GymSteps privacy policy

Effective October 21, 2026. GymSteps is operated by Gymnastics Technology Partners (“GymTech”, “we”). This policy explains what the GymSteps iPhone and Android apps, this website, and their supporting services collect, how it is used, and the choices you have. Questions: support@gymsteps.app.

Who can use GymSteps

GymSteps is for people aged 13 and older. It is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child under 13 has created an account, contact us and we will delete it.

Steps, Apple Health, and Health Connect

With your permission, GymSteps reads step totals from Apple Health on iPhone or Health Connect on Android. It never writes to or changes Health records. Step totals are cached on your phone so the app opens quickly and works offline.

Your steps leave your phone only for teams where step sharing is on or when you separately opt into the Everyone leaderboard. Creating or joining a team starts sharing under the leaderboard name you choose; the app asks for a name first and you can defer it. While sharing is on, GymSteps uploads your step total for each day to that team’s standings and keeps it up to date throughout the day. Only step counts are shared; other health data isn’t.

We use health data only to show your progress and run your team and optional Everyone competitions. We never use it for advertising, marketing, or data mining; never sell it; never share it with data brokers; and never include it in iCloud or Android cloud backups. Service providers below process shared daily totals only to operate GymSteps on our behalf.

Account preferences and recovery

When signed in on an updated app, your daily step goal and Appearance choice are privately saved with your GymSteps account, along with change revisions used to prevent conflicting edits. They are restored after login, reinstall or device loss and retained until account deletion. Signed-in teams, names, sharing choices and blocks are already stored with your account. Unsynced local team drafts stay on their original device. Health permissions, background-read settings, and cached personal Health readings stay on each device; cloud preferences do not grant Health access or turn sharing on.

Using multiple devices

Updated apps register a random installation identifier, the platform (iPhone or Android), its sign-in session, whether steps are connected, and registration and sync times. We use this private, account-linked information to select one source for shared steps and prevent conflicting uploads. It is not shown to other participants or used for tracking or advertising. Two registered updated devices enable source selection automatically; you can also select a source in You. Other updated devices can view standings and explicitly take over. After activation, older app versions must update to manage sources and cannot upload steps. Switching replaces today’s shared totals without adding device totals together; earlier days are kept. You can review step devices and signed-in sessions, remove an old step device without signing it out, or sign out an unwanted session separately. Signing out also removes its linked step registration. A removed registration and its removed session identifiers are retained privately until account deletion to prevent automatic re-registration by that session; a fresh sign-in can reconnect the installation. Existing teams and shared scores are kept. Session activity is retrieved from our authentication provider when you open device management.

Optional Everyone leaderboard and state

Everyone is a separate opt-in for signed-in users. Before joining, you choose a public display name and a US state (or Washington, DC), and agree to share this week’s available daily step totals and future totals. Other signed-in users can see your chosen name, state, daily and weekly totals, rank, and update time. The national map combines these totals by state. Days run midnight–midnight and weeks run Monday–Sunday in each participant’s local time zone. The app sends the device’s time-zone identifier to calculate those calendar periods; it is not shown publicly. Older app versions retain UTC totals until updated. Team sharing does not enroll you in Everyone.

You can select your state manually without location permission. If you press the optional locate button, GymSteps requests approximate location once and matches a state on your phone. Coordinates are never sent to our servers, saved by GymSteps, used in the background, or tracked. Only the state you confirm is saved. A state you select is public profile information linked to your account.

Leaving Everyone deletes your Everyone profile and daily totals when the server receives the request. Offline withdrawal pauses Everyone uploads on that device and retries removal when connected; your server profile can remain visible until removal succeeds. Everyone totals from earlier weeks are deleted at your next Everyone upload. Blocking applies to Everyone results too; downloaded results can remain until refresh. Use a person’s menu to block them or report an offensive name, or contact support@gymsteps.app. Account deletion also deletes your Everyone profile and totals.

What we collect

Account information: your email address, the name you provide, and identifiers from Apple or Google if you choose one of those sign-in options.
Account preferences: your daily goal, Appearance choice and change revisions.
Team information: team names, badges, memberships, leaderboard and roster names, sharing choices, invitations, and the people you block.
Everyone profile: if you opt in, your chosen public name, state, participation choice, device time-zone identifier and a public pseudonym.
Shared step totals: daily totals for teams where sharing is on and for Everyone if you opt in, with the time each total was observed.
Reports: when you report a team or member, the reason, details you enter, and the reported name.
Invitation emails: when an owner emails an invitation, a one-way hash of the recipient address, sender and team identifiers, and send status.
Account security: our authentication provider receives a device identifier (including the iPhone vendor identifier or an Android SDK device identifier), along with device, operating-system, and app metadata, to authenticate sign-ins, manage sessions, and prevent abuse. These identifiers are not used for advertising or cross-app tracking.
Operational data: our providers keep limited request logs, such as IP addresses and timestamps, to run, secure, and troubleshoot the service.

GymSteps has no advertising, does not track you across other companies’ apps or websites, and includes no third-party analytics.

Who can see your information

Members of a team can see its name, its roster names, and the leaderboard name, daily and weekly step totals, rank, and update time of each person sharing with that team. A person you block cannot receive your step results in any team; results they already downloaded may remain until their app refreshes. Membership and roster names are not hidden by a block. Team owners can remove members and reset invitations. We do not show your email address or sign-in account name to other members. Everyone uses the public name and state you explicitly choose.

Service providers

We use Clerk for sign-in and accounts, Supabase for our team and competition database, Vercel for this website and email endpoints, and Postmark to deliver account emails, team invitations, and reports to our support team. Apple and Google process sign-in when you choose them. These providers process information only to provide their services to us. Email open and link tracking are turned off.

How long we keep information

Account and team information is kept while your account exists.
Shared daily totals are kept for up to one year so you and your team can compare monthly and yearly results; older totals are deleted automatically when the team next syncs. Totals are deleted immediately when you stop sharing with a team, leave it, are removed, or the team is deleted.
Invitation email records are deleted after 30 days, when that sender next sends an invitation, or when the team is deleted.
Reports are kept for up to one year so we can handle repeated abuse.
Step totals cached on your phone stay until you clear them in the app or delete the app.
Provider logs and backups expire on those providers’ schedules.

Deleting your account

In the app, go to You → Delete account. This immediately and permanently deletes your GymSteps account and everything our servers hold about you: memberships, Everyone profile, shared step totals, blocks you made or that name you, invitation records, and reports you filed or that name you. Teams you own pass to the longest-standing remaining member; teams with no other members are deleted. Apple Health and Health Connect records are never affected. If you signed in with Apple, you can also stop using Apple sign-in with GymSteps: open iOS Settings, tap your name, find Sign in with Apple, and remove GymSteps. If you cannot use the app, email us and we will delete your account after verifying you own it.

Your choices and rights

You can use personal step tracking without an account. In the app you can sign out, stop sharing, leave teams, block or unblock people, report content, clear cached totals, and delete your account. Manage steps access in the Health app on iPhone or Health Connect on Android. Background step reads on Android need a separate optional permission, which you can turn off in GymSteps or Health Connect. Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, or to object to its processing. Email us to make a request; we may need to verify your identity first. We do not sell or share personal information for cross-context behavioral advertising.

Security

Information is encrypted in transit. Server access is restricted by account, so teammates receive only the results described above. No system is perfectly secure, so please contact us if you believe your account has been compromised.

Changes

We will update this page when our practices change and revise the effective date. We will notify you in the app before a material change applies to information we already hold.