Privacy Policy

GymOS does not sell personal data. We have never sold member or Customer data to data brokers, advertisers, or any other third party, and we never will. We don't run ads on your data and we don't share it with anyone for their own marketing purposes. The only places data ever goes are the service providers listed below, and only so they can do the specific job we've hired them for.

Account information. Name, email, phone number, and password (stored as a salted hash, never in plain text) for anyone who creates a GymOS account: gym admins, staff, trainers, and members.

Gym operational data. Whatever a Customer's gym records in the normal course of running the business: membership plans, class schedules and enrollments, attendance/check-in history, skill evaluations, dues and payment records, and support communications.

Payment information. Subscription and dues payments are processed by Stripe. GymOS never sees or stores full card numbers; we retain only a Stripe customer/subscription reference so billing can continue to work.

Usage information. Standard technical data (IP address, browser type, pages visited) collected automatically to keep the service secure and working correctly.

Enquiries about GymOS. The demo opens once you give us your name and your email address, and we keep both so we can follow up about your gym. You may also give us a phone number and tell us about your role, the size of your gym, or what you are trying to fix; those four are optional, and leaving them blank does not stop the demo opening. We use all of it to contact you about GymOS and for nothing else; we do not sell it or pass it to anyone else, and you can ask us to delete it at any time using the address at the end of this page.

• To provide and operate the service each Customer signs up for
• To process subscription and dues payments
• To send transactional email and SMS: receipts, class reminders, waitlist alerts
• To provide customer support
• To keep the platform secure and prevent abuse
• To generate AI-assisted social media captions, only when a Customer's admin chooses to use that feature; see our AI Usage page for exactly what that involves

We use a small number of specialized providers to run GymOS. Each only receives the specific data it needs to do its job:

• Stripe — payment processing. Receives cardholder and payment details directly; GymOS never stores full card numbers.
• Resend — transactional email delivery. Receives the recipient's email address and the content of the specific email being sent (a receipt, a reminder).
• Twilio — SMS delivery. Receives the recipient's phone number and the content of the specific text being sent (a class reminder, a waitlist alert).
• Anthropic — AI-assisted social caption generation, only when a Customer uses that optional feature. Receives only the topic, platform, and tone an admin enters, never member names, contact details, or other gym data. See AI Usage.
• GitHub — issue tracking for beta reports, only when a signed-in user submits one through the “Report an issue” button. Receives what they typed, the page they were on, their email address and their gym's name, so we can reply and reproduce the problem. Nothing is sent unless somebody presses the button.
• Meta (Facebook/Instagram) — only if a Customer chooses to connect their own Facebook/Instagram account for social publishing. Receives the post content and media a Customer chooses to publish.

Each of these providers is contractually restricted to using data only to provide their service to us, not for their own marketing or any other purpose.

We retain data for as long as a Customer's account is active, so their gym's records stay intact. If a subscription is canceled, existing data is retained (not automatically deleted) so a Customer can reactivate without losing their gym's history.

A gym admin can permanently delete their gym's entire account (every member, staff record, schedule, and billing history) with no undo, self-serve, from their account settings' Danger Zone. Members who'd like their own personal information deleted or exported, or an admin who'd rather we handle it directly, can contact us at [privacy contact email]. We'll act on verified requests within a reasonable time.

• Passwords are hashed, never stored in plain text
• Data is encrypted in transit (HTTPS) and at rest
• Access within GymOS is role-based: staff only see what their role permits
• Each gym's data is isolated from every other gym on the platform

Depending on where you live, you may have rights to access, correct, export, or delete your personal information. To exercise any of these rights, contact us at [privacy contact email].

GymOS is intended for use by gym businesses and their adult staff and members. It is not directed at children, and we do not knowingly collect personal information directly from children. A gym may record a minor member's attendance/membership information as part of its own operations, managed by the gym as the data controller for that member.

GymOS is operated from [Country]. If you access the service from another country, your information may be transferred to and processed in [Country] and other locations where our service providers operate.

We may update this policy from time to time. We'll update the "Last updated" date above, and for material changes, we'll provide more prominent notice.

Questions about this policy or how we handle your data: [privacy contact email].

[Company Legal Name] · [Company Address]