Privacy policy

Effective date: 27 October 2026

Akash World (this website, the AW Fitness mobile app, and sites published with Showcase) is operated by Akash Gupta, an individual (“we”, “us”). This policy describes what we collect, why, where it is kept, who else processes it, and what you can ask us to do with it. Questions go to akash@akash-world.com.

What we collect

Your account

• Sign-in. Accounts are managed by Amazon Cognito. You give us your email address and a password. The password is passed straight to Cognito and is never stored or logged by us. Cognito also sends the verification and password-reset codes.
• Signing in with Google or Apple. You can also sign in with Google or Apple. If you do, Google or Apple tells us your email address, whether they have verified it, and your name; we never receive your Google or Apple password. Apple may give us a private relay address instead of your real one. If the email address Google or Apple has verified matches an account you already have here, you are signed in to that account and it is linked to Google or Apple automatically.
• Account record. We keep your email address, whether it is verified, an optional display name, the identifier Cognito assigns you, your role, your account status, when you joined and when you last signed in.
• Typing a code in the app. In the app you can also type a friend’s referral code within 14 days of signing up and before your first purchase; we record it the same way.
• What a salesperson can see about you. If you were referred by a salesperson, they can see your public name (the one shown on your profile, never your email), the date you signed up, the date of your first payment and the amounts you paid us for credits. They cannot see what you do with credits, your files, your meals, your sites or anything you write.
• Credits and payments. Every credit movement is recorded in a ledger that cannot be edited after the fact: grants, purchases, amounts held for a job, amounts charged, amounts returned, and adjustments. For purchases we keep the Razorpay order and payment identifiers, the amount in paise and the time of payment. We do not receive or store your card, UPI or bank details; those are entered on Razorpay’s checkout. If you buy credits in the AW Fitness app, you pay Apple (App Store) or Google (Google Play), not us. We receive from the store the transaction identifier, the product, the price and currency, the time of the purchase, whether it was a test purchase, and whether it was later refunded, and we keep these as payment records. We never receive your card or other payment details.
• Subscriptions. If you subscribe to a AW Fitness plan we keep which plan, the Razorpay subscription identifier, its state (for example active, cancelled or a failed renewal), the dates of the period paid for and whether it is set to end, and a record of each notice Razorpay sends us about it. We count the AI meal analyses each plan includes per calendar month. These are payment records and are kept like the others below.
• Free trial. If you start the AW Fitness 5-day free trial, we keep when it started and ended and how many AI meal analyses it used, to offer it only once per account.
• Gift codes you redeem, and which account redeemed them.
• Notifications. The notices we show you under the bell on the website (for example that a long run, or a download of your data, is ready), whether you have read them, and your email preferences.

What you put into the products

• Files you upload, and files the products produce for you, kept with their name, size and checksum.
• Data Analyst. Your questions, the conversation history (messages and the summaries we make of long conversations), the datasets you import (stored as tables in a separate analytics database, in a schema only your account can read), the documents you add and the text extracted from them, the questions you save and the dashboards you build from them, and a record of each run: what was asked, the steps taken, and what each step cost.
• Showcase. Your projects, the instructions you give the builder, the conversation with it, the assets you upload, every version of the site it produces, previews, and the sites you publish. A published site is public by design: anyone with its address can read it.
• AW Fitness. What you record in the app or on the website: your profile (sex, date of birth, height, activity level, goal, time zone and units), nutrition targets, foods and meals, water intake, fasts (from the fasting timer), workouts, sessions and sets, schedules, and body measurements (weight, body fat and girth measurements), with any notes and photos you attach. Food preferences. If you choose to set them: your diet type (for example vegetarian, eggetarian or vegan), foods you avoid or dislike, and the cuisines you prefer. We use them only to tailor the food suggestions we show you. They are kept with your other AW Fitness records, included in your data download, and deleted with your account. This is health data; we store it only with your consent (see AW Fitness consents below), and you choose what to enter.
• Feedback you send us from the website or the app (its type, your message and, from the app, the app's version and whether it is the iOS or Android app; nothing that identifies your device), any screenshots or photos you choose to attach to it (up to three; before we store an image we remove the details saved inside it, such as where and when it was taken and the camera or phone used), and problems you report with a run or with an AW Fitness AI meal estimate (the reason you choose and the note you add, if any), linked to your account.

Reports about published sites

Anyone can report a Showcase site with its “Report this site” link. We keep the reason you give and which site it was about. We do not record who sent the report; your network address is used only, in memory, to limit how many reports one address can send.

If you are a salesperson

We keep your referral code, your commission terms, the commission you earn and the payouts we make to you. To pay you we hold a UPI id or the last four digits of a bank account, and whether we have your PAN on file, in a separate service. We do not keep a full account number.

