Privacy Policy

Who we are (data controller)

Go Gym is currently operated by Tom Dowling as a sole trader, based in the United Kingdom, who is the data controller responsible for your personal data. Go Gym Ltd is in the process of being incorporated; at or around public launch it will become the data controller, and the app, your account, and associated data will transfer to it. We will update this policy and notify you when that happens. For any privacy question or to exercise your rights, contact us at privacy@go-gym.app.

What data we collect

We collect your account email and profile details, together with the fitness and workout data, food and nutrition logs, body weight and measurements, and any other trackables you choose to record. Some of this — such as body measurements, weight, and health-related habits — is health information, which counts as a special category of personal data and is given extra protection under UK data protection law. We also collect limited technical data such as device type and app usage needed to operate and improve the service.

Our legal bases for using your data

We rely on the following legal bases under the UK GDPR:

• Contract — to create your account, sync your data across devices, and provide the core Go Gym service you sign up for.
• Explicit consent — to process the health and fitness information you log (special-category data). You give this consent when you sign up and log data, and you can withdraw it at any time by deleting the relevant data or your account.
• Consent — to load optional analytics and advertising cookies on this website, and, where applicable, in-app analytics. You control this through the cookie banner and your settings.
• Legitimate interests — to keep the service secure, prevent abuse and bot sign-ups, and improve the product, balanced against your rights.

How we use it

We use your information to provide the Go Gym service, sync your data across devices, send service messages such as sign-up confirmations and password resets, keep the service secure, and improve the product. We do not sell your personal data, and we do not use your health and fitness data for advertising.

Service providers we share data with

We use a small number of trusted providers who process data on our behalf under contract:

• Supabase — hosting, database, and authentication for your account and app data (EU region).
• PostHog — privacy-focused product analytics inside the app, on EU cloud infrastructure. You are identified only by an internal ID, and health fields are not sent to it.
• Resend — sending transactional emails such as confirmations, password resets, and account notifications.
• Cloudflare Turnstile — bot protection on the waitlist form (see below).
• Google Analytics and Google AdSense — analytics and advertising on this marketing website only, loaded solely if you accept optional cookies. See our Cookie Policy.

In-app advertising (Google AdMob) is not active during the beta. When ads are introduced at public launch, this policy will be updated to describe them.

Bot protection (Cloudflare Turnstile)

When you join the Go Gym waitlist, we use Cloudflare Turnstile in invisible mode to help distinguish genuine sign-ups from automated bot traffic. Turnstile processes minimal client-side signals such as IP address, browser metadata, and site origin solely for bot detection. We do not use Turnstile to profile or target you for advertising. For more detail on how Cloudflare processes this data, see the Cloudflare Turnstile Privacy Addendum.

Cookies and analytics

On this website we ask for your consent before loading analytics or advertising cookies. If you accept, we use Google Analytics (measurement ID G-WR55R7Z2CV) and Google AdSense (publisher ID ca-pub-1200144947372260). If you decline, neither service is loaded and no cookies are set. See our Cookie Policy for full detail on what each service sets and how to manage it.

Where your data is stored and transferred

Your account and app data is stored with Supabase in the EU region, and in-app analytics is processed on PostHog's EU cloud. Some providers (for example Google, Cloudflare, and Resend) are based outside the UK/EU; where data is transferred internationally, it is protected by appropriate safeguards such as UK/EU standard contractual clauses or an adequacy decision.

How long we keep it

We keep your personal data for as long as your account is active. If you request account deletion, we apply a 14-day grace period (during which you can cancel) and then permanently delete your account and associated records, except where we must retain limited information to meet a legal obligation. Data may persist briefly in encrypted backups before those cycle out.

Your rights

Under UK data protection law you have the right to access your data, request a copy or export, have it corrected or deleted, restrict or object to processing, and withdraw consent at any time. You can delete your account and data from within the app, or contact us at privacy@go-gym.app. If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.

Age

Go Gym is intended for people aged 18 and over. We do not knowingly collect data from anyone under 18.

Not medical advice

Fitness data, food logs, and measurements in Go Gym are for informational purposes only. They do not constitute medical, dietary, or professional health advice. Always consult a qualified professional for medical decisions.