Privacy Policy

Last updated: October 2026

This Privacy Policy describes how your gym ("the Gym", "we", "us") collects, uses, and protects your personal information when you use the GymMaxx mobile application ("the App"). Your gym is the data controller for your personal information; GymMaxx provides the App software and processes data on your gym's behalf.

1. Information We Collect

We collect the following categories of personal information:

Account Information: Email address, first name, last name, phone number (optional), date of birth (optional), gender (optional).
Profile Information: Profile photo (optional), fitness preferences, workout goals.
Workout Data: Workout plans, completed exercises, sets, reps, workout duration, and fitness history.
Visit Data: Gym check-in and check-out times recorded via NFC card scans at the gym entrance.
Subscription Data: Subscription plan, start/end dates, payment method type (we do not store payment card numbers).
Class Enrollment: Classes you book and attendance records.
Push Notification Token: If you grant notification permission, we store an anonymous device identifier issued by Apple (APNs) or Google (Firebase Cloud Messaging) so we can send you class, subscription, and gym announcement notifications. We do not collect your device's advertising ID or any cross-app identifier.
Local Storage: The App uses iOS UserDefaults / AsyncStorage to cache your login session, theme preferences, and an offline copy of your current workout. This data never leaves your device and is removed when you delete the App or your account.
Device Information: Device type and operating system version (collected automatically for app compatibility).

Why we collect date of birth: some classes have minimum-age requirements and some subscription plans (e.g. senior, student) require age verification.

Why we collect fitness data: to generate your personalized workout plans, show your progress, and produce your year-in-review wrap. Fitness data is never used for advertising or marketing and is never sold.

2. How We Use Your Information

To provide and maintain your gym membership account
To track your workouts, visits, and fitness progress
To manage class bookings and gym access
To send you notifications about your subscription, classes, and gym updates
To generate personalized workout plans based on your fitness preferences
To provide gym occupancy information and best-times-to-visit data
To comply with legal obligations

3. How We Store Your Information

Your data is stored securely on servers managed by your gym. We use industry-standard encryption (HTTPS/TLS) for all data in transit. Passwords are hashed using bcrypt and never stored in plain text. Access to your data is restricted to authorized gym staff (receptionists and administrators) who need it to manage your membership.

4. Data Sharing

We do not sell, trade, or share your personal information with third parties for marketing purposes. Your data is only accessible to:

Your gym's authorized staff (for membership management)
Service providers who host our infrastructure (under strict data processing agreements)
Law enforcement, if required by applicable law

To operate the App, we rely on the following service providers (sub-processors), who process limited data strictly on our behalf and not for their own purposes:

Cloud hosting provider — stores the application database and uploaded profile photos.
Expo (push notification delivery) — your device's push token is processed by Expo's push service to route class, subscription, and announcement notifications to Apple's APNs or Google's Firebase Cloud Messaging. No other personal data is shared.
Email delivery provider — processes your email address solely to send transactional messages such as password-reset codes.
OpenAI (AI workout plans) — only if you tap Allow in the AI consent prompt, when you complete the workout questionnaire your answers (gender, age range, height, weight, experience level, goal, training days, session length, and any injuries, focus areas or note you choose to add) are sent to OpenAI's API to generate your workout plan. Your name, email and other account details are not sent. Under OpenAI's API terms this data is not used to train their models. If the AI service is unavailable, the plan is generated on our own servers instead.

5. Third-Party Tracking

The App does not use third-party analytics, advertising trackers, or any form of cross-app tracking. We do not share data with advertisers.

6. Your Rights

You have the right to:

Access: Request a copy of all personal data we hold about you (available in-app under Profile > Account > Export Data).
Correction: Update your personal information at any time via the Edit Profile screen.
Deletion: Request permanent deletion of your account and all associated data (available in-app under Profile > Account > Delete Account). This action is irreversible.
Portability: Export your data in a machine-readable format.

These rights comply with GDPR (EU), CCPA (California), and other applicable data protection regulations.

7. Data Retention

We retain your personal data for as long as your account is active. If you delete your account, all personal data is permanently removed within 30 days. Anonymized billing records (subscription ID, amount, payment method type, date — no link to your identity) may be retained for up to seven (7) years to comply with tax, audit, and financial-reporting law in the gym's jurisdiction. Aggregated operational data (such as total gym visit counts) may be retained indefinitely.

8. Children's Privacy

The App is not intended for children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact your gym immediately.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via in-app notification. The "Last updated" date at the top reflects the most recent revision.

10. Apple App Tracking Transparency

The App does not track you across other apps or websites. We do not show the App Tracking Transparency prompt because there is no tracking activity to disclose. The privacy manifest bundled with the App declares NSPrivacyTracking: false.

11. Required Reason API Disclosure

To comply with Apple's Required Reason API requirements (May 2024+), the App declares its use of:

UserDefaults (reason CA92.1) — to persist your login session, theme preference, and current workout offline copy on your device.
FileTimestamp (reason C617.1) — to display the modification time of any locally cached profile photo.

These APIs are used solely for the purposes declared and never to fingerprint your device.

12. Contact

If you have questions about this Privacy Policy or wish to exercise your data rights, contact your gym directly using the phone number on the Profile screen, or email us:

Email: support@gymmaxx.al