Security and data protection

Staff accounts and sign-in

• All plansStaff passwords are stored only as argon2 hashes, never in readable form
• All plansTwo-factor login for staff with an authenticator app
• All plansSign-in sessions use HTTP-only cookies, with CSRF protection, rate limits and security headers on every request
• All plansAudit log of logins and staff actions

Sensitive data

• All plansWhatsApp access tokens, payment gateway keys and staff bank account numbers are encrypted with AES-256-GCM; only the last 4 digits of a bank account are shown
• All plansFor Aadhaar, only the last 4 digits and a one-way hash are kept — never the full number
• All plansPersonal data inside payment-gateway notifications is purged after 90 days

Your gym's data

• All plansOwner-only full data export and member anonymisation on request (DPDP Act 2023)

Member money

• All plansDynamic UPI QR that pays straight to your own UPI ID, 0% commission
• Pro+ or add-onMembers can set up autopay by card or UPI AutoPay through your own Razorpay account, so the money settles straight to you

Gates and biometrics

• Pro+ or add-onThe gateway keeps only member codes, first names, card numbers and pass dates — no phone numbers, photos or fingerprint templates
• All plansThe member's QR pass keeps changing and only works at your gym, so screenshots and forwarded passes are refused

Found a problem?

If you think you have found a security issue, email [email protected] privately (or message us on WhatsApp) with the steps to reproduce it. Please don’t share it publicly, access other gyms’ data or disrupt the service while testing; we will acknowledge your report and keep you updated until it is fixed. Our contact details are also published in security.txt. How we handle personal data is set out in the privacy policy.