Privacy Policy

Effective date: June 23, 2026 Last updated: June 23, 2026

In plain language Gymme is a "commitment contract" fitness app: you set a fitness goal, stake your own money on it, and we verify your gym visits using your phone's GPS location. To make verification work we collect your account details, precise location (used while the app is open to confirm you are inside the gym), your check-in and fitness activity, payment information processed by our payment partner Paddle, and the occasional photo you submit when you appeal a failed check-in. How the money works: when you start a commitment, your stake amount is charged to your payment method through our payment partner Paddle. If you meet your goal, the stake is refunded in full to your original payment method. If you miss your goal, the stake is retained; by default Gymme keeps it, or — if you chose this at signup — it is donated to a charity. The App provides a "Wallet" view of your stakes and transaction history; Gymme does not offer a fundable stored-value balance, pre-funded deposit, or general-purpose cash withdrawal — your stake is charged to, and refunds are returned to, your payment method per commitment through Paddle. We use your information only to run the service, keep it secure, and comply with the law. We do not sell your personal information, and we never use your location or health data for advertising. This policy explains what we collect, why, who we share it with, how long we keep it, and the rights you have — including rights under the EU/UK GDPR and the California CCPA/CPRA. If you only read one thing, read this summary; if you want the detail, read on.

1. Who we are and the scope of this policy

1.1 This Privacy Policy describes how Gymme, Inc. ("Gymme," "we," "us," or "our") collects, uses, shares, and protects personal information ("personal data" / "personal information") when you:

• use the Gymme mobile application for iOS or Android (the "App," package id com.gym.me); and
• visit our website and its sub-pages, including https://gymme.me (the "Site").

The App and the Site are together the "Services." Gymme was previously developed under the codename "GymBet"; the product is now called Gymme, and the gymme.me domain remains our canonical web home (including this policy at https://gymme.me/privacy).

1.2 Controller. For the purposes of the EU General Data Protection Regulation ("GDPR") and the UK GDPR, Gymme, Inc. is the data controller of the personal data described in this policy, except where we act as a processor on your behalf or where a third party (such as Apple, Google, or our payment partner Paddle) acts as an independent controller for its own purposes (see Sections 4 and 7).

1.3 Related documents. This Privacy Policy should be read together with our Terms of Service (https://gymme.me/terms) and our Refund Policy (https://gymme.me/refunds), which govern your use of the Services, the staking/commitment-contract model, and your refund rights.

1.4 Age — 18+ only. The Services are intended only for adults aged 18 or over. The Services are not directed to, and we do not knowingly collect personal data from, anyone under 18. See Section 13.

1.5 Where we operate. At launch the Services are offered in New York City and Los Angeles (USA), London (United Kingdom), and Berlin (Germany / EU), and we expect to expand over time. The Services may be unavailable or void where prohibited by local law, and availability may be restricted by region.

2. A note on what Gymme does (so the data makes sense)

To understand why we collect what we collect, it helps to understand the product:

• You set a fitness goal (for example, a number of gym visits per week or workouts per month) over a defined period and stake your own money on completing it, within the limits shown in the App.
• How your stake is handled. When you start a commitment, your stake amount is charged to your payment method through Paddle. The App provides a "Wallet" view of your stakes and transaction history; Gymme does not offer a fundable stored-value balance, pre-funded deposit, or general-purpose cash withdrawal — your stake is charged to, and refunds are returned to, your payment method per commitment through Paddle.
• If you meet your goal, the stake is refunded in full to your original payment method.
• If you miss your goal, the stake is retained. By default a retained stake is kept by Gymme, or — if you elected this at signup — donated to a charity.
• We verify each gym visit using a GPS-verified check-in: you register your gym(s) (up to three), and to check in you must have the App open and be physically inside a geofence around the gym (roughly within 30 metres) and remain there for a minimum session length (about 30 minutes). Check-in verification uses precise location while the App is in the foreground (open); it does not run in the background. We use best-effort anti-spoofing / fake-location detection (see Section 3.3) and may also use manual review to protect the integrity of check-ins.

The verification and staking mechanics are why we need precise location, fitness/check-in data, and payment data. The full legal details of the commitment-contract model, stakes, the charge-and-refund mechanism, freezes, and appeals are set out in the Terms of Service and Refund Policy.

3. The personal data we collect

We collect the following categories of personal data. Some you provide directly; some is generated automatically when you use the Services; some comes from third parties (such as Paddle).

