Privacy Policy

Last updated: August 6, 2026 · Applies to the GymCrush iOS app and this website

1. Who we are

GymCrush is built and operated by Antoine Gosset, an individual developer based in France. For the purposes of the EU General Data Protection Regulation (GDPR), Antoine Gosset is the data controller for the data described in this policy.

Contact for any privacy question or request: support@getgymcrush.com.

2. What we collect and why

This table is the summary; the sections underneath give the detail.

2.1 Account information

You need an account to use GymCrush. You can create one with an email address, with Sign in with Apple, or with Sign in with Google. We store:

• Your email address, used for sign-in, account recovery and support. If you use Sign in with Apple and choose Hide My Email, we only ever receive Apple's private relay address — we never see your real one.
• An account identifier and authentication session tokens.
• Your display name and your currently equipped companion.

We do not receive your Apple or Google password. Those providers confirm your identity to us and nothing more.

2.2 Couple and partner data

GymCrush is built for two people. When you pair with a partner, the following is shared between the two accounts, because the shared game cannot work otherwise:

• Your invite link or code and the resulting partner relationship
• Your shared couple streak, streak-freeze status, Team Assist state and daily completion counts
• Your shared coin balance and shared inventory — companions, accessories, backgrounds and consumables
• Your daily task progress, which counts toward the shared goal and is therefore visible to your partner
• Your lifetime progress statistics and your display name and equipped companion
• Whether premium is active, since one subscription covers both partners

Your partner cannot see your email address, your password, your payment details or your analytics data.

2.3 Photos you send to your partner

GymCrush lets you take a photo in the app and send it to your partner as a "moment". This is optional — the app works without ever taking one.

• Camera and photo library access. iOS asks your permission before the app can use your camera or save an image. You can refuse, or change your mind later in iOS Settings.
• Where photos go. Photos you send are uploaded to a private storage bucket hosted by Supabase in the United States, stored under your couple's identifier, and are readable only by you and your paired partner. Access is enforced by server-side storage policies, not just by the app.
• On your device. Recent moments are also cached on your device and in a shared app group container so the GymCrush home-screen widget can display them without re-downloading.
• Deletion. Photos are deleted when you delete your account, and you can remove moments in the app. Copies already cached on your partner's device are outside our control, in the same way any photo you send someone is.

We do not scan, analyse, or use your photos for any purpose other than showing them to your partner. They are never used for advertising or for training machine-learning models.

2.4 Fitness and activity data

GymCrush does not connect to Apple Health / HealthKit and does not read any health data from your device. The only "fitness" data we hold is what you tell the app yourself: which daily challenges you marked as complete, and the streak and statistics derived from that. It is self-reported activity, not measured health data.

2.5 Onboarding questionnaire

During onboarding we ask a few questions about your goals and habits so the app can start you in a sensible place. Your answers are stored with your account. They are not shared with your partner and are not used for advertising.

2.6 Notifications

If you allow notifications, Apple issues a device token that we store so we can send the reminders you have enabled — for example when your shared streak is at risk or your partner has done something. You can turn notifications off at any time in the app or in iOS Settings, and we delete the token when you delete your account.

2.7 Product analytics

Provider: PostHog Inc., United States.

We record usage events to understand how the app is used and to improve it: app opens, screen views, task completions, streak events, chest and reveal openings, shop and purchase events, onboarding steps, and errors.

To be precise about something that is easy to overstate: these events are linked to your account identifier — they are not anonymous. We use them to understand product behaviour and to debug problems. We do not use them to build advertising profiles, we do not sell them, and we do not combine them with data from other companies' apps or websites. GymCrush does not use the iOS Advertising Identifier (IDFA) and never presents the App Tracking Transparency prompt, because we do not track you across other companies' apps or websites.

2.8 Subscriptions and purchases

Provider: RevenueCat Inc., United States.

We use RevenueCat to manage premium entitlements, including couple ("pair") premium. It processes a customer identifier, purchase and renewal events, subscription status, and entitlement changes. We store a record of purchases granted to your account so that coins and items are delivered exactly once.

Your payment details are handled entirely by Apple. Card numbers and billing addresses are never sent to, seen by, or stored by us or by RevenueCat.

2.9 Diagnostic and technical data

To operate the service securely, our servers process ordinary technical information such as the IP address a request comes from, timestamps, and the app version. This is used for security, abuse prevention and debugging, and is not used to build a profile of you.

2.10 This website

This website sets no cookies, runs no analytics, and embeds no third-party scripts, fonts or trackers. Fonts and images are served from this site itself. That is why you are not seeing a cookie banner — there is nothing to consent to. Our host, Cloudflare, processes standard server logs to deliver the site and protect it from attack.

