Privacy Policy

Effective 22 September 2026 · Poshan.fit is operated by Umesh Chandra (sole proprietorship), Bengaluru, Karnataka, India.

Poshan.fit handles information about your body and eating habits. This page explains, plainly, what we collect, why, where it goes and how to get it removed. It is written to comply with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.

1. What we collect

• Email, name, password hash (or Google account ID)

  To create and secure your account

  Kept until: Account deletion

• Age, sex, height, weight, waist/neck/hip, activity level, goal, diet type, grocery budget

  To compute your calorie and macro targets and plans. This is health-adjacent personal data and we treat it as sensitive.

  Kept until: Account deletion

• Food, water, weight, measurement and activity logs

  To show your dashboard, trends and weekly insights

  Kept until: Account deletion

• Progress photos (optional)

  Stored privately; only you can view them, through short-lived signed links

  Kept until: You delete them, or account deletion

• Subscription status, plan, Razorpay order/payment/subscription IDs

  To grant access and support refunds; required for tax records

  Kept until: 8 years (Indian accounting rules), then deleted

• Push-notification subscription (optional)

  To send the reminders you set

  Kept until: You turn reminders off, or account deletion

• Server logs (IP address, browser, pages requested)

  Security and debugging

  Kept until: Up to 30 days

• Referral clicks (affiliate code, a salted one-way hash of your IP, browser, landing page)

  To credit the affiliate who referred you. The raw IP is never stored and the hash cannot identify you.

  Kept until: 24 months

We do not collect location, contacts, or advertising identifiers, and we do not use third-party analytics or advertising trackers.

2. How we use it

• To run the service you signed up for: calculations, logging, plans, reminders, insights, export.
• To bill you and to detect fraud (through Razorpay).
• To send account and billing emails. We do not send marketing email unless you opt in, and every such email has an unsubscribe link.
• We do not sell personal data, share it with advertisers, or use it to train AI models.

3. Who processes it for us

• Supabase · AWS, Asia-Pacific region

  Database, authentication and private file storage (progress photos)

• Vercel · Global edge network; server functions in the US

  Hosting and delivery of the web app

• Razorpay · India

  Payment processing — receives your name, email, phone and payment instrument; we never see card/UPI details

• Google · Global

  Optional 'Sign in with Google' — we receive your name, email and avatar

• Open Food Facts · France

  Barcode lookups — the barcode you scan is sent; no personal data

• Resend · US

  Transactional email (only if you enable email reminders)

Each provider is bound by its own data-processing terms and only receives what is needed for its job. Some data is therefore stored outside India, as permitted under the DPDP Act.

4. Cookies and local storage

Strictly necessary: your login session (Supabase auth) and a short-lived state cookie during Google sign-in. The installed app uses browser storage for conveniences such as remembering a dismissed banner.

Referral attribution: if you arrive from a link shared by one of our affiliates (a link containing ?ref=), we store that affiliate’s code in a cookie for up to 60 days so that, if you later subscribe, we can pay them their commission. It records the code only — not who you are, and not what you do on the site. You can delete it in your browser at any time; doing so only means the affiliate is not credited.

We do not use advertising cookies, and we do not run third-party analytics or tracking pixels.

5. Security

All traffic is encrypted (HTTPS). Data is stored with row-level security so each account can only read its own rows. Passwords are hashed by Supabase Auth; we never see them. Payment webhooks are signature-verified. Access to production systems is limited to the operator.

6. Your rights

• Access & portability: Settings → Data export downloads everything you have logged (JSON/CSV) at any time.
• Correction: edit your profile and logs in the app.
• Erasure: email support@poshanfit.com from your account email with the subject “Delete my account”. We delete your account, logs and photos within 7 days and confirm by email; billing records are retained only as required by law.
• Withdraw consent: turn off reminders or photos in the app at any time; deleting the account withdraws all consent.
• Grievance: see below. You may also complain to the Data Protection Board of India.

7. Children

The service is for adults (18+). We do not knowingly collect data from anyone younger; if you believe a minor has an account, contact us and we will remove it.

8. Grievance officer

Umesh Chandra
Poshan.fit, Bengaluru, Karnataka, India
support@poshanfit.com
We acknowledge grievances within 2 business days and resolve them within 30 days.

9. Changes

If we change what we collect or who we share it with, we will update this page and notify you in the app before the change takes effect.

Questions about this policy: support@poshanfit.com. See also our Terms, Privacy Policy, Refund & Cancellation Policy and Contact pages.