GymPact Privacy Policy

Last updated: 8 September 2026

GymPact helps gym-goers find a community at their gym. This policy explains exactly what we

collect, why, who else sees it, and how to get it deleted. We've tried to write it in plain

language rather than legalese.

If anything here is unclear, email us at privacy@getgympact.com and we'll explain it.

The short version

• We collect what you type into the app, plus a record of your gym check-ins and sleep logs.
• We do not store your location. We ask for it to sort gyms by distance and to fetch local

weather, but the coordinates never reach our servers.

• Other members of a Gem you join can see your **name, profile photo, streak count, posts,

messages and event RSVPs; which days of the week you train; whether you're at the gym

right now** (for two hours after you check in); and, only if it is the same as theirs, your

free-meal day. They cannot see your age, gender, height, weight, goal, sleep data, or your

free-meal day when it differs from their own.

• Matching is opt-in, off by default, and 18+. If you never turn it on, nothing about you is

ever shown to anyone outside your Gems. If you do, the people swiping still cannot see your gym,

your Gem, your training days, whether you're at the gym, or how far away you are.

• We don't sell your data. We don't run ads. We don't share anything with advertisers.
• You can ask us to delete your account and everything in it, and we will.

The waitlist on this website

This policy covers the GymPact app, and also this website, which currently does one thing: it

takes an email address for the pre-launch waitlist.

• What we collect: the email address you type, and a note that it came from the website rather

than somewhere else. Nothing else — no name, no IP address stored by us, no profile.

• Why: so we can email you once, when GymPact opens. Our lawful basis is your consent, which

you give by submitting the form.

• How long: until we launch and send that email, or until you ask us to remove you, whichever

comes first. We delete the list once it has served its purpose.

• Who else sees it: Supabase, which stores it, and Resend, which would deliver the email.

Nobody else. We do not sell it, rent it, or share it with any other company.

• How to get off it: email privacy@getgympact.com and we will

delete your address. You do not need an account and you do not need to explain why.

The waitlist is stored so that it cannot be read back out by the website. The page can add an

address to the list and can do nothing else with it — it cannot retrieve the list, search it, or

check whether a particular person is on it.

This website sets no cookies and runs no analytics. See our Cookie Policy for the

detail.

What we collect

Information you give us

Account details. Your email address and password (passwords are hashed by our authentication

provider — we never see or store the plain text). If you sign up by phone, your phone number.

Profile information you enter during onboarding or later edit. Your name, age, gender, height,

weight, fitness goal, and chosen "free meal day." All of these are optional except your name — you

can leave them blank and the app still works.

Training preferences. How many days a week you train, your typical session length, your weekly

workout split, and which outside-the-gym activities interest you.

Content you create. Posts, chat messages, events you organise, and RSVPs. Photos you upload —

as a cover image for a gym or Gem you created, attached to a post, or sent in a chat. Videos you

upload as a Reel, which are visible to everyone using GymPact, not just your Gem. GIFs you choose

from the GIF picker are not copied to our servers; we store only a link to Giphy's copy.

Reports and blocks. If you report content or block someone, we store who filed it, who or what

it was about, and any reason you gave, so we can act on it. Reports are not visible to the person

reported, and blocks are not visible to the person blocked.

Information generated by using the app

Gym check-ins. Each day you tap "I'm at the gym," we store that calendar date and the time you

tapped it. We do not store where you were — no coordinates, no gym address, nothing about your

physical location. The timestamp exists so the app can show your Gem's "who's here now" strip: for

two hours after you check in, other members of your Gem can see that you're at the gym. After that

window your check-in counts only toward your streak, and the time is not shown to anyone.

Sleep logs. The hours you report sleeping each night, your chosen nightly target, and your

bedtime reminder time if you set one.

Gem membership. Which Gems you've joined and when, and your role in each.

Basic usage events. We log a small, fixed set of events to understand whether the app works:

account created, onboarding finished, Gem joined, post created, event RSVP'd. Each record contains

your user ID, the event name, a timestamp, and (where relevant) the ID of the Gem or event

involved. No content, no message text, no personal details.

