Privacy Policy
Effective date: 5 July 2026
Last updated: 5 July 2026
This Privacy Policy explains what personal data Gymothy ("we", "us", "the App") collects when you use the Gymothy mobile application, why we collect it, how it is stored, and the rights you have over it. Gymothy is an invite-only workout-tracking and fitness-social app. We built it to be small, honest, and boring about your data: we do not sell it, we do not run ads, and we do not track you across other apps or websites.
This policy is written to comply with the EU General Data Protection Regulation (GDPR). If you are outside the EU, the same protections apply to you — we do not offer a lesser standard elsewhere.
1. Who is responsible for your data (data controller)
The data controller is the individual operator of Gymothy. Full legal identity and contact details are published in the Impressum, as required for services offered to users in Germany.
2. What data we collect
We collect only what the App needs to function:
| Category | Examples | Why we collect it |
|---|---|---|
| Account data | Email address, password (stored hashed by our authentication provider, never in plain text), username, display name, bio, avatar image | To create and secure your account, and to let friends recognize you |
| Workout data | Exercises logged, sets, reps, weight, RPE, workout start/end times, personal records (PRs), notes | This is the core function of the App — tracking your training and detecting PRs |
| Social & activity data | Friend connections, blocks, posts, comments, "respect" reactions, witness attestations (confirmations that a friend witnessed a PR), reports you file | To power the friends feed, PR verification, and safety features |
| Photos | Images you choose to upload to a workout post | Only uploaded if you explicitly attach a photo to a post |
| Gamification data | XP events and level, achievements earned, weekly missions and their progress, streak tokens, unlocked and equipped avatar cosmetics | To run the RPG-style progression layer — all of it is derived from your own training and social activity, none of it from tracking you |
| Location data (optional, opt-in) | For a saved gym: a label, coordinates, and a check-in radius. For a workout check-in: one GPS coordinate fix, its reported accuracy, the computed distance to your nearest saved gym, an Android "mock location" flag, and a verified/unverified/flagged verdict | Only if you create a saved gym and grant location permission — to verify (anti-cheat) that a workout happened at your gym, for a small XP bonus. See §3 |
| Two-factor authentication (2FA) data | If you enable 2FA: a TOTP (authenticator-app) secret, held entirely by our authentication provider (Supabase Auth) — never stored or seen by the App itself | To add an optional second layer of login security |
| Push notification token | A device token issued by Apple/Google/Expo's push service | To deliver notifications (friend requests, comments, witness requests) to your device |
| Technical/session data | Auth session tokens, timestamps of account/content creation | To keep you signed in and to operate the database correctly |
Beyond the optional, opt-in gym check-in described in §3, we do not collect: continuous or background location, contacts, advertising identifiers, browsing history outside the App, biometric data, or health data beyond what you manually type in as workout numbers (reps/weight/RPE are not treated as special-category health data by us, but we handle them with the same care regardless).
3. Location data (gym check-in)
Gymothy has one optional feature that uses your device location: gym check-in. It verifies that a workout actually happened at a gym you saved — a small anti-cheat measure that grants a modest XP bonus for a verified check-in. This is the only feature that uses location, and it is strictly opt-in. If you never save a gym, Gymothy never requests or reads your location at all.
Opt-in, twice over. Location is used only if both are true: (1) you have created at least one "saved gym" in Settings, and (2) you have granted the App "while using the app" (foreground) location permission. We never request background or "always" location, and the App is technically configured (in `app.json`) so that it cannot collect location in the background — no background location, no geofencing service, no foreground service.
When we read your location — and how often. We take a single, one-shot GPS fix at two moments only:
- when you tap to save your current location as a gym in Settings (to store that gym's coordinates); and
- when you finish a workout, and only if you already have a saved gym and have already granted permission — one fix, compared against your saved gym. It never prompts you at workout finish and never blocks finishing.
There is no continuous tracking, no route recording, no background collection, and no location read at any other time.
What we store. For a saved gym: the label you choose, its coordinates, and a check-in radius (80–300 m). For a workout check-in: the single coordinate fix, its reported accuracy, the computed distance to your nearest saved gym, a "dwell" flag (whether the workout lasted long enough to be plausible), the Android mock-location flag (see below), and a verdict of verified, unverified, or flagged. The verdict is computed on our server, never by your device — the App cannot mark its own check-in as verified.
Android mock-location disclosure. On Android, the operating system exposes a flag indicating whether a location reading was produced by a mock-location (GPS-spoofing) app. We read and store this flag solely to flag potentially faked check-ins for anti-cheat review. We do not use it for any other purpose. (iOS does not expose an equivalent flag.)
Legal basis. Consent (Art. 6(1)(a) GDPR). You give consent by saving a gym and granting the OS-level permission, and you can withdraw it at any time: revoke location permission in your device settings and/or delete your saved gyms in Gymothy (Settings → gyms), which stops all future location use.
