Privacy Policy

Last updated 13 October 2026

Who we are

Gymastra is gym management software made in Kathmandu, Nepal. This policy covers gymastra.com, the Gymastra panel at app.gymastra.com, the member app, and the websites we host for gyms.

Two kinds of data pass through Gymastra. Data about a gym owner and their staff is ours to look after. Data about a gym’s members belongs to that gym: the gym decides what to record, and we store and process it on the gym’s behalf.

What we collect

Gym owners and staff

Name, mobile number and email address, used to sign in.
The gym’s name, branches, plans, prices, logo and contact details.
Staff records the owner adds, including salary payments.
Sign-in sessions and an audit log of changes made in the panel.

Gym members, as entered by the gym

Name, mobile number, address and photo.
Memberships, payments recorded against them and how they were paid.
Check-ins, and whether the member has agreed to receive SMS.

Members who use the member app

Fitness goals, height, weight and body measurements the member logs.
Workouts the member logs: the routines they plan, and the exercises, sets, weights and times they record.
Progress photos. These are stored privately and only the member who took them can open them; the gym cannot.
A device token, if the member allows reminder notifications.

Visitors to our websites

gymastra.com uses Google Analytics to count visits and see which pages are read. It sets cookies in your browser and sends Google your IP address, your browser and the pages you open. We use no advertising trackers. The panel, the member app and the websites we host for gyms carry no analytics.
Our servers and network provider keep standard request logs (IP address, browser, pages requested) to keep the service running and to stop abuse.
What you type to Pandey, the AI helper on gymastra.com, is saved so we can see what visitors ask and answer it better. With it we keep the time of each message, your IP address, your browser and a fingerprint of your device, to tell one visitor from another and to stop abuse. We do not keep your name or number. If you press its WhatsApp button, the message it wrote for you is saved too.
Anything you send through an enquiry form on a gym’s website goes to that gym.

How we use it

To run the service: show a gym its members, renewals, payments and reports.
To send the SMS renewal reminders and notifications a gym has switched on.
To sign people in, with one-time codes sent to their phone or email.
To answer support requests and to tell owners about changes to the service.
To keep the service secure and to fix faults.

How long we keep it

For as long as the gym’s account is open. When an owner closes their account, or asks us to delete a record, we delete it within 30 days, apart from what we must keep for tax or legal reasons. Copies in backups disappear as those backups are replaced.

How we protect it

All traffic is encrypted with HTTPS. Each gym’s data is kept separate from every other gym’s, staff see only the branches they are assigned to, and private files such as progress photos sit in storage that is not publicly reachable. No system is perfectly secure; if a breach affects your data we will tell you.

Your choices

Owners and staff can see and correct their details in the panel, and can ask us for a copy or for deletion.
Members should ask their gym first, since the gym holds the record. If the gym cannot help, contact us and we will work with the gym.
Members can delete their member app account from the app, or as described on Delete your account.
Members can turn off reminder notifications and hide their name from the leaderboard in the member app, and ask their gym to stop SMS.

Changes to this policy

If we change this policy we will update the date at the top of this page, and tell owners in the panel before a significant change takes effect.

Contact us

Questions or requests about your data: email [email protected] or call 984-084-0539.

Gymastra, Kathmandu, Nepal.