Privacy Policy

This Privacy Policy explains how ZEUFIT ("ZeuFit", "we", "us") collects, uses, shares, keeps and protects your personal data when you use our website, web app and Android app (the "Service"). It is written to meet India's Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (together, "DPDP law"). Under DPDP law, ZeuFit is the Data Fiduciary for your data and you are the Data Principal.

1. Who we are

ZEUFIT is operated by the ZeuFit team, Gandhipuram, Pollachi – 642006, Tamil Nadu, India. For anything about your data, write to our Grievance Officer at zeufitapp@gmail.com or call +91 98431 06004.

2. What we collect, and why

• Account details — name, email address and/or phone number (from Google or phone sign-in). Why: to create your account, sign you in, keep it secure, and contact you about it (for example receipts and plan reminders).
• Body, goals & preferences — age, sex, height, weight, target weight, activity level, diet preference and goals. Why: to calculate your calorie and nutrition targets and forecasts.
• Meals, photos & questions — meals you describe, speak or photograph, and questions you ask the AI Coach. Why: to estimate nutrition and answer you. These are sent to our AI providers (see section 4) only for that purpose.
• Activity & health-app data — steps from your phone's step sensor and, with your permission, steps, calories, workouts, distance and heart rate from Android Health Connect; workouts you log. Why: to show your activity, rings, badges and progress.
• Location (only during a workout you start) — GPS position while a GPS workout is running, including with the screen off, saved as that workout's route. Why: to measure route, distance and pace. We don't track your location at any other time.
• Payments — plan, amount, date and payment/order/subscription references. Why: to process purchases, give you receipts, and meet tax and accounting law. Card, UPI and bank details are handled by Razorpay — we never see or store them.
• Expert consultations (only if you choose a dietitian) — your health assessment (shared with the dietitian only if you tick the sharing box), messages, appointments, diet plans and plan progress. Why: so the dietitian you chose can deliver the service you paid for.
• Community (only if you use it) — your buddy profile, activity you choose to share with buddies, cheers, and events you submit. Why: to run those features.
• Consent & technical records — which privacy notice you agreed to and when, sign-in tokens, app settings stored on your device, and basic server logs. Why: to prove consent, keep the Service secure and working, and investigate problems.

We process this data on the basis of your consent, which you give in the app with a clear action (nothing is pre-ticked), and — where DPDP law allows without consent — for "legitimate uses" such as complying with law, a court order, or responding to a medical emergency. We do not make decisions about you that have legal or similarly significant effects based solely on automated processing.

3. Your consent, and withdrawing it

When you set up ZeuFit (and whenever this notice changes materially) we show you a short, itemised notice in your app language — English, தமிழ், മലയാളം, తెలుగు, ಕನ್ನಡ, मराठी or हिन्दी — and ask for your consent. We keep a timestamped record of what you agreed to (current notice version: 2026-09-30).

You can withdraw consent as easily as you gave it, in Profile → Privacy & data or by emailing us. Because ZeuFit can't track anything without processing your health data, withdrawing closes your account: we stop processing and delete your data as described in section 6. Withdrawal doesn't affect processing done before it. You can also turn off individual features at any time — for example revoke location, Health Connect or notification permissions in your phone's settings.

4. Who we share data with

We do not sell your data and do not use it for advertising. We share it only with service providers ("Data Processors") that help us run the Service, under contracts that limit them to our instructions:

• Google Firebase (Google) — sign-in, database and file storage.
• AI providers — OpenAI, Groq and Google (Gemini) — nutrition estimates from meal text and photos, and AI Coach answers.
• Razorpay — payment processing, autopay mandates and refunds.
• Resend — transactional emails (welcome, receipts, reminders).
• Vercel — website and server hosting.
• Google Play / Android Health Connect — app distribution and, with your permission, health data on your phone.

Dietitians you choose see only what's needed to serve you (section 2). Buddies see only what you share with them — never your meals or exact weight. We may disclose data if required by law, to a court or government authority acting lawfully, or to protect someone's life or safety.

Processing outside India. Some of these providers process data outside India, for example in the United States. We transfer data only to countries that are not restricted by the Government of India under DPDP law, and only to providers bound to protect it.

5. Android Health Connect & location

On Android, with your explicit permission, the app reads steps, calories, workouts, distance and heart rate from Health Connect and can write your logged weight and workout calories back so other apps you choose can use them. Health Connect data is used only for ZeuFit's activity features, is never sold or used for advertising, and is not shared with third parties for their own purposes. Background location is used only while a GPS workout you started is running and stops when it ends. You can revoke either permission at any time in your phone's settings.

6. How long we keep data

• Your account and tracking data — while your account is active. When you delete your account (or withdraw consent) we delete it promptly; copies in routine backups expire within 30 days.
• Inactive accounts — if you don't use ZeuFit for 3 years, we may delete your account after emailing you at least 48 hours before.
• Payment and tax records — for as long as tax and accounting law requires (currently up to 8 years).
• Consent records — as long as needed to show what you agreed to, and for the period in which a claim could be made.
• Membership record — trial and plan dates are kept after deletion so a free trial isn't granted twice.
• Paid dietitian consultation messages — kept after deletion, because the dietitian holds the same conversation and it may be needed to resolve a dispute about a paid service.
• Security logs — at least 1 year, as DPDP Rules require, to detect and investigate misuse.

7. Your rights

Under DPDP law you have the right to:

• Access — a summary of your data and how we process it, and who we've shared it with. Use Download my data in Profile → Privacy & data, or email us.
• Correction, completion, updating and erasure — edit your details in Profile, or delete your account in Profile → Account.
• Withdraw consent — see section 3.
• Nominate someone to exercise these rights if you die or become unable to — in Profile → Privacy & data.
• Grievance redressal — complain to our Grievance Officer (section 11). We respond within 90 days.

We may ask you to confirm your identity before acting on a request. DPDP law also asks you not to impersonate anyone, not to suppress material information, and not to file false or frivolous complaints.

8. Children

ZeuFit is only for people 18 and over; you confirm your age when you sign up. We don't knowingly collect data from anyone under 18, and we delete it if we learn we have.

9. Security

We use reasonable security safeguards: encrypted connections (HTTPS/TLS), encryption at rest by our infrastructure providers, strict database access rules so each member can reach only their own data, server-side checks for payments and memberships, least-privilege access for staff, and logging to detect misuse. No system is perfectly secure. If a personal data breach affects you, we will tell you without delay — what happened, the likely impact, what we're doing and what you can do — and report it to the Data Protection Board of India as DPDP Rules require. See our Security page.

10. Cookies & on-device storage

We use your browser's / app's local storage to keep you signed in and remember settings. We don't use advertising cookies or trackers. See our Cookie Policy.

11. Grievance Officer & complaints

Grievance Officer, ZEUFIT — zeufitapp@gmail.com, +91 98431 06004, Gandhipuram, Pollachi – 642006, Tamil Nadu, India. We acknowledge grievances promptly and resolve them within 90 days. If you're not satisfied with our response, you may complain to the Data Protection Board of India.

12. Changes to this policy

We may update this policy. For material changes we'll tell you in the app and ask for your consent again before the change applies to you. The "Last updated" date shows the latest version. This policy is governed by the laws of India.

This document is provided for general information and is not legal advice. Please have it reviewed by a qualified legal professional for your specific circumstances.