3.1 Summary table

[FOUNDER/PRODUCT DECISION — verify location model before publishing] This policy states that check-in verification uses precise location only while the App is in the foreground (open) and does not run in the background, and that any background ("Always") location is used solely for optional near-gym proximity reminders (not for verification). This must be confirmed against the shipped product. If background ("Always") location in fact contributes to verifying gym presence, then Section 2, this Section 3.1, Section 3.3, and the lawful-basis table in Section 6 must be corrected accordingly — in particular, the lawful basis for any verification-related background location would shift from consent (Art. 6(1)(a)) to contract (Art. 6(1)(b)), to match the foreground-verification basis. See our open items.

3.2 Sensitive / special-category data

Your fitness and health-adjacent data can be data concerning health for an EU/UK user. This includes both:

• the core check-in, streak, goal, and workout-count data that the Services routinely generate to run your commitment; and
• any data you choose to import through Apple HealthKit or Android Health Connect (workouts, steps, and active energy/calories burned).

We treat this as a special category of personal data under GDPR Article 9 / UK GDPR. Where the GDPR/UK GDPR applies, we rely on your explicit consent under Article 9(2)(a), collected separately (unbundled) at signup, to process fitness/health data for the purpose of running your commitments. See Section 6 for the lawful bases and [FOUNDER/COUNSEL DECISION — confirm the Article 9 condition and that the signup flow captures unbundled explicit consent] in our open items.

We follow Apple's and Google's health-data platform policies. In particular: health data is never used for advertising, marketing, or data-broker / resale purposes, and is used only to provide the Service to you. Health-platform data is not shared with third parties except as needed to operate the feature you enabled, or as required by law.

3.3 What we do not do with location and health data — and the limits of our anti-spoofing

• We do not sell your precise location or health data.
• We do not use your precise location or health data for advertising or ad targeting.
• We use precise location only to (a) verify, while the App is open, that you are inside your registered gym for a check-in (geofence + dwell time), (b) show you nearby gyms, (c) detect fake-location/spoofing attempts, and (d) where you enable it, remind you when you are near a registered gym.
• Anti-spoofing is best-effort. Our fake-location detection may not catch all spoofing and is not uniform across all platforms and devices (for example, some signals are available only on certain operating systems). We may also use manual review and other fraud controls. We do not represent that spoofing detection is comprehensive.

3.4 What we do not collect

Where card entry is handled through Paddle's hosted checkout, Gymme does not receive or store your full payment card number; Paddle collects and processes card data in its capacity as our payment processor and Merchant of Record (see Sections 4 and 7), and we receive only the limited payment metadata listed in the table above. Important: this representation depends on all card entry occurring exclusively within Paddle's hosted checkout. See [FOUNDER/ENG ACTION — BLOCKING/PCI] in our open items: this clause must not be published until engineering confirms that no first-party card-entry path and no legacy payment-tokenization path remain in shipped builds.

4. Payments and Paddle (Merchant of Record)

4.1 Our order process and payments are conducted by our payment partner Paddle (Paddle.com Market Limited and/or Paddle, Inc.). Paddle acts as the reseller and Merchant of Record for transactions made through the Services. This means:

• Paddle, not Gymme, is the merchant shown on your card or bank statement.
• Paddle handles checkout, card data and PCI-DSS compliance, invoicing, and the calculation and remittance of applicable sales tax / VAT.
• When you start a commitment, the charge of your stake and any later refund are processed through Paddle.
• Gymme stores only a Paddle customer id, transaction ids, the amount, currency, and charge/refund status, plus limited card metadata (such as brand and last 4 digits) that Paddle may pass back to us. (See the qualification in Section 3.4 regarding full card numbers.)

4.2 Paddle processes your data as an independent controller for the payment, tax, and fraud-prevention purposes described in Paddle's own privacy notice, which we encourage you to review. Amounts are generally processed in US dollars (USD); where the App displays another currency for your market, that currency applies.

4.3 Chargebacks. If you initiate a chargeback, we may suspend or close your account pending investigation, and we may share relevant transaction information with Paddle and the relevant card scheme to resolve the dispute. See the Terms of Service and Refund Policy.

