This Privacy Policy explains what information Gymgress ("we," "us") collects when you use the Gymgress app, how we use it, and the choices you have. Gymgress is operated by Alejandro Lionardo Jarquin Avendano, an individual based in California, USA.
1. Information You Provide to Us
Account information: the email address and password you sign up with (your password is handled entirely by our authentication provider, Supabase — we never see or store it in plain text).
Profile information: your username, display name, profile photo, bio, fitness goal, experience level, pronouns, location (a free-text field you type, not your device's GPS location), bodyweight, height, and age (you can hide your age from other users, but we still store it).
Workout data: the workout plans, exercises, sets, reps, and weights you log; your workout history; and any personal records you enter or that we calculate from your logged workouts.
Content you create: posts (including any photo or video you attach and any caption you write), comments, likes, and direct messages to other users (including any photo or video you attach to a message).
Social information: your friends list, friend requests you send or receive, and any users you block.
Phone number: if you choose to verify your phone number (to let contacts who already have you saved find you on Gymgress), we store that verified number linked to your account.
Your device contacts (only if you turn on Contact Discovery): after you verify your own phone number, you can optionally let Gymgress check your phone contacts against other verified Gymgress accounts. If you do, the app reads your device's contact names and phone numbers, but only the phone numbers ever leave your device — they're sent to our server for matching and are not stored once that request completes. Contact names never leave your device; they're used locally to label the friend suggestions you see. We only ever match against other users who have themselves verified their own phone number — an unverified number is never matched or exposed. You can deny or revoke contacts access at any time in your device's Settings, and Contact Discovery simply won't run.
2. Information Collected Automatically
Device push token: if you enable notifications, we store a device-specific push token so we can deliver notifications (for example, a new message) to your device. This token identifies your device for notification delivery only.
Account security metadata: standard authentication data such as when your account was created and last updated.
We do not collect your device's precise location (GPS), browsing history outside the app, or advertising identifiers, and we do not use any third-party analytics or advertising SDKs.
3. How We Use Your Information
We use your information to: operate the app's core features (workout tracking, the friends feed, direct messages); show your content to the audience you choose (see "Who Can See Your Information" below); calculate stats like streaks, personal records, and volume; send you notifications you've opted into; secure your account and prevent abuse; and respond to you when you contact support.
We do not sell your personal information, and we do not use your data to serve you third-party ads.
4. Who Can See Your Information
Gymgress is a social fitness app, so some of your information is visible to other users by design:
- Your profile (username, display name, avatar) is visible to other signed-in users so they can find and add you as a friend.
- Your workout history, personal records, and posts are visible according to the privacy settings you choose for each (Everyone / Friends / Only Me).
- Direct messages, including any photos or videos you send, are visible only to the participants of that conversation.
- If you block someone, they can no longer see your content or message you, and you won't see theirs.
These access rules are enforced at the database level, not just hidden in the app's interface.
5. How We Share Information With Service Providers
We use Supabase to host our database, authentication, and file storage (including any photos and videos you upload), with infrastructure located in the United States. We use Expo's push notification service solely to deliver push notifications to your device. These providers process data on our behalf and are not permitted to use it for their own purposes.
We may also disclose information if required by law, or to protect the rights, safety, and security of Gymgress, our users, or the public.
We do not currently use any other data processor. If that changes (for example, adding a transactional email provider), we will update this section before that processor handles any real user data.
6. Your Choices and Controls
In Settings, you can: set a per-feature privacy level for who can see your workout history and stats; make your account private; hide your age from other users; unfriend or block another user; report a user, post, comment, or message that violates our terms; update your email and password; and export a copy of your data. You can delete your account and all associated data at any time from Settings → Account → Delete Account. Deletion is permanent and cannot be undone.
When you report content, we store the report (who filed it, what it targeted, and the reason) so we can review it; we do not share your identity as the reporter with the person you reported.
7. Data Retention
We retain your information for as long as your account is active. When you delete your account, we permanently delete your profile, workout data, posts, messages, and associated media within 30 days, except where we're required to retain limited records for legal compliance.
8. Data Security
We use industry-standard measures — including encryption in transit, database-level access controls, and authenticated file storage — to protect your information. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
9. Children's Privacy
Gymgress is not directed at children under 13, and we do not knowingly collect information from children under that age. If you believe a child has provided us with personal information, contact us and we will delete it.
10. International Users
Your information is processed in the United States, where our infrastructure providers host this project, which may have different data protection laws than your own country.
11. Changes to This Policy
We may update this Privacy Policy from time to time. If we make material changes, we'll notify you in the app or by email before they take effect.
12. Contact Us
Questions about this policy? Contact us at support@gymgress.app.