Privacy Policy

togetherfit ("we", "us") is a wellness app for posture, movement, recovery and finding real people to be active with. This policy explains what personal data we collect, why, who we share it with, and the rights you have, including under India's Digital Personal Data Protection Act, 2023 ("DPDP Act"). For the purposes of that Act, togetherfit is the Data Fiduciary for your data.

1. What we collect

• Account: your name, email address, a password (stored only as a one-way scrypt hash, never in readable form) and a friend code we generate for you.
• Profile photo (optional): re-saved by our servers so that hidden data in the original file, such as the GPS location where it was taken, is removed. Only your accepted friends see it, unless you turn on "Show my photo on Find a Friend". It's checked automatically for a clear face and inappropriate content.
• Gender and matching preference (optional): used only so that matching respects both people's comfort preferences. Your gender is never shown to other members.
• Verification (optional): to earn the ✓ badge you take a live selfie, which is compared automatically with your profile photo. The selfie is deleted immediately after the check; we keep only the result, the date and the match scores. We never use it to guess your gender or anything else.
• Wellness setup: the answers you give during onboarding, such as wake and sleep times, work hours, preferred walk length and whether you allow the camera.
• Find a Friend location: when you start a search, the area you choose, rounded on our server to roughly a few hundred metres before it is stored. We never store your exact position. Other people see only an approximate distance (for example "~2 km away"), never your location.
• Social activity: friend requests, connections, 1:1 and group chat messages, groups you create or join, activities you log and milestones you unlock. Celebration cards in chat are deleted automatically after 24 hours.
• Safety reports: if you block or report someone, we keep a record of the report and the reason you give.
• Security data: for each signed-in device, the IP address, browser user agent and sign-in times; and short-lived counters used to stop password guessing and spam.

2. Data that never leaves your device

• Camera: Posture & Gaze Guard analyses your camera on your device, in the browser. Video and images are never recorded, stored or uploaded. Your browser downloads the face-landmark model file from Google's servers the first time you use it.
• Workouts, wellness scores, breathing patterns and reminder settings are saved to your account on our servers, so they follow you to a new phone or browser, and kept in your browser as a cache (separately for each account). They are included in your data download and deleted with your account.

3. Why we use it

• To create and secure your account, including emailing one-time codes when you sign up, sign in or reset your password.
• To match you with nearby people for the same activity and time, and to deliver your messages.
• To show your progress, streaks and milestones.
• To keep the community safe: preventing abuse, acting on reports and blocking accounts that misuse the service.
• To answer AI Coach questions (see section 4).

We use your data only for these purposes, on the basis of the consent you give when you create an account and use each feature. We do not sell your data and we do not use it for advertising.

4. Who we share it with

• Other members: your name and friend code are shown to people you connect with. Your email address is never shown to other members.
• Hosting and database providers that run togetherfit and store its data on our behalf.
• Email delivery: Google (Gmail) or Amazon Web Services (SES) send our one-time codes and account emails.
• Live notifications: Ably delivers "you have a new message" signals to your open app, identified by your account id. They never contain the message text, which stays on our servers.
• Identity checks: when automatic verification is enabled, your live selfie and profile photo are processed by Amazon Web Services (Amazon Rekognition) only to confirm they show the same real person, then deleted.
• AI Coach: the question you type is sent to Groq, Inc. to generate an answer. Don't include personal details you don't want to share.
• Maps: place searches are sent from our server to OpenStreetMap's Nominatim service, and your browser loads map tiles from OpenStreetMap, which sees your IP address.
• Legal requirements: we may disclose data when required by law or a valid order from an authority.

Some of these providers may process data outside India, subject to the DPDP Act.

5. How long we keep it

We keep your account data until you delete your account. One-time codes expire after 10 minutes, sessions after 30 days without use, and Find a Friend searches end when you stop them or when they expire. When you delete your account, your profile, connections, messages, searches, groups you created, activities and milestones are deleted permanently from our database.

6. Your rights

• Access: download a copy of your data any time from Settings → Your Data.
• Erasure: delete your account and its data from Settings → Your Data.
• Correction: ask us to correct inaccurate data by writing to togetherfit3@gmail.com.
• Withdraw consent: stop using a feature, revoke camera access in your browser settings, or delete your account.
• Nominate: you may nominate someone to exercise these rights on your behalf in case of death or incapacity, by writing to togetherfit3@gmail.com.
• Grievances: write to togetherfit3@gmail.com. We aim to respond within 7 days. If you are not satisfied, you may complain to the Data Protection Board of India.

7. Security

Passwords are hashed with scrypt, sign-in requires a one-time code sent to your email, sessions use secure httpOnly cookies, and all traffic is encrypted with HTTPS. No system is perfectly secure; if we learn of a breach affecting your data, we will notify you and the Data Protection Board as the law requires.

8. Age

togetherfit is for people aged 18 and over. We do not knowingly collect data from children.

9. Changes

If we change this policy in a way that matters, we will tell you in the app or by email before the change takes effect. Questions: togetherfit3@gmail.com.