Privacy Policy

Traccoon ("we", "us", "our") provides gym-management software and a member mobile application (Android & iOS, package com.traccoon.mobile). This Privacy Policy applies to our website, mobile apps, and related services (collectively, the "Service").

Your gym acts as the controller of your membership records; Traccoon provides the platform that processes them on the gym's behalf. For your personal fitness and AI data, Traccoon is the controller.

• Account information — name, email address, phone number, and password (stored securely as a hash, never in plain text).
• Profile & fitness data — only when you provide it: body measurements, workout logs, nutrition/macro entries, water intake, body-composition goals, and lab reports you upload for AI analysis.
• Membership & transaction data — your gym membership, bookings, wallet balance, top-ups, and payment/transaction records processed through your gym.
• Usage & device data — app interactions, device type, app version, and push-notification tokens used to deliver notifications.
• Access logs — gym check-in records when you use card/NFC access at participating gyms.
• Device health & fitness data (Android Health Connect) — only if you choose to connect Health Connect in the Traccoon app: steps, distance, active calories, workout/exercise sessions, and the heart-rate recorded during those workouts. This access is read-only — we never write to Health Connect — and we request only these data types.

We do not collect precise location, contacts, photos beyond what you explicitly upload, or any advertising identifiers.

• Operate your membership, bookings, payments, and gym access.
• Provide AI coaching, nutrition tracking, food scanning, and lab / body-composition analysis you opt into.
• Send notifications and reminders (you can turn these off in your settings at any time).
• Secure your account, including optional biometric login handled entirely on your device.
• Operate, maintain, troubleshoot, and improve the Service.

We do not sell your personal information. We share data only in these limited cases:

• With your gym — which administers your membership and may view membership, booking, and (where you consent) progress data.
• With service providers that run the Service for us, under confidentiality agreements: hosting (Vercel), database & authentication (Supabase), email delivery (Resend), push notifications (Firebase), and AI processing (Google Gemini).
• With trainers — only when you explicitly enable data sharing with a specific trainer.
• When required by law — or to protect the rights, safety, and security of users and the public.

These providers are processors acting on our instructions — not independent third parties who may use your data for their own purposes.

We retain your information while your account is active or as needed to provide the Service. You may request deletion of your account and associated personal data at any time. Some records — such as transaction and payment history — may be retained by your gym where required for accounting or tax compliance, only for as long as the law requires.

We use industry-standard safeguards: encryption in transit (HTTPS/TLS), hashed passwords, row-level access controls that isolate each gym's data, and secure authentication. No system is 100% secure, but we continuously work to protect your information.

• Access, update, or correct your profile information directly in the app.
• Turn notifications on or off in your settings.
• Enable or revoke trainer data-sharing at any time.
• Request a copy or full deletion of your personal data.

We use only essential cookies and on-device storage — to keep you signed in, remember your gym and preferences, and cache data so the app loads instantly. We do not use advertising or cross-site tracking cookies, and we do not run third-party analytics trackers on your personal data. Clearing your browser or app storage signs you out and resets cached preferences.

The Service is intended for users aged 16 and older. We do not knowingly collect data from children under 16. If you believe a child has provided us data, contact us and we will remove it.

We may update this policy from time to time. We will post the updated version here and revise the "Last updated" date above. Significant changes will be highlighted in the app.