Trainlabs Software ("TrainLabs", "we", "us") operates the TrainLabs mobile application and website. This policy explains what personal data we collect, why, who else sees it, how long we keep it, and what you can do about it.
We are the Data Fiduciary for that data under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), and the "body corporate" under s.43A of the Information Technology Act, 2000 and the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"). Where the General Data Protection Regulation applies, we are the "controller".
The short version. TrainLabs is software your coach uses to run their coaching. Your coach sees what you log — that is the point of the app. We do not sell your data, we do not show you ads, and we do not build advertising profiles. Your body photographs are off by default, stay off until you turn them on, are visible only to the coach you chose, and are permanently deleted the moment you withdraw consent. You can ask us for a copy of everything we hold, or ask us to delete it, at privacy@trainlabs.app.
1. Who this policy covers
TrainLabs has two kinds of user, and the data involved is very different:
- Trainers — fitness professionals who pay for a TrainLabs subscription and use it to manage their own clients and their own coaching business.
- Clients — people coached by a trainer. Clients use TrainLabs free of charge.
Where a section applies to only one of them, it says so.
1.1 Your coach is a separate controller
A trainer decides, independently of us, what to ask you for, what programs to write, and how to coach you. For that, your trainer is a Data Fiduciary in their own right, and we process client data partly on their instructions. This policy covers what we do. It does not govern what your trainer does with information you give them outside the app, or what they do with their own records. Questions about that go to your trainer.
2. What we collect
2.1 Everyone
| Data | Where it comes from | Why |
|---|---|---|
| Name | You, at sign-up | Identifying you to the person you work with |
| Phone number and/or email address | You, at sign-up | Signing you in, and matching you to an invitation someone sent to that number or address |
| Sign-in identity | You, or Google if you use Google Sign-In (a stable account identifier and the email address Google asserts) | Proving it is you. We never receive your password |
| One-time codes | Generated by us | Verifying control of a phone number or mailbox. The code is deleted once used, or after 10 minutes |
| Record of codes sent | Generated by us: the number or address, when each code was sent, and how many wrong attempts were made — never the code itself | Limiting how many codes can be sent and guessed, and looking into abuse of sign-in. Deleted after 30 days |
| Role (trainer or client) | Chosen at sign-up | Deciding which app you see |
| Profile photo, if you set one | You | Shown to the people you are connected to |
| Session tokens | Generated by us | Keeping you signed in without asking for a code every time. Stored encrypted on your device |
| Device push token | Your device operating system | Sending the notifications you enabled |
| Messages | You | Delivering them to your trainer or client |
| App usage and diagnostics | Your device | Understanding which features are used, and finding crashes. See §6 |
2.2 Clients — health and fitness data
This is "sensitive personal data or information" under Rule 3 of the SPDI Rules and a special category of personal data under Article 9 GDPR. We treat it accordingly, and we ask for it only because coaching does not work without it.
| Data | Notes |
|---|---|
| Height, weight, goal weight | Self-reported; editable at any time |
| Year of birth, sex, activity level | Used to calculate calorie and macronutrient targets |
| Training goals, in your own words | Free text |
| Medical notes — injuries, conditions, limitations you choose to share | Free text, optional. Do not enter anything here you do not want your coach to read |
| Body measurements and body-fat figures | Optional, entered by you |
| Weight history | A dated series, separate from the single figure on your profile |
| Workout logs | Which sessions you completed, sets, repetitions, weight lifted, your notes |
| Nutrition logs | Whether you ate, partly ate or skipped a prescribed meal, and why |
| Supplement plans your coach recommends and what you record | Recommendations only; we do not prescribe |
| Progress photographs | Off by default. See §3 |
| Meal photographs | Off by default. See §3 |
2.3 Trainers — professional and financial data
| Data | Notes |
|---|---|
| Biography, specialities, years of experience, sex | Shown to your clients |
| Public handle, if you publish a coach record | Only if you choose to publish. Unpublished records return "not found" |
| Subscription status, trial end date, billing history | See §2.4 |
| Tax registration details, if you enter them | Only to print them on invoices you issue |
| Payment collection details — e.g. a UPI ID or bank reference you ask clients to pay to | Shown to your clients so they can pay you directly. We never collect on your behalf |
| Invoices, payment records, coaching prices, reminder history | Your books. See §2.5 |
| Programs, workouts, exercises, foods, supplements and demonstration videos you create | Your professional content |
2.4 Payment data — trainer subscriptions
Your subscription is processed by Razorpay Software Private Limited, a payment gateway authorised by the Reserve Bank of India. We never see or store your card number, UPI PIN, CVV, or bank credentials. Those go directly to Razorpay on a page Razorpay hosts.
