This policy explains what personal data the data controller named above processes through the Gym Booking mobile app and its website, why, on what legal basis, and what rights you have. It applies to both the Android and iOS apps and the web application.
What data we process
- Account data — your name, email address and password (stored only as a secure hash). Needed to create and secure your account.
- Membership and booking data — your passes, class bookings, attendance and, for staff, the operational records needed to run the gym.
- Workout data — workout results you choose to log, and related leaderboard entries.
- Push notification token — a device token from Google Firebase Cloud Messaging, so we can send booking and reminder notifications. You can turn notifications off on your device.
- Camera — used only to scan your gym’s QR code when joining. Images are not stored or transmitted.
- Biometrics (Face ID / fingerprint) — used only on your device to unlock the app. Biometric data never leaves your device and is never sent to us.
- Advertising identifier — the app includes the Google AdMob SDK. Advertising is off by default; if a gym enables ads, Google may process a device/advertising identifier to show them.
Why we use it and the legal basis
We process account, membership, booking and workout data to provide the service you asked for (performance of a contract). We send notifications and keep the service secure on the basis of our legitimate interest. Where advertising is enabled, any advertising identifier is processed on the basis of your consent, which you can withdraw at any time.
Who we share it with
We do not sell your personal data. We share it only with service providers that help us run the app:
- Google Firebase — delivery of push notifications.
- Google AdMob — advertising, only when a gym has enabled it.
- Our hosting provider — secure storage and operation of the service.
How long we keep it
We keep your data for as long as your account is active. When your account is deleted, we remove or anonymise your personal data, except where we must keep certain records to comply with the law.
Deleting your account
You can delete your account yourself at any time: in the mobile app open Profile and tap Delete account, or on the web open your Profile page and use Delete account. Deletion is immediate and permanent. We remove or anonymise your personal data (name, email, phone, profile picture), cancel your upcoming bookings and deactivate your passes. Records we are legally required to keep for accounting are retained in anonymised form. If you are a member of more than one gym, deletion applies to the gym you are signed in to.
Your rights
Under the GDPR you may request access to your data, correction, erasure, restriction or portability, and you may object to certain processing or withdraw consent. To exercise any of these, contact us at the email above. You also have the right to lodge a complaint with your data protection authority (in Hungary: NAIH, naih.hu).
Children
The app is not directed at children under 16. If a minor uses it, it is under the responsibility of the gym and the parent or guardian who registered them.
Changes to this policy
We may update this policy; the effective date above shows the latest version. Material changes will be communicated through the app.