Privacy Policy

Effective date: 2026-05-17 Last updated: 2026-10-10

1. Who we are

Agaru ("we," "us," "our") is a service operated by Performa Creative, a company offering a live group-fitness leaderboard, heart-rate tracking, and class management software for gyms and their athletes.

You can reach us at:

• Email: support@agarufit.com
• Postal: Available on request — email support@agarufit.com
• Data Protection Officer: support@agarufit.com (subject line: "DPO")

This Privacy Policy describes what personal information we collect, why we collect it, how we use it, who we share it with, and what rights you have over your information.

2. Who this policy applies to

This policy applies to anyone who uses our service, including:

• Athletes — individuals who attend classes at a gym using Agaru, including via our iOS/Android phone app, our Apple Watch / Wear OS apps, or by checking in on a gym TV.
• Coaches and gym staff — individuals using our admin web app to schedule classes, manage rosters, and view leaderboards.
• Gym owners — businesses (our customers) that subscribe to Agaru to run classes for their members.
• Visitors to our marketing website at https://agarufit.com.

For athletes: the gym you attend is our customer. They use Agaru to run their classes. Some of your data is processed by us on the gym's behalf (acting as the data controller) — see Section 4 for details.

3. The information we collect

We have deliberately minimized what we collect. Here is the complete list:

3.1 Account information

When you create an account, we ask for:

• Email address — used to log you in, send transactional emails (password resets, class confirmations), and identify you uniquely.
• First and last name — shown on the leaderboard so coaches and classmates can recognize you.
• Password — stored only as a salted hash (we never see or store your plain-text password).

Optional fitness profile — date of birth, weight, sex and maximum heart rate. You can leave these blank; if you add them we use them only to make heart-rate zones and calorie estimates more accurate.

We do not ask for: phone number, height, address, card or bank details, government ID, or social-network identifiers.

3.2 Health and fitness data ⚠️ Special category data

When you take part in a live class, we collect:

• Heart rate (BPM) — sampled approximately once per second during a live class session, transmitted to our servers in real time so your effort score and zone appear on the gym's leaderboard.
• Heart-rate-derived metrics — HR zone (Z1–Z5), zone time, estimated calorie burn, effort score. Computed from your heart rate using a formula based on your age and resting heart rate (which you supply during onboarding; we don't read these from HealthKit).

Sources: whichever you choose — an Apple Watch or Wear OS watch, a Bluetooth heart-rate strap, Apple Health / Health Connect, or (with no wearable) your phone's motion sensors, which produce an effort estimate rather than a heart rate. Device permissions can be revoked at any time in your device settings.

Consent: before your first live class the app asks for your explicit consent to process heart-rate data, and records the date and the version of the consent text you agreed to. You can withdraw it at any time in the app under Profile → Privacy; you can still book classes, but you won't appear on live leaderboards.

Optional export: if you turn on Profile → Calendar & Health → Save classes, we write each finished class (duration and calories) to Apple Health or Health Connect on your phone. Classes recorded by your Apple Watch are already saved by the watch and are skipped.

Storage scope: heart-rate samples are kept for the duration of a class plus 30 days for dispute resolution and personal-record verification, then deleted automatically by a daily job. After 30 days we retain only aggregate per-class summaries (total time per zone, calories, effort score, peak HR), not individual samples.

This is "special category data" under GDPR Article 9, the Saudi PDPL Article 23, the UAE PDPL Article 5, and analogous sensitive-data provisions of other jurisdictions. We process it only with your explicit consent (collected in the app before your first live class) and only for the purpose described above.

3.3 Class and attendance data

• Class bookings, check-ins, attendance status — when you book or check into a class, we record the class ID, the gym, the timestamp, and the outcome (booked / checked-in / completed / no-show).
• Leaderboard rank and score per class — derived from your HR data above.
• Personal records (PRs) — your best score per class type per gym.

3.4 Membership, payment and staff records

• Memberships and passes — the plans you buy from your gym (class packs, unlimited plans), their dates, and how many classes you've used.
• Payment records — when your gym's staff record a sale: the amount, currency, payment method (e.g. cash, CliQ, card) and an optional reference number. We never receive card numbers or bank details; payment itself happens at your gym.
• Staff notes — short notes your gym's coaches may add to your profile (for example an injury to work around). They are not shown in the app, and they are included if you request a copy of your data.
• Class calendar link — if you subscribe to your class calendar, a secret link that lets your calendar app fetch your bookings. You can reset it at any time, which stops the old link working.

3.5 Device data

• Push-notification token — if you opt into push notifications, your device sends us an Apple/Google push token so we can deliver class reminders, waitlist and membership updates, streak and weekly-summary messages, and achievement notifications. You can turn the reminder and summary messages off in Profile → Notifications.
• Approximate technical data — app version, OS version, device model. Used for crash diagnostics and to roll out fixes for OS-specific bugs. We do not collect device IDs, advertising IDs, or persistent fingerprints.
• IP address — automatically logged by our servers for security (rate limiting, fraud detection) and audit purposes. Retained for 90 days then deleted.

