Privacy policy
This privacy policy informs you under Articles 13 and 14 of the General Data Protection Regulation (GDPR) about the personal data we process when you use our website gympli.com, the web app at https://test-app.gympli.com and the "Gympli" mobile app for iOS and Android (together "Gympli" or the "service").
1. Controller and contact
The controller within the meaning of the GDPR is:
[Vor- und Nachname]
[Straße und Hausnummer]
[PLZ] [Ort]
Deutschland
Email: [E-Mail-Adresse]
Phone: [Telefonnummer]
We have not appointed a data protection officer because we are not legally required to. For data protection questions, contact us at the email address above.
2. Who is responsible for which data
Gympli is software that trainers and studios (the "organization") use to coach their clients. Each organization has an owner who pays for Gympli; employed or freelance trainers (the "team") and clients use Gympli free of charge through the organization. This results in two roles:
- We are the controller for the data we need to run the service ourselves: your user account, sign-in and security data, billing of the subscription, communication with us (support) and visits to our website. This privacy policy applies to that data in full.
- The organization is the controller for the coaching content it keeps about its clients in Gympli: training plans, training sessions, measurements and goals, questionnaires and check-ins including photos, notes, messages, calendar entries, passes and attendance. We process that data only on its behalf and on its instructions (Article 28 GDPR, see our data processing agreement). Your trainer or organization decides on the purposes, legal basis and retention of that processing; please direct requests about this data to them. If such a request reaches us, we forward it to the organization.
Section 5 nevertheless describes which coaching content Gympli stores technically, so that you know what happens to your data.
3. Visiting the website
When you open gympli.com, our server processes the technically necessary information your browser sends: IP address, date and time, requested address, referrer, browser and operating system. We need it to deliver the website and to protect it against abuse and attacks. The legal basis is our legitimate interest in a secure, working website (Article 6(1)(f) GDPR). Server logs are overwritten continuously and deleted after [[number]] days at the latest.
The website sets no cookies, stores nothing in your browser, loads no scripts, fonts or images from third parties and uses no analytics, advertising or tracking tools.
4. User account and use of the service
4.1 Registration and account
For an account we process your name, email address, password (stored only as a bcrypt hash), language, time zone, your gender and profile photo if you choose to add them, when you confirmed your email address, your status (e.g. "online") and your role in the organization (owner, team or client). When registering you confirm that you are at least 16 years old and accept our terms; we store the version of the accepted terms and privacy policy with a timestamp.
If a trainer creates an account for you, it initially knows only your name. It becomes your account only once you open the invitation link, set your own email address and password and accept the terms. Until then nobody can sign in with it and no emails are sent to it.
The legal basis is the user agreement with you (Article 6(1)(b) GDPR); we store the records of your acceptance of the terms on the basis of our legitimate interest in being able to prove the conclusion of the contract (Article 6(1)(f) GDPR).
The small version of your profile photo (256 × 256 pixels) can be retrieved without signing in through an address that cannot be guessed, so that it loads quickly in emails and apps; the address is not listed publicly anywhere. The original photo is available only after signing in.
4.2 Security
To protect your account we process:
- Sessions in the web app with session id, IP address, browser identifier (user agent) and last activity. You can see your signed-in devices and sign them out.
- Sign-in tokens of the mobile app with device name, last use and expiry.
- Two-factor authentication (optional): the TOTP secret and recovery codes, stored encrypted.
- A security log of important events (e.g. sign-ins and failed attempts with the email address used, sign-outs, password and two-factor changes, members added or removed, data exports, billing actions). No IP addresses or browser identifiers are written to this log. The owner of an organization sees their organization's log.
- Technical error logs with user and organization ids, without message content.
The legal basis is the performance of the user agreement (Article 6(1)(b) GDPR) and our legitimate interest in a secure service and in preventing abuse (Article 6(1)(f) GDPR).
4.3 Emails and notifications
We send you the emails needed to use the service: email confirmation, password reset, invitations, security notices, billing notices and – depending on your settings – notifications about activity in your organization. In the app we show notifications; for this we store the type, the trigger, a reference and, for new messages, a preview of up to 120 characters. New messages are not delivered by email. We send no advertising emails and no newsletter. The legal basis is Article 6(1)(b) GDPR.
