Privacy note
What we hold, and what we don’t.
Plain language · consent and purpose per DPDP Act, 2023 · last revised 3 Sep 2026
We keep only what the engine needs to build your plan — your body numbers, your training and food answers, and your email. We never sell it, we never hand it to advertisers, and if you ask us to delete it, we do.
The short version
You give us eleven answers and an email address. We use them to compute your plan, to write the explanation on top of it, and to serve your private report link back to you. Nothing else. We do not sell your data, we do not share it with advertisers or insurers, and we delete it on request.
ifit90 is operated from India and follows the consent-and-purpose framing of the Digital Personal Data Protection Act, 2023: consent is specific, informed and withdrawable, and we hold nothing we do not need to render your report.
What we collect
- Body numbers
- Sex, age, height, weight and — if you give it — waist. These are the inputs to BMR, BMI and your calorie and protein targets. Without them there is no plan.
- Lifestyle answers
- Job type and daily steps, training setup, days and minutes, experience, diet type and region, meals per day and food budget, sleep hours and a stress rating. These pick your training template and your meal template.
- Health flags
- Injuries and conditions you tick (knee, back, shoulder, wrist; diabetes, PCOS, blood pressure, thyroid; pregnancy). This is sensitive information. We use it only to run the safety gate, to remove contraindicated movements, and to attach a clinician note. It is never used for advertising, scoring, or anything shared onward.
- Calendar answers
- Travel dates, festivals and exam windows in your next 90 days.
- Name, language, email
- The name only changes wording. The email exists so you can recover your private report link and so we can answer support and refund requests. It is not used for marketing.
- Consent record
- That you confirmed you are 18 or older, that you understood this is not medical advice, and that you consented to this processing — with a timestamp.
- Product analytics
- Coarse events — a page view, an intake step reached, a completed order, a report opened — tied to a random session id in your browser’s local storage. No third-party advertising or cross-site tracking pixels.
- Tracker and habit data
- What you log inside the report (sets, reps, ticked habits) stays in your browser’s local storage, keyed to your report token. It is not uploaded.
- Payment details
- None. Card and UPI details go directly to the payment gateway; we receive only a payment identifier and a status.
Why we collect it
- To compute your metrics, training programme, meal template and 90-day calendar.
- To run the safety gate that decides whether we should build a plan for you at all.
- To generate and store the written explanation that sits on top of those facts.
- To serve your private report link back to you when you open it.
- To handle support, refunds and deletion requests.
- To understand, in aggregate, where the product is confusing or broken.
That is the whole list. We do not profile you, build advertising audiences, or enrich your record from other sources.
Where it is stored
Your order, your fact packet and your report live in a managed PostgreSQL database, encrypted in transit and at rest, on a server rented in India. Access is limited to the operator of ifit90. Your report link is unguessable and carries a noindex instruction, so search engines do not list it.
Who processes it
- Hosting provider
- Runs the application server and the database.
- OpenAI
- Writes the explanation from your computed fact packet. The packet contains your answers and the numbers derived from them. It is sent for generation and is not used by us to train anything.
- Razorpay
- Payment processing, only for the transaction itself.
- Resend
- Sends the one transactional email that carries your report link.
Each is a processor acting on our instructions for the purposes listed above. We add no others without updating this page.
Selling and sharing
We do not sell your personal data. We do not share it with advertisers, data brokers, insurers, employers, gyms or supplement sellers. We do not publish your plan. Your health flags in particular never leave the systems listed above.
Retention and deletion
We keep your order, packet and report for as long as you may want to reopen the report — the plan covers ninety days, and people come back to it. Ask us to delete it and we remove the order record, the fact packet, the written report and your email address, permanently, normally within seven days. Anonymous aggregate counts that cannot identify you may remain.
To request deletion, a copy of your data, or a correction, write to support@ifit90.in from the address you used at checkout and include your report link.
Your choices
- Withdraw consent at any time; we then delete the data as above.
- Leave the optional fields blank — waist, name and WhatsApp are not required.
- Clear your browser’s local storage to reset the analytics session id and erase everything the tracker has saved on your device.
- Use the free tools without giving us anything at all: they compute in your browser.
Age
ifit90 is for adults. You must be 18 or older, and the intake refuses to build a plan for anyone younger. We do not knowingly process the data of children; if you believe a child’s details were submitted, write to us and we will delete them.
Changes
If this notice changes materially, the revision date at the top changes with it. We will not retroactively broaden what we do with data you already gave us.