Privacy Policy

Last updated: 12 September 2026

TrackFit is an India-first running and walking app. This policy explains what we collect, why we collect it, who can see it, and how you can control it. It covers the TrackFit mobile app (in.trackfit.app), this website (trackfit.in), and related services such as share cards and referral links.

This is a product-aligned draft for App Store and Google Play listings. It is not a formal legal opinion under India’s Digital Personal Data Protection Act, 2023. The operator’s registered legal name is [TRACKFIT LEGAL ENTITY NAME] — to be confirmed by counsel. Until then, “TrackFit”, “we”, and “us” mean the team that operates the app and this website. Default timezone framing is India (Asia/Kolkata).

1. Who we are

TrackFit (also referred to as TrackFit India) is a social fitness app for running and walking in India. You sign in with an Indian (+91) mobile number, record GPS activities, optionally connect Apple Health or Android Health Connect, and can share runs with a community feed, follows, kudos, comments, and challenges.

This policy applies to:

• the TrackFit iOS and Android apps;
• the marketing website at https://www.trackfit.in;
• share cards, referral invite links (for example trackfit.in/i/{code}), and related APIs.

Operator: [TRACKFIT LEGAL ENTITY NAME]. Website: https://www.trackfit.in. Privacy contact: support@trackfit.in.

2. Data we collect

We collect the categories below to run TrackFit. Some data is required for the app to work (for example your phone number to create an account, or GPS while you record a run). Other data is optional and collected only if you grant permission or choose to share it.

Account

• Phone number used for OTP sign-in (Firebase Authentication, India +91).
• Display name, profile photo, and profile settings you choose.
• Account identifiers needed to keep you signed in and to recover your profile.

Location

• Precise GPS while you start, record, and save a run or walk — including background location while an activity is active, so tracking can continue with the phone in your pocket.
• Approximate location, when you allow it, to fetch local weather (via Open-Meteo) and to show India-aware context such as heat or monsoon cues.
• Route polylines and map positions derived from that GPS data, used to draw your activity on a map (Mapbox).

We do not need background location when you are not recording an activity. If you deny location permission, you will not be able to record a GPS-tracked run in the usual way.

Fitness and health (only if you grant permission)

• Steps, distance, and workout data from Apple HealthKit and Android Health Connect, when you connect those platforms.
• Activity stats TrackFit computes itself: distance, duration, pace, splits, and similar figures from a recorded GPS session.

Health platform data is read only with your permission and is used to show your progress, rings, and related features — not to sell health information.

Activity content

• Routes and polylines, stats, titles, captions, and the privacy setting you pick for each activity (public, followers, or private).
• Activity photos and your profile photo, stored on cloud object storage (Cloudflare R2).

Social

• Follows and follow requests, kudos, comments, blocks, and reports.
• Challenge participation — public challenges, private groups, and organisation or workplace challenges.
• Referral / invite codes you create or use.

Device and notifications

• Push notification tokens (FCM) so we can send activity, streak, challenge, or social alerts you opt into.
• Basic device and app information needed to run the service (for example app version, OS, and language).

Usage and diagnostics

• Optional product analytics and crash reporting (for example PostHog and Sentry) when those tools are configured in production, so we can fix bugs and understand which features work.
• Website waitlist emails if you sign up on this site, used only to notify you at launch.

3. How we use data

We use personal data to:

• Provide the product — create your account, record and save activities, show maps and weather, sync optional health data, and display your feed, profile, and challenges.
• Safety and integrity — prevent abuse, fake-GPS misuse, spam, and harassment; review reports; keep leaderboards reasonably fair.
• Support — answer requests you send to support@trackfit.in.
• Improve features — understand crashes, performance, and how people use TrackFit, when analytics or crash tools are enabled.
• Communicate — send transactional or product messages (OTP, waitlist, and push notifications you allow). We do not sell your personal data.

4. How sharing and visibility work

TrackFit is a social fitness app. Some data is visible to other people when you choose public or followers visibility. That can include your display name, profile photo, activity title and stats, photos you attach, and — when the activity is not private — the GPS route shown on the activity, on the feed, or on a share card.

We do not claim that location is never shared. If you post a public run or generate a share card from an activity that includes a route, other people can see that route. Private activities are meant to stay off the public feed; followers-only activities are visible to accounts that follow you.

Organisation and workplace challenges are designed to be privacy-safe at the leaderboard level: org leaderboards show aggregate progress (for example team distance or step totals), and should not expose an employee’s raw GPS route or activity photos to the wider organisation. Individual activity privacy settings still apply to your own feed posts.

We may also disclose data if required by law, to protect people from harm, or to a successor if TrackFit is transferred as a business — in each case only as needed and as allowed under Indian law.

5. Service providers

We use service providers to operate TrackFit. They process data on our instructions, not to build their own TrackFit-branded social graph. Typical processors include:

• Firebase Authentication — phone OTP login.
• Cloud hosting for the API (for example Railway or a similar host).
• Cloudflare R2 — activity and profile photos.
• Mapbox — maps and route display.
• Open-Meteo — weather using approximate location when allowed.
• FCM — push notification delivery.
• Analytics and crash tools (PostHog, Sentry) when configured in production.
• Apple and Google — App Store / Play distribution, and HealthKit / Health Connect when you connect them.

Those providers have their own privacy terms. We do not sell personal data to advertisers.

6. International transfers

TrackFit is built for India, but some service providers run servers outside India. That means your data may be processed in other countries. We use these providers because they are how the current stack authenticates users, stores files, draws maps, and delivers notifications. If you do not want that, you should not create a TrackFit account.

7. How long we keep data

We keep account, activity, and social data while your account is active and as needed to operate the service (for example so your streak, feed, and challenges still make sense). If you close your account, we delete or de-identify personal data within a reasonable period, unless we must keep a subset for legal claims, security, or bookkeeping. Backups may persist for a short additional time before they rotate out. Push tokens are removed when they stop working or when you disable notifications.

8. Your rights and choices

Subject to Indian law, you can ask us to access, correct, or delete personal data we hold about you. Email support@trackfit.in from the number or account you use in the app so we can verify the request.

In the app you can also:

• change an activity’s privacy (public / followers / private);
• edit your display name and profile photo;
• unfollow, block, or report other people;
• revoke HealthKit, Health Connect, location, or notification permissions in your phone settings (the related features will stop working);
• request account deletion via support if an in-app control is not yet available.

You may have additional rights under the Digital Personal Data Protection Act, 2023 and other applicable law. This page is not a substitute for legal advice on those rights.

9. Children’s privacy

TrackFit is not directed at children. You must be at least 18 years old to create an account. We do not knowingly collect personal data from anyone under 18. If we learn that we have, we will delete that account and related data. If you believe a minor has signed up, write to support@trackfit.in.

10. Security

We use reasonable technical and organisational measures to protect personal data, including HTTPS in transit and access controls on our systems. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Changes to this policy

We may update this policy as TrackFit changes. The “Last updated” date at the top will change when we do. If a change is material, we will try to notify you in the app or on this website. Continued use after an update means you accept the revised policy, to the extent allowed by law.

12. Contact

Questions, access, correction, or deletion requests:

• Email: support@trackfit.in
• Website: https://www.trackfit.in
• Operator: [TRACKFIT LEGAL ENTITY NAME]

Related: Terms of Use. This policy is written in English for App Store and Play listing. Governing law framing is India.