Privacy Policy

Overview

GymSpaces is operated by GymSpaces Limited, a company registered in New Zealand ("GymSpaces", "we", "us", or "our"). This Privacy Policy explains what information we collect when you use the GymSpaces mobile app, how we use it, and the choices you have. We provide it in the interest of transparency, and it should be read alongside our Terms of Service.

Optional Body, Nutrition, Recovery and device-health import features, External food lookup, and saving Apple Watch workouts to Apple Health each have their own choice in the app. Using GymSpaces or accepting this policy does not turn any of them on. You can use core training without enabling them. Our Consumer Health Data Privacy Policy has more detail on health-related data and these choices.

Information we collect

We collect the following categories of information so that the app can function and stay in sync across your devices:

• Account data — your email address, name, and authentication details. Authentication is handled by Firebase Authentication, including sign-in with Google and Apple.
• Profile and body metrics you enter — such as weight, body-fat percentage, body measurements, height, and age.
• Age-eligibility information — during onboarding, your date of birth is sent to our server solely to determine whether you are at least 18. We do not retain the date of birth. We retain a minimal eligibility decision, decision time, policy version, method, and, for an underage decision, the time when another attempt is allowed. This information is used for eligibility, not to prefill optional Body or Nutrition inputs.
• Training data — the programs, workouts, sets, personal records, and goals you create and log.
• Nutrition data — your food logs, custom foods, saved meals, and water and supplement entries.
• Recovery data — your daily check-ins, including soreness, stress, energy, and sleep.
• Health and fitness data — only with your explicit permission, the phone app can, with GymSpaces Pro, read data from Apple Health or Android Health Connect, including heart rate, resting heart rate, heart-rate variability (HRV), sleep, steps, active calories, and weight. If you use workout tracking on Apple Watch and grant Apple Health permission, the Watch app can also write a completed traditional-strength workout record to Apple Health. See the dedicated section below.
• Usage, analytics, crash, and performance data — information about how the app is used and how it performs, such as feature interactions, app screens and routes, device and app version details, crash reports, stack traces, and related diagnostics. These records may be linked to your pseudonymous Firebase user ID. Analytics and crash reporting run for everyone who uses the app; the app has no setting to turn them off.

Health and fitness data

GymSpaces can display selected readings from Apple Health and Android Health Connect in Device context and source-labelled Body records. The Apple Watch app can also save a completed strength workout to Apple Health. We treat these paths with particular care:

• These paths require their separate in-app choice and the applicable platform permission.
• Imported readings are for display. They do not feed readiness, training-load guidance, Pocket Coach or Nutrition targets in this release.
• The Apple Watch workout adapter writes only a completed traditional-strength workout record to Apple Health. It does not read live health metrics or your Apple Health history.
• We do not sell your health data, and we do not use it for advertising.
• You can revoke platform health access at any time in your device settings. You can also turn off each import choice inside the app. Device imports and Apple Watch workout export are separate choices.
• If you revoke access, we stop reading new health data from your device and stop saving new completed Apple Watch workouts to Apple Health where write permission has been withdrawn.

How we use your information

We use the information we collect to:

• Operate and personalize the app — including generating your training, nutrition, and recovery recommendations. These recommendations are produced by rules and sports-science formulas; they are not sold or shared for advertising.
• Sync your data across the devices where you are signed in. A workout in progress stays on the phone it was started on, and older workout detail is loaded when you ask for it.
• Measure feature use, diagnose crashes and performance problems, protect reliability, and improve the app.
• Provide customer support and respond to your requests.

How your data is shared

We do not sell your personal data. We share data only with the services we use to run the app, and only to the extent needed to provide the service. Those services are listed below.