5. How and why we use your data (purposes)

We use personal data for the following purposes:

1. Provide the Services — create your account; set up and run your commitment contracts; charge your stake to your payment method when you start a commitment; verify gym check-ins while the App is open (geofence + dwell time); operate freezes and appeals; show nearby gyms.
2. Process stakes — via Paddle, refund the stake in full when you meet your goal, or retain it when you miss it; handle related tax, invoicing, and dispute processing.
3. Communicate with you — send service messages, check-in/streak notifications and reminders (via push tokens), and respond to support and appeal correspondence.
4. Protect integrity, security, and prevent fraud — run best-effort detection of fake-location/spoofing (see Section 3.3), prevent abuse and fraudulent staking, secure accounts, and investigate chargebacks.
5. Comply with law — meet legal, tax, accounting, anti-money-laundering ("AML"), and identity-verification ("KYC") obligations. We reserve the right to verify your identity and to refuse, limit, or delay stakes, charges, or refunds to comply with AML and fraud rules.
6. Improve and maintain the Services — diagnostics, crash analysis, usage analytics, and product improvement (see Section 10 on analytics/SDKs).
7. Marketing (subject to your choices — see Section 6) — send you promotional messages about Gymme; you can opt out at any time.

We do not use your data for automated decision-making that produces legal or similarly significant effects on you without a lawful basis and appropriate safeguards. Verification of check-ins is rules-based (geofence + dwell time + best-effort anti-spoof signals), and you may submit an appeal with evidence, which a person reviews and decides at Gymme's reasonable discretion (see Sections 7 and the Terms of Service for how appeal review is handled).

6. Lawful bases for processing (GDPR / UK GDPR)

Where the GDPR or UK GDPR applies (for example, if you are in the EU/EEA or the UK), we rely on the following lawful bases. Note on device permissions: the location, health, camera, and notification permission prompts shown by your phone's operating system are a technical gate that lets the App access a device feature — they are not themselves the Article 6 lawful basis for our processing.

The lawful bases above assume that background ("Always") location is used only for optional near-gym reminders and not for verification. If background location in fact contributes to verifying gym presence, the basis for that verification-related use is contract (Art. 6(1)(b)), not consent, and this table must be corrected — see the founder/product decision flagged in Section 3.1 and our open items.

Marketing — regional approach. In the EU/EEA and the UK, marketing emails are sent only with your consent, which you can withdraw at any time. In the US, marketing emails are sent on an opt-out basis with an unsubscribe link in every message, honoured promptly (consistent with the CAN-SPAM Act).

Withdrawing consent / turning off permissions. Where we rely on consent (for example, the optional nearby-gyms feature, background near-gym reminders, the Article 9 health-data condition, or marketing), you may withdraw it at any time — for example by turning off the relevant permission in your device settings or using the unsubscribe link in a marketing email. Turning off a device permission disables the related feature (for example, withdrawing location permission means check-in verification can no longer run), but it does not retroactively invalidate processing already lawfully carried out under contract or legitimate interests before you withdrew.

7. Who we share data with (sub-processors and recipients)

We share personal data only as needed to provide the Services, and under appropriate contractual and security safeguards. We do not sell personal data (see Section 9). The table below intentionally mixes processors acting on our instructions and independent controllers (such as Apple, Google, and Paddle) that also process certain data for their own app-distribution, payment, and platform-analytics purposes under their own privacy policies. Our key service providers and recipients are:

Appeal-review note (Telegram). Appeal evidence surfaced to authorized reviewers through the Telegram-based admin review interface is processed under appropriate data-processing and international-transfer safeguards. Appeal review is also addressed in our Terms of Service.

We may also disclose personal data:

• to professional advisers (lawyers, accountants, auditors) under duties of confidentiality;
• to authorities, regulators, or courts where required by law, or to establish, exercise, or defend legal claims, or to enforce our Terms;
• in connection with a merger, acquisition, financing, or sale of assets, subject to this policy continuing to protect your data; and
• with your consent or at your direction.

You can request an up-to-date list of our sub-processors at any time by emailing privacy@gymme.me.

8. International data transfers

8.1 Gymme is a US company, and several of our sub-processors are located in or transfer data to the United States. If you are in the EU/EEA or the UK, your personal data may be transferred to, stored in, or processed in the United States and other countries that may not provide the same level of data-protection law as your home country.

8.2 Where we transfer personal data out of the EU/EEA or the UK, we rely on appropriate safeguards. Our primary mechanisms are:

• the European Commission's Standard Contractual Clauses (SCCs) for transfers from the EU/EEA; and
• the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the SCCs for transfers from the UK.

Where a particular recipient is certified under the EU-US / UK-US Data Privacy Framework (DPF), we may rely on the DPF for transfers to that recipient instead. We have conducted (and keep under review) a transfer risk assessment for transfers made under the SCCs/IDTA and apply supplementary measures where needed. The specific mechanism and the current DPF-certification status of each US sub-processor are being confirmed — see our open items.

