CoreFitPrivacy policy
Effective 4 November 2026
CoreFit is a gym app made by VinVen Technologies ("we"), Needamangalam, Thiruvarur, Tamil Nadu, India. This policy covers the CoreFit Android and iOS apps and the owner dashboard at dashboard.vinven.net. It follows India's Digital Personal Data Protection Act, 2023 and the IT Act, 2000.
Who decides about your data
You join CoreFit through your gym. Your gym (its owners and supervisors) manages your membership, attendance and plans, and decides what it records about you. We run the app and store the data for the gym, and use it only to provide CoreFit.
What we collect
- Account: name, email, mobile number, password (stored encrypted) and an optional profile photo.
- Member details: date of birth, weight, height, body measurements and progress photos you or your gym add.
- Gym activity: check-ins and check-outs, workouts, workout and diet plans, class and trainer bookings, memberships, payments and notes your gym records.
- Staff records: for trainers, hours worked and permission requests.
- Payments: amount, plan, status and Razorpay reference. Card, UPI and bank details go only to Razorpay; we never see or store them.
- Device: a push notification token and the app version.
The camera is used only when you scan a check-in QR code or take a photo. We do not collect your location, contacts or browsing history.
How we use it
- To run your gym's services: sign-in, check-in, plans, bookings, memberships and payments.
- To send notifications you'd expect, such as renewal, class and birthday reminders.
- To keep CoreFit secure and fix problems.
We do not sell your data, show ads or track you across other apps.
Who can see it
- You see and edit your own profile.
- Your gym's owners and supervisors see their members' details and activity.
- Your trainers see the details, workouts and progress of members mapped to them.
- Progress photos are private: only you, your trainers and your gym's managers can open them.
Service providers
We use these companies to run CoreFit. They process data only on our instructions.
- Supabase: database, sign-in and file storage.
- Cloudflare: network, web hosting and app updates.
- Razorpay: online payments.
- Expo and Google Firebase Cloud Messaging: push notifications.
- Google (Gmail): sign-in and invite emails.
Some of these store data on servers outside India. When you choose to share an invite or message on WhatsApp, WhatsApp's own policy applies.
How long we keep it
We keep your data while you have an account. When you delete your account, we delete your profile, photos and history. Copies in backups are removed within 30 days. We may keep records the law requires.
Your rights
- See and correct your details in the app (Edit profile).
- Delete your account in the app (Account and privacy → Delete account), or ask us to.
- Withdraw consent by deleting your account.
- Ask about your data or raise a complaint with our grievance officer below.
Children
CoreFit is for people 18 and over. A gym may add a younger member only with a parent's or guardian's consent.
Security
Data is encrypted in transit, and every record is protected by access rules so people see only what their role allows.
Changes
We'll update this page when the policy changes and show the new date at the top.
Grievance officer and contact
Vinitha Nagarajan, Proprietor, VinVen Technologies
Needamangalam, Thiruvarur, Tamil Nadu, India
support@vinven.net
We reply within 7 days.