Kartayu is committed to protecting the privacy and security of your Personal Data. This Privacy Policy of Kartayu (hereinafter referred to as "Privacy Policy") explains how we collect, use, process, store, disclose, transfer, and protect your Personal Data when you access or use the Kartayu application, website, platform, and related Services and shall be effective from 20th October 2026. By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy.
1. Information We Collect
We collect the following categories of Personal Data and identify the source from which each category is obtained below.
| Category | What it includes | Source |
|---|---|---|
| Account | Your email address and basic profile (name, and profile photo where shared) from the sign-in provider. With Apple, the email may be a private relay address. | Sign in with Apple or Sign in with Google |
| Profile | Date of birth, biological sex, height, weight, fitness goals, training background and experience, training schedule and where you train, and a profile picture if you add one | You, or Apple Health with your permission |
| Apple Health data | Heart rate, resting heart rate, heart rate variability, active energy burned, step count, workouts, sleep analysis, VO2 max, height, body weight, date of birth, biological sex, walking and running distance | Apple Health on iPhone and Apple Watch, with your iOS permission, including background sync |
| Workout data | Workout plans, sessions, exercises, sets, repetitions, weights, rest times, effort ratings, and workout metrics recorded with Apple Watch | You and your Apple Watch |
| Injuries and limitations | Injuries you tell us about when you create an AI workout plan, so the plan can work around them. This is health data. | You |
| AI coach conversations | Messages you type to the AI coach and the responses | You and our AI Features |
| Support | Messages you send to support, photos or videos you choose to attach, and a diagnostic log file if you choose to attach one | You |
| Subscription | Subscription status, product, purchase and renewal dates, and Apple transaction identifiers. No card or bank details. | Apple and our subscription service provider |
| Device and diagnostics | Device model, operating system, app version, crash reports, app usage events, IP address in server logs, and approximate location inferred from IP address | Collected automatically |
- We use your health and fitness data only to provide the features you choose to use.
- AI features are optional and process only limited data with your consent. Direct identifiers, such as your name and email address, are removed before processing.
- We do not display ads or track your activity across Third-Party Platform.
- You can delete your account and Personal Data from within the App at any time, subject to Applicable Law requirements.
- The App does not ask access to your camera, microphone, contacts, calendar, motion data, bluetooth, or photo library, and does not send push notifications. Where you choose to upload a profile picture or support attachment, Apple's photo picker is used, and we receive only the specific items you select.
- To keep your information up to date, the App may synchronize Apple Health data in the background. You can manage or disable background synchronization at any time through your device's settings, including the background app refresh settings in iOS.
Unless stated otherwise, the information requested by the App is required to provide its Services. If you choose not to provide required information, we may be unable to provide certain features or Services. Where information is identified as optional, you may choose not to provide it without affecting the availability or functionality of the App.
2. How We Collect Information
We collect information:
- Directly from you when you register, subscribe, or use the Services;
- Automatically through the App and related technologies;
- From wearable devices and fitness integrations authorized by you;
- From Third Party Platforms; and
- From publicly available sources where permitted by Applicable Laws.
2.1 How We Use Personal Data
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and run your account | Account, Profile | Performance of our contract with you |
| Provide workout plans, tracking and insights | Profile, Apple Health data, Workout data, Injuries and limitations | Your consent, given at sign-up and when you allow Apple Health access; necessary to provide the service you ask for |
| Provide AI Features | Profile, metrics derived from Apple Health data, Workout data, Injuries and limitations, AI coach conversations | Your separate, optional permission in the app |
| Manage your subscription | Subscription | Performance of our contract with you |
| Answer support requests | Support, Account | Performance of our contract with you |
| Keep the service secure, prevent abuse, and find and fix crashes | Device and diagnostics | Our legitimate interest in a secure, working service |
| Understand how the app is used so we can improve it | App usage events. These contain no health data. | Our legitimate interest in improving the app |
| Send service and legal notices | Account | Performance of our contract; legal obligation |
| Comply with law and handle legal claims | As needed for the matter | Legal obligation; our legitimate interest in defending claims |
3. Purpose of Processing
We may collect and process your Personal Data for the following purposes:
3.1 Provision of Services
- Creating and managing your account;
- Delivering fitness and wellness services;
- Tracking progress and performance;
- Personalizing user experiences;
- Providing customer support.
3.2 Improvement of Services
- Improving features and functionality;
- Conducting analytics and research;
- Developing new products and services;
- Enhancing user experience.
