Privacy Policy

Last updated 27 October 2026

We collect only what we need to sell you a gym pass: your account details, your bookings, and (if you allow it) your location to find gyms near you. We never sell your data. Card and UPI details go straight to Razorpay and never touch our servers.

This policy explains how Nomead ("Nomead", "we", "us") handles personal data when you use nomead.app, book.nomead.app, our API and our mobile apps (together, the "Service"). We follow the Digital Personal Data Protection Act, 2023 (the "DPDP Act"), the Information Technology Act, 2000 and the rules under it. For the DPDP Act, Nomead is the data fiduciary.

1. What we collect

You give us:

Account data: your name, email address and password (stored hashed, never in plain text). If mobile sign-in is switched on, your phone number.
Booking data: the gyms you view, save and book, pass type, dates, number of guests, pass codes, check-ins, credit balance and transactions, and cancellations.
Reviews: ratings and comments you post about a visit.
Gym owner data: if you list a gym, its name, address, map location, photos, prices and opening hours, plus the business and bank details Razorpay needs to pay you.
Messages: what you send to hello@nomead.app.

Collected automatically or with your permission:

Location: only if you allow it, to show gyms near you and directions. You can turn it off in your device settings and search by city instead.
Camera: only for gym staff scanning a member's pass QR code. Images are not stored.
Photos: only the images you choose to upload, such as gym photos.
Device and log data: IP address, browser or device type, operating system, pages viewed and error logs, used to keep the Service secure and working.

Payments: card, UPI and netbanking details are entered on Razorpay's checkout and handled by Razorpay. We receive only a payment reference, the amount, the status and the type of method (for example "UPI").

We do not knowingly collect data from anyone under 18. If you believe a child has given us data, write to us and we will delete it.

2. Why we use it

To create your account and sign you in.
To process bookings, take payment, issue passes, verify them at the gym door, and handle cancellations and refunds.
To send service messages: booking confirmations, reminders, receipts and account notices.
To show gyms near you and to rank and filter search results.
To let a gym see who holds a pass for its venue (your name and pass details, not your email or payment data).
To prevent fraud and abuse, fix bugs, and meet legal duties such as tax records.

We rely on your consent (which you can withdraw) or on the "legitimate uses" the DPDP Act allows, such as carrying out the booking you asked for and complying with the law. We send marketing messages only if you opt in.

3. Who we share it with

Gyms you book: your name, pass type, dates and pass code, so they can let you in.
Razorpay: our payment processor, under its own privacy policy.
Infrastructure providers: Supabase (database and sign-in) and Cloudflare (hosting and delivery) store and process data for us under contract. Some of their servers are outside India.
Authorities: when the law requires it, or to protect our users, our rights or the Service.
A buyer or successor: if Nomead is merged or acquired, the new owner must honour this policy.

We do not sell your personal data, and we do not run third-party advertising or tracking on the Service.

4. Storage on your device

We do not use advertising or analytics cookies. We use your browser's local and session storage, and the app's own storage, only for things that make the Service work: keeping you signed in, remembering that you closed a banner, and your recent searches. Signing out or clearing site data removes them.

5. How long we keep it

We keep account data while your account is open. Booking and payment records are kept for as long as tax, accounting and consumer law require (generally up to 8 years). Logs are kept for a short period for security. When you delete your account we erase or anonymise your personal data, except records we must keep by law.

6. Your rights

Under the DPDP Act you can:

ask for a summary of the personal data we hold about you and who we share it with;
ask us to correct or complete it, or to erase it;
withdraw consent at any time (this does not affect what we did before);
nominate someone to exercise these rights if you die or become unable to;
complain to us, and then to the Data Protection Board of India if we do not resolve it.

Email hello@nomead.app from the address on your account. We reply within 30 days, and sooner for simple requests.

7. Security

Data is encrypted in transit, passwords are hashed, access to production data is limited, and gym staff see only what they need for a pass. No system is perfectly secure. If a breach affects your data, we will tell you and the Data Protection Board as the law requires.

8. Changes to this policy

If we change this policy in a way that matters, we will say so in the app or by email before it takes effect. The date at the top shows the latest version.

9. Contact and grievances

Grievance contact: Nomead, Kerala, India. Email hello@nomead.app. We acknowledge complaints within 48 hours and resolve them within 30 days.

Adapted from the General Legal privacy policy and terms of use templates (CC0) and reworked for an Indian day-pass marketplace. Not legal advice.