Privacy Policy

Last updated: May 26, 2026

1. Information We Collect

When you create an account or shop on GripFit, we collect:

  • Account Information: Full name, email address, phone number, delivery address, and profile picture (if you sign in with Google) provided during registration or profile updates.
  • Order Information: Products purchased, sizes, colors, quantities, order totals, shipping address, discount codes used, and order status.
  • Cart Data: Products you add to your shopping cart, including selected size, color, and quantity. You must be logged in to add items to your cart. Your cart is securely stored on our servers so you can continue shopping later, and it is automatically deleted after 30 days of inactivity.
  • Contact Messages: Name, email, subject, and message content submitted through our contact form.
  • Wishlist Data: Products you save to your wishlist for future reference.
  • In-App Notifications: We store notifications related to your account, orders, and important updates. These notifications are available only to logged-in users and are automatically deleted after 10 days.
  • Push Notification Subscription: If you opt in via the "Get Updates" button, we store your browser's push subscription endpoint. No personal information is collected through notifications beyond what you have already provided.
  • Payment Receipts: Screenshots or images of payment confirmations (e.g., eSewa, bank transfer receipts) uploaded during checkout for order verification purposes.
  • Theme Preferences: Your selected display theme (light, dark, or system) stored locally in your browser.
  • Product Reviews: Your rating (star score), review title, written text feedback, and whether your submission is a "Verified Purchase" based on your order history. This review is permanently linked to your profile and displayed publicly on the product page.

Important: We do not store debit card numbers, credit card numbers, bank PINs, wallet passwords, or any banking credentials. Payment receipt uploads are used solely to verify that your payment has been made and are linked to your order for processing purposes.

2. How We Use Your Information

Your information is used to:

  • Process and fulfill your orders, including sending order confirmation emails
  • Maintain your shopping cart contents across sessions so you can continue shopping later
  • Manage your account, wishlist, and order history
  • Pre-fill checkout details for a faster shopping experience
  • Respond to your contact form inquiries
  • Send password reset and account verification codes to your email
  • Apply coupon codes and track usage limits
  • Notify you about order status updates
  • Send push notifications about promotions, new arrivals, and store announcements (only if you opt in)
  • Validate product stock availability and adjust cart quantities when items go out of stock
  • Display public customer feedback on product pages and dynamically calculate a product's average rating score and total review counts

3. Information Sharing

We do not sell, trade, or rent your personal information. We may share limited data only with:

  • Delivery Partners: Your name, phone number, and shipping address to fulfill deliveries within Nepal.
  • Email Service (Gmail SMTP): Your email address to send order confirmations, password reset codes, and contact form responses.
  • Push Notification Service (Web Push): Your browser's push subscription endpoint is used to deliver notifications. This is handled by the Web Push protocol and your browser's built-in push service (e.g., Firebase Cloud Messaging for Chrome, Mozilla Push Service for Firefox).
  • Legal Authorities: When required by Nepali law or to protect our legal rights.

4. Data Security

We take the following measures to protect your data:

  • Your password is securely encrypted and never stored in plain text
  • We use industry-standard security measures to protect your personal data
  • Login attempts are limited to prevent unauthorized access to your account
  • All data transmitted between your browser and our servers is encrypted
  • Payment receipt uploads are stored securely and are never shared with third parties

5. Cookies and Sessions

We use secure session cookies to keep you logged in and remember your cart. These cookies are configured with industry-standard security settings to protect your account. You must be logged in to add items to your cart. We also use browser localStorage to save your theme preference (light/dark mode) and notification opt-in state. We do not use third-party tracking cookies. Disabling cookies will prevent you from logging in and using the cart.

6. Your Rights

As a registered user, you can:

  • View and update your profile information (name, phone, address) from your account page
  • Reset your password at any time using email verification
  • View your complete order history
  • Manage your product wishlist
  • Unsubscribe from push notifications at any time through your browser settings or by clicking "Unsubscribe" on the site
  • Permanently delete your account and personal data from the account page with email verification

Account Deletion & Data Anonymization

When you choose to delete your account, the following process applies:

Immediate actions (at the time of deletion):

  • Your account is marked as deleted and you are logged out immediately
  • You cannot log back in — the account is blocked and all login attempts (email/password, Google OAuth, password reset) will be rejected with a message that the account has been deleted
  • Your push notification subscriptions are removed
  • Stock is restored for any pending or processing orders that have not yet been shipped
  • Your product reviews and ratings are retained at this stage but will be anonymized later

After 10 days — Profile data anonymization:

If you do not contact us to reactivate your account within 10 days, your personal profile data is permanently anonymized in our database:

  • Full name → DeletedUser
  • Email address → deleted@GripFit.com
  • Phone number → null (removed)
  • Delivery address → null (removed)
  • Password → null (permanently removed, cannot be recovered)
  • Google account link → null (removed)
  • Product reviews → "Deleted User" (your name replaced, review text may remain)

Order history retention:

Order history is retained indefinitely for business reporting and sales tracking purposes. Your order details (name, email, phone, address) will remain attached to your order records.