Retention & deletion. Saved gyms and check-in records last as long as the account (or the associated workout) they belong to. Deleting a saved gym removes that gym definition. Deleting a workout deletes its check-in. Deleting your account deletes all of your saved gyms and all of your check-in records via the same server-side cascade as the rest of your data (see §9). Location data is never shared with third parties and never leaves our EU-hosted database.
4. How we use your data (purposes & legal basis)
- To provide the service (Art. 6(1)(b) GDPR — performance of a contract): storing your workouts, computing PRs, rendering your feed, running the XP/level/achievement/mission progression, sending notifications you'd expect from a social fitness app.
- To keep the community safe (Art. 6(1)(f) — legitimate interest): processing reports, enforcing blocks, allowing moderator review of reported content, and reviewing check-ins flagged by the anti-cheat system.
- To secure your account (Art. 6(1)(f)): authentication, session management, abuse prevention.
- With your consent (Art. 6(1)(a)): push notifications, uploading a photo to a post, and the optional gym check-in location feature (see §3). You can withdraw any of these at any time.
We do not use your data for advertising, profiling, or any purpose beyond operating the App as described above. We do not sell, rent, or trade your personal data to any third party.
5. Who can see your data
Gymothy is a friends-only social app, enforced by server-side access rules (Row Level Security), not just app-side logic:
- Your workouts, sets, PRs, XP, gym check-ins, and location data are private to you unless you post them (and location/check-in data is never posted).
- Posts are visible to your confirmed friends only (or to nobody, if you mark a workout "private"). Your achievements and equipped cosmetics are visible to your confirmed friends.
- If you block someone, all content between you becomes mutually invisible — this is enforced at the database level, not just hidden in the UI.
- A designated moderator account (the app operator) can view content you report, content someone reports about you, and check-ins the anti-cheat system has flagged, solely to resolve reports and investigate suspected cheating.
6. Where your data is hosted
All Gymothy data is hosted on Supabase, running in the `eu-central-1` (Frankfurt, Germany) AWS region. Your data does not leave the EU as part of normal operation. Push notification delivery uses Expo's push notification service, which necessarily routes a device token and notification text through Apple/Google infrastructure to reach your device — this is standard for any app that sends push notifications.
7. How long we keep your data
We keep your data for as long as your account exists. If you delete your account (see §9), your data is deleted immediately and permanently — there is no "soft delete" grace period, no backup retention window we can restore from, and no way for us or you to undo it. Individual items you delete yourself (a workout and its check-in, a saved gym, a post) are removed at the moment you delete them.
8. Your rights
Under GDPR you have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectification — correct inaccurate data (most of this you can already edit yourself in Settings).
- Erasure ("right to be forgotten") — delete your account and all associated data, in-app, at any time (§9).
- Restriction & objection — ask us to limit or stop certain processing.
- Data portability — request your workout data in a structured, machine-readable format.
- Withdraw consent — for anything based on consent (push notifications, photo uploads, gym check-in location), at any time, without affecting past lawful processing.
- Lodge a complaint with your local data protection supervisory authority.
To exercise any right not available directly in-app, contact us using the details in the Impressum.
9. Deleting your account (in-app)
You can permanently delete your Gymothy account at any time from Settings → Delete account. You will be asked to type your username to confirm. On confirmation, your account and all data linked to it — profile, workouts, sets, PRs, posts, comments, reactions, attestations, friendships, blocks, reports you filed, notifications, XP events, achievements, missions, cosmetics, saved gyms, and gym check-in records — are deleted immediately via a server-side cascade. This action cannot be undone and we cannot recover the data afterward, so please be certain.
10. Children
Gymothy is invite-only and not directed at children. You must be at least 16 years old (or the age of digital consent in your jurisdiction, if higher) to use the App.
11. No ads, no tracking, no third-party analytics
Gymothy does not embed advertising SDKs, does not use third-party analytics or tracking pixels, and does not share data with data brokers. The only third-party processors involved are Supabase (database/auth/storage hosting) and Expo/Apple/Google (push notification delivery) — both acting strictly as data processors on our instructions, not as independent controllers of your data.
12. Changes to this policy
If this policy changes materially, we will update the "Last updated" date above and, where required, notify you in-app.
13. Language versions
A German-language version of this Privacy Policy (Datenschutzerklärung) is available in-app and at privacy-policy.de.md. If the two versions ever conflict, the English version governs for legal interpretation, but we intend them to say exactly the same thing.
14. Contact
See the Impressum for the legally responsible party and contact details.
Terms of Service (ToS / EULA)
Effective date: 5 July 2026
Last updated: 5 July 2026
These Terms of Service ("Terms") are a legal agreement between you and the operator of Gymothy (see the Impressum) governing your use of the Gymothy mobile application ("Gymothy", "the App"). By creating an account or using the App, you agree to these Terms. If you do not agree, do not use the App.