3.6 Camera and microphone

• Camera is requested only when you scan a class check-in QR code. No images are taken or stored; the camera buffer is processed locally on your device for QR decoding only.
• Microphone is declared as a permission on iOS but is not actively used by Agaru today. The declaration exists because of a default in our app framework (Expo). We will remove it in a future release.

3.7 We do not collect

• Location (GPS or otherwise)
• Contacts, photo library, calendar, files
• Any Apple Health data other than heart rate during an active class
• Your video, audio, or biometric face/voice data
• Children's data — see Section 9
• Browsing history outside our app/website
• Cross-app or cross-website tracking identifiers

4. Why we collect this — and on what legal basis

| Purpose | Data used | Legal basis (GDPR / KSA PDPL / UAE PDPL) | |---|---|---| | Provide the leaderboard service | Account info, HR data, class data | Performance of the contract (the Terms of Service you agreed to), AND for HR data: your explicit consent | | Authenticate you and secure your account | Email, password hash, IP, device data | Legitimate interest (account security) | | Send transactional emails (password resets, class reminders) | Email | Performance of contract | | Send push notifications you opted into | Push token | Your consent (revocable in OS settings) | | Detect fraud, prevent abuse, debug | IP, device data, audit logs | Legitimate interest | | Comply with legal obligations | All of the above as required | Legal obligation | | Operate the gym's class roster (acting on the gym's behalf) | Account info, class data | The gym's contract with their members; we are a data processor for this |

We do not rely on legitimate interest for processing your heart-rate data — that always requires your explicit consent.

5. Who we share your information with

We share data only as listed below. We do not sell your information.

5.1 Your gym

The gym you attend can see:

• Your name and email (so they know who's in the class)
• Your live HR, HR zone, and effort score during the class (on the TV display and the coach app)
• Your historical attendance and class scores at that gym
• Your memberships and the payments their staff recorded
• Notes their staff have written about you

A gym cannot see: your data from other gyms, your password, your devices, or any heart-rate samples older than the 30-day retention window.

5.2 Other athletes in the same class

Your first name and leaderboard rank/score are visible to other athletes in the same live class on the gym's TV display and on the athlete app. You can request that we display only your initials by emailing support@agarufit.com (we'll add a privacy mode setting in a future release).

5.3 Service providers (data processors)

We share strictly necessary data with the following service providers, all of whom are contractually bound to process data only on our instructions:

• Hosting, database and cache — Oracle Corporation (Oracle Cloud Infrastructure), Saudi Arabia Central region (Riyadh). Our database and our Redis cache/queue run on our own servers there; storage volumes are encrypted at rest. Privacy policy.
• Push notifications — Apple, Inc. (APNs) and Google LLC (FCM), via Expo's push service. We send only the push token + the notification payload (no other personal data).
• Transactional email — Resend, Inc. We send only your email address and the message content. Privacy policy.
• Crash & error monitoring — Sentry (Functional Software, Inc.). Error reports may contain stack traces, app version, and a hashed user ID — never your HR data, password, or email content.

We do not share data with advertising networks, analytics brokers, or social platforms.

5.4 Legal requests

We may disclose information if required by a binding legal order from a court of competent jurisdiction, or to protect against imminent harm. We will notify you of any such request unless legally prohibited from doing so.

5.5 Business transfers

If Agaru is acquired or merges with another company, your information may be transferred as part of that transaction. We will notify you in advance and you will retain all rights described in this policy.

6. International transfers

Agaru's primary servers are in Riyadh, Saudi Arabia (Oracle Cloud's Saudi Arabia Central region). If you use Agaru from outside Saudi Arabia — for example from Jordan, the UAE or the EU — your data is transferred to and processed in Saudi Arabia. Some service providers listed in Section 5.3 (email, error monitoring, push notifications) process the limited data they receive in other countries, including the United States.

We rely on the following safeguards for international transfers:

• Contractual safeguards with our service providers, including Standard Contractual Clauses or equivalent data processing terms where they apply.
• Encryption in transit (TLS 1.2+) for all traffic, and encryption at rest for stored data, including health data.
• Data minimisation — providers outside Saudi Arabia receive only what they need (an email address, a push token, an error report), never heart-rate data.

If you are in Saudi Arabia, you have the right to be informed of these transfers and to object under PDPL Article 30. Email support@agarufit.com to do so.

7. How long we keep your information

| Data | Retention | |---|---| | Account info (email, name, hashed password) | While your account exists, plus 30 days after deletion request | | Heart-rate samples (raw, per-second) | 30 days after the class | | Aggregate per-class summaries (calories, zones, effort score) | While your account exists | | Personal records | While your account exists | | Attendance records | While your account exists | | Memberships and payment records | While your account exists (gyms may need them for their own accounting) | | Staff notes | Until the gym deletes them or your account is deleted | | IP logs | 90 days | | Audit logs (admin actions, security events) | 1 year | | Push tokens | Until you uninstall the app or revoke notifications | | Backups (Postgres) | 14 days rolling, then deleted |

When you request account deletion (see Section 8), we delete or irreversibly anonymize all of the above within 30 days, except where retention is required by law (e.g., a gym's financial records of payments you made to it).

