Privacy policy
Last updated: 29 September 2026
This policy explains what information Liftuno collects, why we collect it, who we share it with and the choices you have. It covers the Liftuno web app (liftuno.vercel.app), the Liftuno Android app, the Liftuno Windows app and this website.
1. Who we are
Liftuno (“Liftuno”, “we”, “us”) provides gym management software for gyms in Bangladesh.You can reach us at mohiuddin.200@outlook.com.
2. Gyms, members and our role
Each gym that uses Liftuno decides which member and staff information to record, and is responsible for how that information is used. For those records, Liftuno acts on the gym’s behalf, as its service provider.
If you are a gym member or staff member and have a question about your records, please contact your gym first; we will help them respond. For the gym owner’s own account and the gym’s Liftuno subscription, Liftuno is responsible.
3. Information we collect
Account and sign-in
- Name, Bangladeshi mobile number, role (gym admin, staff, member or platform operator) and staff permissions.
- Your six-digit PIN, stored only as a secure one-way hash. We never see your PIN.
- When you were last active, and a 30-day sign-in session.
We don’t ask for an email address to sign in.
Membership records (entered by the gym)
- Member name, mobile number, optional member ID, joining date, monthly fee and membership status.
- Coverage periods, charges, discounts, write-offs, offers and offer requests.
Payment records
- Amount, date, method (cash, bKash or bank transfer), an optional reference such as a transaction ID, who recorded it, and the resulting receipt.
- Liftuno does not process payments. Members pay the gym directly and the gym records the payment.
Attendance
- Date and time of each check-in, and whether it came from the gym’s QR code or was added by staff (with a reason for manual entries).
Gym business information
- Gym name, address, phone numbers and logo.
- The bKash number and bank account details the gym shows members for payments.
- Spending, other income, recurring costs, photos of bills, cash-drawer counts, and trainer names with their share of training income.
Text messages (SMS)
- For each SMS we send — sign-in codes, invitations and messages a gym chooses to send — we keep the phone number, message text, delivery status and the SMS provider’s message ID. Sign-in codes are masked in this log once sent.
Security and activity records
- A history of every change in a gym (what changed, who did it and when). Corrections are recorded as reversals rather than edits.
- Counters of wrong PIN attempts, and one-time sign-in and login codes, stored as hashes, which expire.
Stored on your device
- Your sign-in session (in the Android app, in the phone’s secure storage).
- Your language choice.
- If you scan a gym QR code while signed out, a pending check-in that is deleted after 15 minutes.
This website
This marketing website doesn’t use cookies, analytics or tracking. Like any website host, our hosting provider may keep standard technical logs (such as IP address and browser type) for security and reliability.
4. Device permissions
- Camera and photos (Android): used only when you choose to take or pick a photo — for example, a bill for a spending record or your gym’s logo. Liftuno doesn’t access your camera or photos at any other time.
- Windows app: doesn’t request camera, microphone, location or notification permissions. Files are only read when you choose them.
- Liftuno doesn’t collect your location or contacts.
5. How we use information
- To provide the service: sign-in, balances, receipts, attendance, finance reports and exports.
- To send the SMS messages you or your gym ask for: sign-in codes, invitations and gym messages.
- To keep accounts secure: preventing unauthorised access, detecting misuse and keeping an audit trail.
- To bill gyms for their Liftuno subscription and paid SMS.
- To answer you when you contact us for support.
We don’t sell personal information, use it for advertising, or build advertising profiles. The Liftuno apps contain no analytics, advertising or crash-reporting tools.
6. Service providers
We share information only with the providers that run parts of the service for us, and only as needed:
| Provider | What they do |
|---|---|
| Convex | Database, file storage (logos and bill photos) and server functions |
| Better Auth | Sign-in and sessions, including its hosted administration dashboard |
| MRAM SMS (Bangladesh) | Delivering SMS messages |
| Vercel | Hosting the web app and this website |
| Expo (EAS) | Building the Android app and delivering its updates |
| Google Play, Microsoft Store | Distributing the apps (their own privacy policies apply to the stores) |
We may also disclose information when the law requires it, or to protect the rights, property or safety of our users or others. If Liftuno is merged or sold, information may transfer to the new owner under this policy.
7. Where data is stored
Our service providers may store and process data on servers outside Bangladesh. We choose providers that protect data in transit and at rest with industry-standard security.
8. How long we keep it
- We keep a gym’s records while its account is active. Payments, receipts, day closes and the change history are kept intact because gyms rely on them for their accounts.
- When a gym closes its account, we delete or anonymise its data within 90 days, unless the law requires us to keep some of it for longer.
- When a person asks to delete their account, we remove their sign-in and personal details. Financial records the gym needs may be kept with the name and phone number removed. See Delete your account.
- Sign-in codes expire within minutes, and login codes within 24 hours.
- The public demo (liftuno-demo.vercel.app) needs no account. Each visitor gets a private copy of a fictional gym; the copy and anything typed into it are deleted within 24 hours, or as soon as the visitor exits the demo or starts over. The demo never sends SMS.
9. Security
- All connections use HTTPS encryption.
- PINs and one-time codes are stored as hashes, never as plain text.
- After five wrong PIN attempts, sign-in for that number is paused for 15 minutes.
- Each gym’s records are kept separate, and staff see only what their permissions allow.
- Every change is logged with who made it.
No system is perfectly secure, but we work to protect your information and will act promptly if a problem occurs.
10. Your choices and rights
- You can ask to see, correct or delete the personal information we hold about you.
- Members can ask their gym to correct their details or to stop sending them SMS messages.
- You can change your language and your PIN at any time in the app.
- To delete your account and data, follow the steps on our account deletion page.
To make a request, email mohiuddin.200@outlook.com. We may confirm your identity by sending a code to your registered mobile number.
11. Children
Liftuno is built for gyms and is not directed at children. When a gym registers a member under 18, the gym is responsible for having the consent of a parent or guardian.
12. Changes to this policy
We may update this policy as Liftuno changes. We will change the “Last updated” date above and, for significant changes, tell gym admins in the app or by SMS.
13. Contact us
Questions about privacy? Email mohiuddin.200@outlook.com.