Privacy policy
Last updated 30 September 2026
This explains what Atlitos collects, why we collect it, who else receives it, how long we keep it, and how you delete it. It is written to match what the app actually does.
The short version. We collect what the app needs to work: your profile, what you book and pay for, what you post, and who you talk to. We do not sell your data. We do not track you across other apps or websites. We record which retailer offers you open, to measure the shop. We carry no advertising or third party analytics software. You can delete your account from inside the app at any time.
Who we are
Atlitos is operated by ELSHEPH SYSTEMS INDIA PRIVATE LIMITED. For any privacy question, or to raise a grievance under India's Digital Personal Data Protection Act, write to support@elsheph.com. We respond to data requests within 30 days.
Grievance Officer
Grievance Officer, ELSHEPH SYSTEMS INDIA PRIVATE LIMITED
Email support@elsheph.com
with the subject line Grievance.
Post: 701 Giridhari Executive Park, Peerancheruvu, Golconda, Hyderabad,
Telangana 500008, India.
We acknowledge a grievance within 72 hours and resolve it within 30 days.
What we collect, and why
| Category | What it is | Why we need it |
|---|---|---|
| Account | Name, phone number, email address if you sign in with one, date of birth, city and state, the sports you play, profile photo, display name | To create your account, show your profile, and show you courts and coaches near you |
| Content you post | Videos and captions you upload, comments, likes, who you follow | To show your posts to other members, which is the point of posting them |
| Training videos | Videos your coach uploads of your sessions | So you and your coach can review your training. Only you and that coach can see them |
| Shop activity | Which retailer offers you open, linked to your account, with a click reference | To measure the shop and settle retailer commissions. It is not used for advertising |
| Search | The words you type into search | To find results. Search text is kept for 10 minutes in a short lived cache, then removed |
| Messages | Chat messages between you and coaches, and in group chats | To deliver your messages. We do not read them except when investigating a report |
| Bookings and sessions | Coaching sessions you request or attend, group memberships, attendance | To run the booking, tell the coach, and show you your history. Courts are booked on the venue's own website, so we hold no court booking or court payment for you |
| Saved addresses | Addresses you choose to save in your account | Kept for you to reuse. We do not sell or ship physical goods, so nothing is sent to them |
| Payments | Amount, currency, status, and the payment reference from our payment provider | To take payment and keep the financial record we are legally required to keep |
| Payout details (coaches and venue partners) | Account holder name, bank account number, IFSC, UPI ID and PAN | To pay you. Only the last four digits are shown back to you, and staff access is logged |
| Location | Approximate device location, only while the app is open and only if you allow it | To sort courts by distance from you. We never collect location in the background |
| Photos and files | Only the specific files you choose: a video, a profile picture, a coaching certificate, or evidence for an Atlitos Life application | You choose the file in the system photo picker, so the app receives only that file. It never scans your library |
| Coach verification | Certificates and qualification documents you submit | To verify coaches, so athletes can trust who they are training with |
| Atlitos Life applications | Your application, what you need, and supporting documents | To verify the application and let supporters fund it |
| Notifications | A device token for push notifications | To send you booking and message alerts. Turn them off in Settings |
What we never collect
We do not collect your card number, CVV, UPI PIN or bank credentials. Those go directly to our payment provider and never reach our servers. We record which retailer offers you open, to measure the shop. We carry no advertising or third party analytics software, and no cross app tracking.
Who else receives your data
These are the only third parties that receive any of it, and only the parts they need.
| Who | What they receive | What for |
|---|---|---|
| Supabase | Everything listed above. They host our database, sign in system and file storage | Running the service. They process it on our instructions only |
| Razorpay | Your name, phone number and the amount, at the moment you pay | Taking payment. They are the ones who see your card or UPI details, not us |
| Anthropic | Only the words you type into search, when smart search is switched on | Understanding what you searched for. It is not used to train their models |
| Voyage AI | Only the words you type into search, when smart search is switched on | Matching your search to the right gear, courts and coaches |
| Apple and Google | Only if you choose Sign in with Apple or Google: they confirm who you are and share your name and email, or an Apple private relay address | Signing you in. We never see your Apple or Google password |
| Email and SMS delivery providers | Your email address or phone number, and the one time code | Only to deliver your sign in and password reset codes |
| Retailers | When you tap Buy on a retailer's offer we send you to that retailer with a click reference | Taking you to the product. Their own privacy policy applies from there |
| Expo and Vercel | App delivery and web hosting. No profile data | Getting the app and website to your device |
| Sentry | Crash and performance reports: device and app details and the network address the report came from. Your account is not attached | Finding and fixing faults |
We do not sell your personal data, and we do not share it for anyone else's advertising.
How long we keep it, and what deletion actually does
You can delete your account at any time: Settings, then Account, then Delete account, then confirm by typing DELETE. Deletion is immediate and cannot be undone.
When you delete your account, we remove:
- your profile, photo, phone number, date of birth and location
- every video and caption you posted, and your likes
- who you follow and who follows you
- your name, photo and details on anything you wrote to others: your chat messages and comments stay in the other person’s conversation, shown as from “Deleted user”
- your saved addresses, cart and wishlists
- your notifications and push tokens
- your coaching certificates and any Atlitos Life application and documents
- photos you uploaded for venues you manage
- your training progress
What we keep, and why. We keep the record of payments, refunds, payouts and donations. Indian tax and accounting law requires us to retain transaction records, and our financial books have to balance. Those records stay attached to an anonymous entry rather than to you: your name, phone number and other details are erased from them. They identify a transaction, not a person.
If we paid you as a coach or venue partner, the payout record keeps only the last four digits of your bank account number and your bank's IFSC, so a past payout can still be matched to a bank statement. Your name, your PAN, the rest of the account number, and your UPI ID apart from the bank handle after the @ are erased.
We also keep reports you filed about other members. Otherwise anyone could erase the evidence against an account by deleting their own.
While your account is open, we keep your data for as long as you use Atlitos. Your sign in identity is disabled immediately on deletion and the email address is released, so it can be used for a new account later.
Your rights
Under India's Digital Personal Data Protection Act you can:
- See what we hold about you. Ask us and we will send it.
- Correct it. Most of it you can edit yourself in the app.
- Delete it. Use Delete account in the app, or ask us.
- Withdraw consent. Turn off location or notifications in your device settings at any time. The rest of the app keeps working. To withdraw consent entirely, delete your account.
- Nominate someone. You can nominate a person to exercise these rights for you in the event of your death or incapacity. Write to us to do so.
- Complain. Write to us first at support@elsheph.com. You may also complain to the Data Protection Board of India.
Age
You must be at least 18 to create an Atlitos account. Atlitos is not directed at children, and we do not knowingly collect data from anyone under 18. If you believe a child has created an account, write to us and we will remove it.
Security
Data is encrypted in transit and at rest. Access to your rows is enforced by the database itself, not only by the app, so another member cannot read your data by changing an identifier in a request. Private files, including your videos and any verification documents, are served through short lived signed links rather than public addresses.
No system is perfect. If a breach affects you we will tell you and the authorities as the law requires.
Where your data is processed
Our database and files are hosted by Supabase in Mumbai, India (AWS ap-south-1). Payments are processed by Razorpay in India. Some processing, such as search, crash reports and app delivery, may take place outside India, protected by contractual safeguards with each provider.
Changes
If we change this policy we will update the date at the top, and tell you in the app if the change is significant.