Technical information

• Network address. Your IP address reaches our server through our reverse proxy and is used, in memory, to rate-limit requests (for example sign-in and password reset). It is not written to our logs.
• Request log. For each request to the website our server writes one log line: the time, the method, which page or action it was as a pattern from our code (for example /products/<slug>, never the address you typed or its query string), the response status, how long it took, a request reference, and your account identifier if you are signed in. It does not record your IP address, your browser, your cookies or anything you submitted.
• Daily traffic counts. To see how much each product is used, our server counts, for each day, how many requests each product received from the website, the iOS app and the Android app, and how many different signed-in accounts made them. To count each account only once, it keeps your account identifier together with the day and the product and app or website you used for at most two days, then deletes it. The daily totals that remain do not identify anyone and are kept for 90 days. No page address, nothing you submitted and no IP address is recorded. Your entries are deleted with your account.
• Application logs. Our services also write operational logs (errors, job progress, timings), which can include your account identifier. Passwords, tokens, secrets and cookies are removed from log lines before they are written.
• Crash reports from the app. If the AW Fitness app crashes or hits an unexpected error, it sends us a report so that we can fix it. A report contains:
  • the app’s version and build;
  • whether it is the iOS or Android app, and the operating system version;
  • the screen you were on, the names of up to four screens before it, how many of your changes were waiting to sync (a count, never what they are), and whether the phone was online;
  • the error’s name, message and technical trace;
  • when it happened, whether it stopped the app, and whether you were signed in.
  It is not linked to your account: it carries no account identifier, email address, device identifier or anything you entered. Reports are stored by us, never sent to a third-party crash service, and deleted after 30 days.
• How long logs are kept. Logs stay on our server in files of at most 10 MiB, with at most 10 files for each of our services. When they are full, the oldest lines are overwritten, and all of a service’s logs are discarded when it is redeployed. Logs are not archived or backed up.

AW Fitness consents

AW Fitness asks for two separate consents. Each is asked on its own, neither is given until you give it, and you can give one without the other.

• Your health data. Your consent to our storing and showing your meals, foods, workouts and sets, body measurements and nutrition targets. Without it, AW Fitness cannot save anything new for you.
• AI meal analysis. Your consent to our sending your meal photos, and the descriptions of meals you type, to Anthropic (Claude), which analyses them on our behalf as our processor and returns an estimate of their nutrition. One consent covers both: it is asked before your first photo or description is sent. You review the estimate before anything is saved, and you can always log meals by hand instead.

Withdrawing a consent. You can withdraw either consent at any time, each on its own: in the AW Fitness app under Profile → Privacy and consents, or on the website on the Privacy and consents page of your account. Withdrawing stops new processing from that moment: after withdrawing the health-data consent we save no new AW Fitness records for you, and after withdrawing the AI meal analysis consent we send no new photos or descriptions to Anthropic. Withdrawing deletes nothing. What is already stored stays in your account, and you can still see it, export it and delete it. To have it deleted, delete the records yourself, and each is removed for good 30 days after you delete it (see AW Fitness records you delete), or delete your account.

We keep a record of each consent: which one, the version of its wording, when you gave it, whether in the app or on the website, and when you withdrew it. If we change what a consent covers, we ask you again.

Sharing with a trainer

In AW Fitness you can let a trainer see some of your records. Nothing is shared until you accept: a trainer gives you a code or a link, or invites your account, and before you accept we show you who the trainer is and what they will be able to see. You choose the categories to share — meals and nutrition (water included), workouts (every exercise and set) and body measurements — and we record your agreement with the version of the wording you were shown.

• What a trainer sees. The categories you chose, for any day, including days before you started sharing, and your name and username. Never your email address, your credits, or anything outside AW Fitness. They can only look: they cannot add, change or delete anything of yours. Meal photos are not shared.
• Stopping. You can stop sharing with a trainer at any time under My trainers, in the app or on the website. It takes effect at once: the trainer’s next request is refused. The trainer can also stop. To share again, you accept a new invite.
• The access log. Each time a trainer looks at your data we record it, before anything is read: which trainer, when, what kind of view and which day. You can read your log under My trainers. Your trainer cannot read your log; their own download lists the views they made. The log, and the record of whom you have shared with and when, are kept for as long as your account exists, including after you stop sharing, and are deleted with your account.
• Deleting an account. When you ask for your account to be deleted, all your sharing ends at once, on both sides: no trainer can see your data, and if you are a trainer you can no longer see your clients’. Cancelling the request does not restore it. When the account is deleted, its sharing records, the invites it sent or received and the access-log entries it appears in are deleted with it, on both sides; so when a trainer deletes their account, the record of their views also leaves their clients’ logs.
• Your copy. The AW Fitness JSON download, and the account zip described under Downloading your data, include your sharing records on both sides (whom you share with, and as a trainer who shares with you), the invites you sent or received (without their codes), and the access log: the views of your data and, as a trainer, your own views of your clients’.