What we store is the record of the transaction: a Razorpay subscription identifier, payment identifiers, amounts, currency, dates, and success or failure status. We need this to know whether your subscription is active and to show you your billing history.
Razorpay handles your payment information under its own privacy policy and under RBI rules, as an independent controller for that purpose.
2.5 Payment data — clients paying trainers
Money that a client pays a trainer never passes through TrainLabs. We neither hold, route, nor take a commission on it. There is no wallet, no escrow and no balance.
What the app does is record-keeping. A trainer can issue an invoice; a client can see it, copy the trainer's payment details, or open a UPI payment link that hands off to their own banking app; and a client can tell the trainer "I have paid". That statement does nothing to the trainer's records on its own — only the trainer, checking their own bank, can confirm a payment was received.
So what we hold is: invoice amounts, dates, line descriptions, tax figures where the trainer has enabled them, a text label describing how a payment was made, and the dates of any payment reminders. We do not receive a transaction feed from any bank.
3. Photographs — consent, and only consent
Photographs of your body are the most sensitive thing in this app, and they are governed by a separate, explicit, revocable opt-in. Nothing here happens by default.
3.1 Progress photographs
- Off until you turn them on. There is no progress-photo feature visible to a client who has not consented.
- Only your connected coach can see them. No other trainer, no other client, and no third party.
- The app enables the operating system screenshot and screen-recording protection on every screen that displays them.
- They are stored as private objects. They are never served from a public URL — each view is a short-lived link generated for that request.
- Withdrawing consent permanently deletes every progress photograph, along with any AI report derived from them. This is not a soft delete.
3.2 Meal photographs
Same consent model, shown once before your first meal photo. Meal photographs are automatically deleted approximately 90 days after upload, because a photograph of last quarter's lunch has no coaching value and keeping it is pure risk.
3.3 AI analysis of progress photographs — a second, separate consent
Letting your coach see your photographs and letting an AI company's servers process them are two different decisions, so we ask twice.
If — and only if — you turn on AI progress notes:
- Two of your photographs are sent to Google's Gemini API so that it can describe what visibly changed between them.
- The model returns words only. It is instructed and constrained never to produce measurements, weights, percentages, or any numeric estimate about your body, and our server enforces that before anything is stored.
- Your coach reads every note before you do and can hide or edit any of it. You see only what your coach chose to keep.
- Photographs are sent with the request and are not uploaded to any Google file store by us.
- Turning this off deletes every AI report. Your photographs stay.
While TrainLabs is in testing: the app tells you, on the consent screen itself, if we are running on a Google API tier where Google may use what is sent to improve its models. If you see that wording, it is accurate — do not turn the feature on unless you are comfortable with it. When we move to a tier where inputs are contractually excluded from training, the consent screen changes to say so. The words on that screen are always the true ones.
4. Why we are allowed to process this
Under the DPDP Act we rely on your consent, given at the point each feature is first used, and on the "legitimate uses" the Act permits — chiefly providing a service you asked for, and complying with law.
For users in the EEA and the UK, the corresponding GDPR bases are:
| Purpose | Article 6 basis | Article 9 basis (health data) |
|---|---|---|
| Running your account and connecting you to your coach | Art. 6(1)(b) contract | Art. 9(2)(a) explicit consent |
| Health, fitness, nutrition and body data | Art. 6(1)(b) contract | Art. 9(2)(a) explicit consent |
| Progress and meal photographs, AI analysis | Art. 6(1)(a) consent | Art. 9(2)(a) explicit consent |
| Billing trainers, keeping tax records | Art. 6(1)(b) and 6(1)(c) legal obligation | n/a |
| Security, fraud and abuse prevention | Art. 6(1)(f) legitimate interests | n/a |
| Product analytics and crash reporting | Art. 6(1)(f) legitimate interests | n/a |
Withdrawing consent is as easy as giving it and takes effect from the moment you withdraw it. It does not undo processing that already happened lawfully.
