How we look after your data

Where your data lives

Gymciety runs on managed infrastructure rather than servers we rack ourselves. The database, authentication and file storage are provided by Supabase, which runs on Amazon Web Services. The application servers and this website run on Railway. We do not operate our own data centre, and we do not store production data on laptops or office machines.

Encryption

• In transit: every connection to Gymciety, from the app, the website and between our own services, uses TLS. Plain HTTP is not served.
• At rest: the database and file storage are encrypted at rest by our database provider using AES-256.
• Passwords: we never see them. Sign-in is handled by Supabase Auth, which stores only salted password hashes. Sessions are short-lived signed tokens that our API verifies locally on every request.

Who can see what

Access follows the shape of a real gym. Every record belongs to one organisation, and every person in that organisation has one role: owner, admin, coach, front desk, or client.

• Clients see their own programme, nutrition, check-ins, bookings and messages, and nothing about any other member.
• Coaches see the clients assigned to them. A coach does not see another coach's roster.
• Owners and admins see their whole organisation, and nothing outside it.
• Progress photos are private to the client and their coach. Clients control whether a photo is shared.
• Staff actions that change member data, billing or access are written to an audit log the owner can review.

These rules are enforced in the database itself, through row-level security, as well as in the application. The database key that bypasses those rules is used only by our own servers and is never shipped to a browser or a phone.

Payments

Card details never touch Gymciety. Web payments go through Stripe, and payouts from clients to coaches go through Stripe Connect, so Stripe holds the card and the bank details and Gymciety holds only a reference. Purchases on iPhone go through Apple. We are never in scope for card-data handling because we never handle card data.

Backups and availability

The database is backed up automatically every day by our provider, with backups kept separately from the live database. Our hosting providers publish their own uptime and incident histories; we do not currently publish a status page of our own, and we will add one when the size of the customer base justifies it.

Your data is yours

• Export: owners and coaches can request a full export of their organisation's data by emailing support@gymciety.net. We deliver it within 30 days, usually much sooner, in machine-readable form.
• Deletion: any account can be deleted from inside the app or at gymciety.net/delete-account. Coaching content, messages and photos are deleted within 30 days of the request.
• Clients moving on: a client's history belongs to the client. When a client leaves a coach or gym, their data is not visible to that coach or gym any more.
• No selling, no ads: Gymciety has no advertising and never sells or rents data. The only revenue is subscriptions.

Who else processes data

We use a small number of specialist providers. Each one receives only what it needs for its job.

We will update this list before adding a provider that handles personal data, and the date at the top of this page changes when we do.

The law we work under

Pittura FZ-LLC is registered in the United Arab Emirates and follows the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). For customers and clients in the UK and the European Union we apply GDPR principles: lawful basis, data minimisation, purpose limitation, and the rights of access, correction, portability and erasure described above. We have not yet completed a third-party audit such as SOC 2 or ISO 27001; we will say so here when we have.

Reporting a vulnerability

Questions about any of this? Contact us. Our full privacy policy and terms are the binding documents; this page is the plain-language version.