This Privacy Policy explains what information Gymgress (“we,” “us”) collects when you use the Gymgress app and website, how we use it, who can see it, and the choices you have. Gymgress is operated by Alejandro Lionardo Jarquin Avendano, an individual based in California, USA.
1. Information You Give Us
Account: your email address and password, or the account details Apple or Google share with us if you use Sign in with Apple or Sign in with Google (an email address, which may be an Apple “Hide My Email” address, and, from Apple, your name if you choose to share it). Passwords are handled by our authentication provider, Supabase, and are never stored in plain text.
Public profile: your username, display name, profile photo or avatar color, and experience level. Optionally: a bio, fitness goals, nationality, and body weight.
Private profile details: your date of birth (to confirm you are at least 13), and, if you choose to give them, your gender, height, pronouns, and location (a free-text field you type, not your device’s GPS location). These are not shown to other users. Gender is used only to place you in the matching ranking lists (for example, women’s lists).
Signup answers: your units, weekly workout goal, target weight, starting squat, bench and deadlift (saved as your first personal records), how you heard about Gymgress, and which friend referred you. Other users can’t see how you heard about us or who referred you. A copy of your signup answers is also kept with your login account until you delete it.
Training data: the workouts, exercises, sets, reps, weights and durations you log; workout plans, saved workouts and routines; activities such as runs, rides, swims and sports (type, time, duration and, if recorded, distance and calories); rest days; scheduled sessions with friends; the gyms you save (a name and, if you choose, the gym’s location); your goals (main goal, subgoals, targets and the starting numbers they were set from); and personal records, achievements and strength ranks, whether you enter them or we calculate them from your workouts.
Imported history: if you import a workout export file from another app, we store those workouts on your account. Imported workouts never count toward streaks, rankings or achievements. If the import contains an exercise Gymgress doesn’t know, it can be added to the shared exercise catalog: its name, muscle group and equipment become visible to all users, and stay in the catalog (no longer linked to you) if you delete your account.
Body data: your body-weight log (including body-fat percentage if you enter it or allow it from Apple Health) and body measurements (such as waist or arm size). These are visible only to you.
School email (only if you verify a school club): we email a one-time code to the school address you enter. We store only a one-way hash of that address (to keep one school email to one account), never the address itself, plus which school you verified and when the verification expires. Where a high school district gives all its schools the same email domain, you pick your school from that district’s list or add it.
Content you create: posts (photos, videos, captions and workout cards), comments, likes, and messages (text, photos, videos, view-once photos and videos, replies, nudges, and posts, profiles, sessions or workouts you share in a chat), plus the group chats, buddy groups, clubs and club challenges you create or join.
Social information: your friends and the nicknames you give them, friend requests you send or receive, suggestions you dismiss, users you block, and reports you file.
Phone number and contacts (not yet available): Contact Discovery is built but switched off. When it is turned on, you will be able to verify your phone number with a text-message code so people who have your number can find you; we would store that verified number on your account. If you then allow contacts access, the app reads the names and phone numbers in your address book. Only the phone numbers leave your device: they are sent over an encrypted connection to our server, compared with other users’ verified numbers, and not stored after that request. Contact names never leave your device. You can deny or revoke contacts access at any time in your device’s Settings. Separately, the “Invite” screen can open your phone’s contact picker so you can text or email one person an invite; the contact you pick is not sent to us.
2. Apple Health
Gymgress connects to Apple Health only if you turn it on in Settings → Apple Health, and iOS lets you choose exactly which data types to allow.
- Workouts and activities you finish can be saved to Apple Health (strength training with an estimated energy burn, or the activity you recorded, with its distance and calories).
- Workouts recorded by other apps or your Apple Watch (for example a run) can be imported as Gymgress activities: their type, time, duration, distance and calories are stored on our servers like any workout you log, and are visible according to your workout history setting.
- Body weight and body-fat percentage (or lean body mass, which body fat is worked out from): your weigh-ins in Apple Health, including past ones, are copied into your Gymgress weight log, which is stored on our servers and visible only to you. Days you logged yourself are not changed.
- Height, date of birth and sex: used only to fill in those fields in your profile when they are empty; they are then stored like the rest of your private profile details and are not shown to other users.
- Heart rate: your heart rate during a workout is read on your device to show your average and your time in each heart-rate zone on your own workout summaries, and to estimate calories. It is never sent to our servers or shown to other users; it only leaves your phone if you share an image of your own workout card.