3.3 Communications
- Sending service-related communications;
- Responding to inquiries;
- Providing notifications and updates;
- Sending marketing communications where permitted and consented.
3.4 Security and Compliance
- Preventing fraud and misuse;
- Ensuring platform security;
- Complying with legal and regulatory obligations;
- Establishing, exercising, or defending legal claims.
3.5 Who Receives Your Personal Data
We share Personal Data to the below parties as mentioned in the table below. We may update this list from time to time to reflect changes in our service providers or processing activities.
| Service | Provider | Data received | Location |
|---|---|---|---|
| Cloud hosting | Amazon Web Services | All data we store | United States |
| Content delivery and file storage | Cloudflare | IP address when media loads; profile pictures; support attachments | United States |
| AI gateway | OpenRouter, Inc. | Pseudonymised fitness and health inputs for the AI Features; see section 8.3 and section 8.4 | United States |
| AI models | Anthropic, PBC; TypeSafe AI, Inc. | Pseudonymised fitness and health inputs for the AI Features; see section 8.3 and section 8.4 | United States |
| Sign-in | Apple; Google | The sign-in request. They send us your email and basic profile. | Worldwide |
| Crash reporting, app analytics and remote configuration | Google Firebase | Your Kartayu user ID, device and diagnostics data, app usage events and approximate location inferred from IP address. No health data. | United States |
| Subscription management | RevenueCat | Your Kartayu user ID and subscription status | United States |
| Customer support and email | Zoho | Support messages and attachments; email address | India |
| Backend monitoring | Pydantic Logfire | Server logs and traces, including AI prompts with health and personal data redacted | United States |
- Apple provides sign in with Apple, payments, and Apple Health. Google provides sign-in if you choose it and handling of Personal Data is as per their respective privacy policy.
- We do not sell Personal Data, share it for advertising, use advertising identifiers, or track you across other companies' apps or websites.
- We disclose Personal Data only where required by Applicable Law, court order, lawful authority, or to investigate fraud, security incidents, or defend legal claims.
- In the event of a merger, sale, acquisition, or transfer of the App or its business, your Personal Data may be transferred to the successor entity. We will notify you before such transfer takes effect, and the successor entity will be required to process and protect your Personal Data in accordance with this Privacy Policy.
3.6 Processing Location. Personal Data is processed at the App's residential address as set forth above and at any other location where the App, its service providers, or authorized processors operate or process data on its behalf.
4. Health Data Processing
4.1 Certain information collected through the Services may constitute health-related information or sensitive Personal Data under Applicable Laws. By voluntarily providing such information and expressly consenting where required, you acknowledge and agree that App may process such information for:
- Providing personalized recommendations;
- Creating fitness plans;
- Monitoring fitness progress;
- Delivering health and wellness insights;
- Performing analytics and service improvements; and
- Complying with legal obligations.
You may withdraw your consent at any time, subject to Applicable Laws.
5. Legal Basis for Processing
5.1 Where required by Applicable Laws, we process Personal Data on the basis of:
- Your consent;
- Performance of a contract with you;
- Compliance with legal obligations;
- Legitimate business interests; or
- Other lawful grounds permitted under Applicable Laws.
6. Sharing and Disclosure of Information
We may disclose Personal Data to:
6.1 Third-party vendors providing:
- AI services (OpenRouter, Anthropic, TypeSafe);
- Data analytics;
- Customer support;
- Payment processing;
- Security services.
6.2 Integrated Platforms
- Where you choose to connect Third Party Platforms such as wearable devices, fitness platforms, or health applications.
6.3 Corporate Transactions in connection with:
- Merger;
- Acquisition;
- Reorganization;
- Investment transaction; or
- Sale of assets.
6.4 Legal Requirements
- Where disclosure is required:
- By law;
- By governmental authority;
- By court order;
- To protect legal rights; or
- To investigate fraud, abuse, or security incidents.
7. Apple HealthKit
7.1 The App accesses Apple Health data only after you grant permission through iOS. With your authorization, the App may also write workout records and related active energy data to Apple Health. The User will be in control as to which Personal Data are shared and may modify or revoke permissions at any time through the Apple Health settings on your device.
7.2 Apple Health data is used solely to provide and improve the health and fitness features you choose to use, including personalized plans, workout tracking, and performance insights.
7.3 We do not use Apple Health data for advertising, marketing, profiling, or data mining purposes, and we do not sell such data. We only share Apple Health data with service providers as necessary to deliver the requested features and in accordance with your permissions and applicable law.
