Privacy Policy

FlexTrack ("FlexTrack," "we," "us," or "our") is a gym and fitness facility management platform operated by Future Dev Solutions. This Privacy Policy explains what information we collect through the FlexTrack web dashboard and the FlexTrack mobile application, how we use and share it, and the choices available to gym owners, staff, and members. By creating an account or using FlexTrack, you agree to the practices described in this Policy.

1. Who This Policy Covers

FlexTrack is used by several types of accounts, each with different access levels:

• Super Admin: Future Dev Solutions personnel who administer the FlexTrack platform itself.
• Owner: the person or business that registers a gym, its physical locations, equipment, and subscription plans.
• Staff: personnel granted access by an Owner to manage check-ins, members, and day-to-day operations at one or more locations.
• Member: an individual enrolled at a gym who uses FlexTrack (web or the mobile app) to check in, view their membership, invoices, and exercise plans.

This Policy applies to all of these account types. Gym Owners and Staff who enter information about their members are responsible for ensuring they have the appropriate rights and consents to do so.

2. Information We Collect

2.1 Account and Profile Information

• First and last name, email address, phone number, and password (stored as a salted hash — we never store your password in plain text).
• Date of birth, residential address, city, and country.
• National identification number (CNIC), collected for certain accounts (e.g. gym owners and members) where a facility requires it for identity verification.
• Profile photo, where provided.
• Account role (Super Admin, Owner, Staff, or Member) and account status (active, blocked, or deleted).

2.2 Gym and Location Information

Gym Owners provide details about their business, including the gym name, one or more physical branch addresses ("locations"), and gym equipment inventory (name, category, quantity, and condition).

2.3 Your Selected Gym Location — Not GPS Tracking

FlexTrack lets a Member or Staff account select or be assigned to a specific gym branch ("location") from the list of locations a gym operates — for example, choosing "Downtown Branch" instead of "Uptown Branch." This selection is stored so the app can show you the right branch's equipment, invoices, announcements, and check-in records.

FlexTrack does not collect GPS coordinates, real-time location, or background location data from your device. We do not track where you physically are at any given moment. The only "location" data we store is the administrative gym branch record (a name and address entered by the gym Owner) that you or your gym has associated with your account.

2.4 Attendance and Check-In Data

When you check in at a gym, we record the check-in and check-out time, the gym location the check-in belongs to, and the method used: manual entry, QR code scan, NFC tap, or an automatic method configured by the gym. We use this to maintain attendance records for you and for the gym Owner/Staff who manage the facility.

2.5 Membership, Subscription, and Billing Data

• Membership records, including which gym location you joined and when.
• Subscription plan details: plan name, price, duration, and the number of locations it covers.
• Subscription assignment start/end dates and active status.
• Invoices: invoice number, amount, tax, discount, total, due date, payment status, paid date, and the payment method as recorded by your gym's staff (e.g. cash). FlexTrack does not currently process card or online payments itself — payment methods are recorded manually by gym staff for bookkeeping purposes.
• Subscription expiry and payment-due reminders, and records of when those reminders were sent.

2.6 Fitness Goals and AI-Generated Exercise Plans

If you use the exercise-plan feature, we collect the fitness information you provide — your fitness level, goals, and desired workout days per week. This information, together with your gym's registered equipment list, is sent to a third-party AI provider (Groq, running a Llama large language model) to generate a personalized monthly workout plan. We also store the generated plan, its daily exercises, and your logged completion status (completed or missed) so we can track your progress and send reminders for missed workouts.

2.7 Communications

Gym Owners and Staff can send announcements to members through the FlexTrack app and, where enabled for a gym, via SMS text message. We store the announcement content, its intended audience (e.g. all members, staff only, active members), and delivery status. If you contact us through the FlexTrack contact form, we collect your name, email address, and message so we can respond, and we send an automatic acknowledgement email.