- Activity, recovery and nutrition: steps, active and resting energy, resting heart rate, heart rate variability, VO2 max, sleep, waist measurements, and the calories and protein you log in a food app. These are read and kept on your device only, to show your recovery, make calorie estimates more accurate, and check progress on your goal (for example, protein and calorie balance). They are never sent to our servers or shown to other users. A separate switch in Settings → Apple Health turns these reads off.
Data from Apple Health is never used for advertising, marketing or data mining, is never sold, and is not shared with third parties (our hosting provider only stores your weight log and imported activities on our behalf). Gymgress does not store Apple Health data in iCloud. You can turn these switches off at any time, or revoke access in the Health app; weights already in your log stay until you delete them or your account.
3. Information Collected Automatically
Notifications: if you allow notifications, we store your device’s push token and platform so we can deliver them.
App activity: when you last opened the app, the days you were active (for streaks), your time zone (so reminders arrive at the right local time), and which destination you picked when you share a card (for example Instagram or TikTok).
App usage and diagnostics: which screens you open and key actions such as signing up, finishing a workout, or sharing a card (counts and types only, never the content of your messages, captions, or posts), plus crash reports and app performance data (device model, OS version, app version). These are tied to your account’s internal ID, not your name or email, and help us find bugs and understand which features are used. You can turn usage analytics off in Settings → Privacy & Social.
Location (only if you allow it): during a run, walk or ride you time live, the app uses your device’s GPS to measure distance; the route stays on your device and only the total distance is saved with the activity. The app can also compare your location with the gyms you saved to pick the gym you are at; a gym’s location is stored only if you save it, and only you can see it. When you start or join a gym or city club, the app sends your current location once to confirm you are at that gym or in that city: our server measures the distance and keeps only that your account was there and when (for 30 minutes), never your coordinates. If you add a gym this way, the gym itself (its name, address and position) is saved so others can find its club, but it is not linked to you on your profile. Your location is never shown to other users. You can allow it only while using the app, or turn it off at any time in iOS Settings.
Service logs: our providers (Supabase, Expo and Cloudflare) keep standard request logs, such as IP address, device type and time, to run and secure the service.
Photo and video metadata: files you upload may contain information your camera added, such as where a photo or video was taken. The app removes location data from photos and videos before uploading them where it can, and we don’t read or use what remains, but some may stay inside the file. To avoid it, turn off location for your Camera in iOS Settings → Privacy & Security → Location Services.
Apart from the location uses above, we do not collect your device’s GPS location. We do not collect browsing history outside the app or advertising identifiers, Gymgress contains no advertising or attribution SDKs, and we do not track you across other companies’ apps or websites.
4. How We Use Your Information
We use your information to: run the app’s features (workout tracking, feed, messages, groups, clubs, sessions, rankings); show your content to the audience you choose; calculate streaks, personal records, volume and rankings, including checks that flag lifts that look unrealistic for your history and body weight; send the notifications you’ve turned on; keep accounts secure, prevent spam and abuse, and review reports; answer you when you contact support; and look at overall numbers (such as how many people signed up or were active, or how people heard about us) to improve Gymgress. Those overall numbers come from our own database and, if you leave usage analytics on, from the usage and diagnostics data described in section 3.
We do not sell your personal information, we do not share it for cross-context behavioral advertising, and we do not show ads.
5. Who Can See Your Information
Gymgress is a social fitness app, so some information is visible to other users by design:
- Any signed-in user: your username, display name, profile photo and experience level; the clubs you belong to and club member lists; your public posts (except people you’ve blocked or who blocked you); and exercise names you added to the shared catalog.
- People allowed to view your profile (everyone, or only friends if “Private Profile” is on): your bio, fitness goals, nationality (unless you hide it) and body weight. “Private Profile” does not hide your posts or club scores from members of clubs you’re in (see Clubs below).
- Workout history and rest days: whoever “Who Can See My Workout History” allows (Everyone, Friends or Only Me; Friends by default).
- Personal records, achievements and rankings: whoever “Who Can See My Stats” allows (Everyone by default). Global rankings show your username, name, photo, nationality (unless hidden) and the ranked number; relative rankings are calculated from your body weight.
- Friends: others can see how many friends you have if “Who Can See My Friends” allows it, and friend suggestions show how many mutual friends you share.
- Posts: you choose each post’s audience: “Friends & clubs” or “Public”. Friends & clubs posts are visible to your friends and to every member of any club you belong to, whether or not you’re friends, and even if your profile is private. Public posts are visible to everyone. Comments and likes are visible to anyone who can see the post. You can change a post’s audience or delete it at any time.
