Your gym,
minus the awkward.

PRIVACY POLICY

How Gymley handles your data

Effective 29 September 2026 · Operator: William Chow

1. Scope and contact

This Privacy Policy applies to the Gymley mobile and web application. William Chow is the operator responsible for Gymley. Privacy questions, access or correction requests, and deletion requests can be sent to privacy@gymley.app.

2. Information we collect

• Account and authentication: email address, authentication-provider identifiers, sessions, and linked sign-in methods handled through Supabase Auth. A legacy field stores a SHA-256 hash of the verified sign-in identity and is deleted with the account.
• Profile and age gate: nickname, date of birth, confirmation that you are 18 or older, and room-visibility consent. Status, bio, prompts, photos, and gender are optional.
• Location and room presence: coordinates used to find, create, enter, verify, and leave gym rooms; room and venue identifiers; visit times; presence state; and the last verification time. Gymley does not store a continuous route.
• Nearby and live gym figures: when enabled, server-stored room anchors determine whether an active profile and exact checked-in gym room fall within another eligible user's selected 2 km, 10 km, or 20 km distance. Favorite Rooms can show, on request, a banded active-user range, a coarse busy level, and privacy-protected gender percentages rounded to five-point bands when the minimum sample is met. Daily aggregate visit data can provide a peak-period summary. These views do not return exact counts.
• Favorite Rooms: private links between your account and rooms you choose to save after visiting. Favorites sync across your devices and can be removed in Me.
• Social and safety activity: Waves, chats and messages, Gymate connections, blocks, contextual reports, Ask-a-Spot activity, notifications, and saved training programs.
• Device and support: an opaque native-installation hash, push token, notification preferences, app version, platform, and information you enter in a support report.
• Bonus Waves and referrals: your Bonus Wave balance and grant/spend ledger, personal referral code, one referrer/referee relationship, reward milestones, cooldown expiry, and the distinct eligible account IDs counted toward a new room's founder threshold. Referral records may include the same opaque installation hash used for anti-abuse checks.
• Wave purchases: Apple and RevenueCat may provide an app-user identifier, product and transaction identifiers, localized price and currency, purchase status, and sandbox or production environment. Gymley stores the minimum fulfillment record needed to credit a purchase once and prevent duplicate credit. Gymley does not receive your full payment-card details.

3. How we use information

We use this information to authenticate accounts, confirm the 18+ gate, enforce physical room proximity, provide Gymley features, deliver requested notifications, prevent abuse, calculate and protect Bonus Wave rewards, investigate reports, answer support requests, calculate Nearby eligibility and live gym figures, verify and fulfill Wave purchases, prevent duplicate or fraudulent credits, secure accounts, and maintain the service. We do not sell personal data or use it for third-party advertising.

4. Privacy boundaries inside Gymley

• A one-sided Wave never reveals its sender.
• A one-sided Add Gymate action never reveals intent or rejection.
• Grace-period users are invisible to other room members.
• Bio, full photos, prompts, and quick facts are restricted to Gymates.
• Blocking works in both directions without notifying the blocked person.
• Gymley has no read receipts, typing indicators, delivery states, or last-seen status.
• Ask-a-Spot does not create a social connection.
• A referral reward never gives the referrer the referee's gym, Wave target, location, or another activity detail.
• Founder qualification counts distinct eligible visitors privately and never creates a remote member roster.
• Favorite Rooms are visible only to you. They never notify founders, rank rooms, check you in, or contribute to founder rewards.
• A one-sided Nearby Wave remains anonymous, but its notification names the exact gym room from which it was sent.
• While you are actively checked in, eligible Nearby users may see your limited profile and exact checked-in gym room. Your device coordinates are not shown.
• Your selected gender may contribute to privacy-protected percentage bands while you have an active check-in. The split is hidden when the sample is too small and describes Gymley users, not everyone physically in a gym.

5. Location

Location is required for Gymley's in-person room features. The app may use background location to check you out after you leave. The backend receives coordinates to validate distance rules, including Nearby distance tiers. Room creation stores the room anchor; visit records store room-level history and timestamps, not a continuous movement trail. Denying background access means you may need to leave a room manually.

6. Photos, messages, and reports

Profile photos are stored privately and delivered through short-lived authorized links. Messages and closed temporary records may remain server-side for safety and moderation until account deletion even when they are no longer visible in the app. Person reports may contain category, optional description, related-chat context, participants, timestamps, and moderation state.

7. Service providers and transfers

Gymley uses Supabase for authentication, database, file storage, realtime features, and server functions; Expo for application builds and push delivery; Apple or Google when you choose those sign-in methods; Apple for App Store purchases; and RevenueCat to validate and coordinate purchase fulfillment. These providers may process data in other countries under their own contractual and security safeguards. Gymley does not automatically import your provider display name, profile photo, contacts, or social graph.