8. Your rights

You have the following rights over your personal information:

| Right | What you can do | How | |---|---|---| | Access | Get a copy of all the data we hold about you, in machine-readable format | In the app: Profile → Privacy → Download my data. Or email support@agarufit.com | | Rectify | Correct inaccurate data | In the app's profile screen, or via support@agarufit.com | | Delete ("right to be forgotten") | Have your account and data deleted | In the app: Profile → Delete Account. Or email support@agarufit.com | | Restrict processing | Tell us to stop using your data while a complaint is resolved | Email support@agarufit.com | | Object | Object to specific uses (e.g., legitimate-interest processing) | Email support@agarufit.com | | Portability | Receive your data in a portable format (JSON) | In the app: Profile → Privacy → Download my data | | Withdraw consent | Stop us from processing data that relies on your consent (e.g., HR collection) | In the app: Profile → Privacy, or in OS Settings → Health/Permissions, or email support@agarufit.com | | Lodge a complaint | File a complaint with a supervisory authority | See Section 11 below |

We respond to all rights requests within 30 days, free of charge for the first request per year.

For users in Saudi Arabia, the UAE, and Jordan, equivalent rights under the relevant national PDPL apply and are honored.

9. Children's data

Agaru is not intended for, and we do not knowingly collect data from, children under 16 years old. If we learn that we have collected data from a child under 16 without verified parental consent, we will delete it.

If you are a parent and believe your child has created an account, please email support@agarufit.com and we will investigate within 7 days.

This minimum age applies in jurisdictions including the EU (GDPR Article 8), Saudi Arabia, the UAE, Jordan, the United Kingdom, and the United States (COPPA — actually applies to under-13s, but our 16+ floor exceeds that).

10. Security

We protect your data with:

• Encryption — TLS 1.2+ for all connections; AES-256 at rest in Postgres.
• Access control — only authorized engineers have production access; production access is logged and audited.
• Hashed passwords — bcrypt with industry-standard work factors.
• Short-lived tokens — JWTs with limited scope; QR check-in tokens valid for 30 seconds only.
• Network isolation — production database and Redis are not exposed to the public internet.
• Backups — Postgres backups encrypted and tested monthly.
• Monitoring — automated alerts on unusual access patterns.

No system is perfect. If we discover a breach affecting your data, we will notify you within 72 hours of becoming aware, as required by GDPR Article 33–34 and the Saudi PDPL Article 35.

11. Supervisory authorities

If you believe we have not handled your information properly, you can complain to:

• EU / EEA: the data protection authority of your country of residence. List: https://edpb.europa.eu/about-edpb/about-edpb/members_en
• Saudi Arabia: the Saudi Data & Artificial Intelligence Authority (SDAIA) — https://sdaia.gov.sa
• UAE: the UAE Data Office — https://www.uaedo.gov.ae
• Jordan: the Personal Data Protection Council (under the Ministry of Digital Economy and Entrepreneurship)
• UK: the Information Commissioner's Office (ICO) — https://ico.org.uk
• California, USA: the California Attorney General's Office under CCPA

We would prefer you contact us first so we can resolve the issue directly: support@agarufit.com.

12. Changes to this policy

We will revise this policy when we change how we handle your information. Material changes will be communicated by:

• An in-app notification when you next open Agaru
• An email to your account address (for changes that materially affect your rights)
• An updated "Last updated" date at the top of this document

Continued use of the app after a material change constitutes acceptance of the revised policy.

13. Specific jurisdictional addenda

13.1 Saudi Arabia (PDPL)

• We process your personal data on the legal basis of your consent and for the performance of the contract under Article 6 of the PDPL.
• For sensitive data (heart rate), we rely on Article 23 explicit consent.
• You may exercise all rights under PDPL Articles 4–9 by emailing support@agarufit.com.
• Cross-border transfers comply with PDPL Article 30 — see Section 6.

13.2 United Arab Emirates (Federal Decree-Law No. 45 of 2021)

• Equivalent rights and obligations apply.
• Sensitive data processing follows Article 9 of the Decree-Law.
• For users in DIFC or ADGM free zones, the relevant zone's data protection law (DIFC DPL 2020 / ADGM DPR 2021) applies in parallel.

13.3 European Economic Area / United Kingdom (GDPR / UK GDPR)

• Our EU representative under GDPR Article 27 is [EU_REP_NAME], [EU_REP_ADDRESS], [EU_REP_EMAIL]. (TODO: appoint when launching in the EU.)
• Our UK representative under UK GDPR is the same.

13.4 California (CCPA / CPRA)

• We do not "sell" or "share" personal information as those terms are defined under CCPA.
• California residents have rights to know, delete, correct, and limit use — same procedures as Section 8.
• We do not respond to "Do Not Track" signals; see Section 8 for the right to opt out of any processing.

14. Contact

Questions, requests, or complaints:

• General: support@agarufit.com
• Data subject rights: support@agarufit.com (subject: "Data Rights Request")
• Security disclosures: support@agarufit.com (subject: "Security")
• Postal: Available on request — email support@agarufit.com

We respond within 5 business days for general queries, 30 days for rights requests.