GymBuddy Privacy Policy

This Privacy Policy describes how GymBuddy ("GymBuddy," "we," "us," or "our") collects, uses, and shares your personal information when you use the GymBuddy mobile and web application (the "Service"). GymBuddy helps adults (18+) find workout partners at their gym.

If you have questions, contact us at 2026gymbuddy@gmail.com.

1. Information We Collect

We collect only the information needed to run the Service:

• Account information: email address and a password (stored in hashed form by our authentication provider). You may instead create your account with Sign in with Apple or Google Sign-In; in that case we receive only your name and email address from Apple or Google to set up your account. If you use Apple's "Hide My Email" feature, we receive a private relay address instead of your real email, and that is fine — you can use the app fully with it.
• Profile information you provide: first name, age, gender, profile photo, bio, training goals, training schedule, experience level, and — optionally and only if you choose to share it — sexual orientation, along with your choice of whether it is visible to others.
• Gym information: your selected home gym, gyms you check in to, and check-in times. You can set your home gym by searching for it by name — no location access required.
• Messages: messages you send to your matches. Messages are stored so we can deliver them, and may be reviewed if reported for a safety violation.
• Iron Buddy groups: if you create or join an Iron Buddy training group, we store the group's name, gym, goal, description, training times, and its membership (who created it, who was invited, and who accepted, declined, or left). Group details and member lists are visible only to that group's members and invitees — never publicly.
• Notification preferences & push tokens: if you turn on notifications, we store your notification settings (reminder types, quiet hours, frequency limit) so they follow your account, and a push notification token for your device so we can alert you about new matches and new messages. Push notifications are opt-in, their text is generic (they never include message content or sender details on your lock screen), and the token is deleted when you sign out, turn notifications off, or delete your account. Check-in reminders remain scheduled locally on your device from the training times you chose — they are not based on tracking your location.
• Approximate device location (optional): only if you grant location permission, and only while you are using the app, we use your device's coordinates to find gyms near you. Coordinates are sent to our gym-search service to return nearby gyms and are not stored in your profile. If you deny location access, you can use the app fully by searching gyms by name.
• Background location for near-gym reminders (optional, off by default): if — and only if — you turn on "Near-gym reminders" in Settings and grant "Always"/"All the time" location permission, your device watches a single zone (about 150 meters) around your home gym so it can remind you to check in when you arrive, even when the app is closed. This detection is performed entirely on your device by iOS/Android system services: your background location is never uploaded to our servers, never stored, and never shared with anyone. You can turn this off at any time in Settings → Notifications or by revoking location permission in your device settings.
• Safety actions: blocks, unmatches, and reports you submit (including report details you write).
• Usage analytics: in-app events (such as sign-in, swipes, matches, check-ins, and feature usage) linked to your account ID, used to understand and improve how the Service works. The GymBuddy app itself contains no third-party advertising or cross-app tracking SDKs.
• Website advertising measurement (our website only): our website at gymbuddyapp.org uses the Meta Pixel, a measurement tool provided by Meta Platforms, Inc. When you load a page on gymbuddyapp.org — including pages you view while signed in to the web version of GymBuddy — the pixel sends Meta your IP address, your browser and device type, the address of the page you are on, the page you arrived from, and a randomly generated cookie identifier, together with the name of the event (for example, a page view, or a tap on a "Get the app" button and which app store it pointed to). Meta's pixel also has a feature that is switched on by default in Meta's own settings, rather than by anything we wrote, which automatically records details of links and buttons you click on the page — where the link points, the image shown on the button, and the title of the page you were on. We use this to see which ads, posts, and links actually bring people to GymBuddy. It does not run inside the GymBuddy iOS or Android app — the app is built so that the pixel cannot load there — and we do not send Meta your name, email address, profile, photos, messages, or account ID. Meta may use what it receives for its own purposes under its own privacy policy. Section 5 explains this in full and tells you how to turn it off.
• Referral information: if you join through a friend's invite link, we record the referral code used.
• Support communications: messages you send to support, including any contact details you include.

