Privacy policy

1. What we collect

Your account

Your email address or mobile number (to sign you in with a one-time code), your name, and the gym code you joined with.

Orders

Your delivery address and PIN code, the dishes you order, prices, how you paid, order status, order history and receipts.

Payments

If you pay online (for an order or for Premium): the amount, the date and the payment reference Razorpay gives us. Your card, UPI or bank details go to Razorpay, never to us.

Weekly check-in

Age, sex, height, weight, goal, activity level, training days, how you eat (veg, egg or everything), fasting days, sleep, any health conditions you tell us about, and any notes you add.

Progress

The meals and workouts you mark as done, which we use for streaks and your weekly report.

Support messages

What you write to us from the app.

AI buddy

If you chat with your buddy: your messages and its replies, and the short notes you ask it to remember (shown to you in the app, where you can delete them).

Watch and fitness apps

Only if you connect one yourself: from Google Health (Fitbit, Pixel Watch), your daily steps, resting heart rate and how long you slept; from Strava, your workouts (date, type and duration). We store the access the service gives us in encrypted form.

Delivery riders

If you deliver for a partner kitchen: while you deliver an order, your phone’s location (after you tap to share it), so the customer can follow you on a map. We keep only your latest location and delete it as soon as the order is delivered or cancelled.

App usage

Which screens of the member app you open each day (for example Today, Plan or the menu) and how many times, and whether that was in our Android app. Not what you tap, type or look at on the screen. We collect this ourselves; no analytics company is involved.

Partner applications

If you apply as a gym or kitchen: your name, phone, email, area, business name and note, plus a scrambled (one-way hashed) form of your internet address, used only to stop spam.

Alerts

If you turn on notifications: a push address for your device, issued by your browser’s push service, so we can send order updates and reminders.

Technical data

A sign-in cookie, basic request logs (such as internet address, browser type and time) that our hosting provider keeps for security and to fix faults, and error reports (the page and the error message) that we email to ourselves when something breaks.

We don't collect your location from your device, your contacts, photos or payment card details.

2. Health information

Your weight, health conditions and other check-in answers are sensitive. We use them only to build your diet and workout plan and to run safety checks. Plans are produced by automated rules, not by a person, and are general fitness and nutrition guidance, not medical advice. If you report a condition our safety rules can't plan around, the AI coach pauses your plan instead of guessing. You can leave optional questions blank, and you can ask us to delete your check-ins at any time.

Your AI buddy is an AI, not a person, a doctor or a dietitian. It sees your plan, today's targets, your logged meals and workouts, the notes you asked it to remember and, if you connected one, your watch data from Google Health; it never sees data from Strava, whose terms don't allow AI use. It follows safety rules: no diagnoses or medicines, and it points you to a doctor or a helpline when something sounds serious. Steps, heart rate and sleep are wellness numbers, not medical measurements.

3. How we use it

• To sign you in and keep your account secure.
• To build, and rebuild every week, your diet and workout plan.
• To send your orders to the kitchen, check the kitchen delivers to your PIN code, track them, apply your gym's discount and issue receipts.
• To send order updates and reminders, if you turn on notifications (you can turn them off at any time).
• To credit your gym for orders and Premium sign-ups, and to pay kitchens and gyms.
• To answer support messages and contact gyms and kitchens who apply to partner with us.
• To answer you in the AI buddy chat, and to show your watch data on your Today screen.
• To see which parts of the app members use, so we know what to improve. Only totals are shown to our team.
• To prevent abuse, such as limiting repeated sign-in attempts and spam applications.

We don't sell your data, show ads, or share it with advertisers or data brokers.

4. Who can see your data

Partner kitchens

For each order: your first name, delivery address and the items ordered. The kitchen’s rider sees the same, through a delivery link for that one order that stops working once it is delivered.

Your gym

Always: your name, plan tier (free, trial or Premium) and when you joined. Only if you turn on trainer sharing in the app: your goal, daily targets, and how many workouts and active days you logged in the past week. You can turn this off at any time.

Refuel staff

Only the people who run the service, to operate it and help you.

Service providers

Companies that run parts of the service for us under contract: Vercel (hosting) and Supabase (database), both running our service on servers in Mumbai, India; Vercel AI Gateway and the AI model provider it routes to (Anthropic), which process your buddy messages to write the reply and are not allowed to use them to train their models; Google and Strava, only for the account you chose to connect; an SMS provider (MSG91 in India, or Twilio in the United States) to text sign-in codes; Resend, which emails sign-in codes and tells us when a gym or kitchen applies; Razorpay, which takes online payments for orders and Premium (it handles your card or UPI details; we only receive a payment reference); OpenFreeMap, which supplies the map pictures on an order that is out for delivery (your device loads them directly, so OpenFreeMap sees its internet address, not your order); and your browser’s push service (such as Google’s for Chrome and the Android app), which delivers notifications you turned on. They may only use your data to provide their service to us.

When the law requires it

If we are legally required to share data with a court, regulator or police, or to protect someone’s safety.

5. Where it's stored and for how long

Your data is stored in our database in Mumbai, India, run by our providers above. We keep it while your account is open. You can delete your account at any time in the app (Me → Delete my account) or on our account deletion page. Your name, contact details, address, check-ins, plans, progress, buddy conversations and notes, connected services and their data, app usage, support messages and notification settings are deleted straight away (we also give back our access to any service you connected), and copies in our database backups expire within 30 days. We keep order, payment and receipt records, without your name or contact details, for as long as Indian tax and accounting law requires (currently up to 8 years), and then delete them. Partner applications we don't go ahead with are deleted within 12 months. Data from a connected watch or fitness app is kept for 90 days, and deleted at once when you disconnect it. App usage records are kept for 90 days.

6. Your rights

Under the Digital Personal Data Protection Act, 2023, you can:

• ask for a summary of the personal data we hold about you and who we've shared it with;
• correct or update it (most of it you can change yourself in the app);
• withdraw your consent and ask us to delete your data;
• nominate someone to act for you if you die or can't act yourself;
• complain to our grievance officer, and if you're not satisfied, to the Data Protection Board of India.

To use any of these, send a message from the app's Support screen or email [Contact email]. We reply within 30 days.

7. Cookies and storage on your device

We use one cookie, rf_session, to keep you signed in for up to 30 days, and in our Android app a second one, rf_src, that only records that you opened Refuel from the app. Your basket is saved in your browser until you place the order, and the installed app stores its own files so it opens quickly. We don't use advertising or cross-site tracking cookies.

8. Security

All traffic is encrypted with HTTPS. Sign-in codes are stored only in scrambled (hashed) form and expire after five minutes, sign-in attempts are limited, and each partner (kitchen or gym) can see only its own orders and members. No system is perfectly secure; if a breach affects your data, we will tell you and the Data Protection Board as the law requires.

9. Children

Refuel is for adults aged 18 and over: you confirm your age when you sign in, and the weekly check-in won't accept a younger age. We don't knowingly collect personal data from anyone under 18. If you believe someone under 18 has given us personal data, contact us and we will delete it.

10. Changes to this policy

If we change how we use your data, we'll update this page and its effective date, and tell you in the app before a significant change takes effect.

11. Contact and grievance officer

[Company legal name]
[Registered address]
Grievance officer: [Grievance officer]
Email: [Contact email]