Third-party services

We rely on the following service providers, who process data on our behalf:

• Google Firebase — provides Authentication, Cloud Firestore, Cloud Functions, Hosting, App Check, Analytics, and Crashlytics. Your account, training, nutrition, recovery, and profile data are stored and processed on Google's infrastructure. Firebase Analytics and Crashlytics may also process your pseudonymous Firebase user ID, device and app version details, feature interactions, app screens and routes, performance information, crash reports, stack traces, and related diagnostics so we can operate, diagnose, secure, and improve GymSpaces.
• RevenueCat — manages GymSpaces Pro subscriptions. If you subscribe, RevenueCat receives a pseudonymous identifier for your account and your purchase and entitlement status, so that your subscription follows you across your devices. It does not receive your training, nutrition, recovery, or health data.

The following services also receive data, in the circumstances described:

• FatSecret — an optional external food lookup. It is used only after you turn on External food lookup in the app. Once it is on, the search words you enter, the barcodes you scan and the identifiers of the foods you look up are sent to FatSecret's food database service to return results.
• Apple App Attest and DeviceCheck, and Google Play Integrity — app-attestation services provided by Apple (on iPhone) and Google (on Android). Firebase App Check uses them to help confirm that requests to our servers come from a genuine copy of the GymSpaces app. GymSpaces does not send them your training, nutrition, recovery, or health data.
• Google Workspace — provides the mailbox behind our support and privacy email addresses. If you email us, your message, your email address and any attachments are stored there.

Each of these providers maintains its own privacy policy, available on its website. We encourage you to review them.

Firebase Analytics and Crashlytics run for everyone who uses the app, and they cannot be switched off in the app. We do not use Analytics or Crashlytics data for advertising, and we do not use it to track you across other companies' apps or websites.

Data retention and deletion

You can delete your account and associated data at any time from within the app, or via our Delete Your Account page. When you delete your account, access ends while deletion of active account data and service copies proceeds. Saved deletion updates on the original phone distinguish verified deletion, pending cleanup, records kept separately and items needing attention. Other devices may need to open GymSpaces or reconnect before local cleanup. Deletion records, service logs and disaster-recovery copies have separate retention periods; the limited deletion record contains no deleted content and is kept for 24 months after the workflow reaches its final status.

Account deletion does not cancel a subscription or erase purchase history held by Apple or Google. Deletion of the subscription-service profile is tracked separately. Data other apps placed in Apple Health or Health Connect is unaffected. GymSpaces-written Apple Health workouts remain unless you select their separate removal; unconfirmed removal may need manual action.

We cannot confirm deletion of every analytics or crash-report copy. Reports already queued on a device may still upload, and per-person deletion of retained crash reports is unavailable. Food-provider request-log deletion is also unconfirmed. Sending a deletion request or clearing local app data does not establish that every provider copy was erased.

Security

We use reasonable technical and organizational measures to protect your information. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Children's privacy

GymSpaces is for adults aged 18 or older. The onboarding check is based on the date of birth a person declares and is not identity-grade age verification. If a person declares a date showing that they are under 18, substantive app access is blocked; we retain the minimal eligibility outcome described above, not the date of birth. If you believe a person under 18 has provided us with personal data, please contact us so we can review and remove it as appropriate.

Where your data is processed

GymSpaces Limited is a New Zealand company. The providers named under "Third-party services" store and process your information for us, and most of that happens outside New Zealand and Australia.

• United States — your account and the training, body, recovery and nutrition data you save are stored in Google's Firebase services in the United States, and so are the recovery backups of that data. Subscription records are held by RevenueCat in the United States.
• Google's wider network — analytics, crash reports, app-attestation checks, this website and the mailbox behind our email addresses run on Google infrastructure that can process data in the United States or in any other country where Google operates data centres.
• FatSecret, only if you turn on External food lookup — your food searches are sent to FatSecret, whose service terms are governed by the law of Victoria, Australia. We have not confirmed every country in which FatSecret processes requests.

Privacy law in those countries differs from the law in New Zealand and Australia. Where a provider holds or processes your information on our behalf, we remain responsible for it, and you can use the rights below with us wherever it is stored. FatSecret, and Apple and Google as app stores and sign-in providers, handle what they receive under their own privacy policies.

Your rights

Wherever you live, you can ask us:

• whether we hold personal information about you, and for access to it;
• to correct information that is wrong, out of date or incomplete;
• to delete your account and its data, or the whole history of one optional feature;
• to stop an optional feature, by turning off its choice.