2. How We Use Your Information

• To create and operate your account and profile.
• To show your profile to other members at your home gym so you can match and chat (controlled by your privacy settings).
• To find gyms near you (only if you grant location access) or by name search.
• To deliver messages between matched members.
• To run Iron Buddy training groups you create or join (showing the group and its members to each other, and delivering group invites you must accept or decline).
• To schedule the optional on-device reminders you turn on, using your saved notification preferences and training times.
• To remind you to check in when you arrive near your home gym — only if you opt in to near-gym reminders, detected on your device without sending your location to us.
• To enforce our Terms of Service and community safety rules, including processing blocks and reports and removing violating users or content.
• To understand feature usage and improve the Service.
• To measure which ads, posts, and links bring visitors to our website and lead to app installs, so that a small marketing budget is spent sensibly (website only — see Sections 1 and 5).
• To respond to support requests.

3. What Other Members Can See

Your profile (name, age, photo, bio, goals, schedule, experience, gender, home gym, and — only if you opt in — orientation and check-in status) is visible to other GymBuddy members based on your privacy settings ("everyone," "matches only," etc.). Your email, password, location coordinates, and reports are never visible to other members. You can hide your age and check-in status in Settings.

If you join an Iron Buddy group, the group's other members and invitees can see that you are in the group along with your profile card (subject to your privacy settings). Group membership is never visible to people outside the group, and joining a group never reveals your location, coordinates, or check-in history.

4. How We Share Information

We do not sell your personal information. We never share your profile, messages, matches, check-ins, or any other in-app activity with advertisers. The single exception to our "no advertising companies" rule is website visit data, described in Section 5. Otherwise we share information only with service providers ("processors") that host and run the Service on our behalf:

• Supabase — database, authentication, file storage, and serverless functions (hosts account, profile, message, and analytics data).
• Vercel — application hosting and delivery.
• Google Places API — gym search. When you search for gyms, your coordinates (if you granted location) or your text search query are sent to Google to return gym results. Your name, email, and profile are not sent.
• Apple & Google sign-in (optional) — if you choose Sign in with Apple or Google Sign-In, Apple or Google authenticates you and provides your name and email to create your account. Their handling of that sign-in is governed by their own privacy policies.
• Apple Push Notification service & Firebase Cloud Messaging (optional) — if you enable notifications, your device's push token is registered with Apple's or Google's notification service to deliver match and message alerts. Notification text is generic and does not include message content.
• Meta Platforms, Inc. (our website only) — advertising measurement on gymbuddyapp.org through the Meta Pixel described in Section 1. Meta receives page-view events along with your IP address, browser details, and a cookie identifier. Unlike the processors above, Meta acts as an independent controller of that data under its own privacy policy and may use it for its own purposes. The Meta Pixel is not present in the GymBuddy app.

We may also disclose information if required by law, to protect the safety of our users (for example, responding to reports of threats or abuse), or as part of a business transfer.

5. Advertising Measurement & Your Choices

We run a small amount of advertising so that people find out GymBuddy exists. To know whether any of it works, our website uses the Meta Pixel described in Section 1. That is the only advertising or marketing measurement tool we use, and it is limited to gymbuddyapp.org.

What it does not do. It does not run inside the GymBuddy iOS or Android app. It never receives your name, email address, profile, photos, messages, matches, check-ins, or account ID. We do not upload customer or member lists to Meta or to any other advertising platform, and we do not use it to build advertising profiles of individual members. GymBuddy shows no ads, in the app or on the website.

Whether this counts as "sharing." Under several US state privacy laws, sending website visit data to an advertising company such as Meta can be treated as sharing personal information for cross-context behavioral advertising, even though no money changes hands and we receive no personal information back. Rather than lean on a technicality, we state it plainly: we do share website visit data with Meta for advertising measurement. We do not sell personal information, and we share no in-app data with any advertising company.

