Privacy Policy

Effective date and last updated: 01/11/2026

At Y FIT we respect your privacy and handle your data responsibly. This policy explains in detail what data we collect when you use the Y FIT member app, the Y FIT Admin app for staff, or the website yfit.online and its pages (together, the "Services"), how we use it, with whom we share it, how we protect it, and what rights you have. Please read it carefully. By using the Services you acknowledge that you have read and understood this policy.

1. Who we are

The Services are provided by the Y FIT gym ("the Club", "we", "us"), which determines the purposes and means of processing your personal data within the Services. You can reach us as described in section 19.

2. Scope

This policy applies to all users: Club members, staff (coaches, accounting and management) and website visitors. It does not cover third-party websites or services we may link to, such as social media profiles or Google Maps, which are governed by their own policies.

3. Data we collect

3.1 Identity and account data

• Full name, phone number (also used as your login identifier) and gender.
• Password, stored hashed by Firebase Authentication; neither the Club nor any staff member can see it.
• Profile photo, if you choose to upload one.

3.2 Membership and transaction data

• Subscription type, start and end dates, duration and price.
• Amounts paid, payment method and currency, outstanding balances and later payments.
• Attendance via QR code and booked sessions with coaches.
• Additional fields the Club may add to your membership record, such as a locker number.

3.3 Health and fitness data

• Weight, height, age, body measurements, body fat and their progress over time.
• Fitness and nutrition goals and nutritional targets.
• Training and nutrition plans prepared by your coach, and their notes.
• Workout logs (exercises, weights, repetitions, duration), meal and water logs.

3.4 Communications

• Messages the Club sends you within the app and their read status.

3.5 Technical and usage data

• Installed app version and the date it was last opened, to know who needs an update.
• Aggregate usage statistics of app sections, to improve design.
• Technical data automatically collected by hosting servers for security and operation, such as IP address, browser type and request time.

3.6 Staff data

• For staff: name, phone number, role, permissions, and a log of important actions performed in the Admin app.

We do not collect your location, contacts, or photos and files from your device except files you choose to upload, and the camera is used only to scan the attendance code with your permission.

4. How we collect data

• Directly from you when you join the Club or enter your data, measurements, meals and workouts in the app.
• From Club staff when accounting records your membership and payments or a coach prepares your plan.
• Automatically, limited technical data when you use the app or website.

5. Purposes and legal bases

We never sell your personal data, show ads in the Services, or use your data for third-party marketing.

6. Health data

We treat your health and body data as sensitive data. We collect it only to provide training and nutrition services, and it is accessible only to you, the relevant coaches and the owner; accounting can access it only if explicitly permitted by the owner. You may stop entering this data or request its deletion at any time without affecting your membership.

7. Sharing and service providers

• Within the Club, with staff on a need-to-know basis under role permissions set by the owner.
• Technical service providers processing data on our behalf and only on our instructions: Google Firebase (Google LLC) for authentication and cloud database; Cloudflare, Inc. for hosting and delivery; ntfy.sh for push notifications (notification text only); Google Sheets (if enabled by the Club) for a copy of the Club's membership records and financial reports, accessible only to the owner and authorised persons.
• Legal obligations, where disclosure is required by law or by a competent authority.

8. International transfers

The providers above, or their servers, may be located outside your country. In that case your data is transferred and processed under the safeguards these providers offer, such as encryption and approved contractual clauses.

9. Retention

10. Security

• Encrypted connections (HTTPS/TLS).
• Database-level security rules preventing users from reading other users' data and limiting each staff member to their permissions.
• A tamper-proof internal log of important staff actions.
• Passwords are never stored in readable form; any staff account can be frozen instantly.

No method of transmission or storage is 100% secure. If a security breach affects your data, we will notify you and the relevant authorities as required by law.

11. On-device storage and offline use

To be fast and work offline, the app keeps a copy of your data on your device and stores changes made offline until the connection returns, then sends them automatically. Other apps cannot access this copy. Please protect your device with a screen lock and sign out before handing it to someone else. The app updates itself automatically in the background to fix errors and add improvements.

12. Notifications

The app may send notifications about Club messages, membership expiry and workout reminders. You can turn them off at any time in your device settings.

13. Your rights

Depending on the law that applies to you, you may have the right to access your data and receive a copy; rectify inaccurate data; request erasure; restrict or object to processing in certain cases; data portability; withdraw consent at any time without affecting prior processing; and lodge a complaint with your data protection authority. To exercise these rights, contact us as in section 19. We will respond within 30 days and may need to verify your identity.

14. Account deletion

You can request deletion of your account and data in the member app (☰ → Privacy & Terms → Request account deletion) or via the Delete account page. Requests are completed within 30 days; financial records are kept only as long as required by law.

15. Minors

The Services are intended for Club members. Members under 16 are registered only with the consent of a parent or guardian, who may exercise the rights in this policy on their behalf.

16. Cookies and tracking

We do not use advertising cookies or third-party tracking tools for marketing. The app uses local storage strictly necessary for its operation, such as keeping you signed in, your language, and offline data. The website may load fonts from Google Fonts.

17. Automated decisions

We make no decisions with significant effects on you by fully automated means. Plans and recommendations are prepared by human coaches.

18. Changes

We may update this policy to reflect changes in the Services or the law. Material changes will be announced in the app before they take effect; the date of the last update appears at the top of this page.

19. Contact us

For any privacy question or request, contact Y FIT management at the Club or through the official channels listed at yfit.online/links.