Privacy Policy

Effective date: 11 September 2026 Last updated: 11 September 2026 App: Gym Tross (iOS and Android) Developer: D. Raj Gurung Contact: divy5831@gmail.com

This Privacy Policy describes how Gym Tross (“the app,” “we,” “our,” or “us”) handles information when you use the application.

Gym Tross is the mobile companion to a gym management system. It is used by gym staff to register members, check members in, record payments, and log walk-in visitors, and by gym members to see their own membership. It is not a social network, and it is not intended for use by children.

1. Who controls your data

Gym Tross accounts and member records are created and managed by the gym that you work for or are a member of, not by us. That gym decides who has an account, what role each person holds, and what happens to the records it keeps.

In data protection terms, the gym is the controller of the information in its workspace. We operate the software on the gym’s behalf as a processor. If you want your personal information corrected or removed, speak to the gym’s owner or branch manager first — they control the record. You may also contact us at the address above and we will assist.

2. Information we handle

2.1 Account information

Email address — used to sign you in and to identify you to your gym.
Password — never stored in readable form. Authentication is handled by Supabase, and passwords are stored only as salted hashes.
Display name and role — for example Owner, Manager, Trainer, Front Desk, or Member, set by your gym.
User ID — a random identifier that links your actions to your account.
Branch assignment — which location or locations of the chain you belong to.

2.2 Member records

A gym registers its members in the app. A member record may include:

Full name, phone number, and email address
Date of birth and gender
Address
Emergency contact name and phone number
A member photo, if the gym takes one
Membership plan, start and expiry dates, and status

These fields exist because a gym needs to identify the person at the door, contact them about a renewal, and reach someone if they are hurt on the floor. A gym is not required to fill in every field.

2.3 Operational records staff create

While doing their job in the app, staff create business records such as:

Attendance and check-in events, with the time and branch
Payments, with amount, method (cash, eSewa, Khalti, FonePay, bank transfer, or card), reference number, discount reason, and who collected it
Membership renewals, freezes, transfers, and refunds
Walk-in visitor and enquiry entries, including the visitor’s name, phone number, and the plan they were interested in

These records belong to the gym. They describe gym operations, not your private life. Where a record shows who performed an action, that is deliberate — it is how a gym maintains accountability over cash and membership.

2.4 Health information

Gym Tross does not collect health or fitness data. There is no workout logging, no body measurement tracking, no heart rate, and no integration with Apple Health or Google Fit. The app does not read from or write to any health platform.

3. Device permissions

The app asks for the following permissions. Each is used for one narrow purpose, and you can decline any of them and still use the rest of the app.

Camera — to scan a member’s QR code at the front desk for check-in, and to take a member’s photo for their record. QR frames are processed on the device to read the code and are never saved or uploaded. A member photo is saved only when a staff member deliberately takes one, and only to that member’s record. Staff can always look a member up by name or phone instead of scanning.
Photo library — to choose an existing photo for a member’s record instead of taking a new one. The app reads only the image you pick. It does not browse, index, or upload your library.

The app does not request location, microphone, contacts, Bluetooth, or health permissions.

4. Where your data is stored

Account and operational data are stored in a Supabase project operated by us on the gym’s behalf. Supabase provides the database, file storage, and authentication infrastructure and hosts it on cloud servers. Access is enforced by row-level security so that a gym’s staff can reach only that gym’s records, and a member can reach only their own.

Member photos are stored in a private Supabase Storage bucket. They are not public, and they are not served from an open URL.

Data transmitted between the app and the server is encrypted in transit using HTTPS.

5. What we do not do

We do not include advertising SDKs. The app shows no ads.
We do not include third-party analytics or tracking SDKs.
We do not track you across other apps or websites, and we do not use the iOS Advertising Identifier.
We do not sell, rent, or lease any information to anyone, ever.
We do not collect your location. The app has no location permission.
We do not collect health, fitness, or biometric data.
We do not access your contacts, microphone, or calendar.

We share information only in these situations:

With your gym. Staff and managers see the records in their branch or chain, according to the role the gym assigned them. A member sees only their own record.
With infrastructure providers. Supabase stores the data so the service can run. It acts on our instructions and does not use the data for its own purposes.
When legally required. If we receive a valid legal order, we may have to disclose information. We will tell the affected gym unless the law forbids it.

7. Retention and deletion

Operational records are kept for as long as the gym maintains its account, because a business needs historical membership and payment records.

To delete your account, ask the gym’s owner or branch manager to remove you, or email us at divy5831@gmail.com and we will action the request within 30 days. See the Account Deletion page for the full procedure. When an entire gym closes its account, its data is deleted within 90 days of the request.

Note that deleting an account does not erase the gym’s financial history. Payments and membership records remain as business records; the personal account and contact details attached to them are removed.

8. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to certain processing. Email us and we will help. Because your gym controls the workspace, we may need to route the request through them.

9. Children

Gym Tross is not directed at children, and we do not knowingly collect information from anyone under 16 through an account of their own. A gym may hold a record for a junior member; that record is entered and controlled by the gym, with consent obtained by the gym from a parent or guardian as local law requires. If you believe a child has created an account, contact us and we will remove it.

10. Changes to this policy

If we change this policy we will update the “Last updated” date above. Material changes will be communicated to account owners by email.

11. Contact

Questions about this policy, or about how your data is handled:

D. Raj Gurung divy5831@gmail.com