3. How we use your data

• Providing the core couples experience: pairing, the shared streak, the shared economy and collection
• Syncing progress across your devices and with your partner
• Delivering photos you choose to send to your partner
• Processing subscriptions and in-app purchases through Apple and RevenueCat
• Sending notifications you have enabled
• Understanding how features are used so we can improve them
• Diagnosing faults, and preventing fraud, cheating and abuse of the shared economy
• Complying with our legal obligations

We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

4. Legal basis for processing (GDPR)

If you are in the European Economic Area, the United Kingdom or Switzerland, we rely on the following legal bases under Article 6 GDPR:

Where we rely on legitimate interests, we have considered your rights and freedoms and limited the processing accordingly. You may object at any time (see Section 8).

5. Who we share data with

We do not sell, rent or trade your personal data, and we have never done so. We share it only with your chosen partner, as described above, and with the following processors, who act on our instructions:

Each provider publishes its own privacy policy: Supabase, PostHog, RevenueCat, Apple, Google, Cloudflare.

We may also disclose data where we are legally required to, or where it is necessary to establish, exercise or defend legal claims. If GymCrush is ever sold or merged, user data may transfer as part of that transaction; we would notify you and this policy would continue to apply until replaced.

6. International transfers

GymCrush is available worldwide and our providers process data in the United States. If you are in the EEA, UK or Switzerland, your data is therefore transferred outside your home region. These transfers are covered by the Standard Contractual Clauses adopted by the European Commission, as implemented in each provider's data processing agreement, together with the additional safeguards those providers describe. You can request a copy of the relevant safeguards by emailing us.

7. How we protect your data

• All traffic between the app and our servers is encrypted in transit with HTTPS/TLS.
• Database access is restricted by row-level security, so an account can only reach its own data and the data of the partner it is paired with. Photo storage is protected by equivalent server-side policies.
• Coin and item transactions are processed server-side so the shared economy cannot be manipulated from a modified client.
• Secrets and API keys are held outside the app's source code.

No system can be guaranteed perfectly secure, and we cannot promise absolute security. If a breach ever affects your personal data and poses a risk to your rights, we will notify the competent supervisory authority within 72 hours and notify you without undue delay where the law requires it.

8. Your rights and choices

8.1 Rights you can exercise

Wherever you live, you can ask us to give you a copy of your data, correct it, or delete it. If you are in the EEA, UK or Switzerland you additionally have the rights to restrict processing, to data portability, and to object to processing based on legitimate interests.

To exercise any of these, email support@getgymcrush.com. We respond within 30 days. There is no charge, and we will not treat you differently for asking.

8.2 Deleting your account

You can delete your account at any time from inside the app: Menu → Settings → Data & Privacy → Delete account. This deletes your account record, your profile, your photos, your push token and your personal game data, and resets your analytics identifier.

Two honest caveats. First, data that is genuinely shared with your partner — for example your couple's streak history, or a photo you already sent them — may remain part of their record, because it is their data too. Second, we may retain limited records where the law requires it, such as purchase records kept for tax purposes.

Deleting your account does not cancel your subscription. Cancel that separately in iOS Settings → your name → Subscriptions, or Apple will keep billing you.

8.3 Unpairing

You can unpair from a partner in the app. Unpairing stops any further sharing of new activity between the two accounts.

8.4 Permissions

Notifications, camera and photo library access are all optional and controlled by iOS. You can grant or revoke each of them at any time in iOS Settings → GymCrush.

8.5 Complaints

If you are in the EEA, UK or Switzerland and you think we have handled your data improperly, we would like the chance to put it right — but you also have the right to complain to your local data protection authority. Ours is the French CNIL: cnil.fr.

9. How long we keep data

10. Children

GymCrush is not directed at children. You must be at least 13 years old to use it, and in countries that set a higher age for consenting to online services without a parent — for example 15 in France, and 16 in several other EU countries — you must be at least that age, or have your parent or guardian's consent.

We do not knowingly collect data from children below these ages. If you believe a child has given us personal data, email support@getgymcrush.com and we will delete the account and its data promptly.

11. California and other US state privacy rights

If you are a resident of California, Colorado, Connecticut, Virginia or another US state with a comprehensive privacy law, you have the right to know what personal information we collect and why, to request a copy of it, to correct it, and to request its deletion. You may also appeal a refusal.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising — including with respect to anyone under 16. We therefore offer no "Do Not Sell or Share" mechanism, because there is nothing to opt out of. We do not discriminate against anyone for exercising these rights. To make a request, email support@getgymcrush.com.

12. Changes to this policy

We may update this policy as the app changes. We will post the new version here and update the "Last updated" date. If a change materially affects how we use your data, we will tell you in the app before it takes effect, and where the law requires it we will ask for your consent.

13. Contact

• Data controller: Antoine Gosset, France
• Email: support@getgymcrush.com
• Support: getgymcrush.com/support

We aim to answer every privacy request within 30 days, and usually much sooner.