Your data. Your rules.

Dombelz is operated by DOMBELZ, Bengaluru, Karnataka, India ("we", "us"). We are the Data Fiduciary for your personal data under India's Digital Personal Data Protection Act, 2023 (DPDP Act). This policy covers the Dombelz website (www.dombelz.com), web app and Android/iOS apps.

Account: name, email, username, and your password (stored only as a secure hash) or your Google sign-in identity.

Profile and goals: age, gender, height, weight, goal weight, activity level, fitness goal, diet preference, meal frequency and meal names, water goal and cup size, supplements you use, time zone, and WhatsApp number if you choose to give it.

What you log: food diary entries, saved meals and recipes, water intake, weight entries, progress photos, body measurements, workout plans, workout and cardio logs, streaks, XP and achievements.

Health readings: blood pressure and blood glucose readings you add to the Health Log, and the condition you choose to track. These are sensitive — we use them only to show your history and reference-range labels to you.

Media you choose to share: meal photos and voice clips for AI food logging, and camera input for barcode scanning. Meal photos and voice clips are processed to identify food and are not stored. Progress photos are stored privately and are visible only to you.

Social and rewards: friends, cheers, leaderboard scores, your referral code and who you referred, and any gym, clinic or creator partner code you used — plus gym membership details (plan, dates, phone number) if you add them.

Payments: plan, subscription status, payment amounts and dates, refund requests and their reasons. Card, UPI and bank details are handled by Razorpay, Google Play or Apple; we never see or store them.

Reminders: your notification settings and custom reminders. Reminders are scheduled on your phone; we run no push-notification server.

Technical: error and diagnostic information needed to keep the service running (for example a failed request and your user ID).

We do not collect your precise location, contacts, SMS or call logs, and we use no third-party advertising or analytics trackers.

• Run your account and calculate your calorie, macro, fibre and water targets.
• Show your progress, streaks, achievements and AI weekly report.
• Identify food from text, photos, voice and barcodes.
• Run community features you join (leaderboard, friends, cheers).
• Run Refer & Earn and partner codes, including partner commission.
• Process payments, refunds and access to paid features.
• Send reminders you set up.
• Give support, prevent fraud and abuse, keep the service secure, and meet legal and tax obligations.

We do not sell your personal data, and we do not use it for advertising.

You consent to this processing when you create an account. Optional data — health readings, progress photos, body measurements, WhatsApp number, gym membership details, community features — is collected only if you choose to add it. You can withdraw consent at any time by deleting that data or your account; this does not affect processing already done. Camera and microphone are used only while you actively use photo, barcode or voice logging, and the app works without them.

Food search, meal photos, voice clips, your weekly statistics (for the weekly report) and workout preferences (for AI plans) are sent to AI providers — currently Google Gemini on Google Cloud — only to produce the result you asked for. We send the minimum needed and do not use your data to train models.

When AI identifies a food that is not in our database, we save the food name and nutrition values (never your photo or voice) to a shared food cache, tagged with a one-way hashed key instead of your account, so we can answer the same search faster and limit abuse.

Partners and other users never see your food, workout, weight or health logs. Our service providers process data only on our instructions.

Our database and photos are stored in India (Supabase, Mumbai region). Some processing, such as AI requests and hosting, may take place outside India through the providers above, with safeguards in our agreements with them, and never in a country the Government of India has restricted.

• While your account is active, we keep your data so the app works.
• When you delete your account, your profile, logs, photos and health readings are deleted immediately. Copies in encrypted backups are purged within 30 days.
• Payment and invoice records may be kept for up to 8 years where tax law requires it, no longer linked to your account and with access restricted.
• Food-cache entries (food names and nutrition only) are not linked to you and are kept.

Data is encrypted in transit (TLS) and at rest. Every table is protected by row-level security so each account can read only its own data, progress photos sit in a private bucket served by short-lived links, and payment state can only be changed by our server. No system is perfectly secure; if a breach affects you, we will tell you and the Data Protection Board as the law requires.

Under the DPDP Act you can:

• Access — see your data in the app or download it from Profile → Settings → Data export (JSON, or your food diary as CSV).
• Correct and update — edit your profile and entries in the app (entries from the last 7 days; email us for older ones).
• Erase — delete entries, or delete your account and all its data from Profile → Settings → Danger zone. Without the app, email support@dombelz.com from your account email asking us to delete your account.
• Withdraw consent — as in section 4.
• Nominate someone to exercise these rights if you die or become unable to — email us with their details.
• Grievance redressal — contact our Grievance Officer (section 13). If you are not satisfied, you can complain to the Data Protection Board of India.

We respond to requests within 30 days, and to grievances as in section 13.

Dombelz is only for people aged 18 or older. Sign-up requires you to confirm you are at least 18. If we learn an account belongs to someone younger, we delete it.

For material changes we will notify you in the app or by email at least 7 days before they take effect. The "Last updated" date shows the current version.

Complaints are acknowledged within 24 hours and resolved within 15 days. For everyday questions, email support@dombelz.com or visit Help & Support.