Privacy

Data controller

Somnia Intelligence GmbH
Joel Sommerer
Wilenstrasse 37, 8832 Wilen bei Wollerau, Schweiz
info@gymfit.app

Gyms that use GymFit

If you train as a member of a gym that uses GymFit, that gym is responsible for the data relating to your membership: contract and subscription, check-ins, invoices, purchases, bookings and the training plans it provides to you. We process this data on the gym’s behalf. Questions about it are best sent directly to your gym; requests that reach us are forwarded to the gym.

This website

This website sets no cookies and uses no tracking or analytics tools. Fonts are self-hosted; no data is transferred to third parties such as Google Fonts.

When the site is accessed, our hosting provider Infomaniak (Switzerland) stores technically necessary server logs, such as IP address, time and page requested, to deliver the website and protect it from misuse. We keep these logs only as long as necessary for that purpose.

What data the app processes

Depending on the features you use:

• Account and sign-in: name, email address and password. We store the password only in encrypted form (as a hash). If you sign in with Apple or Google, we receive your name, your email address (with Apple, an anonymous relay address if you choose) and an identifier of your account. Gym accounts are created by the gym.
• Profile: first and last name; optionally gender, height and body weight that you enter yourself. If your gym has stored further details such as address, phone number, date of birth or a profile picture, the app shows them.
• Training: training plans, training days, exercises, sets, weights, reps, times and notes, plus values derived from them such as volume, records, stats, XP, levels, streaks and achievements.
• Leaderboard and challenges: only if you take part. Other members of your gym then see the display name you chose and your ranking. You can stop taking part at any time.
• Acceptance of the terms of use: time, version of the terms, app version and platform (iOS, Android or web), so that we can prove your acceptance.
• Requests: content and contact details when you contact us through the app (“My rights”) or by email.

Location at check-in

If your gym requires proof of location at check-in, the app asks for your current location once, only while the app is open and never in the background. Latitude, longitude and accuracy are sent to our server, which checks whether you are near the gym. The coordinates are not stored; only the check-in itself (gym and time) is stored.

If you do not grant location access, you cannot check in through the app at such gyms. All other features remain available. You can change the permission at any time in your device settings.

Health data: Apple Health and Health Connect

Only if you allow it, GymFit connects to Apple Health (iOS) or Health Connect (Android). GymFit then writes completed workouts with type, duration and estimated calories there and reads your body weight. The body weight it reads is only shown on your device and is not transmitted to our servers.

We use data from Apple Health and Health Connect exclusively to provide these features. We do not sell it, do not share it with third parties, and do not use it for advertising or for decisions about creditworthiness, insurance or employment.

You can revoke access at any time: on iOS in the Health app (Profile → Apps → GymFit), on Android in the Health Connect settings (App permissions → GymFit).

Purchases (GymFit Plus)

Purchase and payment of GymFit Plus are handled by Apple or Google. We receive no payment or card details. Whether a subscription is active is checked by the app on your device directly with the respective store.

On your device

The app stores settings, a cache for a fast start and your sign-in session on your device; the session is kept encrypted in the Keychain (iOS) or the Android Keystore. If you use the app lock, the operating system checks Face ID, Touch ID, fingerprint or device passcode; we never receive biometric data. Reminders such as “Rest over” are created locally on your device.

No ads, no tracking

GymFit contains no analytics, advertising or tracking services and does not use an advertising ID. We do not sell personal data.

Purposes and legal bases

We process your data:

• to provide the app with your account, your training, your stats and the gym features (performance of a contract; GDPR Art. 6(1)(b));
• for health data, location at check-in and participation in the leaderboard, with your consent, which you can withdraw at any time (GDPR Art. 6(1)(a) and Art. 9(2)(a));
• for the security of the app, the prevention of misuse and proof of your acceptance of the terms of use (legitimate interest; GDPR Art. 6(1)(f));
• to comply with statutory retention obligations (GDPR Art. 6(1)(c)).

Service providers and storage location

We use the following service providers to run GymFit:

• Supabase Inc., USA: database, sign-in and server functions. The data is stored in a data centre in Zurich (Amazon Web Services, region eu-central-2).
• Infomaniak Network SA, Switzerland: hosting of this website and the web app.
• Hostpoint AG, Switzerland: sending platform emails, for example for sign-in or password reset. If your gym sends you emails, it may use its own mail server for that.
• Apple and Google: only if you use their sign-in, their store or their health platform; their privacy policies also apply.
• Your gym: if you are a member of a gym that uses GymFit (see above).

Disclosure abroad

We store your data in Switzerland. Because Supabase is a US company, access from the USA for operation and support cannot be ruled out. For such disclosures we rely on the provider’s contractual safeguards, in particular the European Commission’s standard contractual clauses recognised by the Swiss Federal Data Protection and Information Commissioner (FDPIC). Apple and Google also process data in the USA under their own terms.

Retention and deletion

We keep your data as long as your account exists. If you delete your account in the app (Settings → Delete account), your account, profile, training data, check-ins, leaderboard settings and the record of your acceptance of the terms are deleted immediately and permanently. Invoices and accounting records issued by a gym are kept without any link to your account where statutory retention obligations require it (in Switzerland usually ten years).

You can also request deletion without the app, by email to info@gymfit.app. How this works is described at gymfit.app/en/delete-account.

Your rights

You have the right to access, rectify and delete your data, to receive or transfer it (the app offers a data export for this), to object, and to withdraw any consent you have given. The easiest way is “My rights” in the app’s privacy centre, or write to info@gymfit.app.

You can also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, if you live in the EU, with the data protection authority of your country of residence.

Security

The connection between the app and the server is encrypted (TLS). On the server, each account sees only its own data or the data it is allowed to manage as gym staff.

Children and young people

GymFit is intended for people aged 16 and over. Between the ages of 13 and 16, use is permitted only with the consent of a parent or legal guardian (Terms of Use, section 3).

Changes

We update this policy when the app or the law changes. The version published here applies. We will inform you of material changes in the app.