Privacy Policy

What We Collect

We collect information you provide directly when using Gymmy, including:

• Account information (name, email address)
• Workout data (exercises, sets, reps, weights)
• Body measurements and progress photos (if provided)
• Device information and usage analytics
• Payment information (processed securely via Stripe or Mollie)

Permissions Used

Gymmy requests the following Android permissions:

• CAMERA — used only when you explicitly tap "Scan" to auto-fill a form (KvK business document, ID card, paper PAR-Q questionnaire). The image is processed in memory on our backend, used only to extract text, and is never stored. See "Document Scanning" below.
• INTERNET — to communicate with our Firebase backend.
• ACCESS_NETWORK_STATE — to detect connectivity for offline-friendly behaviour.
• POST_NOTIFICATIONS — to deliver booking reminders, invite-link acceptance alerts, and other in-app notifications you can disable at any time in your device settings.

Document Scanning

When you use the in-app document scanner (gym creation KvK upload, member ID auto-fill, or paper PAR-Q digitisation), the captured image is sent over an encrypted connection to our Cloud Function which runs optical character recognition via the Google Cloud Vision API. The image is held in volatile memory only for the duration of the OCR call and is never persisted to our storage. Only the extracted text fields are returned to your device. For ID documents, the document number is automatically masked to the last 4 digits before leaving the OCR step.

We keep an internal audit log of which user scanned what document type and when — metadata only, no images and no extracted personal data. This log is retained for 90 days for security review and then automatically deleted.

How We Use It

• Provide and improve the Gymmy service
• Track your fitness progress over time
• Personalize your workout experience
• Send important service notifications
• Process payments for premium features
• Analyze app usage to improve performance

Data Storage and Retention

Your data is stored securely using Google Firebase infrastructure, which employs industry-standard encryption both in transit and at rest. Data is stored within the European Union in compliance with GDPR requirements. We retain your data for as long as your account is active or as needed to provide services.

You can delete your account at any time via Settings → Account → Delete account inside the app, or by following the steps on our account deletion page. On deletion: your profile, workout history, body measurements, photos, memberships, and payment metadata are removed within 30 days. Anonymous aggregated analytics may be retained for service-improvement purposes; this data cannot be linked back to you. Document-scan audit logs are auto-deleted after 90 days regardless of account state.

Third Parties

We share data only with the following trusted third-party services:

• Google Firebase (authentication, database, analytics)
• Google Cloud Vision API (document OCR, image never stored)
• Stripe and Mollie (payment processing)
• Google Analytics (anonymized usage data)

We do not sell your personal data to any third party.

Your Rights

Under GDPR, you have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data — see our account deletion page
• Export your data in a portable format
• Withdraw consent at any time
• Lodge a complaint with a supervisory authority

To exercise any of these rights, contact us using the details below.