Cookies and tracking

We set a session cookie that keeps you signed in and protects forms against cross-site request forgery. It is marked HttpOnly and Secure, is not readable by other sites, and is deleted when you close your browser. Independently of the browser, we end a session after 12 hours without activity or 24 hours in total. Visiting a page that has a form can set this cookie even before you sign in.

Referral links. If you open a link with a referral code in it, such as ?ref=ABCD2345, we keep that code in a cookie on your device for 30 days. If you create an account in that time, we record that the person who shared the link referred you, and when. The cookie holds only the code, is sent only to us, and is not used for anything else. You can delete it in your browser at any time; nothing else changes.

We use no analytics, advertising or tracking scripts or cookies. The only third-party script on the website is Razorpay’s checkout, which loads on the Credits page and on the AW Fitness plans page, for buying credits or subscribing to a plan, and which is governed by Razorpay’s own privacy policy. Published Showcase sites are served without cookies or tracking added by us, and we do not count their visits.

Who else processes your data

The AI providers receive this content only to produce your result. Our own services that talk to them keep a job’s result in memory for a short time and do not log the content you submitted. Each provider handles what it receives under its own terms and privacy policy. We do not sell your data or share it with anyone for advertising.

When a Data Analyst import asks for a public web address, our service fetches that address from the internet on your behalf.

Who at Akash World can see it

The operator, as administrator, can see the list of accounts (email, status, role), a user’s credit balance and product access, the feedback people send (with its images), and the Showcase report queue, and can look at stored data when needed to run, debug or secure the service, or to deal with a report.

How long we keep it, and deleting it

• Your account and the records attached to it are kept while the account exists. You can ask for it to be deleted at any time (see Deleting your account below).
• Files. When you delete a file it disappears from your account at once. The stored copy is kept for 7 days and is then removed from storage; our storage also keeps a previous version of a changed or removed file, including a data export file, for up to 30 days. A record of the file’s name and size remains.
• AW Fitness meal photos are kept for 3 days after you upload them, and count against your storage while they are kept. After that the photo is removed from your account and its stored copy is deleted as for any other file, whether or not you logged the meal. No copy of a meal photo is kept on your phone after it is sent. A photo is kept until an analysis of it that is still running has finished. The meal you logged, with its foods and nutrition, stays.
• AI meal estimates. The estimate an AI meal analysis returns, and the description or note you gave it, are kept with the analysis. If you log no meal from it, they are deleted 3 days after the analysis finished, and the estimate can no longer be logged. If you log a meal from it, they are deleted when that meal is removed for good (see AW Fitness records you delete). What the analysis cost stays in your credit history.
• AW Fitness records you delete — meals, water entries, fasts, sets, your own foods and routines — disappear from the app, the website and your exports at once, and are removed from our database for good 30 days after you delete them. We wait so that a phone of yours that was offline can catch up with the deletion. After that we keep only the deleted record’s random identifier (for a meal logged from an AI analysis, also which analysis it came from), so that a phone that was offline for longer cannot bring the record back. A meal you logged with a food you have since deleted keeps its description and nutrition.
• Data exports. A zip of your data that you ask for (see Downloading your data below) is deleted 7 days after it is ready, or when your account is deleted if that comes first.
• Images attached to feedback are deleted 180 days after you send them, or when your account is deleted if that comes first. They are not part of your files and do not count against your storage. The text of your feedback is kept while your account exists.
• Notifications you have read are deleted 90 days after you read them; unread ones are kept until you read them.
• Data Analyst conversations are deleted immediately and permanently when you delete them, and the datasets and files they made are deleted as described above. Deleting a dataset removes its table from the analytics database.
• Showcase. Preview links expire after one hour and expired previews are removed. Removing an asset, or deleting a project, removes its files from storage within minutes. Deleting a project takes its published site offline at once, and its address can then be used by someone else. A site whose hosting is not paid is taken offline after the grace period described in the Terms.
• Backups. Our databases are backed up, encrypted, to Amazon S3. A backup is deleted after 90 days, and storage keeps a deleted backup for a further 30 days. So data you delete, including everything in a deleted account, can remain in a backup for up to 120 days (about four months) before it ages out. Backups are used only to recover the service; if we ever restore one, we delete again every account that was deleted after that backup was made.
• Payment records may be kept for as long as the law requires, even after the account is closed.
• Referrals and commission. We keep a referral for as long as your account exists, and it is included in your data download. Records of what we paid a salesperson, and the tax deducted, are kept for ever.

