Privacy Policy · OROGEN

1. Who we are

OROGEN (www.orogenapp.com) is a workout-tracking app operated by Sandesh Pakhare, India ("OROGEN", "we", "us"). For the purposes of India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), we are the Data Fiduciary for the personal data described here, and you are the Data Principal.

Contact for anything about your data, including grievances: orogen.app.team@gmail.com.

2. What we collect and why

We only collect what the app needs. Here is every category, what it is for, and whether you have to provide it.

DataWhat it's used forRequired?

Account: What it's used for:Your email address, name and password (stored only as a secure hash by our authentication provider; we never see it). If you use Google sign-in: your name, email, Google account ID and profile-picture link (we don't use the picture). Used to create and secure your account and send account emails.; Required?:Yes
Profile & preferences: What it's used for:Display name, chosen avatar, units, theme, app mode, default rest time, time zone, training start date, your gym's plates, bar and rack spacing, and your plan: experience level, main goal, where you train, training days and usual training time. Used to personalise the app, pick a starter program, count Daily Quest days in your time zone and time your reminders.; Required?:Display name yes; the rest optional
Training data: What it's used for:Routines, custom exercises, workouts, sets (weight, reps, duration, RPE, set type) and notes, plus what we calculate from them: volume, personal records, Daily Quest days, streaks, Streak Shields, seasons, achievements and your strength rank (current and peak, and the confirmed lifts behind it).; Required?:Only what you choose to log
Body data: What it's used for:Sex, birth date, height and bodyweight history. Sex, bodyweight and age (from your birth date) are used to calculate your Strength Grades and strength rank against published powerlifting data; bodyweight also powers your bodyweight chart. Height is simply stored on your profile and isn't used in any calculation. Because sex and birth date set your rank, they can be changed once every 30 days; you can always erase them.; Required?:Optional, with separate consent
Rank verification: What it's used for:Only if you ask us to verify a Magma or Orogen rank: the video link you paste, an optional note, and a snapshot of the lifts, bodyweight, sex and age behind that rank. A reviewer (the operator) opens the link where you posted it and approves or declines it with an optional note. We store the link, never the video. Kept with your account and erased when you delete it.; Required?:Optional
Reminders: What it's used for:If you turn on reminders: the push address and encryption keys your browser gives us for this device, the device's browser name, and a log of which reminders we sent and whether you opened them (so we can send fewer if you ignore them). Push messages are delivered through your browser maker's push service (Google, Apple or Mozilla). Turn reminders off in Settings or in your phone's settings at any time.; Required?:Optional
Voice logging: What it's used for:Only if you tap the microphone in a workout. Your browser turns your speech into text using its own speech service (Google on Android and Chrome, Apple on iPhone and Safari), under that company's privacy terms. Orogen receives only the resulting words, turns them into a weight and reps on your device, and never records, sends or keeps audio. Your readiness check answers (slept badly, sore) are kept only with the in-progress workout, synced like the rest of it so another device can resume it, and deleted when the workout is finished or discarded.; Required?:Optional
Device storage: What it's used for:Your in-progress workout, workouts waiting to sync, cached screens and preferences are saved on your device so the app works offline and survives a refresh.; Required?:Needed for offline use
Technical logs: What it's used for:Our hosting and database providers record technical information such as IP address, browser type and request times, to keep the service secure and diagnose errors.; Required?:Automatic

We do not collect your location, contacts, photos, payment details or advertising identifiers, and we do not use third-party analytics, advertising or tracking tools. If you add a photo to a story image, it is processed on your device and never uploaded to us.

We process your personal data on the basis of your consent (section 6 of the DPDP Act). You give it when you create an account and accept this policy and the Terms. Body data has its own, separate consent, asked for only if you choose to add it.

You can withdraw consent at any time, as easily as you gave it:

Body data: Settings → Privacy & data → Remove my body data. This erases your sex, birth date, height and bodyweight history, and your Strength Grades become "unrated".
Everything: Settings → Privacy & data → Delete my account.

Withdrawing consent does not affect processing that happened before you withdrew it.

In limited cases the law allows processing without consent (section 7), for example to comply with a legal obligation or a court order.

We never sell, rent or trade your personal data, and we don't share it for advertising. We use a small number of service providers ("Data Processors") who process data only on our instructions and only to run OROGEN:

ProviderWhat they doData involved

Supabase: What they do:Database and sign-in. Our database is hosted in Mumbai, India (AWS ap-south-1).; Data involved:All data described above
Vercel: What they do:Hosts the website and app; may serve requests from locations worldwide, including the USA.; Data involved:Requests passing through, technical logs
Google: What they do:Only if you choose “Continue with Google”, to confirm your identity.; Data involved:Your Google name, email, account ID and picture link
Resend: What they do:Sends account emails (sign-up confirmation, password reset).; Data involved:Your email address and the email's content

We may also disclose data if required by law, to protect the rights, property or safety of our users or others, or as part of a merger or sale of OROGEN, in which case your data would remain protected by this policy and you would be told first.

5. Where your data is stored

Your account and training data are stored in India (Mumbai). Some providers above may process data in other countries (for example, Vercel in the USA) to deliver the service. The DPDP Act permits this unless the Government of India restricts transfers to a particular country; we will follow any such restriction.

6. How long we keep it

We keep your data for as long as you have an account, because keeping your training history is the point of the app.
When you delete your account, your data is erased from our live database immediately. Backup copies, if any, expire within 30 days.
Data stored on your device stays there until you sign out, clear the app's site data, or delete your account from that device.
Technical logs held by our providers are kept for short periods set by those providers, and security logs for at least one year where the law requires it.
If we ever decide to remove long-inactive accounts, we will email you at least 48 hours before doing so.

7. Your rights

Under the DPDP Act you have the right to:

Access a summary of your data and how it is processed: Settings → Privacy & data → Download my data gives you everything we hold, instantly.
Correct or update your data: edit it directly in the app (Profile and Settings), or email us.
Erase your data: Settings → Privacy & data → Delete my account, or email us from the address on your account.
Withdraw consent, as described in section 3.
Nominate someone to exercise these rights for you in the event of your death or incapacity: email us with their name and contact details.
Grievance redressal: email orogen.app.team@gmail.com. We aim to reply within 7 days and will resolve it within 90 days at the latest. If you are not satisfied, you can complain to the Data Protection Board of India.

8. Children

OROGEN is only for people aged 18 or over. Everyone confirms this when creating an account. We do not knowingly process the personal data of children (under 18 under the DPDP Act). If we learn that an account belongs to someone under 18, we will delete it. If you believe a child is using OROGEN, please email us.

9. Security

We protect your data with reasonable security safeguards, including:

Encrypted connections (HTTPS) everywhere.
Database rules (row-level security) that let each account read and change only its own data, tested automatically.
Passwords stored only as secure hashes by our authentication provider.
Access to production systems limited to the operator.

No system is perfectly secure. If a personal data breach affects you, we will inform you and the Data Protection Board of India as the law requires.

10. Cookies and device storage

We use only essential cookies, to keep you signed in. We also use your browser's local storage for your in-progress workout, offline sync and preferences such as theme. We don't use advertising or tracking cookies, so there is nothing to opt out of.

11. Changes to this policy

If we make a material change, we will show it in the app and ask you to review and accept the new version before continuing. The effective date at the top of this page always shows the current version (2026-10-09).

12. Contact

Sandesh Pakhare, India. Email: orogen.app.team@gmail.com.