Privacy Policy

1. Who We Are

GymWars is owned and operated by Nathaniel Price ("GymWars," "we," "us," or "our"). We operate a team-based fitness competition platform available as a mobile app on iOS. This Privacy Policy applies to the GymWars app, the gymwars.org website, and all related services.

Privacy contact: privacy@gymwars.org

2. Information We Collect

2.1 Account Information

• Email address — required to create an account or join the waitlist
• Display name and username — shown on your profile and crew
• Date of birth — used for age verification (13+ required); optional after setup
• Password — stored as a secure hash via Supabase Auth; we never see your plaintext password

2.2 Profile & Fitness Information

• Body weight — used to calculate your normalized lift score (required to log lifts)
• Height — optional, used for profile display
• Experience level, training years, home gym — optional profile fields
• Profile photo — optional, stored in Supabase Storage

2.3 Activity Data

• Lift logs — exercise name, category (Push/Pull/Legs), weight, reps, sets, timestamp
• War participation — which wars your crew participated in, scores, results
• Chat messages — messages sent within your crew chat
• Crew membership — crew name, tag, captain status, join date

2.4 Technical Data

• Device information — device type, OS version, app version
• Crash reports — collected via Sentry when the app crashes; includes stack traces but no personally identifying information
• IP address — logged by Supabase for authentication security and rate limiting
• Push notification token — stored if you grant notification permission; used only to send GymWars notifications

2.5 Payment Information

We do not collect or store your payment card information. All purchases are processed by Apple via In-App Purchase and RevenueCat, which manages subscription state. We receive only your subscription tier (free, pro, crew pass) — not your card details.

2.6 Waitlist

If you sign up at gymwars.org before launch, we collect only your email address and the timestamp of signup. We use this to notify you when the app is available.

3. How We Use Your Information

Purpose	Data used
Running the app — scoring, matchmaking, war resolution	Lift logs, body weight, crew membership
Account management — login, profile, settings	Email, username, password hash
Displaying your profile to crew members and opponents	Display name, username, profile photo, stats
Crew chat — delivering messages within your crew	Chat messages
Push notifications — war results, crew activity	Push notification token
Safety & moderation — detecting policy violations, processing bans	All content you post
Crash reporting — fixing bugs and crashes	Stack traces, device info (via Sentry)
Subscription management — tracking your plan	Subscription tier (via RevenueCat)
Waitlist & launch communication	Email (waitlist only)

We do not use your data to serve advertisements. We do not build advertising profiles.

4. How We Share Your Information

We do not sell, rent, or trade your personal information. We share data only in these circumstances:

4.1 Other GymWars Users

• Your display name, username, and profile photo are visible to all app users
• Your lift scores (not raw lift data) are visible to your crew and opposing crew during an active war
• Your crew stats (trophies, war record, tier) appear on the league leaderboard
• Your chat messages are visible to your crew members only

4.2 Service Providers

Provider	Purpose	Privacy Policy
Supabase	Database, authentication, file storage	supabase.com/privacy
RevenueCat	Subscription management	revenuecat.com/privacy
Sentry	Crash monitoring (production only)	sentry.io/privacy
Apple	App distribution, in-app purchases, push notifications	apple.com/privacy
Cloudflare	Website hosting and DNS	cloudflare.com/privacypolicy

4.3 Legal Requirements

We may disclose your information if required by law, court order, or governmental authority, or if we believe disclosure is necessary to protect the rights or safety of GymWars, our users, or the public.

4.4 Business Transfers

If GymWars is acquired or merges with another entity, your information may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.

5. Data Retention

• Active accounts — data is retained for as long as your account exists
• Deleted accounts — personal data (email, name, body weight, lift logs, chat messages) is deleted within 45 days of account deletion. Anonymized aggregate statistics (e.g., crew war records) may be retained
• Waitlist emails — retained until the app launches and you've been notified, or until you request removal
• Crash reports — Sentry retains crash data for 90 days

6. Children's Privacy

GymWars is not directed at children under 13 years old. We do not knowingly collect personal information from children under 13. If we discover that a user is under 13, we will delete their account and all associated data immediately.

Users between 13 and 17 should have parental or guardian consent before using the app. If you believe a minor's data has been collected without consent, contact us at privacy@gymwars.org.

7. Your Rights and Choices

Delete Your Account

You can delete your account at any time from Settings → Delete Account in the app. All personal data will be removed within 45 days.

Access Your Data

You can view and export your lift logs and profile data from within the app. To request a full data export, email privacy@gymwars.org.

Correct Your Data

You can update your profile information at any time from the Profile tab in the app.

Opt Out of Notifications

Disable push notifications at any time from your device's Settings → Notifications → GymWars.

Waitlist Removal

To be removed from the pre-launch waitlist, email privacy@gymwars.org with the subject "Remove from waitlist."

California Residents (CCPA)

California residents have the right to know what personal information we collect, request deletion, and opt out of sale (we do not sell data). To exercise these rights, contact privacy@gymwars.org.

8. Security

We take security seriously. GymWars uses:

• TLS encryption for all data in transit
• Row-Level Security (RLS) — database rules ensure users can only access their own data
• Column-level privilege restrictions — sensitive fields (subscription tier, ban status) cannot be modified by client-side code
• Rate limiting — login attempts and form submissions are rate-limited
• Password hashing via bcrypt — we never store plaintext passwords

No system is 100% secure. If you discover a security vulnerability, please report it to security@gymwars.org.

9. International Transfers

GymWars is operated from the United States. If you are accessing GymWars from outside the US, your data may be transferred to and processed in the United States, where data protection laws may differ from your country. By using GymWars, you consent to this transfer.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you via the app or by email at least 7 days before the change takes effect. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of the app after the effective date constitutes acceptance.

11. Contact

Privacy questions: privacy@gymwars.org
General support: support@gymwars.org
Security reports: security@gymwars.org
Legal: legal@gymwars.org