Deleting your account

This section is also published on its own page, Delete your AW Fitness / Akash World account, which you can read without an account or the app.

You can ask for your account to be deleted in three ways:

• in the AW Fitness app on your phone, under Profile → Delete account;
• on the website, on the Delete my account page of your account, where you type DELETE to confirm;
• by email from the address on your account to akash@akash-world.com; we may ask you to confirm the request comes from you.

We carry out the deletion within 30 days of your request (for an emailed request, within 30 days of your confirming it). Until then your account keeps working, and the date by which it will be deleted is shown on the same page in the app and on the website.

Cancelling. You can cancel a pending request at any time before it is carried out, with the cancel button on that same page, in the app or on the website; you can also email us to cancel it. Once the deletion has been carried out it cannot be undone.

What is deleted. When we carry out the deletion, we:

• delete your files, any data exports, datasets and documents, your Data Analyst conversations, saved questions and dashboards, your AW Fitness records, your feedback (with any images attached to it) and problem reports, your notifications and email preferences, and your Showcase projects, assets and sites (a published site goes offline at once and its address becomes free for others; the builder’s own copy of each build’s output is deleted within 90 days of the build);
• delete your sign-in account at Amazon Cognito, and remove your email address, name and sign-in identifier from our records, so the account can no longer be used or linked to you.
• remove the link between your account and Google or Apple, if you signed in with one. You can also remove Akash World from your Google account at myaccount.google.com/permissions, or on an Apple device in Settings → Apple Account → Sign in with Apple. If you later sign in with Google or Apple again using the same email address, that creates a new, empty account.

What is kept, and why.

• We keep the credit ledger and payment records, which by law and by design cannot be edited after the fact, attached to the anonymised account. A record of each paid job’s cost is kept, but not what you asked or what it returned. Unused credits are not refunded.
• We also keep the record of your consents (see AW Fitness consents), attached to the anonymised account, as the record of what you agreed to and when.
• Copies in backups age out as described under Backups, up to 120 days after the deletion. Backups are used only to recover the service.

Your choices and rights

You can see and change your profile, see your credit history and usage, withdraw a AW Fitness consent, and delete files, conversations, datasets, documents, AW Fitness records and Showcase projects yourself.

Downloading your data

Everything, in one zip. On the website, Profile → Download your data prepares one zip file of what Akash World holds about your account: your profile, your credit history with purchases and receipts, your runs and what each one cost, your Data Analyst conversations and files, your Showcase projects with every version’s pages, any referral recorded for you, and your AW Fitness records. Your stored files, including AW Fitness meal and body photos, are copied into the zip’s files folder up to a size limit; larger files are listed rather than included, and the zip says which.

• When the zip is ready we tell you with a notification on the website, which takes you to your account page, not to the file. You can ask for up to 3 exports in any 24 hours, one at a time.
• The download starts only from your account while you are signed in, and the file link it opens works for 5 minutes.
• The zip is deleted 7 days after it is ready, or when your account is deleted.
• What it leaves out: passwords (we never hold yours; see above) and access keys; our operator audit records and Showcase moderation records, which you can ask for by writing to akash@akash-world.com; and other people’s data.

AW Fitness on its own.

• A full copy, as JSON. From Profile in the app, or the AW Fitness profile page on the website, you can download everything AW Fitness holds about you as one JSON file: every record except the ones you have deleted, your consents and data-sharing grants, and a link to each photo we still hold (meal photos are kept 3 days, as described above). Each photo link works for one hour from when the file is made; after that, download the export again for fresh links. Anyone who has a link can open that photo while it works, so do not share the file. The same JSON is in the account zip above, and there the photos themselves are also in the files folder, within its size limit.
• A spreadsheet download, as CSV files, is also available, from the same places.

You can ask us at any time to give you a copy of any of your data, to correct it, or to delete your account and data, by emailing akash@akash-world.com from the address on your account. We may ask you to confirm the request comes from you. We answer requests within 30 days.

Grievance officer: Akash Gupta, akash@akash-world.com. A grievance about how we handle your personal data is answered within 30 days.

Security

Traffic is encrypted in transit. Files are stored in private, encrypted storage that is not publicly readable, and each account can reach only its own data. AI-written database queries run under a separate read-only identity that can see only your own tables. No system is perfectly secure, and we cannot promise that yours will never be exposed.

Children

Akash World is not directed at anyone under 18, and we do not knowingly collect data from them. If you believe a child has given us data, write to us and we will delete it.

Changes

If we change this policy we will post the new version here with a new effective date. For significant changes we will also post a notice on the website.

Contact

Akash Gupta · akash@akash-world.com · Contact page