for us: routine support does not involve reading your gym’s records, and privileged database access is limited to what is needed to operate and repair the service.
No system is perfectly secure. You are responsible for keeping control of the phone number and device you sign in with. If you lose control of your number or device, tell us immediately so we can help secure the account.
10.If there is a data breach
If a personal data breach occurs, we will notify the Data Protection Board of India and every affected user in the form and within the time the DPDPA and rules made under it require. Notice to you will describe, as far as we know it, the nature and extent of the breach, its likely consequences, the measures we have taken, and what you can do to protect yourself.
We keep an internal record of breaches and near-misses and review them to prevent recurrence.
11.How long we keep it
- Gym and member records — retained for as long as the gym’s account is active, because they are the gym’s operating records. A gym may delete or archive individual records at any time.
- After you request account deletion — the account enters a 15-day grace period, during which signing in again cancels the request. If the grace period passes, we delete or irreversibly anonymise the personal data within 30 days of the grace period ending.
- Backups — deleted data can persist in encrypted backups for up to 90 days, after which it is overwritten in the normal backup rotation. Backups are never used to restore an account that was deliberately deleted.
- Sign-in attempt logs — retained for a short period (not more than 90 days) for abuse prevention, then purged.
- Diagnostics and analytics — retained according to our providers’ default windows, which do not exceed 14 months for analytics events and 90 days for crash reports.
- Subscription and tax records — records of subscription purchases are retained for as long as Indian tax and accounting law requires, currently up to eight financial years, even after account deletion. These are financial records, not profile data.
- Support correspondence — retained for up to 24 months from the last message.
- Inactive gym accounts — if a gym account has no sign-in and no active subscription for 24 consecutive months, we may notify the owner at the registered number and delete the account and its data if there is no response within 30 days.
Where we must keep something to meet a legal obligation, or to establish, exercise, or defend a legal claim, we keep only that, and only for as long as the obligation or claim lasts.
12.Your rights
Subject to the DPDPA, you have the right to:
- Access — a summary of the personal data we hold about you, how it is being processed, and the identities of anyone it has been shared with.
- Correction and completion — to have inaccurate or misleading data corrected, incomplete data completed, and out-of-date data updated.
- Erasure — to have your personal data deleted, unless retention is required by law.
- Grievance redressal — a readily available means of raising a complaint with us, and escalation to the Data Protection Board of India if you are not satisfied with our response.
- Nomination — to nominate another individual to exercise these rights on your behalf in the event of your death or incapacity. Write to us to record a nomination.
How to exercise them. Email [email protected] from an address we can associate with you, or write from the phone number on the account. For deletion you can also use navaye.com/akhada/delete-account. We will ask you to verify control of the phone number on the account before we act — this protects you from someone else making requests in your name.
If you are a gym member, ask your gym first: it controls its member records and can correct or remove them directly, which is usually faster. If your gym does not respond, contact us and we will assist, and where the DPDPA requires it we will act ourselves.
Your duties. The DPDPA also requires you not to impersonate anyone else when providing data, not to suppress material information, and not to file false or frivolous complaints. We may decline requests that are manifestly unfounded, excessive, or repetitive, and we will tell you why.
13.Grievance redressal
We have appointed a Grievance Officer as required by the DPDPA and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.
Grievance Officer
Navaye (sole proprietorship)
Gwalior, Madhya Pradesh, India
Email: [email protected]
Write to that address with the phone number on your account, what happened, and what you want done. We will acknowledge your complaint within 24 hours and resolve it within 15 days of receipt, or tell you why we need longer.
If you are not satisfied with our response, you may complain to the Data Protection Board of India established under the DPDPA.
14.Children and minors
Akhada is a business tool operated by gyms and is not directed at children. We do not knowingly collect the personal data of anyone under 18 through a direct sign-up.
Where a gym enrols a member under 18, the DPDPA requires verifiable consent from a parent or lawful guardian before that child’s data is processed, and prohibits tracking, behavioural monitoring, and targeted advertising directed at children. Akhada does none of those things. Obtaining and holding that consent is the gym’s responsibility as Data Fiduciary, and the gym warrants to us that it has done so.
The same protections apply to persons with disabilities who have a lawful guardian.
If you believe a child’s data has been entered without proper consent, email [email protected] and we will remove it.
15.This website
The Navaye website sets no advertising or tracking cookies and runs no third-party analytics. Pages are served as static files. Fonts are loaded from Fontshare and Google Fonts, which receive your IP address and browser user-agent as a normal consequence of serving those files.
The account-deletion page submits only the phone number and confirmation you enter, and only when you press the button.
Standard server request logs (IP address, timestamp, requested URL, user agent) may be kept by our hosting provider for security and troubleshooting for a short period.
16.Changes to this policy
We may update this policy as the app changes or the law does. The "last updated" date at the top always reflects the current version.
For changes that materially reduce your rights or materially expand what we collect, we will give notice in the app or by push notification at least 14 days before they take effect, and where the law requires consent for the change, we will ask for it rather than assume it.
For minor clarifications, correction of errors, and changes required by law with immediate effect, the updated policy applies as soon as it is posted. Continuing to use Akhada after a change takes effect means you accept the updated policy.
17.Contact
For any privacy question, data request, or grievance:
Navaye — sole proprietorship
Gwalior, Madhya Pradesh, India
Email: [email protected]
Please include the phone number on your Akhada account so we can verify and act on your request.