We've tried to write these in plain language rather than dense legalese, so that they're actually useful to a German consumer as well as anyone else. Where plain language and precise legal meaning conflict, the plain-language intent controls.
1. What Gymothy is
Gymothy is an invite-only workout tracker and social fitness app: you log your training, the App detects personal records (PRs), and you can share your progress with friends who can react, comment, and "witness" (verify) your PRs.
2. Eligibility & invite access
- Gymothy is invite-only. You need a valid invite code to create an account.
- You must be at least 16 years old, or the minimum age of digital consent in your country if that is higher.
- You are responsible for keeping your login credentials confidential and for all activity under your account.
3. Your content (User-Generated Content / UGC)
You keep ownership of everything you post — workout data, photos, captions, comments, PR claims ("Your Content"). By posting Your Content, you grant Gymothy a limited, non-exclusive, royalty-free license to store, process, and display it to the audience you chose (friends, or nobody, per your visibility setting) solely to operate the App. We do not license Your Content to third parties, and we do not use it for advertising.
You are solely responsible for Your Content. You represent that you have the rights to post it and that it does not violate these Terms or any law.
4. Objectionable content & acceptable use
Photo posts in Gymothy are not pre-moderated before publishing — they go straight to your friends, because Gymothy is built for small, trusted circles. That means the safety of the community depends on you following these rules, and on the report/block/moderation system as the backstop. You agree not to post or send, via the App:
- Nudity, sexually explicit material, or content primarily intended to be sexually gratifying.
- Content depicting or promoting violence, self-harm, eating disorders, or dangerous/unsafe training practices presented as advice.
- Hate speech, harassment, bullying, or content that threatens, demeans, or discriminates against any person or group.
- Illegal content of any kind, including content that infringes another person's intellectual property or privacy rights.
- Spam, scams, or commercial solicitation unrelated to your personal training.
- Impersonation of another person, or intentionally false claims presented as fact.
Enforcement. Any user can report a post or a user, with a reason, at any time (Settings → report flow, or the "⋯" menu on any post). Reports are reviewed by a moderator. Confirmed violations may result in content removal, and repeated or severe violations may result in account suspension or deletion, at the operator's discretion. You can also unilaterally block any user, which hides all content between you and them in both directions, immediately, without needing operator involvement.
5. The witness-honesty clause (PR verification)
Gymothy lets you tag a friend as a "witness" to a personal record, and that friend can confirm or decline the request. A confirmed witness attestation is displayed as a verified badge next to your PR.
By requesting a witness confirmation, you represent that the lift actually happened as logged, in front of (or verifiably known to) the witness you tagged.
By confirming a witness request, you represent that you actually witnessed the lift, or have a good-faith basis to believe it happened as described, and are not confirming it as a favor, joke, or automatic reflex.
Knowingly false PR claims or knowingly false witness confirmations are a violation of these Terms and may be reported like any other objectionable content, with the same enforcement consequences. Gymothy's witness system is a social trust mechanism, not a cryptographically verified one — we rely on the community using it honestly, and we reserve the right to remove badges or restrict accounts that abuse it.
6. No professional advice
Gymothy displays exercise information (muscle groups, equipment, instructions) and your own logged numbers. This is not medical, nutritional, or professional fitness advice. Consult a qualified professional before starting any new training program, especially if you have a pre-existing health condition. You use the App's exercise library and training features at your own risk.
7. Account termination
By you: you may delete your account at any time, in-app, via Settings → Delete account. This immediately and permanently deletes your data (see the Privacy Policy §8) — it cannot be undone.
By us: we may suspend or delete your account if you materially violate these Terms (see §4), for legal compliance reasons, or to protect the safety of other users, with notice where reasonably possible.
8. Availability & changes
Gymothy is currently operated as a free, invite-only, small-scale service. We do not guarantee uninterrupted availability, and features may change, be added, or be removed as the App evolves. We will not charge you money without clear advance notice and your explicit agreement — there is no hidden billing.
9. Disclaimer of warranties & limitation of liability
The App is provided "as is," without warranties of any kind to the extent permitted by applicable law. To the maximum extent permitted by law, the operator is not liable for indirect, incidental, or consequential damages arising from your use of the App. Nothing in these Terms excludes liability that cannot be excluded under German or EU consumer protection law (e.g. liability for intent or gross negligence, or statutory rights you have as a consumer).
10. Governing law
These Terms are governed by the laws of Germany, without prejudice to any mandatory consumer-protection rights you have under the law of your country of residence if you are a consumer within the EU.
11. Language versions
A German-language version of these Terms (Nutzungsbedingungen) is available in-app and at terms.de.md. If the two versions ever conflict, the English version governs for legal interpretation, but we intend them to say exactly the same thing.
12. Contact
See the Impressum.