- Clubs: while you’re in a club, its members can see all your posts (as above), your scores on the club’s leaderboard and challenges, your share of the club’s total, and that you’re a member; members also see what you write in the club chat. Club rosters are visible to any signed-in user (members under 18 are shown only to other members). Leaving a club stops sharing with its members from then on; posts they already saw or saved outside the app can’t be recalled.
- Photos and videos on posts, and profile, group and club photos, are stored at long, random web links. The app only shows them to people allowed to see them, but anyone who obtains a link can open that file. Photos and videos in messages are private and are opened through temporary links that only the chat’s members get; a view-once photo or video is deleted from our servers after it is opened.
- Messages: only the members of that conversation. If notifications are on, a preview of a new message or comment appears on the recipient’s device.
- Scheduled sessions: the host and the people invited.
- Only you: your date of birth, gender, height, pronouns, location field, phone number, weight log, body measurements, goals, saved gyms and their locations, imported workouts, plans and routines, settings, signup answers, blocks and the reports you file.
If you block someone, they can no longer message you or see your public posts, and you won’t see theirs. These access rules are enforced by our database, not only hidden in the app. The operator of Gymgress can access account data when needed to provide support, investigate reports, keep the service secure, or comply with the law.
6. Service Providers and Other Sharing
We use these providers, which process data only to provide their service to us:
- Supabase: database, sign-in, file storage and server functions, hosted in the United States.
- Expo: delivers push notifications (including the notification text, such as a message preview) and app updates.
- Apple: Sign in with Apple, push notification delivery, and Apple Health on your device.
- Google: only if you use Sign in with Google.
- Cloudflare: hosts our website and invite links.
- PostHog (United States): the app usage analytics described in section 3 (you can turn these off).
- Sentry (United States): crash and error reports.
- Resend: sends the one-time code when you verify a school email.
When you share a card or post to another app (such as Instagram, TikTok or Messages), what you share is handled under that app’s own policy. We may also disclose information if required by law, or to protect the rights, safety and security of Gymgress, our users or the public. If we add another provider that handles personal data, we will update this section first.
7. Your Choices and Controls
In Settings you can: turn usage analytics off; choose who can see your profile details, workout history, stats and friends; who can send you friend requests and message you; hide your nationality; turn Apple Health syncing and each notification type on or off; allow or deny location (in iOS Settings); unfriend, block or report users and content; edit your profile; delete posts, comments, messages, workouts, weight entries and measurements; and update your email and password.
Download your data any time from Settings → Data → Download My Data (a JSON file of everything tied to your account) or export your workout history as CSV.
Delete your account and its data any time from Settings → Account → Delete Account. Deletion is permanent and can’t be undone.
When you report content, we store who filed the report, what it targeted and why, so we can review it; we don’t tell the reported person who reported them.
8. Data Retention and Deletion
We keep your information while your account is active. When you delete your account we immediately delete, from our live database and file storage: your profile, workouts and imported workouts, body data, posts, comments and likes, the messages you sent (they also disappear from the other person’s chat), groups and clubs you own (including their chats), friends, settings, push tokens, and the photos and videos attached to your profile, posts and messages. Copies can remain in our hosting provider’s encrypted backups for up to 30 days before they are overwritten.
Some things are kept after deletion: exercise names you added to the shared catalog (no longer linked to you), reports other users filed about you and our moderation records, short-lived security logs, and usage analytics and crash reports already sent to PostHog and Sentry (tied only to an internal ID), which those providers keep for their standard retention period. Workouts Gymgress saved to Apple Health stay in Apple Health, under your control.
9. Data Security
We use encryption in transit (HTTPS), database-level access rules on every table, private storage with temporary links for message photos and videos, and an encrypted sign-in session on your device whose key is kept in the iOS Keychain. Post and profile photos use unlisted links, as described in section 5. No method of transmission or storage is 100% secure, and we can’t guarantee absolute security.
10. Children’s Privacy
Gymgress is not directed at children under 13, and signup requires a date of birth showing you are at least 13. If you believe a child under 13 has given us personal information, contact us and we will delete it.
11. International Users
Your information is processed and stored in the United States, which may have different data protection laws than your country.
12. Your Privacy Rights
Depending on where you live (for example California, the EU or the UK), you may have the right to access, correct, download or delete your personal information, and to object to or restrict some processing. You can do most of this yourself in Settings (section 7), or email us and we will respond within 45 days. We don’t sell or share personal information as those terms are defined in California law, we don’t use sensitive information to infer things about you, and we won’t treat you differently for exercising your rights.
13. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we’ll notify you in the app or by email before they take effect.
14. Contact Us
Questions or requests about your privacy? Contact us at [email protected].