5. Who else sees your data
5.1 The person you are working with
This is the core function of the app, not a disclosure to a third party. Your trainer sees your profile, your goals, your medical notes, your logs, your weight history, your invoices, and — only with the consent described in §3 — your photographs. You see your trainer's profile, the programs they write for you, and the invoices they issue you.
5.2 When you change coaches
If you connect to a new coach, you choose what they can see from before. Your history is not handed over automatically. A record of each coaching relationship is kept so that neither side loses their own history.
5.3 Publicly, only if a trainer chooses
A trainer may publish a coach record at a public address. It is off by default and a page that has not been published does not exist as far as the internet is concerned. A published record shows figures derived from what clients logged. It never identifies individual clients, and figures are suppressed below a minimum number of clients so no one can be singled out.
5.4 Service providers who process data for us
Each of these is bound by a contract to process data only on our instructions, to keep it secure, and not to use it for their own purposes.
| Provider | What they do | Where |
|---|---|---|
| Neon | Hosts the database | Singapore (AWS ap-southeast-1) |
| Railway | Hosts the backend application | See provider region |
| Cloudflare R2 | Stores photographs, videos and avatars | Distributed; region set on the bucket |
| Cloudflare Web Analytics | Counts visits to our website (page views, referrers, country, device and browser type), without cookies | Distributed |
| Google (Gemini API) | AI analysis of progress photographs (§3.3) and extraction of programs from PDFs a trainer uploads | Google regions |
| Google (Sign-In) | Verifies identity if you sign in with Google | Google regions |
| Razorpay | Processes trainer subscription payments | India |
| Expo | Delivers push notifications via Apple and Google | USA |
| PostHog | Product analytics and crash reporting | European Union |
| Resend | Sends one-time sign-in codes by email | USA/EU |
| Our SMS provider | Sends one-time sign-in codes by SMS | India |
5.5 Everyone else — the short list
We also disclose personal data:
- when a law, a court, or a lawfully empowered authority requires it;
- to our professional advisers, under confidentiality;
- to a buyer, if the business is sold or merged — with notice to you, and the buyer bound by this policy until it lawfully changes it.
We do not sell personal data. We do not share it with advertisers or data brokers. We do not use it to train our own or anyone else's AI models, except for the single, separately consented case in §3.3, and only on the terms the consent screen states.
6. Analytics and crash reporting
We use PostHog to understand how the app is used and to see crashes. It records events such as screens opened and features used, along with your app version, device model, operating system version and IP address, tied to your TrainLabs account identifier and whether you are a trainer or a client.
- It is not advertising, and there is no advertising identifier, no ad network, and no cross-app tracking.
- Events record what you did, not what you entered. Some carry counts or simple details: for example, how long a workout took and how many sets were completed, whether a meal was marked eaten, partly eaten, swapped or skipped, or how long a message or voice note was. They never contain the exercises, weights, foods, body measurements, notes or messages themselves.
- We do not send your photographs, the content of your messages, or your financial records, such as invoice and payment amounts, to it.
- Signing out resets the analytics identity on your device.
We do not use cookies for tracking in the mobile app. The website uses only what is necessary for it to function. To count visits to the website we use Cloudflare Web Analytics, which does not use cookies and does not track you across other sites. It does not use your TrainLabs account, and we use it only to see which pages are read.
7. Cross-border transfers
Some of the providers in §5.4 store or process data outside India. The DPDP Act permits transfers except to countries the Central Government restricts, and we will stop transferring to any such country if one is notified.
For EEA/UK users, transfers outside those areas are made under the European Commission Standard Contractual Clauses or an adequacy decision, with supplementary measures where needed. Ask us at privacy@trainlabs.app for details of the safeguards for any particular transfer.
