Privacy Policy
Last updated: 9 August 2026
The short version. We collect what FitMe needs to build your plans and remind you to train — nothing more. We do not sell your data, we do not share it with advertisers, and we do not track you across other websites. You can delete your account and everything in it from your profile at any time.
This policy explains how ElimX Private Limited ("ElimX", "we", "us") handles personal data when you use FitMe at fitme247.co and app.fitme247.co. ElimX is the data controller. Our parent company site is elimx.co.
1. What we collect
Only what you give us or what the app produces as you use it. We do not buy data about you from anyone else.
| Category | Examples | Where it comes from |
|---|---|---|
| Account | Name, email, password (stored only as a secure hash), profile photo, phone number if you add one | You, at signup |
| Fitness profile | Age or date of birth, sex, height, weight, goal, experience, equipment, activity level, diet preference, allergies | You, during setup |
| Training data | Plans, completed sessions, sets, reps, weights, duration, muscles trained, schedule | Generated as you use the app |
| Bookings and messages | Sessions you request and the messages you exchange with trainers | You and your trainer |
| Notification settings | Channel preferences, muted categories, push subscription for your device | You |
| Payments | Plan purchased, amount, date, payment reference. We never see or store your card number | Our payment provider |
| Technical | Basic request logs, delivery records for emails and messages we send you | Automatic |
We do not run advertising trackers, third-party analytics profiling, or cross-site tracking pixels.
2. Why we collect it
- To build your plans. Your body metrics and goal are the direct inputs to your workout split and calorie and macro targets. Without them the app cannot function.
- To run the features you switch on. Reminders need your schedule and contact preferences; bookings need your trainer and time; chat needs your messages.
- To show your progress. The calendar, streaks, volume and muscle recovery map are all derived from sessions you logged.
- To keep accounts secure. Sign-in verification, and detecting misuse.
- To take payment where you buy a paid plan.
Our legal bases are performance of our contract with you (running the Service), your consent (optional channels such as WhatsApp and push, and any health details you choose to enter), and our legitimate interests (security and service improvement).
3. Health-related information
Some of what you enter — weight, allergies, injuries you mention to a trainer — can be considered health data, which deserves extra care. We treat it accordingly:
- It is used only to generate your plans and to inform a trainer you have chosen to book.
- It is never used for advertising, and never sold or shared for marketing.
- You can edit or remove it from your profile at any time.
- Deleting your account removes it entirely.
Please do not enter detailed medical history into chat or free-text fields. FitMe is not a medical record system.
4. Who we share it with
We do not sell your personal data. Ever. We share it only in these situations:
- Trainers you book. A trainer you book can see your name, fitness profile summary and current plan so they can coach you effectively. They cannot see your payment details or your conversations with other trainers.
- Service providers that make FitMe work, each handling only what is needed: our hosting provider; our email provider for the messages we send you; WhatsApp Business (Meta) if you enable WhatsApp alerts; push notification services operated by your browser or device maker; our payment provider for paid plans; and an AI provider for exercise explanations, which receives only the exercise name you searched for and no personal details.
- Legal requirements, where we are required by law to disclose information.
- A business transfer, if ElimX is acquired or reorganised. We would tell you before your data moved to a new controller.
5. Cookies and local storage
FitMe does not use advertising or tracking cookies. The app stores a small amount of data in your browser so it can work:
- Your sign-in token, so you stay logged in.
- Your basic profile details, so the app can render before the server responds.
- The last tab you were on, so refreshing returns you to it.
- A cached copy of the app files, so it loads quickly and works offline.
Clearing your browser data or signing out removes these.
6. How long we keep it
- Account and training data — while your account is open. Deleting your account removes it immediately and permanently.
- Unverified signups — pending verification codes expire after 10 minutes and incomplete signups are cleared automatically.
- Message delivery logs — a short rolling window, to diagnose failed emails.
- Payment records — retained as long as tax and accounting law requires, even after account deletion. These are transaction records, not your training data.
- Backups — deleted data may persist in encrypted backups for a short period before those backups rotate out.
7. How we protect it
- All traffic is encrypted in transit over HTTPS.
- Passwords are stored only as bcrypt hashes. We cannot read your password, and nor can anyone who obtained the database.
- Sign-in uses signed, expiring tokens; changing the signing key invalidates every session at once.
- Access to production data is restricted to those who need it to operate the Service.
- Card details are handled entirely by our payment provider and never reach our servers.
No system is perfectly secure. If a breach affects your data, we will tell you and the relevant authority as required by law.
8. Your rights and choices
You can, at any time:
- See and correct your data — everything we hold about you is visible and editable in your profile.
- Delete your account — Profile → Delete account. This removes your profile, plans, training history, bookings, messages and notification settings permanently.
- Control how we contact you — turn email, WhatsApp and push on or off individually, and mute categories you do not want.
- Withdraw consent for optional processing, without affecting what came before.
- Request a copy of your data, or object to how we process it, by emailing us.
We respond to requests within 30 days. If you are unhappy with our response, you may complain to the relevant data protection authority in your country.
9. Children
FitMe is not intended for children under 16, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will remove it.
10. International transfers
FitMe is operated from India and your data is primarily stored there. Some providers we rely on — email, messaging, push and AI services — may process data on servers in other countries. Where that happens, we use providers that offer appropriate safeguards.
11. Changes to this policy
If we change how we handle your data, we will update the date at the top and, for significant changes, tell you in the app or by email before the change takes effect.
12. Contact
For any privacy question or request:
ElimX Private Limited
Kerala, India
Email: privacy@fitme247.co
Web: elimx.co
A note on this policy. It describes how FitMe actually handles data today. It is not a substitute for advice from a qualified lawyer, and we recommend having it reviewed against India's Digital Personal Data Protection Act — and GDPR if you take users in the EU or UK — before relying on it commercially.