Privacy Policy

1. Eligibility

GymShape is intended only for users who are at least 18 years old. We do not knowingly offer the service to children.

2. Information we collect

Account and sign-in information

• Name and email address.
• Firebase user ID.
• Authentication provider.
• Google profile photo when you choose Google Sign-In.
• Apple account information returned with your consent when you choose Sign in with Apple, which may include a private relay email address.
• Account creation, verification, and recent sign-in information.

Fitness, body, and nutrition information

• Age, gender, height, and weight.
• Fitness goals, experience level, workout location, schedule, equipment, preferences, and limitations.
• Workout plans, completed workouts, progress, and workout history.
• Nutrition goals, dietary preferences, allergies, disliked foods, meal preferences, and generated meal-plan information.

Access and purchase information

• Workout Premium and Nutrition Plan status, duration, start date, and expiration date.
• Gym Partner access status, gym name, redeemed code, and expiration date.
• Google Play or Apple App Store purchase and verification information needed to validate a purchase, activate access, prevent duplicate or fraudulent use, and process refunds or revocations. Depending on the store, this may include a purchase token or transaction identifier, hashed token or transaction identifier, product and plan identifiers, order or original transaction identifier, account-binding data, purchase time, store environment or region, purchase status, entitlement dates, and refund or revocation event information.

Battle Mode information

• Your Battle display name (or, on iOS, a stable non-editable generated alias) and private Battle Code used to connect with another eligible GymShape user.
• Battle invitations, participant identifiers, invitation and battle status, attempt timing, and completion information.
• Repetition counts you submit, total Battle scores, win/loss/draw results, streaks, Battle points, and weekly leaderboard points.

Battle Mode does not use your camera, microphone, contacts, precise location, or biometric sensors to verify repetitions. Repetitions are entered by the user during the timed attempt.

App settings and reminders

• Measurement-unit preferences.
• Workout reminder settings and reminder time.
• Partner-gym notification preferences when this feature becomes available.

Security and service information

GymShape uses Firebase Authentication, Cloud Firestore, Cloud Functions, and Firebase App Check. These services may process authentication identifiers, app and device attestation information, app/OS technical information, function invocation metadata, and IP addresses needed to authenticate users, protect the app from abuse, and deliver the service. Google Sign-In may also process a user identifier and IP address for authentication and fraud prevention; the IP address may be used to estimate a general location.

3. Information we do not request

The current version of GymShape does not request or use device location, camera, microphone, contacts, or photos/files stored on your device.

GymShape may request notification permission for workout reminders and other functional app notifications.

4. How we use information

• To create and secure your GymShape account.
• To generate and store personalized workout and nutrition content.
• To display progress, workout history, and active access status.
• To operate Battle Mode, including private Battle Code invitations, timed attempts, results, streaks, and weekly leaderboards.
• To provide Workout Premium, Nutrition Plan, and Gym Partner access.
• To verify Google Play and Apple App Store purchases and manage paid access.
• To prevent duplicate purchase use, fraud, abuse, and unauthorized access.
• To process and reconcile refunds, chargebacks, and purchase revocations.
• To send verification, password-reset, account-security, deletion, and purchase-support communications.
• To provide reminders and other functional notifications you enable.
• To protect the app, investigate abuse, and enforce our Terms.

GymShape does not use personal information for targeted advertising or behavioral profiling.

5. Payments

Purchases are processed through Google Play Billing on Android or Apple In-App Purchase on iPhone. GymShape does not receive or store your full payment-card details. Google or Apple may process and retain purchase information under their own policies.

To verify purchases and manage access, GymShape may store limited store transaction and verification metadata, including purchase tokens or transaction identifiers, hashed identifiers, product and order or original transaction identifiers, account-binding data, purchase status, entitlement dates, and refund or revocation information.

This information is used for purchase verification, entitlement management, fraud prevention, duplicate-use prevention, refund and chargeback handling, dispute resolution, and service security.

6. Partner gyms

Partner gyms do not receive access to your name, email address, body information, workout history, nutrition information, or other personal GymShape data.

Partner gyms may provide informational content such as news, schedules, working-hours updates, and member information. Partner-gym notifications will be opt-in and user-controlled.

GymShape does not currently display paid advertisements or use third-party advertising networks or advertising SDKs.

7. Sharing and sale of information

GymShape does not sell user information, share it with advertisers, or use it for targeted advertising.

Information may be processed by service providers necessary to operate GymShape, including Firebase services, Google Sign-In, Google Play, and Apple services used for Sign in with Apple, App Attest, and In-App Purchase.

When you use Battle Mode, the friend you challenge or who challenges you can see your Battle display name or iOS generated alias, invitation status, whether you submitted an attempt, and the final score and result after the Battle is completed. Eligible Battle Mode users may see Battle display names or iOS generated aliases and points shown in the weekly leaderboard. Your Battle Code is intended to be shared only with people you choose.

Information may also be disclosed where required by law or necessary to protect users, prevent fraud, resolve payment disputes, or respond to security threats.

8. Data storage and retention

Your information is retained while your GymShape account remains active. Inactive accounts are not automatically deleted.

When you delete your account, GymShape deletes the personal profile, workout, nutrition, Battle profile, Battle records, leaderboard, access, legal-consent, and authentication data associated with your active GymShape account from systems controlled by GymShape.

Limited transaction-verification, security, anti-fraud, refund, revocation, or dispute records may be retained after account deletion where reasonably necessary to verify prior Google Play or Apple App Store transactions, prevent reuse of refunded or revoked purchase tokens, investigate abuse, resolve payment disputes, protect the service, or comply with legal or regulatory obligations.

Such retained records are not used for advertising or behavioral profiling and are kept only for as long as reasonably necessary for those purposes.

Records handled directly by Google or Apple, including store purchase history and identity-provider records, are governed by their own retention policies.

9. Account deletion

You may delete your account directly in the GymShape app or submit a deletion request by email. Full instructions are available on the Delete Account page.

Deleting your account removes the active GymShape account and associated personal profile, workout, nutrition, Battle profile, Battle records, leaderboard, access, and authentication data controlled by GymShape.

As explained in Section 8, limited transaction-verification or security records may be retained where necessary for fraud prevention, refunds, chargebacks, dispute resolution, security, or legal obligations.

Email requests should be sent from the email address connected to the GymShape account. We aim to complete verified web requests within 30 days.

10. Security

GymShape uses reasonable safeguards, including Firebase Authentication, Firestore Security Rules, Firebase App Check with Apple App Attest on iPhone, server-side store purchase verification, and access controls.

No online service can guarantee absolute security.

11. Your choices and rights

Depending on your country, you may have rights to access, correct, delete, restrict, or object to certain uses of your personal information.

You can update certain information in the app, control notifications, delete your account, or contact support@gymshapeapp.com .

12. International use

GymShape may be used internationally. Information may be processed in countries where our service providers operate. Privacy rights may vary by jurisdiction.

13. Changes to this Privacy Policy

We may update this Privacy Policy when features, legal requirements, or data practices change. The updated effective date will be shown at the top of this page.

14. Contact

Questions about privacy or data deletion may be sent to support@gymshapeapp.com .