8. How long we keep things
| Data | Retention |
|---|---|
| One-time sign-in codes | Deleted once used, or after 10 minutes |
| Record of codes sent (number or address, times, wrong attempts — not the code) | 30 days, then deleted |
| Session refresh tokens | Up to 90 days from last use, then expired |
| Meal photographs | ~90 days, then automatically deleted |
| Progress photographs and AI reports | Until you withdraw consent or delete your account — then deleted immediately |
| Account, profile, logs, messages, coaching history | While your account is open |
| Everything, after account deletion | Deleted or irreversibly anonymised within 30 days, except the categories below |
| Invoices, payment records and tax data | Retained as long as tax and company law requires — currently up to 8 years — because we are not permitted to delete them on request |
| Records needed for a live legal claim or a regulatory investigation | Until it concludes |
Backups are overwritten on a rolling cycle; deleted data disappears from backups within that cycle.
9. Security
We use TLS in transit; encrypted storage at rest; private object storage with short-lived, per-request access links; tokens held in your device secure keychain or keystore rather than ordinary app storage; role-based access checks on every request; rate limiting on sign-in; and screenshot protection on photograph screens.
Access to production data is limited to people who need it to run the service.
No system is perfectly secure. If a breach affects your personal data, we will notify the Data Protection Board of India and affected users as the DPDP Act requires, and — where GDPR applies — the relevant supervisory authority within 72 hours.
10. Your rights
Under the DPDP Act you have the right to:
- Access a summary of the personal data we process about you and who we have shared it with;
- Correct, complete, update or erase your personal data;
- Nominate another person to exercise these rights if you die or become incapacitated;
- Grievance redressal — see §13;
- Withdraw consent at any time.
If GDPR applies to you, you also have the rights to restriction, objection, portability in a machine-readable format, and not to be subject to solely automated decisions with legal or similarly significant effects. We do not make such decisions: the AI feature in §3.3 produces suggested wording that a human coach reviews before you ever see it.
To exercise any of these, email privacy@trainlabs.app. We respond within 30 days. We may ask you to verify control of the phone number or email on the account — we will not hand your health records to someone who merely knows your name.
10.1 Deleting your account
You can delete your TrainLabs account and the personal data in it. Start from Settings → Privacy → Delete account in the app, or email privacy@trainlabs.app from the address or phone number on your account.
Deletion removes your profile, your logs, your photographs, your messages, your body data and your sign-in details, so the account cannot be recovered or signed into again. Signing up later with the same number starts a new account.
Two things survive, and the app tells you which apply to you before you confirm:
- The financial records in §8, which we are not permitted to delete on request. Where a tax invoice must name its recipient, that name stays on the invoice — nothing else about you does.
- If you are a trainer, programs you already assigned to clients. Deleting those would delete your clients' logged sessions along with them, and their training history is theirs, not yours. Your library, your drafts and everything unassigned go. Your clients are not told automatically, so tell them first.
11. Children
TrainLabs is for people aged 18 and over. We do not knowingly allow anyone under 18 to create an account.
The DPDP Act treats everyone under 18 as a child, requires verifiable parental consent before their data is processed, and prohibits tracking, behavioural monitoring and targeted advertising directed at them. Because TrainLabs collects health data and body photographs, we have chosen not to process children's data at all rather than attempt to do so safely.
If you believe someone under 18 has an account, email privacy@trainlabs.app and we will delete it.
A trainer who coaches minors must do so outside TrainLabs. Creating an account on a minor's behalf is a breach of our Terms.
12. Changes to this policy
We will post any change here and update the date at the top. For a change that materially affects your rights or introduces a new purpose, we will notify you in the app or by email before it takes effect, and where the change needs your consent, we will ask for it — not assume it.
13. Contact and grievance redressal
For any privacy question, request or complaint:
Trainlabs Software
Kuttipravan House, Ward 7, Canal Road, Bakkalam, Peelery, Taliparamba, Kannur, Kerala 670562, India
Sole proprietor: Abhinav C · Udyam Registration No. UDYAM-KL-04-0087446
Email: privacy@trainlabs.app
Web: https://trainlabs.app
Grievance Officer — appointed under the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the DPDP Act:
Abhinav C
Email: grievance@trainlabs.app
Kuttipravan House, Ward 7, Canal Road, Bakkalam, Peelery, Taliparamba, Kannur, Kerala 670562, India
We acknowledge every complaint within 24 hours and resolve it within 15 days. A complaint about non-consensual intimate imagery, or about content that exposes a person's body, is actioned within 24 hours.
If you are not satisfied, you may complain to the Data Protection Board of India. Users in the EEA or the UK may complain to their national supervisory authority.