Reactivation:

If you change your mind within 10 days, you may contact us to reactivate your account. After 10 days, reactivation is no longer possible as your personal data will have been anonymized.

7. Third-Party Links

Our website may link to external sites including social media platforms. We are not responsible for the privacy practices of those sites. Please review their policies before sharing any personal information.

8. Children's Privacy

Our services are not intended for individuals under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with their data, please contact us and we will remove it promptly.

9. Changes to This Policy

We may update this privacy policy as our features and practices evolve. Changes will be reflected on this page with an updated date. Continued use of the website after changes constitutes acceptance of the revised policy.

10. Progressive Web App (PWA)

GripFit can be installed as a Progressive Web App (PWA) on your device for a native app-like experience. When you install our PWA:

  • Service Worker: A service worker is installed to cache essential app files (HTML, CSS, JavaScript, icons, and the offline page). This enables the app to load faster on repeat visits and display an offline page when you lose internet connectivity.
  • Offline Access: When offline, the PWA displays a cached offline page. Page navigation requests (e.g., visiting the shop) will show the offline page if no network connection is available. Static assets like images and stylesheets are served from cache when possible.
  • Cache Storage: The service worker uses a named cache ("GripFit-cache-v1") to store app shell files. Cached files are updated automatically when new versions are deployed.
  • Local Storage: Your theme preference (light/dark mode) and notification opt-in state are stored in localStorage for a consistent experience across sessions.
  • No Additional Data Collection: The PWA does not collect any additional personal information beyond what is already described in this policy.
  • App Updates: When we release updates, the service worker activates immediately and fetches new versions of cached files. You do not need to manually update.
  • Uninstall: You can uninstall the PWA at any time through your browser settings or device app settings. Uninstalling the PWA removes all locally cached data.

11. Push Notifications

GripFit offers optional push notifications to keep you informed about promotions, new arrivals, and store updates.

  • Opt-In Only: Push notifications are entirely optional. You will only receive notifications if you explicitly click the "Get Updates" button and grant permission through your browser's notification prompt. We never send notifications without your consent.
  • What We Store: When you subscribe, we store your browser's push subscription endpoint (a unique URL provided by your browser's push service) and your user ID (if logged in) in our database. We do not collect your device name, phone number, or any other personal data through notifications.
  • What We Send: Notifications may include promotional offers, new product announcements, sale alerts, and general store updates. Each notification includes a title, body text, and a link to the relevant page on our website.
  • Browser Push Service: Notifications are delivered through your browser's built-in push service (e.g., Firebase Cloud Messaging for Chrome, Mozilla Push Service for Firefox). We do not use any third-party notification platforms.
  • Clicking a Notification: When you tap or click a notification, it opens the linked page in a new browser tab.
  • Unsubscribing: You can stop receiving push notifications at any time by:
    • Clicking "Unsubscribe" on our website (if available)
    • Revoking notification permission in your browser settings
    • Clearing your browser data, which removes the push subscription
  • Data Retention: Your push subscription is stored until you unsubscribe or your account is deleted. Inactive subscriptions (no updates for 60 days) are automatically cleaned up.

12. In-App Notifications

GripFit displays an in-app notification bell icon for logged-in users. This system works separately from push notifications:

  • Bulk Notifications: Promotional messages (new products, sales, announcements) are visible to all logged-in users in the notification bell, regardless of whether they have subscribed to push notifications. These notifications do not require push subscription — they are displayed directly on the website when you are logged in.
  • Personalized Notifications: Order status updates, payment confirmations, and account-related messages are sent only to the specific user they are intended for. These are linked directly to your account and are not visible to other users.
  • Read Status: When you open the notification panel, notifications are marked as read. Read status is stored per user in our database.
  • No Additional Data Collection: The in-app notification system does not collect any additional personal information beyond what is already described in this policy.

13. Contact Us

If you have any questions or concerns about this privacy policy or how we handle your data, reach out to us:

  • Email: info@gripfit.com.np
  • Phone: +977 9844025788
  • WhatsApp: 9779844025788
  • Address: Sundarharaicha-12, Biratchowk, Morang, Nepal
  • Or use our Contact Form

14. Consent

By using our website, installing our PWA, and subscribing to push notifications, you agree to this Privacy Policy.