4.4 Mobile app
The app keeps its sign-in token in your device's secure storage (iOS Keychain or Android Keystore), accessible only while the device is unlocked. For each installation we store the platform, app language and when it was last used.
You receive push notifications only if you allow them on your device. We then store your device's push token and when a notification was last delivered successfully or failed. To deliver a notification we send the token and the notification's title and text in your language to the Expo push service, which forwards them to your device via Apple or Google. You can turn push notifications off at any time in your device settings; we delete the token when you sign out. The legal basis is Article 6(1)(b) GDPR; access to your device happens with your permission or because it is strictly necessary for the service you requested (§ 25 TDDDG).
The app requests no health-data permissions (Apple Health, Health Connect) and reads no such data.
When you download the app from the App Store or Google Play, Apple or Google process data as independent controllers under their own privacy policies; we have no influence on this.
4.5 Subscription and payment
Owners take out a paid subscription on Stripe's checkout page and manage it in Stripe's customer portal. You enter card details and billing address directly with Stripe; we do not receive them. We store the Stripe customer id, the type and last four digits of the payment method, the end of the trial, the plan, quantity and status of the subscription and the ids of the payment events Stripe reports to us. Invoices are created and stored by Stripe.
The legal basis is the contract (Article 6(1)(b) GDPR) and our legal obligation to retain accounting records (Article 6(1)(c) GDPR in conjunction with § 147 AO and § 257 HGB).
4.6 Ordering and cancellation
When ordering a subscription you confirm that you are purchasing Gympli for your commercial, freelance or self-employed professional activity. We store the time of this confirmation, the plan, the Stripe customer id, the versions of the terms and of this privacy policy and the exact text of the accepted terms as evidence of the contract (Article 6(1)(b) and (f) GDPR). You can cancel in your account under Account → Billing or in text form, e.g. by email; we process a cancellation by email to carry it out and to document it (Article 6(1)(b) GDPR).
4.7 Contact and support
When you write to us, we process your information to answer your request (Article 6(1)(b) GDPR, or Article 6(1)(f) GDPR for requests outside a contract). We delete the correspondence once it is settled and no retention obligation applies.
4.8 Data export
You can request a copy of your own data. We create an encrypted ZIP archive with your account and usage data and your own files; files belonging to other people are never included. We email you a link to it; the archive can be downloaded once, only while signed in to your account, and is deleted after 48 hours.
5. Coaching content and health data
Depending on how your trainer uses Gympli, the following coaching content is stored: client profile (status, assigned trainer, goals), training plans and workouts, training sessions with sets, reps, weight, rate of perceived exertion (RPE) and notes, body measurements, weight and steps, questionnaires and check-ins with answers, photos and trainer feedback, trainer notes, messages with attachments, calendar entries, passes with price and attendance, and an activity feed for the trainer.
Your organization is the controller for this data (section 2); we process it on its behalf. Who can access it is fixed technically: clients see only their own data, trainers only the clients assigned to them, the owner every client of their organization. Messages can be read only by the participants of the conversation and the assigned trainer – not by the owner unless they take part. We as the operator have no administrative interface through which we could read coaching content.
Health data. Body measurements, progress photos, check-in answers, perceived exertion and notes can be health data within the meaning of Article 9 GDPR. Your organization is responsible for processing them: it determines the legal basis and, where required, obtains your explicit consent (Article 9(2)(a) GDPR). We process this data only on its behalf. Please direct questions about your health data, the withdrawal of a consent and deletion requests to your trainer.
6. Recipients and processors
We share your data only where the service requires it and use the following service providers, which process data on our behalf under Article 28 GDPR:
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany | Servers, database (PostgreSQL), Redis, file storage | Germany |
| Resend, Inc., San Francisco, USA | Sending emails | EU (Ireland); company in the USA |
| 650 Industries, Inc. (Expo), Palo Alto, USA | Delivering push notifications to the mobile app | USA |
| Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin | Checkout page, subscription management, invoices, portal | Ireland; transfers to the USA possible |
Stripe processes some payment data as an independent controller, in particular for fraud prevention and to meet its own legal obligations (e.g. anti-money-laundering); Stripe's privacy policy applies to that.
Members of your organization see the data their role provides for (section 5). Authorities receive data only where we are legally obliged to provide it. We do not sell data and do not share it for advertising.
