Privacy Policy

Punch Monk Inc. ("Punch Monk," "we," "us") operates punchmonk ai and the coach + client applications. This policy explains what we collect, why, and the rights you have over your data.

1 · What we collect

• Account data: name, email, phone, business name, profile photo, timezone, locale.
• Coaching data you create: programs, exercises, check-in templates, client roster, messages, payment history.
• Client data your clients submit: workout logs, body metrics, progress photos, wearable data (where authorised).
• Technical data: device, IP, browser, app version, crash reports — used to keep the service running and secure.
• Marketing site analytics: aggregated, anonymised pageviews. No tracking cookies are set unless you opt into a paid plan.

2 · Why we collect it

• To provide the service you signed up for.
• To process payments via Stripe and Razorpay (we never store card numbers).
• To send transactional email (receipts, password resets, check-in nudges).
• To investigate abuse, security incidents, and fraud.
• To meet legal obligations (tax, audit, lawful requests).

3 · Who has access

Only Punch Monk staff with a need-to-know basis. We never sell data. We share with the minimal set of subprocessors required to run the service: AWS, Supabase, Stripe, Razorpay, Resend, Firebase, Google Cloud. A current list is available on request.

4 · Where it lives

Data is stored in our primary region (Mumbai, ap-south-1). Backups are encrypted at rest. Some subprocessors operate globally — see their respective DPAs.

5 · How long we keep it

Active account data is retained while your subscription is active. On cancellation we keep a backup for 90 days, then permanently delete. You can export everything you've created at any time from the in-app data export tool.

6 · Your rights

Under GDPR (EU/UK), DPDP Act 2023 (India), and CCPA (California) you have the right to access, correct, delete, port, and object to processing of your data. Email [email protected] with the subject "data request" and we will respond within 30 days.

7 · Children

Punch Monk is not directed at children under 16. We do not knowingly collect data from minors without parental consent.

8 · Cookies

The marketing site sets one cookie to remember your light/dark preference and no third-party advertising cookies. The product app uses session cookies required for authentication.

9 · Changes

We will email all account holders 30 days before any material change to this policy. The effective date at the top of this page tracks the latest version.

10 · Contact

Punch Monk Inc., privacy officer: [email protected].