Legal Documentation

Privacy Policy.

Last updated: August 31, 2026. This policy explains the personal data handled by the GymLinx website, gym dashboards, and member mobile application, why it is used, where it can be shared, and the available account and deletion choices.

1. Scope and responsibility

This policy covers the GymLinx website, gym-owner and staff dashboards, member mobile application, public profiles and content pages, support channels, and related payment, notification, media, and account services.

The GymLinx service operator is MEVVO EXPRESS LLC, with legal contact address 271 W Short St, Suite 410, Lexington, Kentucky 40507-1213, United States. Privacy questions for the service operator can be sent toprivacy@gymlinx.com.

A gym may separately decide why and how it records member, staff, access, payment, attendance, fitness, or nutrition information for its own operations. In that situation, the gym may be the responsible organization for that record and GymLinx may provide the software used to process it. Questions about a gym-managed record should also be directed to that gym.

2. Data we handle

Data can come from you, a gym or staff member, another user interacting with you, a connected payment or app-store service, and the device or network used to access GymLinx. The categories currently represented in the product are:

Account, contact, and gym records

Name, username, email address, phone number, profile photo, date of birth, gender, biography, address, gym and branch relationships, membership identifiers and status, staff role, preferences, and emergency-contact or fitness-goal details supplied by you or a gym that manages your membership.

Social, communication, media, and support data

Profiles, follows and blocks, posts, captions, comments, reactions, bookmarks, reports, sounds, photos, video, audio, message content and attachments, conversation membership and read state, and messages or files sent to support, privacy, demo, contact, or account-help channels.

Workout, fitness, health-related, and nutrition data

Workout plans and sessions, exercises, sets, repetitions, weight, distance, duration, personal records, fitness goals, body weight and measurements, body-fat and muscle-mass entries, progress photos and notes, meal and water logs, food entries, calories, macronutrients, nutrition targets, and saved meal templates. These can be sensitive even though GymLinx is not a medical service.

Location and check-in data

Approximate or precise device location when you grant permission and use nearby-gym, check-in, geofence, or location-tagging features; gym and branch addresses and coordinates; and check-in time, branch, method, and related validation results.

Purchases, memberships, creator earnings, and payouts

Plan, subscription, invoice, purchase, refund, dispute, transaction and entitlement status; amounts, currency, provider references and limited billing metadata; coin or in-app purchase history; creator earnings; and payout destination details such as a PayPal email, bank account, or mobile-money destination. Payment credentials may be collected directly by the applicable payment or app-store provider rather than GymLinx.

Device, usage, crash, performance, and push data

Account or user ID, app route and feature events, content-view and engagement events, app version and environment, device platform, locale, notification permission state, Firebase Cloud Messaging or Apple push token, known-device and session information, IP and request metadata, diagnostics, stack traces, crash reports, and performance traces. Release builds currently enable Firebase analytics, crash reporting, and performance collection.

3. How we use data

We use data only as relevant to the feature, account relationship, and request involved. Current purposes include:

  • Create and authenticate accounts; connect members, staff, gyms, branches, and memberships; and keep sessions and devices secure.
  • Provide feeds, profiles, follows, private and group messaging, media upload and playback, comments, notifications, search, sharing, moderation, and support.
  • Provide gym operations, membership access, check-ins, workouts, progress history, nutrition tracking, reminders, rewards, and personalization requested by the user.
  • Quote, process, reconcile, refund, and support gym payments, app-store purchases, subscriptions, creator earnings, and payouts, including fraud, dispute, and accounting workflows.
  • Deliver transactional, security, support, lifecycle, and separately selected marketing communications.
  • Monitor reliability, diagnose crashes, measure performance and feature use, prevent abuse, enforce policies, and improve the service.
  • Comply with legal obligations, protect users and the service, investigate reports, and establish or defend legal claims.

4. Sharing and service providers

Data is disclosed when needed to operate a selected feature, complete a transaction, communicate with a recipient, support a gym account, keep the service safe, or meet a legal obligation. Depending on the feature, recipients include the gym and authorized staff, conversation participants, people who can see content under its visibility setting, payment or payout providers, app stores, and infrastructure or communication providers.

Supabase

Authentication, databases, row-level access, realtime features, server functions, and storage-related application services.

Cloudflare

Website and Worker delivery, network and security handling, and media processing or storage through Cloudflare Images, Stream, and R2.

Firebase by Google

Push messaging, product analytics, crash diagnostics, and application performance monitoring. GymLinx associates its Firebase telemetry with the signed-in user ID.

Adapty, Apple, and Google Play

Paywall, product, purchase, restore, receipt, subscription, coin-purchase, and entitlement handling for in-app purchases. The applicable app store also processes the store account and payment method under its own terms.

Stripe, Flutterwave, and PayPal

Stripe and Flutterwave support payment, subscription, refund, verification, and reconciliation flows where configured. Flutterwave and PayPal also support creator payout destinations or disbursements where offered. Availability depends on the gym, country, currency, and selected flow.

Resend

Transactional, support, security, lifecycle, and separately authorized marketing email delivery, receipt, and delivery-status handling.

Providers can process data in countries other than your own and may have their own legal responsibilities and retention duties. We may also disclose information in response to a valid legal request, to investigate abuse or protect safety and rights, or as part of a merger, financing, reorganization, or transfer of the relevant service, subject to applicable law.

5. Visibility and choices

Public profiles, gym profiles, public posts, comments, workouts, exercises, nutrition content, and their preview metadata can be visible outside the app, shared to other services, and indexed by search engines. Content limited to a gym, group, or private conversation is intended for the relevant audience, but recipients can still save or reshare what they receive.

Location access and push-notification permission are controlled through device settings. Profile and content visibility, blocks, follows, notification preferences, and available communication settings can be changed in the product. Some transactional, account, security, or legal notices are not marketing messages.

Removing a post or changing a profile can take time to disappear from third-party search, link-preview, device, or recipient caches. GymLinx cannot directly erase copies another person or independent service has lawfully retained.

6. Retention and deletion

We keep data for as long as it is needed to provide the relevant account or feature and for legitimate operational, security, moderation, fraud-prevention, dispute, accounting, tax, backup, and legal purposes. The period varies by record, feature, provider, account relationship, and applicable requirement; this policy does not promise one fixed period for every category.

The mobile self-service deletion flow removes or anonymizes account-linked application data, removes posts from visible surfaces, replaces authored post comments and messages with deletion markers, detaches the member identity, disables mirrored app-subscription access, and soft-deletes the Supabase authentication user. A limited deletion-request and event record remains for completion, support, and audit handling.

Payment, refund, dispute, payout, security, moderation, provider, and accounting records may remain when required to reconcile a transaction, prevent abuse, support another person's rights, or meet a legal obligation. Data in backups is removed through the applicable backup lifecycle rather than necessarily at the same moment as the live account. A gym may also need to retain records it controls independently.

Deleting the mobile app does not delete the account. Use theAccount Help page or the in-app account deletion control to start an account or data-deletion request.

7. Security

GymLinx uses technical and organizational controls appropriate to the service, including authenticated sessions, role and row-level access controls, encrypted transport, secret separation, provider webhook verification, and logging or monitoring used to detect and investigate failures or abuse. Access can also depend on the controls configured by a gym and the providers listed above.

No online service can guarantee absolute security. This page does not claim a particular external security certification or that every security feature is available for every account, platform, or plan.

8. Rights and contact

Depending on your location and the responsible organization, you may have rights to ask for access, correction, deletion, restriction, objection, portability, or withdrawal of consent. These rights can have legal exceptions. We may need to verify identity and clarify whether GymLinx or a particular gym is responsible for the requested record.

Access or portability

Ask for information about, or a copy of, applicable personal data.

Correction

Ask to correct incomplete or inaccurate account or service data.

Deletion

Ask to delete applicable account data, subject to identity checks and lawful retention needs.

Consent and communications

Change available permissions or withdraw consent for optional processing, including marketing.

Submit an account or deletion request throughAccount Help, or emailprivacy@gymlinx.com. Include enough information to identify the relevant account and gym, but do not send a password, full payment-card number, or other unnecessary secret.