7. Transfers to third countries
Our servers are located in Germany. Where Resend, Expo or Stripe process data in the USA or another country outside the EU/EEA, the transfer is based on an adequacy decision of the European Commission – for the USA the EU-US Data Privacy Framework, where the provider is certified under it – or, where applicable, on the European Commission's standard contractual clauses (Articles 45 and 46(2)(c) GDPR). You can request a copy of the safeguards.
8. Retention
We keep personal data only as long as necessary for the purpose or required by law:
| Data | Retention |
|---|---|
| User account, profile, two-factor data | until the account is deleted |
| Web app sessions (with IP address and user agent) | 30 days after the last activity; immediately on a password change |
| App sign-in tokens | until sign-out, expiry or one year without use |
| Push tokens | until sign-out or deletion of the account |
| Security log | 365 days |
| Read notifications | 6 months after being read; unread ones until the account is deleted |
| Attachments of deleted messages | 30 days after the message is deleted |
| Data exports | 48 hours or until the first download |
| Password reset links | 60 minutes |
| Failed background jobs, technical logs | 30 days or continuously overwritten |
| Evidence of accepted terms and orders | until the account is deleted, then without the email address for 3 years from the end of that year |
| Invoices and accounting records (at Stripe and with us) | 8 years (accounting vouchers) or 10 years (books, financial statements), § 147 AO, § 257 HGB |
| Coaching content | as determined by the organization; at the latest until the organization is deleted |
Account deletion. You can delete your account in the account settings with your password. Any running subscription ends immediately, all sign-ins are revoked and your profile photo, check-in photos and exports are deleted. If an owner deletes their account, their organization is deleted with all its data. Content you wrote for others (e.g. messages sent, notes, calendar entries, measurements) stays with the other participants, but without any link to you. Security log entries are deleted when their 365 days have passed. Evidence of which version of the terms and privacy policy you accepted and which orders you placed is kept without your email address – only with a keyed check value that lets us match it to you on request – and deleted three years after the end of the year of the deletion. Data we are required to keep is restricted until the period ends.
9. Your rights
You have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20) and to withdraw consent with effect for the future (Article 7(3)). You can exercise many of these rights directly in Gympli: edit your profile, export your data, delete your account. For anything else, an email to [E-Mail-Adresse] is enough. If your request concerns coaching content, please contact your trainer; we support them in handling it.
Right to object (Article 21 GDPR). Where we process data on the basis of our legitimate interest (Article 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then stop processing the data unless we demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims.
Right to lodge a complaint (Article 77 GDPR). You can lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement. The authority competent for us is: [Datenschutz-Aufsichtsbehörde des Bundeslandes des Betreibers, mit Anschrift].
10. Cookies and local storage
The website gympli.com sets no cookies. The web app sets only cookies that are strictly necessary for the service you requested (§ 25(2) no. 2 TDDDG):
| Name | Purpose | Duration |
|---|---|---|
gympli_session | Keeps you signed in (HttpOnly, Secure, SameSite=Lax) | 120 minutes of inactivity |
XSRF-TOKEN | Protection against forged requests (CSRF) | same as the session |
remember_web_… | Only if you choose "Remember me" | until sign-out, at most 400 days |
In your browser's local storage the web app keeps only your chosen colour theme and language. Because we use no analytics, advertising or tracking technology and load no third-party content, we need no consent and show no cookie banner.
11. Obligation to provide data and automated decisions
We need your name, email address and password to create an account; owners must also provide payment details to Stripe. Without this information you cannot use Gympli. Everything else is voluntary. We make no automated decisions and carry out no profiling within the meaning of Article 22 GDPR.
12. Minimum age
Gympli is not intended for people under 16. When registering, and when claiming an account created by a trainer, you confirm that you are at least 16 years old. If we learn that an account belongs to a younger person, we delete it.
13. Security
All connections are encrypted with TLS. We store passwords only as hashes, two-factor secrets encrypted, photos and attachments in non-public storage that serves them only after sign-in, and data exports encrypted. Access within an organization follows fixed roles. Our data processing agreement has more details.
14. Changes
We update this privacy policy when the service or the law changes. The version published on this page applies; we inform registered users of material changes in advance by email or in the app.