Privacy Policy
GymTag is a friends beta operated personally by Kahlil Padgham for adults age 18 or older, in any country. GymTag’s servers and backups are in the United States, so information you give GymTag is stored and processed there. This policy covers the GymTag mobile app, API, and these public pages. Questions and requests go to safety@playgymtag.fit.
1. The private pilot
GymTag runs one-to-one fitness challenges between adults who already know each other. There is no participant directory for strangers. A participant shares a private handle directly, and only the two Tagmates can access their ordinary gameplay and authorized media. A Tag link’s page is the one exception (section 6).
2. Information GymTag handles
- Account and profile: email address, provider account identifier, private handle, display name, optional profile photo, short signature, decorative frame and title, adult eligibility statement, and versions of rules and safety notices accepted.
- Friend invitations: a friend may provide your email address to invite you to GymTag before you have an account. Resend receives the address and invitation text to deliver that email. GymTag stores a keyed email digest, a masked address, the inviter, and invitation status to match your verified email when you join. Invitations expire after 7 days; invitation records are removed by scheduled cleanup after 30 days, or when a linked account is deleted. Accepting is optional.
- Fitness, gameplay, and content: challenge type, activity, target, measure, response window, safety selections, terms, decisions, deadlines, proof claims, disputes, scores, Letters, Completion points, belt state, written summaries, notes sent with Respect, uploaded video with embedded sound, and photos.
- Watch stats: if you tap Add watch stats on a proof, GymTag reads one workout you pick from Apple Health (Health Connect on Android), including that workout’s speed and heart-rate samples, and your highest heart rate of the past 30 days to set the heart-rate zones. These are read and worked out on your phone. GymTag keeps only the numbers worked out from them and two simplified curves of speed and heart rate of at most 60 points each, and never reads your route. It stores a one-time summary with that proof: workout type, duration, average and highest heart rate, active calories, distance, steps, climb (elevation gain), whether it was indoors, the source and the app or watch that recorded it, whether the workout was entered by hand, top speed, sprints and how long fast speeds were held, mile and kilometre splits, minutes in five heart-rate zones and where the hard zone starts, hard efforts, running or cycling power, cadence and form, heart-rate recovery and effort, and swim laps and strokes, each only where your watch recorded it. No raw samples are stored, and the summary is visible only to you and that Tagmate. It is removed when the proof is removed or the account is deleted, and it is never used for scoring, advertising, analytics, or notifications.
- Safety and moderation: reports, selected reason, optional private detail, blocks, keyed one-way email digests used to keep blocks effective after account recreation, safety exits, media state, moderation decisions, and action audit records.
- Optional reminders: a device push token, device platform, your phone’s time zone so reminders arrive at a sensible hour, your per-device turn and deadline preferences, and delivery records. Both reminder preferences start off.
- Support and operation: correspondence sent to the support address, session credentials, and network or operational records necessarily processed while delivering and protecting the service.
A selected video may contain metadata already in the file. GymTag does not intentionally extract location metadata.
GymTag removes location and camera details from photos before storing them.
The app requests health read access only when you tap Add watch stats, and only for workouts, heart rate, speed, active energy, distance and steps, plus elevation gain on Android and running and cycling power, cadence and form, heart-rate recovery, effort and swim strokes on iPhone. It never writes to Apple Health or Health Connect. The app does not intentionally request Contacts, Location Services, Motion and Fitness, advertising identifiers, or tracking permission.
Profile photos are optional. The server checks that a photo is a valid supported still image, crops and resizes it, and removes embedded metadata before storing the processed copy. The original photo is not stored. Profile details and photos are visible only to you and your active, unblocked Tagmates; they are never listed in a directory or served through a public photo link.
For interrupted-upload recovery, the app keeps pending drafts and copies of selected videos and photos in its private local cache. It clears this cache on sign-out or observed account deletion. Your phone may clear cached files sooner; restoring a draft does not automatically submit it.
3. How information is collected and used
Information comes directly from participants when they sign in, build a profile, play, upload, report, block, request deletion, or contact support. The service also records the state transitions needed to authorize private access, enforce agreed deadlines, prevent unfair scoring, respond to reports, preserve blocks, and complete deletion.
GymTag uses this information only to authenticate participants; operate the private game; provide accessible written meaning for video and photos; enforce safety, moderation, and fair-play controls; answer support; protect the service; and carry out deletion. The pilot runs no advertising, analytics, telemetry, or cross-app tracking. Participant content is not used for model training.
4. Who can access information
- The participant and their Tagmate can access the identity, terms, state, and authorized content needed for the game they share. Blocking, quarantine, removal, or account deletion can stop that access.
- The operator can access bounded report and moderation records and content attached to a case. GymTag does not proactively inspect every video. Ordinary private video is not sent to an outside artificial-intelligence moderation service.
- Service providers process information only to provide their named function: Supabase for authentication, database, and private media storage; Render for API, worker, and operator-console hosting; Resend for sign-in and friend-invitation email; ImprovMX plus Gmail/Google for support correspondence; and, if you enable reminders, Expo Push Service, Apple Push Notification service, and Google Firebase Cloud Messaging for notification delivery.
- Anyone with a Tag link can see that link’s page while it is open: the sender’s display name and the challenge, and the sender’s callout only if they chose to show it (section 6).
Kahlil remains responsible for limiting each provider's access and instructions to the stated service purpose. Each provider also publishes its own privacy and security terms. Information may be preserved or disclosed when required by a valid legal obligation. An evidence hold removes participant playback access; it does not make the content public.
