Privacy Policy

This policy explains what Itsha collects when you use itsha.com or the Itsha mobile apps, why, and how to have it removed. It describes what the service actually does today rather than every possibility, and it is updated when the behaviour changes.

Itsha is operated by Vweb technologies LLP, a limited liability partnership registered in India, which is the data controller for everything described below. Write to support@itsha.com about anything on this page.

The short version

A web account stores your name, email address, and a hash of your password — never the password itself.
Workouts, plans, timers, and progress in the mobile apps stay on your device. They are not uploaded to us and we cannot see them.
There are no analytics, advertising, or cross-site tracking scripts on this site.
We do not sell your data, and we do not share it for advertising.

What we collect

When you create a web account:

Your name and email address, as you enter them.
Your password, stored only as a one-way hash. We cannot read it, and we cannot tell it to you if you forget it — you reset it instead.
A six-digit verification code sent to your address to confirm it is yours. Codes expire after five minutes and are stored hashed.

If you choose “Continue with Google”: Google sends us your name, email address, and profile picture. We do not receive your Google password and we get no access to your Gmail, Drive, contacts, or any other Google service.

While you are signed in, we keep a session record containing a session token, the IP address and browser user-agent the session was created from, and its timestamps. This is what lets you stay signed in and what lets you spot a session you do not recognise.

To stop abuse, we count requests and emails against IP addresses. These counters hold an IP address and a number — nothing about who you are or what you did.

What we do not collect

No analytics or advertising trackers. As of the date above there is no Google Analytics, no advertising pixel, and no third-party script that profiles you. The only third-party tag on the site is a Pinterest domain-verification meta tag, which collects nothing and runs no code.
No mobile workout data. The apps keep your training data on the device by design. Signing in on mobile, when that arrives, will exist to carry a paid subscription across your devices — not to upload your workouts.
No location, contacts, photos, or health-app data is sent to our servers.

Analytics

We do not currently use any analytics or attribution service. If that changes we will name the provider here and update the date at the top of this page before it goes live.

Cookies

We set a session cookie when you sign in, and a separate cookie for staff signing in to the internal admin panel. Both are strictly necessary — the site cannot keep you signed in without them. We set no advertising or analytics cookies, which is why you are not asked to accept a cookie banner.

Cloudflare Turnstile — our bot check on sign-up, sign-in, password reset and email verification — may set a short-lived token to confirm you are not automated. It is not used to track you between sites. For most visitors it clears in the background and shows nothing; you only see a challenge if it cannot. Cloudflare describes what it processes to do this in its Turnstile Privacy Addendum.

Who else processes your data

Cloudflare — hosting, the database your account lives in, and bot protection. Account data is stored in Cloudflare’s Asia-Pacific region.
Resend — delivers verification and password-reset emails. It receives your email address and the message contents.
Google — only if you choose to sign in with Google.
Apple — only if you choose to sign in with Apple. If you use Apple’s Hide My Email, we never receive your real address, only the relay one Apple gives us.

Each acts on our instructions to run the service. None of them is given your data to use for their own advertising.

How long we keep it

Sessions expire after 30 days and are removed when they do. Abuse counters are per-day records that are not tied to an account. Account details stay until you ask us to delete them.

Your choices

Email support@itsha.com to get a copy of what we hold, correct it, or delete your account. Deleting an account removes your details and your sessions. Depending on where you live you may also have rights under the GDPR, the UK GDPR, the CCPA, or India’s DPDP Act; we will honour a request under any of them.

Children

Itsha is not directed to children under 13, and we do not knowingly collect their data. If you believe a child has created an account, email us and we will remove it.

Security

Traffic is encrypted in transit. Passwords are hashed. Sign-up and sign-in are rate-limited and protected by a bot check. No system is perfect, and we will not claim otherwise — if a breach affects your data we will tell you.

Changes

When this policy changes we update the date at the top. Material changes — a new processor, a new category of data — will be described here rather than made quietly.