7.4 Apple Health data is not stored in iCloud by the App.
7.5 For provision of Services, we may store Apple Health data obtained through your authorized connection on our servers. Such data is used solely to deliver personalized fitness features and insights and will be deleted when you delete your account, subject to any retention requirements as per Applicable Law.
8. AI Processing
8.1 We use AI for coach chat, workout plans, plan adaptations, and workout insights.
8.2 AI Features are optional and available only with your consent. You may withdraw consent at any time.
8.3 To provide AI Features, we may process and share only the information necessary for the Service, including prompts, fitness goals, training plans, workout history, reported injuries, profile information, and relevant health metrics.
8.4 We remove direct identifiers, such as your name and email address, before sending AI requests and use a pseudonymous identifier where feasible.
8.5 The AI features use Anthropic's Claude models, accessed through OpenRouter. Anthropic's privacy and data-retention terms apply to the data we send. We also use TypeSafe as an AI provider, under zero data retention and with no training on your data. If this changes, we will provide notice and obtain any required consent.
8.6 Anthropic does not use your data to train its models. Anthropic retains AI requests for up to 30 days for safety and abuse monitoring, after which they are deleted, unless a request is flagged by its safety systems or retention is required by law. Your AI coach chat history is stored on our servers and deleted when you delete your account.
8.7 AI-generated content may be inaccurate and is provided for informational purposes only. It is not medical advice.
8.8 We do not make decisions with legal or similarly significant effects solely through automated processing.
8.9 We do not use your AI interactions, fitness data, or health information to train AI models without your express consent.
9. International Data Transfers
9.1 As the App operates globally, your Personal Data may be transferred to, stored, or processed in countries outside your country of residence. Where required by Applicable Laws, App shall implement appropriate safeguards to ensure lawful international data transfers and protection of Personal Data.
10. Data Retention
10.1 The App shall retain Personal Data only for as long as necessary to:
- Provide the Services;
- Fulfill contractual obligations;
- Comply with legal requirements;
- Resolve disputes; and
- Enforce legal rights.
Upon expiration of the applicable retention period, Personal Data shall be deleted, anonymized, or securely disposed of in accordance with Applicable Laws.
11. Data Security
11.1 App implements appropriate technical, organizational, and administrative safeguards designed to protect Personal Data against unauthorized access, disclosure, alteration, destruction, or loss. However, no method of transmission over the internet or electronic storage system can guarantee absolute security.
12. Your Privacy Rights
12.1 Subject to Applicable Laws, you may have the right to:
- Access your Personal Data;
- Correct inaccurate information;
- Request deletion of Personal Data;
- Withdraw consent;
- Request portability of Personal Data;
- Lodge complaints with relevant regulatory authorities.
Requests may be submitted using the contact details provided below.
13. Third-Party Services
13.1 The Services may contain links to or integrations with Third-Party Platforms and the App does not control such Third-Party Platforms and is not responsible for their privacy practices. Users are encouraged to review the relevant privacy policies before sharing information.
14. Children's Privacy
14.1 The Services are not intended for children under the age permitted under Applicable Laws. The App does not knowingly collect Personal Data from children without appropriate parental or guardian authorization where required. If App becomes aware that Personal Data has been collected in violation of this section, reasonable steps shall be taken to delete such information.
15. Marketing Communications
15.1 Where permitted by Applicable Laws, the App may send promotional communications regarding products, features, services, events, and updates. You may opt out of such communications at any time by following the unsubscribe instructions or contacting us directly.
16. Changes to this Privacy Policy
16.1 App reserves the right to amend this Privacy Policy from time to time. Any material changes shall be notified through email communications, or other appropriate means. Your continued use of the Services following such modifications shall constitute acknowledgment of the revised Privacy Policy.
17. Grievance Officer / Data Protection Contact
For questions, requests, complaints, or concerns regarding this Privacy Policy or the processing of Personal Data, please contact:
- App Name:
- Kartayu (Vinod Kumar Biradar)
- Residential Address:
- Vinod Kumar Biradar, Bengaluru, Karnataka, India
- Data Protection Officer / Privacy Officer:
- Vinod Kumar Biradar
- Customer Support:
- help@kartayu.com
- Website:
- www.kartayu.com
By clicking "I Agree," creating an Account, accessing, or using the App, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, processing, storage, and transfer of your Personal Data and health-related information as described herein, and you expressly consent to the processing of your health and fitness information for providing personalized fitness, wellness, and related Services.