Privacy Policy
Last updated: June 15, 2026
The short version
GymCrush is a couples app, so some of your data is stored in the cloud and shared with the partner you pair with — that's how you keep one shared streak, one shared coin balance, and a shared collection. We use a small set of trusted providers to run the app (Supabase for accounts and game data, PostHog for anonymous analytics, RevenueCat for subscriptions, and Apple for payments). We do not sell your data or use advertising trackers.
1. Information We Collect
1.1 Account Information
To use GymCrush you create an account. We collect and store:
- Your email address (used for sign-in and account recovery)
- An authentication identifier and session tokens
- Your display name and chosen avatar/equipped companion
1.2 Couple & Partner Data
GymCrush is built for two people. When you pair with a partner, certain data is shared between the two accounts so the experience works:
- Your pairing link / invite code and partner relationship
- Your shared couple streak, streak-freeze status, and daily completion counts
- Your shared coin balance and shared inventory (companions, accessories, backgrounds, consumables)
- Your daily task progress, which your partner can see as part of the shared streak
- Lifetime progress statistics tied to your account
Your partner can see the shared couple state described above. They cannot see your email address or payment details.
1.3 Game & Usage Data (Supabase)
Provider: Supabase, hosted in the United States.
Your account, couple state, inventory, and progress are stored in our database, hosted by Supabase. Coin and item transactions are processed server-side to keep the shared economy consistent between partners.
1.4 Analytics (PostHog)
Provider: PostHog Inc., hosted in the United States.
We collect usage events to understand how features are used and improve the app. This includes events such as app opens, screen views, task completions, streak events, chest openings, shop and purchase events, and onboarding steps. Analytics events are associated with your account identifier so we can understand product behavior; we do not use this data to build advertising profiles or share it for advertising.
1.5 Subscription Management (RevenueCat)
Provider: RevenueCat Inc., hosted in the United States.
We use RevenueCat to manage premium subscription entitlements (including couple/"pair" premium). Data processed includes a customer identifier, purchase events, subscription status, and entitlement changes. Your payment details (credit card, billing address) are handled entirely by Apple and are never accessible to us or RevenueCat.
1.6 Payment Processing (Apple)
All purchases are processed by the Apple App Store. We do not receive or store any payment information.
2. How We Use Information
- Providing the core couples experience (pairing, shared streak, shared economy, collection)
- Syncing your progress across your devices and with your partner
- Processing in-app purchases and subscriptions (via Apple and RevenueCat)
- Understanding how features are used to improve the app
- Diagnosing problems and protecting against abuse or exploits
- Sending notifications you have enabled
3. Data Storage and Security
Your data is stored in our Supabase database and protected by access controls (row-level security) so that you and your paired partner can only access your own couple's data. We use industry-standard encryption in transit (HTTPS/TLS). However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
4. Data Sharing and Disclosure
We do not sell, rent, or trade your data. Data is shared only with the service providers below, who process it solely on our behalf, and with the partner you choose to pair with:
- Supabase (United States) — database, authentication, and game state
- PostHog (United States) — product analytics
- RevenueCat (United States) — subscription management
- Apple — processes all payments through the App Store
We may also disclose information if required by law or to protect our legal rights. If our company is acquired or merged, user information may be transferred as part of that transaction.
5. Third-Party Services
GymCrush relies on the following third-party services. Each provider has its own privacy policy:
- Supabase — Database & authentication — Privacy Policy
- PostHog — Product analytics — Privacy Policy
- RevenueCat — Subscription management — Privacy Policy
- Apple App Store — Payment processing — Privacy Policy
6. Children's Privacy
GymCrush is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at gosset.dev@gmail.com and we will delete it.
7. Your Rights and Choices
7.1 Access & Account Deletion
You can delete your account from within the app. When you delete your account, we delete your personal account data and reset your associated analytics identifier. Note that some shared couple data may persist for your partner's account where it forms part of their own record (for example, shared history that belongs to the couple). Some records may also be retained as required by law or for fraud prevention.
7.2 Unpairing
You can unpair from a partner within the app. Unpairing stops further sharing of new activity between the two accounts.
7.3 Notifications
You can control notification permissions through your device settings or within the app's settings screen.
7.4 Subscription Cancellation
You can cancel your premium subscription at any time through your Apple App Store account settings.
8. Data Retention
- Account & game data: Retained while your account is active; deleted when you delete your account, subject to the exceptions in Section 7.1.
- PostHog analytics: Retained according to PostHog's data retention policy.
- RevenueCat: Retains subscription records for the duration of the subscription relationship and as required by applicable law.
9. International Users
GymCrush is available worldwide. Your account, game, analytics, and subscription data are processed in the United States by the providers listed above. By using the app, you acknowledge that your data may be transferred to and processed in these locations.
10. European Users (GDPR)
GymCrush is developed by Antoine Gosset, based in France. If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, the following applies under the General Data Protection Regulation (GDPR):
10.1 Legal Basis for Processing
- Contract performance (Article 6(1)(b)): Account creation, pairing, shared game state, and subscription management — necessary to provide the service you signed up for.
- Legitimate interest (Article 6(1)(f)): Analytics and abuse/exploit prevention to maintain and improve app quality.
10.2 Your Rights
You have the right to access, rectification, erasure, restriction of processing, data portability, and objection. To exercise any right, contact us at gosset.dev@gmail.com.
10.3 Data Controller
Antoine Gosset, France — gosset.dev@gmail.com
10.4 Automated Decision-Making
We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.
10.5 Cross-Border Transfers
Data processed by Supabase, PostHog, and RevenueCat is transferred to the United States. These transfers rely on standard contractual clauses (SCCs) as implemented by each provider.
11. California Privacy Rights
If you are a California resident, you have the right to know what personal information we collect and how it is used, and to request deletion. We do not sell your personal information. For questions, contact us at gosset.dev@gmail.com.
12. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on this page, updating the "Last updated" date, and where appropriate providing an in-app notification.
13. Contact Us
- Email: gosset.dev@gmail.com
- Support Page: Support