Privacy Policy

Last updated: 28 October 2026

This describes what TrainSmarter collects, why, and who sees it. TrainSmarter is operated by Nischal Mohan, sole proprietor of TrainSmarter (see Contact Us). For a one-page, itemised list of every kind of data and what it is used for, see our Data Notice.

1. What we collect

• Account details: name, phone number, and password (stored as a salted hash — we never see or store your plain-text password). When phone verification is switched on, we also send a one-time code by SMS to your number; we keep only a scrambled (hashed) copy of that code, never the code itself, and it stops working after 10 minutes.
• Health & fitness data you or your trainer enter: workout logs, meal and nutrition logs, body measurements (weight, height, sex, date of birth), and macro goals.
• Profile photo (optional): if you add one, a small square copy of the picture you choose (about 256 pixels wide). It is stored privately; it is not public, and you can remove it at any time, which deletes the file.
• Trainer–client relationship data: who is attached to whom, and when, so the app can show a trainer their clients and a client their trainer.
• Payment records: the amount, plan, timestamp and payment reference for anything you buy. We do not collect or store your card, bank or UPI app credentials — payments are made by UPI through our payment gateway partner Razorpay, which handles the sensitive part directly.
• Basic technical data: standard server logs (e.g. request times, error logs) generated by running the app; error reports when something breaks; and a small number of usage events (for example: signed up, logged in, started or finished a workout, logged a meal, confirmed a payment). An error report or usage event identifies your account only by an internal number and your role (trainer or client) — never your name, phone number, what you ate or lifted, your measurements, or anything you typed. We do not run advertising trackers, and we do not record your screen.

2. Why we collect it

• To provide the Service: showing you your own data, and — if you’re a client — showing your attached trainer what you’ve logged.
• To operate the account: logging in, password changes, and telling paid access apart from free.
• To confirm and reconcile payments, and to calculate referral rewards.
• To keep the Service secure and investigate abuse.

3. Who sees your data

• Your trainer sees the data you log, for as long as you’re attached to them — that visibility is the point of the product, and a client consents to a specific trainer seeing it at the moment they accept that trainer. After a coaching relationship ends, the former trainer can still see your history up to the day it ended — and nothing you log after that — for 30 days, so they can hand over and finish their notes. Then their access ends for good, and it ends sooner if you start with another trainer. Your data then stays with you alone.
• A trainer who referred your trainer (if you are a trainer who joined through someone’s referral link) sees that you bought training days, when, and how many. They see nothing about your clients, workouts or anything else, and never any health data.
• Your profile photo, if you add one, is shown only to you, your current trainer (if you are a client) or the clients you currently coach (if you are a trainer). Nobody else, and nobody who is not signed in, can open it.
• We (TrainSmarter) can see account and usage data to operate and support the Service. We do not sell your data to anyone.
• Infrastructure providers that host the app and database on our behalf (our hosting platform Vercel and our database provider Neon) process data as part of running the Service, under their own security commitments to us.
• Our payment gateway partner, Razorpay, if you pay through it, processes your payment under their own privacy policy — we only receive confirmation that payment succeeded, plus a reference id.
• Two monitoring tools, used only to keep the app working and to understand which features are used. Sentry receives error reports (what failed and where in the app); personal details, form contents and cookies are stripped before anything is sent. PostHog receives the usage events described above, in the live app only. Both are set up in their European regions; their servers are outside India. Neither is used for advertising and neither receives your health data.
• Our SMS provider, MSG91 (Walkover Web Solutions Pvt. Ltd.), receives your phone number and the one-time code text so it can deliver the message. We send it nothing else.
• We may disclose data if required to by law.

4. How long we keep it

• Account and activity data: for as long as the account is active.
• One-time codes and login-attempt records: a few minutes to a few days; they are cleared automatically as new ones are made.
• Payment and financial records: kept after an account is deleted, because tax and audit rules require us to keep a record of money moved.
• Former trainers: a trainer who stops coaching you keeps read-only access for 30 days after the day it ended, and none after that.
• When you delete your account: your profile, photo, logs, plans and measurements are deleted straight away, apart from the payment records above. Copies in our database backups age out within 30 days.

5. Security

Passwords are hashed, not stored in plain text, and a password change invalidates other active sessions on your account. No system is perfectly secure, and we can’t guarantee absolute protection against every possible attack, but we take reasonable, standard precautions to protect your data.

6. Your rights and choices

• You can view and edit your profile details from within the app.
• Access, correction, deletion: you can edit your details in the app under Profile → Account. To delete your account, use Delete my account on that same screen: enter your password and it is done, with no message to us needed. To get a copy of your data, contact us (see below) from the phone number on the account, and we will send it within 30 days.
• Withdrawing consent: you can withdraw your consent to our processing your data at any time, as easily as you gave it: tap Delete my account in the app, or tell us. Without that consent we can no longer provide the Service, so your account will be closed and your data deleted as above. Anything we did with your data before you withdrew remains lawful.
• Complaints: if you are unhappy with how we handled your data, write to our Grievance Officer first (see Contact Us); we reply within 2–3 business days and resolve it within 30 days. If you are still not satisfied, you may complain to the Data Protection Board of India under the Digital Personal Data Protection Act, 2023.
• You may name another person to exercise these rights on your behalf.
• A client can ask to end a trainer relationship (by contacting us or their trainer), which stops that trainer seeing new activity you log afterwards, and ends their access to your history 30 days later.

7. Age

TrainSmarter is intended for users aged 18 and over. We do not knowingly collect data from anyone under 18 — a contract with a minor is not valid under Indian law, and the health data we handle needs an account holder who can consent to it themselves.

8. If something goes wrong

If a security incident affects your personal data, we will tell you without undue delay, in the app or by SMS, and report it to the Data Protection Board of India as the law requires.

9. Where your data is kept

The app and database are hosted with infrastructure providers whose servers may be outside India. We do not sell your data and we do not share it with anyone for advertising.

10. Changes to this policy

We may update this policy as the Service changes — for example, when a payment gateway or an email-based notification system is added. We’ll update the date at the top when we do.

11. Contact

Questions, or a request to access or delete your data: Contact Us.