Privacy Policy

How GymSpaces Limited collects, uses, and protects your information.

Last updated: 7 August 2026

Overview

GymSpaces is operated by GymSpaces Limited, a company registered in New Zealand ("GymSpaces", "we", "us", or "our"). This Privacy Policy explains what information we collect when you use the GymSpaces mobile app, how we use it, and the choices you have. We provide it in the interest of transparency, and it should be read alongside our Terms of Service.

By using GymSpaces, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the app.

Information we collect

We collect the following categories of information so that the app can function and stay in sync across your devices:

  • Account data — your email address, name, and authentication details. Authentication is handled by Firebase Authentication, including sign-in with Google.
  • Profile and body metrics you enter — such as weight, body-fat percentage, body measurements, height, and age.
  • Age-eligibility information — during onboarding, your date of birth is sent to our server solely to determine whether you are at least 18. We do not retain the date of birth. We retain a minimal eligibility decision, decision time, policy version, method, and, for an underage decision, the time when another attempt is allowed. For an eligible account, the derived whole-year age may be used to prefill the separate body-metrics age field.
  • Training data — the programs, workouts, sets, personal records, and goals you create and log.
  • Nutrition data — your food logs, custom foods, saved meals, and water and supplement entries.
  • Recovery data — your daily check-ins, including soreness, stress, energy, and sleep.
  • Health and fitness data — only with your explicit permission, the phone app can read data from Apple Health or Android Health Connect, including resting heart rate, heart-rate variability (HRV), sleep, steps, active calories, and weight. If you use workout tracking on Apple Watch and grant Apple Health permission, the Watch app can also write a completed traditional-strength workout record to Apple Health. See the dedicated section below.
  • Usage, analytics, crash, and performance data — information about how the app is used and how it performs, such as feature interactions, app screens and routes, device and app version details, crash reports, stack traces, and related diagnostics. These records may be linked to your pseudonymous Firebase user ID.

Health and fitness data

GymSpaces can connect to Apple Health and Android Health Connect to give you a more accurate picture of your readiness and recovery. The Apple Watch app can also save a completed strength workout to Apple Health. We treat these paths with particular care:

  • We access or write health and fitness data only after you grant the applicable platform permission.
  • We use data read from the platform only to calculate your readiness, recovery, and training recommendations within the app.
  • The Apple Watch workout adapter writes only a completed traditional-strength workout record to Apple Health. It does not read live health metrics or your Apple Health history.
  • We do not sell your health data, and we do not use it for advertising.
  • You can revoke platform health access at any time in your device settings. You can also stop the phone's health-data reads by disabling health sync inside the app.
  • If you revoke access, we stop reading new health data from your device and stop saving new completed Apple Watch workouts to Apple Health where write permission has been withdrawn.

How we use your information

We use the information we collect to:

  • Operate and personalize the app — including generating your training, nutrition, and recovery recommendations. These recommendations are produced by rules and sports-science formulas; they are not sold or shared for advertising.
  • Sync your data across the devices where you are signed in.
  • Measure feature use, diagnose crashes and performance problems, protect reliability, and improve the app.
  • Provide customer support and respond to your requests.

How your data is shared

We do not sell your personal data. We share data only with the service providers we use to run the app, and only to the extent needed to provide the service. Those providers are listed below.

Third-party services

We rely on the following service providers, who process data on our behalf:

  • Google Firebase — provides Authentication, Cloud Firestore, Cloud Functions, Hosting, Analytics, and Crashlytics. Your account, training, nutrition, recovery, and profile data are stored and processed on Google's infrastructure. Firebase Analytics and Crashlytics may also process your pseudonymous Firebase user ID, device and app version details, feature interactions, app screens and routes, performance information, crash reports, stack traces, and related diagnostics so we can operate, diagnose, secure, and improve GymSpaces.
  • FatSecret — powers our food database. When you search for foods, your search queries are sent to FatSecret's food database service to return results.
  • RevenueCat — manages GymSpaces Pro subscriptions. If you subscribe, RevenueCat receives a pseudonymous identifier for your account and your purchase and entitlement status, so that your subscription follows you across your devices. It does not receive your training, nutrition, recovery, or health data.

Each of these providers maintains its own privacy policy, available on its website. We encourage you to review them.

We do not use Analytics or Crashlytics data for advertising, and we do not use it to track you across other companies' apps or websites.

Data retention and deletion

You can delete your account and associated data at any time from within the app, or via our Delete Your Account page. When you delete your account, we remove your personal data from our systems, subject to any limited retention that may be required by law. Account deletion does not cancel a subscription or erase transaction records controlled by Apple, Google, or RevenueCat; those providers may retain billing records under their own legal, fraud-prevention, and privacy obligations. Pseudonymous analytics and crash records may also remain for the applicable Firebase retention period where they cannot reasonably be connected back to an active GymSpaces account.

Security

We use reasonable technical and organizational measures to protect your information. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Children's privacy

GymSpaces is for adults aged 18 or older. The onboarding check is based on the date of birth a person declares and is not identity-grade age verification. If a person declares a date showing that they are under 18, substantive app access is blocked; we retain the minimal eligibility outcome described above, not the date of birth. If you believe a person under 18 has provided us with personal data, please contact us so we can review and remove it as appropriate.

International data transfers

Because we use providers such as Google, your data may be processed and stored outside New Zealand on their global infrastructure. By using the app, you acknowledge that your information may be transferred to and processed in other countries.

Your rights

You have the right to access, correct, and delete your personal data. You can manage much of your information directly within the app. To exercise any of these rights, or if you have questions about how we handle your data, contact us at gymspacesapp@gmail.com.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date shown above. We encourage you to review this page periodically.

Contact

If you have any questions about this Privacy Policy, you can reach us at: