Privacy Policy

Effective October 5, 2026 · Last updated October 12, 2026

Gym Check is a shared workout check-in board for small crews. This policy explains the information the service handles and the choices available to account holders.

Information you provide

• Account and profile information: display name, username, password and recovery-code hashes, profile avatar or photo, theme, and usual board mark. Email is collected when verified-email account access is enabled.
• Shared crew content: crew memberships, workout check-ins and their activity, date, duration, intensity, notes and optional photos; short board notes, mentions, and reactions.
• Private Tracker information: workout dates and notes, exercises, sets, weights, repetitions, and body-weight entries. Tracker records and body-weight history are private to your account.
• Safety records: reports, selected reasons, optional report details, block relationships, and administrator review notes.

Information created when you use the service

Gym Check records account creation and recent activity times, session and authentication state, and limited rate-limit events. Rate-limit records use a keyed hash derived from the client IP address rather than storing the raw address in those tables. If email delivery is active, the service stores hashed verification and reset tokens and privacy-minimized delivery outcomes. If you allow notifications in the iPhone app, Gym Check stores that phone's Apple push token with your account and your choice of which notifications to receive.

How information is used and shared

Gym Check uses information to operate accounts and crews, display the content you choose to share, provide private tracking features, send authentication email, prevent abuse, review reports, and maintain backups. Check-ins, photos, board notes, and reactions are shown to the relevant crew. Blocking hides the two accounts' content from each other, but does not remove either person from a shared crew. Private workouts and body-weight records are not shown to crew members.

Configured administrators can review reports and the specific reported text or account. The report queue does not display photo previews. Gym Check does not include an advertising or analytics SDK. Hosting is provided by Fly.io. Resend handles authentication email when that feature is enabled. Notifications you turn on are delivered by Apple's push notification service, and carry the crew name, the other member's display name and a short summary, such as the activity or the text of a note that mentions you. Encrypted off-site backups are stored in Cloudflare R2 using Restic. Sentry is optional and is used only if a DSN is configured.

Retention and deletion

Information is kept while your account is active and removed from the live service when you delete your account, subject to the limited moderation records described on the deletion screen. Reports targeting a deleted account are anonymized; reports filed by a deleted account are removed. Encrypted backup snapshots may retain deleted data for up to one year. Email delivery records are minimized and associated recipient digests are removed when the related account is deleted.

Security and your choices

Passwords and recovery codes are stored as hashes. Authentication links are stored as keyed hashes, and off-site backup bundles are encrypted. You can update profile information in the app, block another account, report content, or delete your account from Me. You can choose which notifications you receive in Me, or turn them off in the iPhone's Settings; signing out of the app removes that phone's push token from your account. Do not put information in a crew board that you do not want visible to its members.

Children

Gym Check is for people aged 13 and older. New accounts must confirm that the account holder is at least 13. Do not use Gym Check or create an account if you are under 13.

Contact

For privacy questions, email gymcheck@swisherspeed.racing.