Privacy Policy

• Account: mobile number, and if you add them, name, email and home city.
• Location: your phone's location when you check in (to confirm you are at the gym) and, if you allow it, to show nearby gyms and your area on the home screen. We don't track you in the background.
• Activity: passes, check-ins (gym, time, method), class bookings and attendance, reviews, coupon use.
• Payments: amounts, plan, Razorpay order and payment IDs, invoice details. Card, UPI and bank details are handled by Razorpay and never reach us.
• Device: a push notification token so we can send you notifications.
• Gym partners: business details, bank account and PAN (stored encrypted) for payouts.

To run your account and pass, verify check-ins, process payments and issue GST invoices, send service notifications (pass expiry, renewals, class reminders), prevent fraud and pass-sharing, pay partner gyms, answer support requests, and improve Cirkuit. Offers and announcements are sent only through the app; you can turn notifications off in your phone settings.

We process your data with your consent (given when you sign up and when you grant permissions such as location), and where needed to provide the service you asked for or to meet legal obligations.

• Partner gyms: your name and phone when you check in or book a class there, so they can admit you and manage capacity. Reviews show only your first name and initial.
• Service providers: Razorpay (payments), Fast2SMS (OTP messages), Expo (push notifications), Hostinger (hosting). They process data only on our instructions.
• Authorities: where required by law.

We don't sell your personal data.

We keep account data while your account is open. When you delete your account we erase your name, phone, email, push token, reviews, notifications and check-in locations straight away. We keep transactions and invoices (with your name and contact details removed) for 8 years as required by tax law, and a one-way coded form of your phone number so the free trial can't be claimed twice.

Under the DPDP Act you can ask for a summary of your data, correct or update it, have it erased (delete your account in the app: Profile → Delete account), withdraw consent, nominate someone to act for you, and raise a grievance. Write to cirkuitfit@gmail.com. If you are not satisfied with our response you may complain to the Data Protection Board of India.

Data is sent over HTTPS. Bank account numbers and PAN are encrypted at rest. Access to personal data is limited to staff who need it. No system is perfectly secure; we'll notify you and the Data Protection Board of any personal data breach as the law requires.

Cirkuit is for adults. If you are under 18 you may use it only with verifiable consent from a parent or guardian.

Grievance Officer: [name], [email], [address]. We'll post changes to this policy here and notify you in the app before material changes.