2.8 Authentication and Security Data

• Login sessions and, where applicable, linked sign-in provider tokens managed through our authentication system (NextAuth).
• Email verification status.
• One-time passcodes (OTPs) used for login verification and password resets. OTPs expire automatically after 10 minutes and are marked as used once redeemed.

2.9 Mobile App and Device Data

If you use the FlexTrack mobile app, we store a Firebase Cloud Messaging (FCM) push-notification token tied to your account. This token lets us deliver push notifications — such as missed-workout reminders, subscription/payment reminders, and gym announcements — to your device, including when the app is not actively running. We do not access your device's precise location, contacts, camera, or other device data beyond this notification token.

3. How We Use Your Information

• Provide, operate, and maintain the FlexTrack web dashboard and mobile app.
• Manage gym memberships, attendance/check-ins, subscriptions, and invoicing.
• Generate AI-assisted, equipment-aware exercise plans and track workout completion.
• Send transactional and account emails (verification, password reset, invoices, contact-form replies) and push/SMS notifications (reminders, announcements).
• Run scheduled background jobs that check for expiring trials/subscriptions and missed workouts, and trigger the relevant reminders.
• Maintain the security of accounts, detect misuse, and enforce account status controls (activation, blocking, deletion).
• Comply with legal, tax, and recordkeeping obligations related to invoicing and billing.

4. How We Share Information

We do not sell or rent your personal information. We share information only as follows:

• Within your gym: a gym Owner and their Staff can view and manage the data of members enrolled at their gym/locations.
• AI plan generation: your fitness-plan inputs (fitness level, goals, workout frequency) and your gym's equipment list are shared with our AI provider (Groq) solely to generate your exercise plan.
• Push notifications: your device's notification token is shared with Google/Firebase Cloud Messaging solely to deliver push notifications.
• Email delivery: message content is shared with our SMTP email service provider solely to deliver transactional emails.
• Legal reasons: where required to comply with law, enforce our Terms, or protect the rights, safety, and property of FlexTrack, our users, or others.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this Policy.

5. Data Retention

• Login and password-reset OTPs are short-lived and expire 10 minutes after issuance.
• Account, membership, attendance, invoice, and exercise-plan data is retained for as long as your account remains active with a gym, and for a limited period afterward to allow account recovery and to satisfy billing/tax recordkeeping obligations.
• Placeholder — to be finalized: we have not yet set a fixed retention period for historical attendance/check-in records and invoices after account closure. Until a specific period is defined, we retain this data no longer than reasonably necessary for the purposes above, and will update this section with an exact retention window (e.g. a number of years) once finalized.

6. Cookies and Similar Technologies

FlexTrack uses essential cookies to keep you signed in and to maintain your session (via our authentication system). We do not currently use advertising or cross-site tracking cookies. See our Cookie Policy for more detail.

7. Data Security

Passwords are stored using industry-standard hashing. We apply role-based access controls so that Owners, Staff, and Members only see data appropriate to their role and gym. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

8. Your Rights and Choices

Depending on your location and applicable law, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing. Members should first contact their gym's Owner/Staff, who control most day-to-day data entered about you; you may also contact us directly using the details below and we will coordinate with the relevant gym as needed.

9. Children's Privacy

FlexTrack is intended for use by adults registering or managing gym memberships. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can remove it.

10. International Data Transfers

Our service providers (including our AI plan-generation provider and push-notification provider) may process data in countries other than your own. Where this occurs, we take steps to ensure your information continues to receive an appropriate level of protection.

11. Governing Law

Placeholder — to be confirmed by counsel: this Policy is intended to be governed by the laws of Pakistan, where Future Dev Solutions and FlexTrack are based, without regard to conflict-of-law principles, unless a different jurisdiction is required by applicable law. This section should be reviewed and finalized before publication.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will revise the "Last updated" date above when we do, and, for material changes, provide additional notice within the app.

13. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, including privacy-specific requests, contact us at [email protected].