8. Retention and deletion

Most account-linked information is retained while your account exists. In-app account deletion removes the authentication account, profile, photos, messages and connections, visit records, Favorite Rooms, Waves, Bonus Wave balance and ledger, referral relationships, founder qualification entries, blocks, reports, support tickets, programs, push records, and other associated app data. Shared gym-room records may remain without identifying the deleted founder. An opaque installation hash remains without the deleted user ID for five days to enforce the device cooling-off period. Infrastructure logs and protected backups may remain for limited operational periods before rotation. Gymley deletes its account-linked purchase fulfillment records with the account, but Apple and RevenueCat may retain their own transaction records under their policies and legal obligations.

9. Security

Gymley uses access controls, row-level database rules, private storage, short-lived links, encrypted network transport, server-side eligibility checks, and restricted operator access. No online system is perfectly secure, so please report suspected account or privacy problems promptly.

10. Your choices and rights

You can edit profile information, remove photos, remove Favorite Rooms, withdraw notification permission, leave rooms, block or unblock people, and delete your account from Me → Delete Account. You may also request access, correction, or deletion by email. We may verify that you control the account before acting. Never send a password or one-time code to support.

11. Age and changes

Gymley is for people aged 18 or older. We may update this policy when the product or legal requirements change. The effective date above will be updated, and material changes will be communicated through the app or this page where appropriate.

TERMS OF USE

A respectful, real-world gym community

Effective 29 September 2026

1. Eligibility and acceptance

You must be at least 18 years old and able to agree to these Terms. By creating or using a Gymley account, you agree to these Terms and the Community Guidelines.

2. Your account

Provide accurate information, protect your sign-in methods, and use only your own account. One native installation may be bound to one Gymley account as an anti-abuse measure. Do not sell, share, automate, or impersonate an account.

3. Gym safety

Gymley is a social coordination tool, not medical, fitness, emergency, or professional supervision. Exercise and spotting involve risk. Use suitable judgment, communicate clearly, follow venue rules, and stop if conditions are unsafe. Ask-a-Spot does not guarantee skill, availability, or safety.

4. Acceptable use

Follow the Community Guidelines. Do not harass, threaten, discriminate, stalk, deceive, spam, scrape, reverse engineer, bypass location or device safeguards, create fraudulent accounts, manipulate Waves or rewards, or use Gymley for unlawful activity.

5. Your content

You remain responsible for profile text, photos, messages, room names, and reports you submit. You grant Gymley a limited licence to host, process, display, and transmit that content only as needed to operate, secure, moderate, and improve the service. You must have the right to submit it.

6. Rooms, presence, and availability

Location and attendance states can be delayed or inaccurate because of device, network, venue, or operating-system conditions. Gymley does not guarantee that a listed person, room, message, Spot request, or feature remains available. Do not use Gymley presence as proof of another person's location or safety. If Nearby is enabled, your active profile and exact checked-in gym room may be shown to eligible users within their selected distance. Nearby distance choices are free for now, may change later, and never guarantee that a particular room or person will remain available.

7. Wave purchases

Wave packs are one-time consumable in-app purchases. Payment is charged to your Apple ID when Apple confirms the purchase; Wave packs do not renew automatically. The price and currency shown by the App Store at confirmation control. Purchased Waves have no cash value, cannot be transferred, and are consumed when used. Refunds and cancellations are handled by Apple subject to applicable law and Apple policy. Contact support if Apple confirms a charge but the Waves are not credited; do not buy the same pack again while a credit is pending. Gymley may correct duplicated, reversed, refunded, or fraudulent credits.

8. Enforcement

We may restrict visibility, remove content, suspend features, or terminate accounts when reasonably needed for safety, integrity, legal compliance, or serious/repeated violations. Blocking and report outcomes may remain private to protect users and investigations.

9. Service changes and disclaimers

Gymley may change, pause, or discontinue features. The service is provided on an “as available” basis to the extent permitted by applicable law. Nothing in these Terms excludes rights or liabilities that cannot legally be excluded.

10. Ending use

You may stop using Gymley or permanently delete your account at any time. Sections that by their nature must survive—such as responsibility for past misuse and lawful dispute handling—continue only to the extent permitted by law.

11. Contact

Questions about these Terms can be sent to legal@gymley.app.

COMMUNITY GUIDELINES

Friendly, consensual, low pressure

Gymley should make the gym feel less awkward—not less safe. Every interaction is optional.

Not allowed

• Harassment, hate, threats, sexual misconduct, stalking, or repeated unwanted contact.
• Profiles or content involving anyone under 18.
• Impersonation, fraud, spam, commercial solicitation, or reward manipulation.
• Sharing private messages, photos, identities, or location information without consent.
• Instructions or conduct that create a credible risk of physical harm.
• Attempts to bypass blocks, account/device controls, moderation, or location checks.

Use the safety tools

Block silently when you want separation. Report a person from the relevant profile or chat so the report includes appropriate context. For an app or account problem, use Report a Problem in Me. If anyone is in immediate danger, contact venue staff or local emergency services—Gymley is not an emergency service.