Skip to content

Privacy Policy

This privacy policy explains the nature, scope, and purpose of processing personal data on the website thegymchallenge.app and in the app “The GymChallenge App” for iOS and Android.

Last updated: 7 October 2026

1. Controller

Sara Lee Rae Häuslschmid-Vialu, TechQuartier, Platz der Einheit 2, 60327 Frankfurt am Main, Germany. Email: hello@thegymchallenge.app.

2. Principles: no trackers, no cookies

This website uses no analytics tools, no marketing cookies, no newsletter services, and no embedded social media content. Instagram is included only as a regular external link; you leave our website only when you click it.

No cookies that are not technically necessary are set. That is why we do not show a cookie banner. If this changes, we will update this policy and the website.

3. Hosting (Vercel)

The website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you visit, Vercel processes technically necessary data in server logs such as IP address, date and time, the page requested, browser and operating system details, and the referring page. This data is required to deliver the website and keep it secure and stable. Vercel keeps the server logs only for a limited time and deletes them automatically; we do not analyse them.

The legal basis is our legitimate interest in operating the website securely and efficiently (Art. 6(1)(f) GDPR). Vercel also processes data in the USA; the transfer is based on the EU Commission’s Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework. A data processing agreement is in place with Vercel.

4. Contact by email

If you email us, we process your details (email address, content, time) to handle your request. The legal basis is Art. 6(1)(b) GDPR where the request relates to a contract or its initiation, otherwise Art. 6(1)(f) GDPR. We delete the correspondence once it is no longer needed and no retention obligations apply.

5. Forms: feedback and tester program

Through the “Feedback” and “Become a tester” forms we collect your name, email address, platform (iOS/Android), for the tester program additionally your device and OS version, for feedback a category, and in both cases your message.

Submissions are validated on the server and forwarded exclusively by email to hello@thegymchallenge.app. We do not store form data in a database. To fend off automated abuse we use an invisible form field (honeypot) and a short-term limit on requests per IP address; for this the IP address is kept in memory for about ten minutes or until the server instance restarts, and is not stored permanently.

The legal basis is your consent (Art. 6(1)(a) GDPR), which you give in the form and can withdraw at any time with effect for the future, and for the tester program the implementation of pre-contractual measures (Art. 6(1)(b) GDPR). We delete details received by email once the purpose no longer applies, for the tester program at the latest when your participation ends.

6. Email delivery (Hostinger)

Form emails are sent through the mailbox hello@thegymchallenge.app, which is hosted by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus (EU). Hostinger processes the form content and technical delivery data on our behalf on servers within the European Union; a data processing agreement is in place with Hostinger. If delivery is not configured, the website offers a link that opens your own email program instead; in that case no data is processed through our servers.

7. External links

The website links to external services such as Instagram, the Apple App Store, and Google Play. The privacy policies of the respective providers apply there. No data is transferred to these providers when you visit our website.

8. The app: account and sign-in

To use the app you need an account. You can register with an email address and password or use “Sign in with Apple” or “Sign in with Google”.

We process your email address, your username, an optional profile picture, and a randomly generated user ID. When you sign in with Apple, Apple gives us only an identifier and, if you agree, your name and email address. If you choose “Hide My Email”, we receive a relay address generated by Apple. When you sign in with Google, we receive the name, email address, and profile picture from your Google account. We do not store your password in plain text. Sign-in is handled through Firebase Authentication (see section 12).

The app is intended for people aged 16 and over. When you register or sign in, you confirm that you are at least 16 years old. If we learn that an account belongs to a younger person, we delete it together with all its data.

The legal basis is the performance of the usage contract (Art. 6(1)(b) GDPR).

9. The app: content, challenges, and chat

When you use the app, we store the content you create yourself:

  • Photos and videos of your workouts, including the time. If you upload a photo from your gallery, we read only the capture date from the image data so the check-in is assigned to the correct day. We do not use location data from the image data.
  • Comments on posts and messages in the challenge chat.
  • Challenges you create or join, your weekly goal, and your role as admin.
  • The list of users you have blocked.

The app shows your posts, comments, chat messages, username, profile picture, and number of workout days only to members of your challenges. Your media can’t be found publicly and is reachable only via unguessable addresses.

The app asks for permission before accessing the camera, microphone, and photo library. Access takes place only when you take or select a photo or video.

The legal basis is the performance of the usage contract (Art. 6(1)(b) GDPR).

10. The app: reporting and blocking

You can report posts and chat messages and block other users. If you block someone, the app hides their posts, comments, chat messages, and notifications from you; the block list is stored in your user profile. When you submit a report, we store who reported what and when, the user ID concerned, and a short excerpt of the content. We usually review reports within 24 hours and remove content that violates the app’s terms of use and community rules (available in the app under “Nutzungsbedingungen”/Terms of use).

The legal basis is our legitimate interest in a safe community and in meeting the requirements of the app stores (Art. 6(1)(f) GDPR). We delete reports once they have been finally processed and no retention obligation applies.

11. The app: push notifications

If you allow notifications, the app notifies you about new posts, comments, and chat messages in your challenges. For this we store a push token of your device. When a notification is sent, this token as well as the title and text of the notification, including the message text for chat messages, are transmitted to the Expo push service. Expo forwards them to the Apple Push Notification Service or Google’s Firebase Cloud Messaging.

The legal basis is your consent (Art. 6(1)(a) GDPR), which you give through your device’s notification prompt. You can withdraw it at any time in your device settings.

12. The app: service providers

To operate the app we use the following service providers, who process data on our behalf:

  • Google Firebase (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) for sign-in (Firebase Authentication), the database (Cloud Firestore), and storage of photos and videos (Cloud Storage). Google may also process data in the USA. The transfer is based on the EU Commission’s adequacy decision for the EU-US Data Privacy Framework, under which Google is certified, and on Standard Contractual Clauses.
  • Expo (650 Industries, Inc., USA) for sending push notifications and delivering app updates. When updates are retrieved, Expo processes technically necessary data such as the IP address and app version. The transfer to the USA is based on the EU Commission’s Standard Contractual Clauses.
  • Apple and Google as providers of the sign-in methods “Sign in with Apple” and “Sign in with Google” and of the push services of their operating systems.

The app contains no analytics tools, no advertising, and no tracking. We do not sell data.

13. The app: retention and deleting your account

We store your data for as long as your account exists. You can delete your account at any time in the app under Settings → “Delete account”. This deletes your profile, your profile picture, all your posts including photos and videos, your chat messages and challenge memberships (as far as technically possible), and your sign-in account.

Comments you wrote on other users’ posts are currently not deleted automatically. They still show your username and profile picture as they were at the time. On request to hello@thegymchallenge.app, we will remove them.

14. Your rights

You have the following rights regarding your personal data:

  • Access (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)
  • Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

You also have the right to lodge a complaint with a data protection supervisory authority, for example the Hessian Commissioner for Data Protection and Freedom of Information. To exercise your rights, an email to hello@thegymchallenge.app is sufficient.

15. Changes

We update this privacy policy when the website or the legal situation changes. The version published here applies.