Doing it yourself. In the app you can change or delete most of what you have logged. A finished workout's sets cannot be edited; you can edit its note or delete it. Food diary entries can be changed or deleted one at a time only while they are dated within the last 90 days; older entries can be removed with Delete Nutrition history. You can edit your display name in your profile, turn off each optional feature or delete its whole history under Profile, then Settings, then Privacy controls, and delete your account under Profile, then Settings, then Delete account.

Asking us. For anything you cannot do in the app, email privacy@gymspacesapp.com, ideally from the email address on your account, and tell us what you are asking for and the country or US state you live in. support@gymspacesapp.com reaches the same team.

• We confirm that a request comes from the account owner before we disclose or change anything. An email's sender address alone is not proof: we send a one-time code to the verified email address already on your account and ask you to quote it back, or we direct you to sign in. The code only confirms that the request is yours. It is not a sign-in code.
• GymSpaces has no download or export button. To ask what information we hold about you, email us at the address above and we will reply in writing.
• We do not charge for a request.
• We will not treat you differently, or give you a worse service or price, because you used any of these rights.
• If we cannot do what you ask, we tell you why in writing and how to take it further.

We reply as soon as we reasonably can, and no later than the time set by the law where you live.

New Zealand

The Privacy Act 2020 gives you the right to ask for access to your personal information and for its correction. We respond to an access or correction request within 20 working days of receiving it. If a request is large or complex and we need longer, we tell you within those 20 working days how much longer and why. If we do not make a correction you asked for, you can give us a statement of the correction you wanted and we will attach it to the information. Our privacy officer deals with requests and complaints at privacy@gymspacesapp.com. If you are unhappy with our response, you can complain to the Office of the Privacy Commissioner at privacy.org.nz, which asks you to raise the matter with us first.

Australia

We give Australian users the access, correction and complaint rights set out in the Australian Privacy Principles. We respond to an access or correction request within 30 days. If we refuse, we give you written reasons and tell you how to complain. If we do not correct something, you can ask us to attach a statement to it saying that you consider it inaccurate, out of date, incomplete, irrelevant or misleading. To complain about how we have handled your information, email privacy@gymspacesapp.com. We look into it and reply in writing within 30 days. If you are not satisfied, or have had no reply in that time, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

United States

The rights above are open to every US resident. We do not sell your personal data, we do not use it for targeted advertising, and we do not use it to make automated decisions that have a legal or similarly significant effect on you. We respond within 45 days of receiving a request. If a request is complex or you have made several, we may take up to 45 more days and will tell you why within the first 45.

Appeals. If we decline a request, you can appeal by replying to our decision or by emailing privacy@gymspacesapp.com with "Privacy appeal" in the subject line. We answer in writing within 45 days of receiving the appeal, with our reasons.

Washington and Nevada. Our Consumer Health Data Privacy Policy sets out your rights over consumer health data and how to use them.

Connecticut. The Connecticut Data Privacy Act gives you the right to opt out of targeted advertising, the sale of personal data and profiling for automated decisions with legal or similarly significant effects, and the right to a list of the third parties your personal data has been sold to. We do none of these, so there is nothing to opt out of and no such third party. The optional health features run only with your consent. You can withdraw it in Privacy controls at any time and the feature stops straight away. We do not collect, use or sell personal data to train large language models. If we deny your appeal, you can complain to the Connecticut Attorney General through "File a Complaint" at portal.ct.gov/ag.

Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date shown above. We encourage you to review this page periodically.

Contact

If you have questions about this Privacy Policy, you can reach us below. Do not send passwords, sign-in codes, health exports, medical documents or unnecessary attachments. See our support guidance.

• Privacy contact: privacy@gymspacesapp.com
• General support: support@gymspacesapp.com

GymSpaces Limited
New Zealand company number: 9430575
NZBN: 9429053682703
Registered office: 15 Te Araroa Drive, Paremoremo, Auckland 0632, New Zealand