Privacy policy

1. Who we are

Akhra is made by Meer Md Estiyak Ahmed, an individual developer in Bogura, Bangladesh. He decides how your data is used. Contact for every privacy question: founder@akhra.app.

We never sell your data and show no ads.

2. What we collect in the app, and why

We use it to run the app, keep it safe and fair, and fix bugs. Nothing else.

• Google sign-in: your email, Google account ID and Google name (it becomes your display name; you can change it). We never get your Google password.
• Age check: you enter your date of birth on the phone; only the birth year and an "18 or older" mark are stored.
• Profile, only what you add: disciplines, weight class, gym, district, bio, fight record and an optional photo. It is private until you make it public.
• Training: your logged sessions (including a short note), streaks, XP, ranks, badges, and settings such as language, weekly goal and reminder time. Until you sign in, your logs stay on your phone only.
• Health information: the optional "Injured / resting" switch with its dates, and the optional "Body" mark (good, sore or hurt) on a log. Only you can see them. They are never shown on your profile, share card or website, and never sent to analytics.
• Invites: your invite code and the code of the person who invited you (also read from the Google Play install referrer). Anyone who types your code sees the first word of your display name; the inviter sees only a count.
• Device check: a one-way hash of your phone’s Android ID, made on the phone. The real ID never leaves the phone. We use it only to stop duplicate accounts and fake invites.
• Feedback you send: your text, an optional screenshot, phone model, Android and app version, and the screen you were on.
• Your acceptance of our terms: version, language and time.

Anonymous analytics and crash reports run from the first time you open the app, also before you sign in. They are a short fixed list of events (for example "timer started" or "log saved") and crash reports, sent to PostHog and Sentry with a random ID that is not your account ID, plus app version, Android version and phone model. They never contain your name, email, notes, invite code or health information. There is no session recording and no location. We ask both services not to store IP addresses. There is no in-app switch to turn this off; if you object, email us and we will remove your analytics and crash data.

We do not collect your location, contacts, messages, phone number, advertising ID, files, camera or microphone.

3. What the website collects

• Waitlist and newsletter: your email, language, sign-up time and a hash of your IP. We email you one confirm link first; nothing else is sent until you confirm. Then we email you once when Akhra launches (newsletter sign-ups: news now and then). Unconfirmed addresses are deleted after 30 days. When you unsubscribe we delete your address and keep only a one-way hash of it, so it is never signed up again by mistake.
• Founding Coach form: name, phone or WhatsApp, gym, district, disciplines and student count, so the founder can contact you.
• Account deletion form: the email you give, to check the account is yours and delete it.
• Profile reports: the reason, an optional note (up to 500 characters) and a hash of the reporter’s IP.
• Forms keep only a hash of your IP (salted, changes daily) to limit spam; the raw IP is never stored. The website has no ads and no tracking cookies. Its one cookie remembers your language for a year. When a public profile page is opened or reported, our server may send PostHog one anonymous event (language, a broad referrer group, the report reason) with a random ID and no IP.

4. Who we share it with

Only these service providers, and only so they can do their job for us. Whenever your phone or browser connects to one, it technically sees your IP address. Your public profile shows only what you switch on, to anyone with the link.

• Supabase: database, sign-in, photos and server functions (Singapore).
• Google: sign-in and Google Play (app delivery, install referrer).
• PostHog: anonymous usage analytics (EU, Germany).
• Sentry: crash reports (EU, Germany).
• Cloudflare: website hosting, email forwarding and our encrypted backups.
• GitHub: runs the automatic backup job (data passes through its temporary servers while it runs; USA).
• Resend: sends our emails (USA).
• Expo: delivers app updates (USA).

This means your data is processed outside Bangladesh (Singapore, the EU, the USA). We send providers only what they need. If Bangladesh law requires data to stay in the country, we will follow it.

5. How long we keep it

• Your account, profile, training and photos: until you delete your account.
• Backups: the hosting provider’s short-term automatic backups (up to 7 days), our encrypted database copies 14 days and our encrypted photo and file copies 28 days. Then they are deleted automatically.
• Waitlist: unconfirmed addresses 30 days; confirmed addresses until you unsubscribe; the one-way hash of an unsubscribed address with no time limit.
• Web deletion requests, Founding Coach applications and profile reports: up to 12 months, then deleted automatically.
• Analytics events: up to 12 months. Crash reports: up to 90 days.
• After a deletion we keep one record that an account was deleted, with a random ID and no name or email, for security and to repeat the deletion if a backup is ever restored.

6. Deleting your data

In the app: Settings, then Delete account, then hold the button and type the word shown. Your profile, photo, training logs, XP, badges, invite codes and feedback are deleted at once, your public page goes offline within a minute, and we ask PostHog to delete the analytics profile tied to your random ID.

Cannot open the app? Use the form at akhra.app/delete-account. We email you to check the account is yours, then delete it within 30 days of that check. Backups age out as in section 5, so every copy is gone at most 28 days after the deletion.

7. Children (18+)

Akhra is for people aged 18 and over. The app asks your date of birth before sign-up and blocks anyone under 18. For them we store no account, birth date or birth year; the app only sends one anonymous event, with a random ID, that an age check was not passed. If we learn an account belongs to someone under 18, we delete it. If you think a child is using Akhra, report the profile or email us.

8. Your rights, security and contact

You can ask to see, correct or delete your data, withdraw a consent, or object to analytics. Most of it you can do in the app. For anything else, email founder@akhra.app from your sign-in email. We answer within 30 days, free of charge.

All traffic uses HTTPS, each user can read only their own private data, and backups are encrypted. No system is perfectly safe; if a breach affects your data, we will tell you.

When this page changes, the version above changes, and the app asks you to accept the new version. This policy follows the laws of Bangladesh.