You may request a copy of the relevant safeguards by contacting us at privacy@gymme.me (see Section 16).

9. California privacy rights (CCPA / CPRA)

This Section supplements the rest of this policy and applies to California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA").

9.1 Categories of personal information we collect

We collect the following CCPA/CPRA categories of personal information (see Section 3 for detail, and Section 11 for how long we keep each type):

We do not use facial recognition or other biometric identification, and we do not treat appeal photos or share-card images as biometric information.

9.2 Sensitive personal information

We do collect sensitive personal information, specifically precise geolocation and health/activity information. We use it only to provide and secure the Services as described in this policy, and not to infer characteristics about you. Because our use is limited to these permitted purposes, we fall within the exemptions in CCPA/CPRA § 1798.121(d) and are not required to offer a "Limit the Use of My Sensitive Personal Information" link — and we do not display one. You may nonetheless contact us to request that we limit our use of sensitive personal information, and we will honour applicable requests.

9.3 We do not sell or "share" your personal information

We do not sell your personal information, and we do not "share" it for cross-context behavioural advertising, as those terms are defined under the CCPA/CPRA, and we have not done so. We also do not knowingly sell or share the personal information of consumers under 16 (and, in any event, the Services are for adults 18+ only).

9.4 Your California rights

Subject to verification and legal limits, you have the right to:

• Know / access the categories and specific pieces of personal information we have collected, the sources, the business/commercial purpose, and the categories of third parties to whom it is disclosed;
• Delete personal information we have collected from you (subject to the legal-retention exceptions in Sections 11 and 14 — for example, payment, tax, and AML records we are required to keep);
• Correct inaccurate personal information;
• Opt out of any sale or sharing (note: we do not sell or share);
• Limit the use and disclosure of sensitive personal information (see Section 9.2); and
• Non-discrimination — we will not discriminate against you for exercising your rights.

To exercise these rights, contact privacy@gymme.me (see Section 16). You may use an authorized agent, subject to our verification of their authority.

10. Cookies, SDKs, and analytics

10.1 Marketing Site (gymme.me). Our Site uses Vercel Web Analytics and Vercel Speed Insights to understand aggregate traffic and performance. We use only the cookies and similar technologies necessary to operate the Site and, where required by law, those used for analytics with your consent. The Site does not use your data for advertising.

10.2 In the App. The App uses Firebase / Google Analytics for usage and crash analytics, Firebase Cloud Messaging for push notifications, and Google Maps Platform for maps and geolocation. These software-development kits (SDKs) may process device identifiers, usage events, and diagnostic data. Apple and Google may also apply their own platform-level analytics under their respective policies.

10.3 No advertising use of analytics. We do not use your precise location or health data for advertising or ad targeting under any circumstances — this is an absolute commitment required by Apple's and Google's platform policies. More broadly, our general device and usage analytics (Firebase/Google Analytics) are used only to operate, secure, and improve the Services and are not used for cross-context behavioural advertising. If we ever propose to change this, we will provide notice and, where required, obtain your consent first.

10.4 Your choices. You can manage push notifications and location/health permissions in your device settings, and you can opt out of non-essential cookies/analytics on the Site where a consent mechanism is provided. Disabling certain technologies may affect how the Services function (for example, disabling location prevents check-in verification).

11. Data retention

11.1 We keep personal data only for as long as necessary for the purposes set out in this policy, including to provide the Services, comply with legal, tax, accounting, and AML obligations, resolve disputes, and establish, exercise, or defend legal claims.

11.2 The criteria and indicative periods we apply are as follows (indicative ranges are subject to confirmation with counsel before EU/UK launch — see open items):

• Account and profile data — kept while your account is active, then deleted or anonymized within a reasonable period after closure, subject to the legal-retention exceptions below.
• Check-in / location-verification data — each successful check-in stores exact GPS coordinates (latitude, longitude), location accuracy, and device identifiers (device model and OS), and we keep per-attempt records for rate-limiting and fraud analysis. These records are retained for the duration of the relevant commitment and for a defined appeals/fraud window thereafter, after which they are deleted or aggregated. We do not currently truncate or coarsen the stored coordinates; [ENG ACTION — implement location data minimization] is recorded in our open items.
• Payment, charge, refund, and transaction records — retained for the period required by applicable tax, accounting, and AML law (indicatively 6–10 years [TO BE CONFIRMED]). Full card data, where applicable, is held only by Paddle (see Section 3.4).
• Appeal-evidence photos and support correspondence — retained for as long as needed to handle the appeal/dispute and for a reasonable period afterward.
• Analytics and diagnostic data — retained on a shorter, aggregated or pseudonymized basis where possible.

