Privacy policy
Draft text for review. It must be checked by a lawyer before the site goes live.
Who we are
XGym connects athletes, coaches and gym owners. Coaches and gyms are independent businesses. For any privacy question use the contact page, or write to support from the app.
What we collect
Account details: name, email, phone and a password (stored only as a one-way hash). For athletes: goals, height and weight, body measurements, progress photos, health notes and restrictions, workout and meal logs, water intake and points. The transfer receipts you upload to prove a payment. The messages you send to your coach and your support tickets. Coaches and gyms also give us their business details, prices and wallet numbers. If you use the contact form: your name, phone and message. Basic technical data (device type, app version, IP address in security logs) needed to run and protect the service.
Location
If you allow it, the app reads your location only while it is open, to show the gyms nearest to you and how far they are. You can refuse and the app still works: you search by name or area. We store the last location you shared (coordinates and area) on your profile, and platform administrators can see it. Turning location off in your phone settings stops new updates; deleting your account removes it.
Camera and photos
The app asks for camera or gallery access only when you choose to add a profile picture, a progress photo or a receipt. What you upload is stored on our servers.
Notifications
If you allow notifications we use Firebase Cloud Messaging (Google) to deliver them to your phone. Every notification is also kept in the app inbox.
Who can see it
Progress photos, body measurements, workout logs and health notes: you, and your coach while your subscription is active (not before you enter the code, and not after it ends or the coach stops it). Receipts: the people involved in that request and the platform administrators. Chat messages: you and your coach. Support tickets: you and the platform administrators. Your profile picture is public, and a shortened version of your name with your points and streak appears on the athletes leaderboard. Platform administrators can also see account details and the last location you shared.
Keeping and deleting your data
We keep your data while your account exists. Athletes delete the account in the app (Profile, Delete account) after confirming the password: profile, measurements, photos, health notes, logs, chat, notifications, devices and support tickets are deleted. Bookings, payments, requests and the receipts they refer to are kept without your name, so gyms and coaches keep their records and disputes can be resolved. Coaches and gym owners can delete their account from the dashboard once nothing is open. The delete-account page lists the steps. We have not set a time limit for the records we keep yet.
Sharing
We do not sell your data. We share it only with the services that run XGym: our hosting provider, email delivery for sign-up codes and password reset, and Firebase for notifications.
Your choices
You can update your details in the app, delete your progress photos, change your password, turn notifications and location off in your phone settings, and delete your account. To ask what we hold about you or to correct it, contact us.
Security
Passwords are stored as one-way hashes, sign-in uses short-lived tokens, and uploads are checked. No system is perfectly secure: tell us if you notice a problem.
Contact
For any privacy question use the contact page, or write to support from the app.