Information we deliberately do not collect or keep

Your location is never stored. GymPact asks for location permission so it can (a) sort nearby

gyms by distance and (b) show a local weather tip. Both calculations happen on your device or in a

single outbound weather request. Your coordinates are never written to our database and we have no

history of where you've been. You can decline the permission entirely — you'll just see gyms

unsorted and no weather card.

Meal photos are not uploaded. If you take a photo of a meal on your free-meal day, it stays on

your device in the app's temporary memory and is gone when you close the app. It is never sent to

our servers.

**We do not collect device advertising identifiers, contacts, browsing history, or data from other

apps.** We do not read from Apple Health or Google Fit.

Why we collect it

| What | Why |

|---|---|

| Email / phone, password | To create and secure your account |

| Name, profile photo | So gym-mates can recognise you |

| Age | To suggest a sensible nightly sleep target |

| Gender, height, weight, goal | To personalise your dashboard — visible only to you |

| Training preferences | To show your workout for today and your weekly plan |

| Check-ins, sleep logs | To calculate your streaks |

| Posts, messages, events | To provide the community features you joined for |

| Usage events | To see which features work and which are broken |

We rely on your consent (which you can withdraw by deleting your account) and on the necessity

of processing this data to provide the service you signed up for.

Who can see your information

Other GymPact members

When you join a Gem, other members of that Gem can see:

• Your name and profile photo
• Your gym check-in streak count
• Anything you post or send in that Gem's chat, including photos and GIFs
• Which events you've RSVP'd to
• Which days of the week you train, taken from your weekly split (the split's contents —

which exercises, session length, and your outside-the-gym interests — are not shared)

• That you are at the gym right now, for two hours after you tap "I'm at the gym"
• Your free-meal day, only when it matches their own — members whose day differs never see

yours, and if you haven't set one you never appear

They cannot see your age, gender, height, weight, fitness goal, sleep data, or email address.

This is enforced at the database level, not just hidden in the app.

Anything you post in a Gem's feed or chat is visible to everyone in that Gem. Treat it as public

within that community.

Everyone using GymPact

Reels are deliberately app-wide, not limited to your Gem: a video you post as a Reel, along with

your name and profile photo, can be seen by anyone signed in to GymPact.

Service providers

We use a small number of third parties to run the app:

• Supabase — hosts our database, file storage, and authentication. All your account and app

data lives here.

• Resend — delivers account emails such as confirmation and password-reset messages. Receives

your email address only.

• Open-Meteo — provides the weather tip. Receives approximate coordinates with no account

identifier, name, or any other information attached, so the request cannot be linked back to you.

• Sentry — collects crash and error reports from release builds of the app, so we can find and

fix crashes. A report includes device model, operating system version, app version, a technical

stack trace, and the IP address the report was sent from. We do not attach your name, email

address, or account identifier to these reports. Crash reporting is off entirely in development

builds.

• Giphy — powers the GIF picker and serves any GIF shown in a feed or chat. When you search for

a GIF, your search term is sent to Giphy; when a GIF is displayed, your device loads it directly

from Giphy's servers, which means Giphy receives your IP address. No account identifier is sent.

• OpenStreetMap (Nominatim) — powers the "search for your gym" box when you add a gym. Receives

what you type into that box, and (as a rough area hint to improve results) your approximate

coordinates. No account identifier is attached.

These providers process data on our behalf and are not permitted to use it for their own purposes.

Nobody else

We do not sell your personal information. We do not share it with advertisers or data brokers. We

do not run advertising in GymPact.

We would disclose information if legally compelled to by a valid legal order, or where necessary to

protect someone's safety.

Matching

Matching is a separate, optional part of GymPact for members who want to meet people rather than

only train with them. **It is off until you turn it on, and it is only available to members aged 18

and over.** If you never enable it, nothing in this section applies to you and no part of your

profile is ever shown to anyone outside the Gems you have joined.

