The whole truth about what SquadFit collects, why, and who can see it. Plain language, no fine print hiding the parts that matter.
SquadFit, operated from Dindigul, India. SquadFit replaces a gym's paper receipts and signature register with plans, payments, attendance and workout tracking for members and owners. If you have a question about your data, message us on WhatsApp — wa.me/918248754430 — and we'll answer directly, not through a form.
Account:your name and phone number, to log you in and identify you to your gym. There's no email sign-in and no SMS one-time codes — a phone number and a password you set is the whole account. Internally we also give every account a placeholder address (your number followed by @squadfit.local) purely to satisfy our login system's plumbing — it's never a real inbox and nothing is ever sent to it.
Body profile: date of birth, sex and height (for BMI and age-aware calculations), plus any bodyweight and tape measurements you log, to chart your progress over time.
Workouts: every exercise, set, weight and rep you log, so your lifts and volume can be charted week over week.
Activities: non-lifting sessions you log — cardio, yoga, a run or walk — with type, duration, distance, intensity and any note you add.
Payments & receipts:the amount, plan and date your gym records against your membership, so its books and your renewal reminders stay accurate. A receipt is a shareable link (no login needed) showing the gym's name, your name and the amount paid — meant to replace a paper slip, so treat the link like one.
Attendance:a timestamp each time you check in — by scanning the gym's QR poster, by a manual mark from the desk staff (e.g. you forgot to scan), or, at gyms with a fingerprint terminal, by a biometric check-in. The terminal matches your fingerprint on-device and only ever sends us a PIN and a check-in event; the fingerprint template itself never leaves the terminal and we never receive or store it.
Steps (Health Connect): if you connect Health Connect on Android, we read your daily step total, including a background read a few times a day so your streak and step chart stay current without you opening the app — and upload that daily total to your account. We never read any other Health Connect data (heart rate, sleep, workouts recorded by other apps, and so on) — steps only.
Notifications:a device push token (Firebase Cloud Messaging, on the Android app) or a web-push subscription endpoint (on the PWA), so we can send squad nudges, streak saves and membership reminders. Sending one means the notification's text passes through that channel's operator — Google (Firebase) for the app, or your browser vendor's push service (Google, Mozilla or Apple, depending on your browser) for the PWA — the same way any push notification works. No token, no notifications — nothing else uses it.
Security events: the IP address behind registration attempts, password-reset requests, join requests and account-deletion requests, kept to rate-limit and investigate abuse (credential stuffing, spammed signups) — not to track where you are. Separately, a sign-in session records the IP address and browser/device string it was created from, kept for as long as that session lives (up to 30 days), and a push-notification subscription records the browser/device string it was created from, kept for as long as that subscription lives — both are deleted when you delete your account. More on how long this stays below.
How we protect it: every page and API call is served over HTTPS, access requires a signed-in session, and what you can see is scoped to your role (a gym only sees its own members; staff only see what their role allows) — enforced on the server, not just hidden in the app. As above, no biometric template is ever stored on our servers.
You don't need a SquadFit account to end up in our records. If you fill in a join request or a "get SquadFit for my gym" request from the public site, we record your name and phone number to follow up — an unreviewed request just waits for an operator, it isn't auto-deleted. If you later register with that number and then delete your account, we clear it then: a request still awaiting a decision is removed outright, and one we've already approved or dismissed is kept afterwards (it's the record of which channel brought people in) with your name and number scrubbed off. A "get SquadFit for my gym" request isn't linked to any account, so it isn't affected by anyone's deletion. If your gym's desk logs you as a walk-in enquiry (name, phone and a note), that record is kept the same way — scrubbed if you become a member and later delete your account. If you filed a request and want it removed regardless, message us on WhatsApp and we'll take it out.
Your gym's owner and staffsee your membership, payments and attendance — that's the front-desk register SquadFit replaces. They never see your workouts, body profile, bodyweight, measurements or step data. Those are yours alone.
Squad-mates(friends you've joined a squad with, up to 12) see your training stats by default — that's the point of a squad: active days and streak, workout counts, muscle-distribution and the training heatmap, monthly step totals and averages, activity minutes, and recent bests, shown as the actual weight and reps (e.g. "@70 × 8"). Your bodyweight and tape measurements are hiddenunless you turn on body sharing for that squad — off by default, and a choice you make separately for each squad you're in.
Our own team.A small number of SquadFit operators and delegated admins can see names and phone numbers to run support — issuing a password reset, approving a join request, releasing a phone number for reassignment. When curating member-created exercises for the shared registry, they see who created an exercise and how many people are using it, so a genuinely useful one can be promoted (with its muscle mapping fixed) instead of staying stuck in one person's list. They never see your workouts, body profile or steps as part of this.
Nobody else.We don't sell your data, and we don't share it with advertisers or other third parties. SquadFit runs on infrastructure we pay for (hosting, database, the notification channels named above) that processes data on our behalf under standard provider terms — it isn't sold or repurposed by them either.
Most of what's above lives for as long as your account does. You can delete your account at any time from /delete-account — here's exactly what happens:
Deleted forever: your login (phone number and password), workout history, splits, your body profile and bodyweight/measurement log, activities, daily steps, squad memberships, notification settings, any muscle-mapping requests you filed, and any join request of yours still pending a decision.
Kept, with your identity removed:any gym you belonged to keeps its payment and attendance records so its books stay accurate, but your name is replaced with "Deleted member" and your phone number is removed. If you worked at a gym, that employment record is closed and kept the same way, for its payroll history. If a gym recorded you as a walk-in enquiry about you, or a join request naming you was already decided (approved or dismissed, not pending), those records are kept too, with the name and number scrubbed off them.
The security log stays whole. Every security event tied to your number or account — registrations, claim attempts, join-request submissions, password-reset requests and attempts, and every deletion attempt including the final one — survives, each carrying the phone number and IP address it was logged with. None of it is trimmed down to just the deletion line; we keep the whole trail, and only ever use it to investigate abuse. It can never be used to log back in.
If you're the only owner of a gym, deletion is refused until you transfer ownership — deleting you would leave that gym with nobody to run it.
This policy is effective 3 August 2026. If it changes, the update is posted here — this page is the one place to check.