Privacy Policy

This Privacy Policy explains how Gym Optional collects, uses, shares, and protects your personal information when you use our mobile application, website, and related services (collectively, the "Services"). By using the Services, you agree to the collection and use of information as described in this policy.

Account information. When you create an account, we collect your name, email address, password (stored in hashed form), and account role (client or trainer).

Trainer profile information. If you register as a trainer, we collect additional information including your biography, profile photo, specialties, equipment, experience level, session rate, and referral code. We may also collect certification documents and government-issued identification if you upload them for verification purposes.

Payment information. We use Stripe to process all payments. Your credit card numbers, bank account details, and other financial information are collected and stored directly by Stripe and are not stored on our servers. We receive limited transaction information from Stripe such as payment status, transaction IDs, and customer IDs to manage bookings and subscriptions.

Booking and session data. We collect information about sessions you book, including dates, times, trainer selection, booking status, and cancellation history.

Messages. We store messages exchanged between clients and trainers through our in-app messaging feature.

Video sessions. Video training sessions are facilitated through Daily.co. We do not record video sessions. Temporary video room URLs are created for each confirmed session and deleted when the session is completed or cancelled.

Device information. We collect push notification tokens (delivered via Expo's push notification service and Apple/Google push notification services) to send you notifications about bookings, messages, and session reminders. We collect basic device information necessary to deliver the Services.

Location search. When you search for a city or location, the search text is sent from our servers to Google Places and Google Time Zone to provide city search and time zone results. The server key used for these requests is never exposed to the browser.

Usage information. We may collect information about how you interact with the Services, including app health and performance data, for monitoring and improvement purposes.

We use your information to:

• Provide, maintain, and improve the Services
• Create and manage your account
• Facilitate connections between clients and trainers
• Process payments and manage subscriptions through Stripe
• Send booking confirmations, session reminders, and other transactional notifications via push notification and email
• Verify trainer profiles and credentials
• Respond to support requests sent to support@gymoptional.com
• Monitor app health, security, and performance
• Enforce our Terms of Service and protect the safety of our users
• Investigate reports of misconduct, abuse, or violations of our Terms
• Comply with legal obligations

Between users. Trainer profiles (name, photo, bio, specialties, equipment, experience, rate, ratings, and reviews) are visible to clients browsing the platform. Client names and messages are visible to trainers they interact with.

Stripe. We share necessary information with Stripe to process payments, manage trainer payouts via Stripe Connect, and manage trainer subscriptions. Stripe's use of your information is governed by Stripe's Privacy Policy.

Daily.co. Video session connections are facilitated through Daily.co. Daily.co's use of your information is governed by Daily.co's Privacy Policy.

Resend. We use Resend to send transactional emails (booking confirmations, session reminders, and other notifications) from no-reply@gymoptional.com.

Zoho Mail. Support emails to and from support@gymoptional.com are handled through Zoho Mail.

Google Places and Google Time Zone. We send city search text from our servers to Google Places and Google Time Zone to provide location search and time zone features. The server API key is never exposed to the browser.

Expo. We use Expo's push notification service to deliver push notifications, which may be routed through Apple and Google push notification services.

Vercel. Our website is hosted on Vercel.

Legal requirements. We may disclose your information if required by law, subpoena, court order, or government request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

Business transfers. If Gym Optional is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

We do not sell your personal information to third parties. We do not share your information with advertisers.

We retain your account information and associated data for as long as your account is active or as needed to provide the Services. If you delete your account, we will delete or anonymize your personal information within a reasonable timeframe, except where we are required to retain it for legal, accounting, or security purposes.

Trainer verification documents (certifications and government-issued ID) are stored securely in Firebase Storage and are deleted when a trainer deletes their account.

Booking records and transaction history may be retained for accounting and legal purposes even after account deletion.

We use commercially reasonable measures to protect your personal information, including:

• Firebase Authentication for secure login
• Firestore and Storage security rules restricting data access by role and ownership
• Stripe for PCI-compliant payment processing (we never store card details)
• HTTPS encryption for data in transit
• Daily security audits of our data access rules

No method of electronic storage or transmission is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

Access and update. You can access and update your profile information through the app at any time.

Delete your account. Trainers can delete their account through the in-app account deletion flow, which cancels subscriptions, removes profile data, and cleans up associated records. Clients can request account deletion by contacting support@gymoptional.com.

Notifications. You can manage your push notification and email notification preferences in the app settings. You may also disable push notifications through your device settings.

Communications. You can contact us at support@gymoptional.com to request access to, correction of, or deletion of your personal information.

The Services are for users 18 years of age or older. We do not knowingly collect personal information from anyone under 18.

The Services contain links to or integrations with third-party services (Stripe, Daily.co, Resend, Zoho Mail, Google Places, Google Time Zone, Expo, and Vercel). This Privacy Policy does not apply to those services. We encourage you to review the privacy policies of any third-party services you interact with through our platform.

The Services are operated from the United States and are available only to users located in the United States. Your information is stored and processed in the United States.

We may update this Privacy Policy from time to time. We will post the updated policy and revise the effective date. Your continued use of the Services after any changes constitutes your acceptance of the updated policy.

If you have questions or concerns about this Privacy Policy or our data practices, contact us at support@gymoptional.com.