How to turn it off. Any one of these works, and none of them requires an account:

• Global Privacy Control. If your browser, or a browser extension, sends a Global Privacy Control (GPC) signal, we treat it as an opt-out: the pixel is not loaded at all and nothing is reported. Some browsers send this signal natively and others support it through an extension.
• Block it in your browser. Blocking third-party cookies and scripts, turning on your browser's tracking protection, or using a private/incognito window prevents the pixel from reporting.
• Adjust it at Meta. You can control how Meta uses activity it receives from other websites in your Facebook or Instagram Accounts Center privacy settings.
• Email us. Write to 2026gymbuddy@gmail.com with the subject line "Do Not Share" and we will confirm your opt-out.

Opting out has no effect on your GymBuddy account, your matches, or any feature of the app.

6. Data Retention & Deletion

• Account and profile data are kept until you delete your account.
• Unmatching another member deletes the conversation between you.
• You can permanently delete your account in the app (Me → Delete Account) or by following the instructions at gymbuddyapp.org/delete-account.html. Deletion removes your profile, photos, matches, messages, check-ins, swipe history, Iron Buddy group memberships, and any groups you own.
• We may retain limited records of safety reports and blocks after account deletion where needed to keep the community safe and to comply with legal obligations.

7. Security

Data is encrypted in transit (HTTPS/TLS). Passwords are hashed. Database access is restricted with row-level security so members can only access data they are permitted to see. No method of transmission or storage is 100% secure, but we work to protect your information using industry-standard safeguards.

8. Age Requirement

GymBuddy is for adults 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If we learn that a user is under 18, we will terminate the account and delete its data. If you believe a minor is using the Service, contact 2026gymbuddy@gmail.com.

9. Your Rights & Choices

• Access & correction: you can view and edit your profile in the app at any time.
• Deletion: delete your account in the app or via the instructions linked above.
• Location: location permission is optional; you can revoke it in your device settings at any time and keep using the app via name search. Near-gym reminders (background location) are a separate opt-in you can turn off in Settings → Notifications or by revoking the "Always"/"All the time" permission.
• Visibility: control who sees your profile, who can message you, and whether your age, orientation, and check-in status are shown.
• Advertising measurement: opt out of website advertising measurement by any of the methods in Section 5, including a Global Privacy Control signal, which we honor automatically.
• To exercise any right you can't complete in the app, email 2026gymbuddy@gmail.com. We respond within the timeframe required by applicable law.

10. US State Privacy Disclosures

Residents of California, Colorado, Connecticut, Texas, Utah, Virginia and certain other US states have rights to know, access, correct, delete, and port their personal information, and the right not to be discriminated against for exercising those rights. The categories of personal information we collect (as defined under the California Consumer Privacy Act) are:

We collect these categories directly from you, from your device (for optional location), and — for website visitors — automatically from your browser. We use them for the purposes in Section 2 and disclose them to the recipients in Section 4.

Sale and sharing. We do not sell personal information and have not done so in the preceding 12 months. We do disclose limited website visit data — IP address, browser and device type, page addresses, and a cookie identifier — to Meta for advertising measurement, which some state laws treat as sharing for cross-context behavioral advertising. Section 5 describes exactly what this is and gives you four ways to opt out, including Global Privacy Control signals, which we honor automatically. We share no in-app data for advertising purposes, and we do not use sensitive personal information to infer characteristics. Sensitive information (orientation) is used only to display it on your profile per your visibility setting.

To exercise your rights, use the in-app tools or email 2026gymbuddy@gmail.com. You may use an authorized agent where permitted by law; we will verify requests using your account email.

11. Users Outside the United States

The Service is operated from the United States and data is stored on US-based infrastructure. If you use the Service from outside the US, you understand your information is processed in the US. Where the GDPR or UK GDPR applies, our legal bases are performance of contract (running the Service you signed up for), legitimate interests (safety, security, improving the Service), and consent (optional location, optional orientation), and you additionally have rights to object, restrict processing, and lodge a complaint with your supervisory authority.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version at this URL and update the "Last updated" date. Material changes will be highlighted in the app.

13. Contact Us

GymBuddy Support — 2026gymbuddy@gmail.com