Privacy policy

1. Who we are

Peko ("Peko", "we", "us") is a mobile app that helps gyms, freelance personal trainers and the people they coach manage training, diet, attendance, memberships and progress. This policy explains what personal data the app collects, why, who can see it, how long it is kept and the choices you have.

Peko is an Indian business.

It applies to everyone who uses the app: freelance trainers, gym owners, managers, trainers, front desk staff, members and clients. By using the app you agree to this policy. If you do not agree, please do not use the app.

2. Our role and your trainer's or gym's role

For your own account — the details you give us to sign in and use the app — Peko decides how that data is used and is responsible for it.

For members and clients, the gym or freelance trainer you train with decides what is recorded about you: your plan, measurements, attendance and payments. Peko stores and processes that data on their behalf and only to provide the service to them. They are responsible for telling you what they record and for having your consent. You can contact them or us about any of it.

3. What we collect

Account details. name, mobile number, email address, profile photo, date of birth, gender, your role, and the gym and branch you belong to. If you sign in with Google or Apple we receive your name, email and an account identifier from them. Passwords are stored only in encrypted (hashed) form; we cannot read them.

Health and fitness details (members). height, weight, body fat, body measurements, fitness goal, activity level, diet preference, food restrictions, allergies, medical conditions you or your trainer record (for example diabetes, thyroid, PCOS, blood pressure, heart conditions, asthma, back or knee pain), health notes and an emergency contact number. Also your workouts, sets, personal bests, meal logs, water intake, weigh-ins and check-ins. Health data is sensitive personal data and is handled with extra care (see sections 5 and 9).

Photos. progress photos, meal photos, profile photos, gym logos, and shift check-in photos taken by staff. When a progress photo is used for posture checks, body points are measured on your phone by an on-device model; the photo is not sent anywhere for that analysis.

Location. only when you use a feature that needs it: to fill in a gym's address during setup, and at the moment a staff member checks in to a shift, to note how far they are from the gym. We do not track location in the background.

Staff and attendance. shift timings, check-in and check-out times, leave requests, notes and, visible only to the owner, pay and commission settings.

Business records. membership plans, packages, prices, payments recorded (amount, date and method such as cash or UPI), expenses, enquiries and follow-up notes, announcements and issues raised. A freelance trainer may add their UPI ID so their own clients know where to pay them; it is shown only to those clients, and the app never takes or moves money. We never receive card numbers, UPI PINs or bank account details.

Exercise videos. links to YouTube or Instagram videos that Peko or a trainer chooses to demonstrate an exercise. A trainer's own links are shown only to their clients.

Device and technical data. a notification token so we can send you alerts, app version, device model and operating system, and crash reports. Crash reports do not include your name, phone number, email, photos or screenshots.

Messages to us. what you send when you contact support by WhatsApp or email.

We do not access your contacts, microphone, call logs or SMS, and we do not collect advertising identifiers.

4. Why we use it

• To create and secure your account and sign you in.
• To run the service: plans, workouts, diets, schedules, attendance, memberships, dues and reports.
• To let your trainer and gym coach you and track your progress.
• To send notifications and reminders you can turn off, such as a session starting or a plan ending.
• To keep the app working and safe: fixing crashes, preventing misuse and protecting accounts.
• To answer your support requests.
• To meet legal obligations, such as keeping business and tax records.

We do not use your data for advertising, we do not build advertising profiles, and we do not sell or rent personal data to anyone. We process data on the basis of your consent and for the legitimate uses permitted by the Digital Personal Data Protection Act, 2023.

5. Who can see your data

A freelance trainer and their clients:

• Freelance trainer — only their own clients, and their own business.
• Client — only their own data, including the measurements, fitness tests and posture results their trainer records.

Inside a gym, people see only what their role needs:

• Owner — everything in their gym, across all branches.
• Manager — their own branch.
• Trainer — only the clients assigned to them.
• Front desk — members and enquiries at their branch, to manage calls and payments.
• Member — only their own data.

No other gym, trainer, member or client can see your data. Data leaves the app only when you choose to share it — for example a PDF report or a monthly progress picture you send on WhatsApp — and those show only what they are designed to.

6. Service providers

We use a small number of trusted providers to run the app. They process data only on our instructions and are bound to protect it:

Supabase. database, sign-in and photo storage, hosted in Mumbai, India.

Google Firebase Cloud Messaging. to deliver push notifications.

