Privacy Policy

1. Who is responsible for your data

The data controller for the personal data described in this policy is GymScan, a French société par actions simplifiée (SAS) with share capital of €1,000, whose registered office is at 5 rue Fénelon, 33000 Bordeaux, France, registered with the Bordeaux Trade and Companies Register under number 944 074 863.

For any question about this policy, about how we handle your data, or to reach our data protection contact, write to contactgymscan@gmail.com.

2. What data we collect

We only collect the data we need to run the Gym Scan service. Depending on how you use the app, that may include:

• Account data: name, email address, password (stored hashed), profile photo and preferred language.
• Training data: sessions, exercises, sets, reps, loads, scanned machines and streaks.
• Health-related data you choose to enter: weight, body fat, BMI and nutrition logs. This is data concerning health under Article 9 GDPR and is processed only with your explicit consent.
• Subscription and referral data, handled through RevenueCat: your subscription status and purchase history, your RevenueCat app user ID, the referral code you share and the account that referred you.
• Technical data: device type, operating system, app version, IP address and crash reports.
• Usage data: pages and screens viewed, features used and interaction timestamps.

3. Why we process it, and on what legal basis

Every processing operation has a legal basis under Article 6 GDPR:

• Providing the app, your account and gym access — performance of a contract (Art. 6(1)(b)).
• Recording your training, progress and nutrition — your explicit consent (Art. 6(1)(a) and Art. 9(2)(a)), which you may withdraw at any time.
• Keeping the service secure, preventing fraud and abuse — our legitimate interest (Art. 6(1)(f)).
• Measuring audience and improving the product — your consent, collected through the cookie banner.
• Meeting accounting, tax and legal obligations — legal obligation (Art. 6(1)(c)).

4. Who we share it with

We never sell your personal data. We share it only with the parties that make the service work, each bound by a data processing agreement under Article 28 GDPR:

• The partner gym you check in at, limited to the data needed to grant you access.
• IONOS SARL (France), our hosting and infrastructure provider.
• RevenueCat, Inc. (United States), which manages our subscriptions, in-app purchases, referral tracking and subscription analytics.
• Public authorities, where we are legally required to disclose data.

5. Transfers outside the EEA

Your data is hosted within the European Economic Area, on infrastructure operated by IONOS in France. One provider, RevenueCat, Inc., processes subscription and referral data in the United States. That transfer is covered by an adequacy decision of the European Commission or by the European Commission's Standard Contractual Clauses, together with additional technical safeguards such as encryption in transit and at rest.

You can request a copy of the safeguards in place by writing to contactgymscan@gmail.com.

6. How long we keep it

We keep your data no longer than necessary:

• Account and training data: for as long as your account is active, then deleted or anonymised within 12 months of closure.
• Health-related data: deleted as soon as you withdraw consent or close your account.
• Technical logs: 12 months.
• Invoices and accounting records: 10 years, as required by law.

7. Your rights

Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw your consent at any time without affecting processing already carried out.

Most of these rights can be exercised directly from the app, under Settings → Privacy. You may also write to contactgymscan@gmail.com; we answer within one month. If you believe your rights have not been respected, you may lodge a complaint with your national supervisory authority — in France, the CNIL (www.cnil.fr).

8. Cookies and similar technologies

Strictly necessary cookies keep you signed in and secure the service; they do not require consent. Analytics and measurement cookies are only set once you accept them in the banner shown on your first visit.

You can change or withdraw your choice at any time from the cookie settings link in the footer, or by clearing cookies in your browser.

9. Security

We apply appropriate technical and organisational measures under Article 32 GDPR: encryption in transit (TLS) and at rest, hashed passwords, role-based access control, logging, regular backups and periodic security reviews. In the event of a personal data breach likely to result in a high risk to your rights, we notify the supervisory authority within 72 hours and inform you without undue delay.

10. Children

Gym Scan is not intended for children under 15. As our controller is established in France, the applicable age of digital consent is 15 (Article 45 of the French Data Protection Act). Below that age, processing based on consent requires the authorisation of the holder of parental responsibility. If you believe a child has provided us with personal data, contact contactgymscan@gmail.com and we will delete it.

11. Changes to this policy

We may update this policy to reflect changes to the service or to the law. Any material change is announced in the app and by email at least 30 days before it takes effect. The date at the top of this page always shows the version in force.