Privacy Policy

Who handles the data

Gympacer is a scheduling tool for personal trainers: the professional registers their students, books classes, records workouts and sends reminders. We are the controller for the data described here, and the contact is systems@gympacer.com.

When a trainer registers a student, it is the trainer who decides what to collect and why; we process it on their behalf. The registered person can approach either of us.

What we collect

Nothing is collected without a purpose. The list below is the whole list.

• From the trainer: name, e-mail, phone with WhatsApp, country, timezone, date of birth, professional registration, photo, bio, Instagram, and their base address with its coordinates.
• From students, registered by the trainer: name, e-mail, phone, date of birth, address with coordinates, sport, contracted amounts and notes.
• From a student who creates their own account: name, e-mail, phone and photo.
• From use: booked classes, attendance, cancellations, reschedule requests, workouts with exercises, sets and loads, and the history of automatic messages sent.
• From message delivery: we store the destination phone number, the outcome, and the provider error when one fails — that is what makes it possible to find out why a reminder never arrived.
• Technical: a count of visits per day and per country, which identifies nobody; an internal event log that stores identifiers only, never the content of what was done; and the public key of devices used for biometric unlock.

What we never store

Your password in readable form, anywhere. Biometric unlock stores the device public key and half of a vault key; the other half stays on the device itself, and neither the database nor a stolen phone can rebuild the credential alone.

We do not store card details either. Stripe processes payment, and the card never passes through our servers.

Your Google account data

Connecting Google Calendar is optional and reversible. When you connect, we request four permissions and no more:

• `openid` and `email` — to show on screen which Google account is connected.
• `calendar.events` — to create, read, edit and delete the events for your classes in your calendar.
• `calendar.freebusy` — to read your busy times and stop anything being booked over a commitment that already exists.
• We do not request the broad `auth/calendar` access, which would grant far more than those two things require.

Limited use of Google data

Gympacer’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

In practice: your calendar data is used only for the features you see on screen. It is not sold, does not feed advertising, is not used to train generalized artificial intelligence models, and no one on our team reads it — except with your explicit permission, to resolve a security issue, or where the law requires it.

Access tokens are stored encrypted. Disconnecting the integration deletes the token immediately, and from that point there is no way back into your calendar.

Who we share with

Only with those who run part of the service, and only what that part needs.

• Netlify — hosting, database, authentication and photo storage.
• Google — Calendar when you connect it, and address lookup and travel time when you use those features.
• Stripe — billing for the trainer’s subscription.
• Resend — sending reminder, verification and password recovery e-mails.
• WhatsApp, from Meta — sending automatic messages to anyone with a WhatsApp number on file.
• WeatherAPI.com — the forecast for outdoor classes. It receives a rounded coordinate only, never a name, phone number or any identification.

How long we keep it

For as long as the account exists. Deleting a student removes their registration and keeps the history of classes already taught without the link, because that is a record of the trainer’s work.

Verification and recovery codes expire within minutes and are never stored in readable form. Past weather forecasts delete themselves. Deleting the account removes its personal data, except what the law requires us to keep, such as tax records of payments taken.

Your rights

You can request access to your data, correction of anything wrong, deletion, portability, and information about who we share it with. Write to systems@gympacer.com; we answer within 15 days.

If you are a trainer’s student and want your data out of their roster, you can ask them or us — either way the request is honoured.

Security

Every data operation is scoped to the authenticated account: no query reaches another person’s account, and automated tests verify this on every change. Integration tokens are encrypted. Photos live in private storage and are served through an authenticated route, never a public address.

Minors

The product is built for professionals aged 18 or over. A student under 18 may be registered by their trainer, and in that case it falls to the trainer to hold the consent of whoever is legally responsible for them.

Changes

When this policy changes, the effective date above changes with it, and we send an e-mail when the change affects how we use your data.