Reminders use generic text and opaque navigation identifiers. They do not send your Tagmate’s name, workout details, scores, photos, or videos in the notification payload. Delivery providers receive the device token and notification payload needed to route the alert. Opening an alert requires current account authorization before the app opens the Tag or Match.
5. Photos, video, text, and moderation
Profile names, custom titles, and signatures pass the same text safety filter. Before uploading a profile photo, confirm that you own it or have permission to share it, that recognizable people consented, and that it follows the community rules. Image-format validation does not determine whether every picture follows those rules. Use the report or block controls for that Tagmate, or contact support about an inappropriate profile.
Participants must follow the community rules for photos, video, summaries, terms, and reports. Participants accept the current rules for photos and videos once for their account, and again when those rules change. For every photo or video, they must have ownership or permission to share it, recording or photo consent for recognizable people, and permission to record at the facility; it must contain no prohibited content. Before participant-written terms, summaries, counters, proof alternatives, dispute clarifications, retry adjustments, or notes sent with Respect become visible to a Tagmate, GymTag runs the same deterministic safety filter; rejected output carries only a bounded category and never the submitted text.
Photos and videos remain private to the two Tagmates unless access is needed for a report or legal obligation, or the sender chooses to show a callout on a Tag link (section 6). GymTag does not proactively inspect every photo or video or send ordinary private media to an outside artificial-intelligence moderation service. Each in-app report enters a durable operator case. Only content bound to that reported case can be opened or acted on there; the operator can quarantine it, place it under an evidence hold, release it, and resolve the report. These controls do not guarantee Apple approval; App Review decisions remain Apple's.
6. Tag links
When you send a Tag to a friend who isn’t on GymTag yet, GymTag makes a one-use link that lasts up to 7 days. The link’s page shows your display name and the challenge to whoever has the link. It shows your callout photo or video, and its words, only if you choose to show it when you text the Tag. You can hide it from Home at any time. The page shows a callout video without its location or other camera details. Your callout leaves the page when the link ends: when your friend joins, when you cancel it, or after 7 days. Link pages are not indexed by search engines, and the preview a messaging app shows uses GymTag’s own image and short film, never your callout. To report a link page, use Report this page on it or email safety@playgymtag.fit.
7. Retention
- Participant media remains while its owner's account is active unless the owner removes it. Removal immediately stops Tagmate access.
- Confirmed account deletion immediately blocks product access and Tagmate media playback. Active media is scheduled to clear within 30 days and backups within 90 days.
- Replacing or removing a profile photo removes the previous photo from the active database. Confirmed account deletion removes the active profile photo, signature, frame, and title immediately. Provider backups follow the 90-day schedule above.
- Report evidence and closed report or support correspondence may remain for up to 180 days after closure.
- Reminder registrations are removed when the server receives an unregister request or account deletion. They expire after 30 days without renewal and are scheduled for worker cleanup. Closed notification delivery records are scheduled for removal after 7 days. Provider backups follow the schedule above.
- Operational logs target deletion after 30 days.
- Minimal gameplay results, policy and action audit records, and block-suppression records remain through the pilot and are scheduled for deletion within 180 days after the pilot ends.
A valid legal or evidence hold can delay deletion of the affected record. Held media is not available to the Tagmate. Account deletion, report evidence expiry, and pilot-end game, audit, and block-suppression cleanup are worker-driven through durable claimed jobs. Provider-managed backup, hosting-log, and support-mail jobs remain visibly open and are never recorded complete merely because time passed; completion requires restricted operator evidence from the provider.
8. Account and content deletion
A participant can remove owned media where the app offers that control and can start permanent account deletion at Account → Delete account. Confirmation raises an immediate API barrier, ends unresolved play without a Letter, winner, Completion point, or belt transfer, vacates a belt held by the deleting participant, and stops their Tagmates from playing that participant's media.
The active-store process removes media and clears the participant's display name and handle. The profile photo, signature, frame, and title are removed when the deletion barrier is raised. A Tagmate may retain a minimal completed result identified only as involving a former player. Keyed block-suppression digests remain for the retention period above so deletion and recreation cannot defeat a block.
Provider authentication cleanup is a distinct deletion stage. The server revokes Supabase sessions and replaces the Auth email with a non-contactable deletion address before the request can report active-store completion. The app reports deletion stages rather than claiming that every backup or held copy is gone early.
9. Choices and requests
Participants can decline before acceptance, use Safety Exit after acceptance, report, block, remove eligible owned media, sign out, and initiate account deletion. For access, correction, appeal, takedown, privacy, or deletion questions, email safety@playgymtag.fit. Include an in-app identifier when useful, but do not email passwords, one-time codes, or photo or video files.
Turn and deadline reminders can be enabled independently in Profile → Settings, and notification permission can be revoked in your phone settings. Sign-out attempts to unregister the phone and clears displayed notifications. While offline, the app cannot immediately revoke remote registration; it saves a cleanup request for the next connection. A notification already handed to a delivery provider cannot be recalled.
10. Security
GymTag uses HTTPS outside local development, provider authentication, server-side authorization, private media storage, restricted operator access, and lifecycle states that deny playback when media is quarantined, held, revoked, deletion-pending, or deleted. Mobile clients do not receive database or private-storage administrative credentials. No storage or transmission method can be guaranteed completely secure.
11. Policy changes
This policy may change as the pilot changes. When an updated rule or acknowledgement is required for gameplay, GymTag's versioned policy controls require the current version before further scoring actions.
12. Contact
Operator and controller: Kahlil Padgham, operating personally in the United States.
Privacy, safety, and support: safety@playgymtag.fit.