What a matching card shows

When you enable matching you choose what goes on your card. Other people who have also enabled it

can see:

• the photos you upload for it
• your first name only — never your surname
• your age
• your fitness goals, interests and how many times a week you train
• the hobbies, likes, dislikes, films and foods you add, and your short bio

What a matching card never shows

This list is enforced in our database, not merely hidden in the app:

• your gym, or which Gem you belong to
• your location, or any distance from the person viewing you
• your training schedule, or whether you are at the gym right now
• your weight, height or gender
• your free-meal day, sleep data, birthday or email address

That combination is deliberate. A Gem maps to a single gym, so naming either one would tell a

stranger where you physically are on a predictable schedule. If you want a match to know where you

train, that is yours to tell them.

Photos

Matching photos are stored privately, not on a public address. They are served through short-lived

links, and our database checks on every request that the person asking is someone your card would

actually be shown to. Turning matching off, removing a photo from your card, or blocking someone

all stop your photo being readable immediately — not eventually.

Likes and matches

• When you like someone, they are told nothing. A like is never revealed on its own.
• When two people have liked each other, both are told how many matches they have — a number,

nothing more.

• Seeing who matched with you is part of the paid plan.
• Nobody can look up who liked them by any other route: the record of likes cannot be read by the

app at all.

Blocking

Blocking works across the whole app in one action. If either of you blocks the other, you disappear

from each other's matching cards, feed, chat, events and "who's here now" — in both directions,

whichever of you did the blocking.

Leaving

You can leave matching at any time. Doing so **deletes your card, your matching photos and the

likes you cast**. Likes other people cast are their own records and stay with them. Leaving

matching does not affect your account, your Gems or anything else in GymPact.

Notifications

If you turn on the bedtime reminder, that notification is scheduled locally on your device. We

do not send push notifications from our servers and we do not collect a push notification token.

You can turn the reminder off in the Sleep screen at any time.

How long we keep things

We keep your information for as long as your account exists. If you ask us to delete your account,

we remove your profile, training preferences, check-ins, sleep logs, posts, messages, events and

RSVPs. Backups are cycled out within 30 days.

Usage events (the five listed above) are retained in aggregate form for product analysis and are

disassociated from your account on deletion.

Your rights and how to use them

You can, at any time:

• See what we hold — email us and we'll send you a copy.
• Correct it — most fields are editable in Profile → Edit Profile.
• Delete your account and data — go to Profile → Delete Account in the app. This is

immediate and permanent: your profile, training preferences, check-ins, sleep logs, posts,

messages and RSVPs are erased. Gyms and Gems you created stay (so the community you started

isn't destroyed for everyone else), but they're no longer linked to you. If you'd rather we do

it for you, email privacy@getgympact.com from your account's email address.

• Withdraw permissions — revoke location, camera or photo access in your device settings; the

app continues to work with those features disabled.

• Object or complain — if you're in the UK or EU, you can complain to your local data

protection authority.

Depending on where you live (for example, the EU/UK under GDPR, or California under the CCPA), you

may have additional rights including data portability and the right to restrict processing. We

honour these requests regardless of where you live.

Children

GymPact is not intended for anyone under 13, and the app does not accept an age below 13. We do not

knowingly collect information from children. If you believe a child has created an account, email

us and we'll remove it.

Matching is restricted to members aged 18 and over. That restriction is enforced in our

database, not only in the app: someone under 18 cannot switch matching on, cannot be shown to

anyone, and cannot see anyone else. If an account's age is later changed to under 18, matching is

switched off automatically and their photos stop being viewable.

Security

• All data is transmitted over encrypted connections (HTTPS/TLS).
• Your login session is stored encrypted on your device, with the encryption key held in your

phone's hardware-backed secure storage (iOS Keychain / Android Keystore).

• Access to your data is enforced by database-level row security rules, not merely by what the app

chooses to display.

• We never store your password — authentication is handled by Supabase, which stores only a

cryptographic hash.

No system is perfectly secure, but we take this seriously and audit our access rules.

Where your data is processed

Our database is hosted in the United States. If you use GymPact from outside the US, your

information will be transferred to and processed there.

Changes to this policy

If we change this policy in a way that meaningfully affects you, we'll notify you in the app before

the change takes effect. The "last updated" date at the top always reflects the current version.

Contact

privacy@getgympact.com