Sentry. crash reporting, without names, contact details or photos.

Google and Apple. if you choose to sign in with them.

SMS and WhatsApp messaging providers. to deliver one-time sign-in codes.

Google ML Kit. runs on your phone for posture checks; photos are not uploaded to Google.

YouTube (Google) and Instagram (Meta). when you play an exercise video, it plays in YouTube's or Instagram's own player inside the app. They receive technical data such as your IP address and device type, and may set cookies, under their own policies — Google's at policies.google.com/privacy and Meta's at privacycenter.instagram.com. We do not send them your name, health details or anything you log.

Razorpay. if a trainer or gym pays Peko for a subscription, to process that payment.

When the app sends a reminder to a member on WhatsApp, it opens WhatsApp on your phone with a message you review and send yourself. We do not read your WhatsApp chats.

Some providers, such as notification and crash reporting services, may process limited technical data outside India. We use them only with safeguards and as the law allows.

We may disclose data if the law, a court or a government authority requires it, or to protect the safety of people or the service. If Peko is merged or acquired, your data would move only under a policy at least as protective as this one, and we would tell you first.

7. How long we keep it

• Account and coaching data: for as long as the account is active.
• Shift check-in photos: deleted the same night.
• Meal photos: deleted after your trainer has reviewed the meal.
• Progress photos: kept while the account is active so progress can be compared; older photos may be thinned over time, and your first set is kept.
• Crash reports: up to 90 days.
• Payment and business records: for as long as the gym's account exists, or longer where tax or other laws require them to be kept.
• Enquiries marked "do not contact": kept only so the person is not contacted again.

After an account is deleted, its personal data is erased or anonymised within 30 days, and removed from backups within a further 30 days, except where the law requires us to keep it.

8. Your rights and choices

You have the right to:

• Know what personal data we hold about you and how it is used.
• Correct or update inaccurate or incomplete data — most of it directly in your profile.
• Delete your account and personal data.
• Withdraw consent at any time; the app may then no longer work for you, but earlier processing stays lawful.
• Turn off notifications, reminders, location and camera access in the app or your phone's settings.
• Nominate someone to exercise your rights if you die or become unable to.
• Raise a grievance with us, and if you are not satisfied, complain to the Data Protection Board of India.

Deleting your account. go to Profile, then Settings, then Danger zone, and choose Delete my account (Delete account for trainers). Your account is scheduled for deletion and you can cancel within 30 days by signing in again. You can also ask us by email or WhatsApp, without the app. Members and clients can also ask their gym or trainer. Deleting a gym owner's own login does not delete the gym's records; closing the gym does.

We respond to requests within 30 days, and may need to confirm your identity first.

9. How we protect it

• All data is encrypted in transit (HTTPS/TLS) and encrypted at rest by our hosting provider.
• Database rules enforce the role-based access in section 5 on the server, not just in the app.
• Progress, meal and check-in photos are stored privately and shown only through short-lived secure links. Profile photos and gym photos are stored so they can load quickly and can be opened by anyone who has their web address.
• Passwords are hashed and never visible to anyone, including us.
• Access by our team is limited to what is needed to run and support the service.

No system is perfectly secure. If a breach affects your personal data, we will inform you and the Data Protection Board of India as the law requires.

10. Children

The app is not directed at children. Members under 18 may use it only through a gym or trainer, and only with the verifiable consent of a parent or lawful guardian, which the gym must obtain before recording their data. We do not knowingly track, profile or send advertising to children. If you believe a child's data was recorded without that consent, contact us and we will delete it.

11. Notifications and permissions

• Notifications: session reminders, daily motivation, plan and payment alerts. Choose which ones you get in Settings, set quiet hours, or turn them off in your phone's settings.
• Camera: only when you take a progress, meal, profile or check-in photo.
• Photo library: only when you choose a photo to attach; the app sees only the photos you pick.
• Location: only during gym setup and staff check-in, never in the background.
• The app does not ask for your contacts, microphone, calendar, health apps, call logs or SMS.

12. Changes to this policy

If we change this policy we will update the date at the top, and tell you in the app before any significant change takes effect. Continuing to use the app after that means you accept the updated policy.

13. Contact and grievance officer

For any question, request or complaint about your personal data, contact our Grievance Officer. We acknowledge complaints within 48 hours and resolve them within 30 days.

Grievance Officer. Grievance Officer, Peko

Email. thepekoapp@gmail.com

WhatsApp. +91 99440 76044