11.3 Retention overrides erasure for certain records. Even where you request deletion (Sections 9.4 and 14), we will retain payment, transaction, tax, and AML records — and any records reasonably needed to establish, exercise, or defend legal claims — for the legally required period rather than erasing them. The remainder of your data is then deleted or anonymized. We are reconciling our account-deletion process with this stated retention so that legally required financial/AML records are preserved or anonymized rather than hard-deleted; see [ENG/COMPLIANCE ACTION] in our open items.

11.4 Specific statutory retention periods for our governing jurisdiction are [RETENTION PERIODS — TO BE CONFIRMED with counsel before EU/UK launch].

12. How we protect your data (security)

12.1 We use appropriate technical and organizational measures to protect personal data, including encryption in transit, encryption at rest (provided by our managed database/storage provider, Supabase), access controls and authentication via our infrastructure provider, restricted access on a need-to-know basis, and use of PCI-DSS-compliant payment processing through Paddle (see the qualification in Section 3.4 regarding full card numbers).

12.2 No method of transmission or storage is completely secure. While we work hard to protect your data, we cannot guarantee absolute security. If we become aware of a personal-data breach that is likely to affect you, we will notify you and the relevant authorities where required by law and within the timeframes the law requires.

13. Children

The Services are for adults 18 and over only and are not directed to children. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, contact privacy@gymme.me and we will take steps to delete it.

14. Your data-protection rights (GDPR / UK GDPR)

If you are in the EU/EEA or the UK, you have the following rights regarding your personal data, subject to legal conditions and exceptions:

• Access — obtain confirmation of, and a copy of, your personal data.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure ("right to be forgotten") — have your data deleted in certain circumstances. Please note: erasure is not absolute. We will retain payment, transaction, tax, and AML records, and any records reasonably needed to establish, exercise, or defend legal claims, for the period required by law (see Section 11.3), and erase the remainder.
• Restriction — restrict our processing in certain circumstances.
• Portability — receive certain data in a structured, commonly used, machine-readable format and have it transmitted to another controller where technically feasible.
• Objection — object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent — withdraw any consent you have given (e.g. health-data consent, optional nearby-gyms / background-location features, marketing), without affecting the lawfulness of processing carried out before withdrawal (see Section 6).
• Lodge a complaint — complain to your local data-protection supervisory authority. In Germany this is the competent state (Land) or federal data-protection authority; in the UK it is the Information Commissioner's Office (ICO). We would, however, appreciate the chance to address your concerns first.

To exercise any of these rights, contact privacy@gymme.me (see Section 16). We will respond within the time limits required by applicable law (generally one month under the GDPR/UK GDPR) and may need to verify your identity first.

15. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, where changes are material, provide additional notice (for example, in the App or by email). Your continued use of the Services after an update takes effect means you accept the revised policy.

16. Data-protection governance

16.1 DPO. [DPO STATUS — TO BE CONFIRMED: Gymme will either appoint a Data Protection Officer and publish their contact here, or document why a DPO is not required.] Until confirmed, please direct all data-protection queries to privacy@gymme.me.

16.2 DPIA. Because the Services involve large-scale processing of special-category (health) data together with systematic monitoring of precise location, Gymme will conduct (and keep under review) a Data Protection Impact Assessment (Article 35 GDPR) covering its location-verification and health-data processing before and during EU/UK operation.

16.3 EU and UK representatives (Article 27). Appointment of both an EU representative and a UK representative is a launch-blocking requirement: Gymme cannot lawfully target data subjects in Berlin or London without them. These are not yet appointed — see [FOUNDER ACTION — LAUNCH-BLOCKING] in our open items.

17. How to contact us

EU / UK GDPR representatives (Article 27): [EU representative — TO BE APPOINTED]; [UK representative — TO BE APPOINTED] (see Section 16.3).

Gymme, Inc. is the controller responsible for your personal data. This Privacy Policy is governed by the laws of [State of Delaware, USA — TO BE CONFIRMED], without prejudice to mandatory data-protection rights you have under the laws of your country of residence (including the GDPR, UK GDPR, and CCPA/CPRA).

This Privacy Policy forms part of, and should be read together with, our Terms of Service and Refund Policy.