Privacy Policy
What Kynvelo collects, why, where it is stored, and how to get it removed.
Last updated 7 October 2026
1. Our role
For gym members, the gym is the Data Fiduciary and Kynvelo is a Data Processor acting on its instructions. For Kynvelo Direct athletes who sign up without a gym, Kynvelo is the Data Fiduciary. This distinction determines who you direct a data request to — for gym members, your gym; for direct athletes, us.
2. What we collect
Account details (name, phone, email), membership and payment records, attendance timestamps with the gate used, and whatever training and nutrition data you choose to log. A meal photo is sent only when you take one to scan; progress photos stay on your phone unless you turn on backup, and then they are locked on your phone before they are uploaded. Your gym's staff can keep short notes about you, such as an injury to work around; you do not see them in the app, but they are included when you download your data and deleted if you ask us to erase it. Messages with your trainer or dietitian are kept while they are assigned to you and for one year after, then deleted. We also note when you last opened the app, so we can send you a short reminder if you have been away for a few days; you can turn that reminder off in Settings, and the time is included when you download your data.
3. Camera and image handling
Barcode scanning is decoded on your device; the video stream never leaves it and only the decoded digits are sent. AI meal scan is available to adults on a paid plan and only after you agree to it in the app. A meal photo is reduced in size on your phone (location data removed), sent through our servers to an AI provider acting as our processor (OpenRouter, Inc., which passes it to the model host it selects, or Google LLC's Gemini API) to identify the foods and estimate portions, and is not stored by Kynvelo. Provider retention and training terms depend on the configured provider and account settings; this page does not certify those settings. We keep the dish names, portions and nutrition numbers with your food log. Where a dish is in a food composition database (USDA FoodData Central, UK CoFID, or a Kynvelo recipe calculated from them), those numbers are used; otherwise the AI estimate is used and labelled as an estimate. Your scans are kept in Scan history so you can log them later or look back: a scan you never log is deleted after 30 days, one you log after 12 months, and you can delete any scan, or all of them, from Scan history at any time. Deleting a scan does not remove the meal from your food log. If you also turn on “Improve portion estimates”, the portions you correct or weigh are kept, under a code that cannot be traced back to you without a key held only on our server, to make portion estimates better for everyone; these are deleted after 36 months. Nothing is kept for that purpose unless you turn it on. Erasing your account deletes your scans and everything kept from them. You can withdraw either consent in Settings. A photo of a food label, if you choose to read one, goes to the same AI service under the same consent, only to copy the printed numbers into your form; it is not kept.
4. What we never do
We do not sell personal data. We do not share training, weight, body-composition or nutrition data with advertisers, insurers or employers. We do not use your health data to target advertising, because we do not run advertising.
5. Storage and retention
Database hosting and storage regions depend on the deployment configuration. Progress photos stay on your phone unless you turn on Backup: then each photo is encrypted on your phone with a passphrase only you know before it is uploaded, so neither your gym nor Kynvelo can open it, and a forgotten passphrase cannot be recovered. Documents your gym files for you (a signed waiver, an ID copy, a doctor's note) use private S3 storage when configured; the storage region is chosen by the operator and opened only through a link that works for 5 minutes. Both are deleted with your account. Meal photos are sent for analysis and are not kept as files. Receipts are made from your payment record when you open one, not stored as documents. Financial and attendance records are retained for audit purposes and soft-deleted rather than erased, so a payment dispute can still be resolved.
6. Your rights
You can download a copy of everything we hold about you and correct your profile details yourself in the app. Erasure is requested from your account settings and reviewed by your gym: your name, contact details and training, body and nutrition history are removed, while paid receipts are kept without your name because tax law requires them to be retained. You can also write to our Grievance Officer, named in section 8.
7. Consent separation
Transactional messages (check-in confirmations, payment receipts, renewal reminders) and promotional messages carry separate consent flags. Withdrawing marketing consent does not stop payment receipts, because those are part of the service you paid for.
Service providers
The integrations in the software include Clerk for sign-in, Razorpay for payments and Firebase for notifications. Private file and photo backup use Amazon Web Services S3 when configured. Optional error reporting uses Sentry; optional WhatsApp delivery uses Meta. AI analysis can use OpenRouter (and the selected model host), Google Gemini, or configured local models. Availability and provider settings depend on the deployment. Food databases supply reference nutrition values, not identity verification or medical advice.
8. Grievance Officer
Under the Digital Personal Data Protection Act 2023 you can raise a grievance about how your personal data is handled with our Grievance Officer, Ankit Shaw, at grievance@kynvelo.online. If your grievance is not resolved, you may approach the Data Protection Board of India.
9. Android app permissions
Internet, to reach your gym's account. Camera, asked the first time you scan a barcode; refusing it leaves typed barcodes and food search working. Notifications (Android 13 and later), asked only when you turn on update alerts, used to tell you a new app version is live. Install apps from this source, granted by you in Android settings the first time you update, so the app can open a downloaded update in Android's installer; you confirm every install there. Location, asked only if you turn on GPS distance for a cardio session; used on the phone to measure distance, and only the total distance is saved. Bluetooth, asked only if you pair a heart-rate strap; only heart-rate readings are used. Google Health Connect, only if you connect it in Health sync: Kynvelo reads steps, active energy, workouts with heart rate and distance, and weight, never writes to Health Connect, and saves only the workouts and weigh-ins you choose to import. Microphone, asked only the first time you tap the microphone to say a meal: your phone's own speech service turns what you say into text, and Kynvelo receives only that text, never the audio. Physical activity, asked when you turn on reminders or "Steps in the status bar": the phone's step counter shows today's steps in a notification. The day's total step count (a single number per day, nothing else) is sent to your account so it can count toward your gym's step challenges, and it is deleted with your account. If you type or say a meal into that notification or the "Log a meal" Quick Settings tile, only the text is sent to log it; the phone keeps its own sign-in key for this, encrypted, and deletes it when you sign out. Kynvelo does not ask for contacts or phone state.
10. Cookies and storage on your device
The website sets only the cookies it needs to work, and none that follow you: kyn_ops_role and kyn_ops_staff (staff only) say which staff screens to show, kyn_platform_role does the same for Kynvelo's own team, and our sign-in provider, Clerk, sets its own session cookies while you are signed in. Every request is still checked by the server; these cookies only decide which screens load. The app keeps your sign-in and the data it needs offline (your gate pass, recent screens, unsent logs) in your browser's or phone's own storage, not in cookies. We run no analytics, advertising or tracking cookies. If that ever changes, you will be asked first, and saying no will be as easy as saying yes.