Privacy Policy

LAST UPDATED: 1 January 2026

This Privacy Policy explains how CodeOps Ltd (operating GymTribe) (“we”, “us”, “our”) collects, uses and protects personal data when you use GymTribe(the “Service”) at https://thegymtribe.co.uk. We are a data controller in respect of the personal data described below and we process it in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003.

1. Data we collect

1.1 Information you provide

• ▸Account data: name, email address, profile picture and authentication details, provided via our identity provider (Clerk).
• ▸Health and fitness data: height, weight, ethnicity, fitness goal, experience level, training frequency and intensity.
• ▸Calculated metrics: BMI and ideal weight range derived from your height and weight.
• ▸Activity data: workout logs (including sets, reps and weights), meal logs (dish name, calories, protein, carbs, fats) and saved items.
• ▸Communications: any messages you send to us.

1.2 Data collected automatically

• ▸Technical data: IP address, browser type and version, device type, operating system, and approximate location derived from IP address.
• ▸Usage data: pages visited, features used, and interaction timestamps.
• ▸Cookies and similar technologies: see our Cookie Policy for details.

2. How we use your data

We use your personal data for the following purposes and legal bases:

• ▸To provide and operate the Service (performance of contract): authenticating you, generating workout programmes, logging workouts and meals, and showing progress and streaks.
• ▸To personalise the Service (legitimate interests / consent): tailoring quotes and programme recommendations to your activity.
• ▸To keep the Service secure (legitimate interests): fraud prevention, security monitoring and troubleshooting.
• ▸To comply with legal obligations: maintaining records where required by law.
• ▸With your consent: optional analytics and marketing cookies, and any communications you opt into.

3. Legal bases (UK GDPR)

Our legal bases for processing are:

• ▸Article 6(1)(b) — performance of a contract: providing the core Service features.
• ▸Article 6(1)(c) — legal obligation: retention and compliance.
• ▸Article 6(1)(f) — legitimate interests: security, service improvement and fraud prevention.
• ▸Article 6(1)(a) — consent: optional analytics/marketing cookies and non-essential communications.

Ethnicity is collected for health-assessment context as part of your athlete profile. Where this constitutes special-category data under Article 9 of the UK GDPR, we rely on your explicit consent (Article 9(2)(a)), which you may withdraw at any time by deleting or editing the field in your account settings or by deleting your account.

4. How we share your data

We do not sell your personal data. We share data only with:

• ▸Clerk (our identity provider) — authentication and account management.
• ▸Hosting and infrastructure providers — to run the Service.
• ▸Professional advisers and regulators — where required or permitted by law.
• ▸Any successor in the event of a merger, acquisition or reorganisation, subject to this policy.

Where we share data with processors, we do so under contracts that require them to protect your data to standards equivalent to the UK GDPR.

5. International transfers

Some of our processors (including Clerk and our hosting provider) may process data outside the UK. Where this occurs we rely on appropriate safeguards, including the UK International Data Transfer Agreement (IDTA) and adequacy regulations, to ensure your data is protected to UK standards. A copy of the relevant safeguards is available on request.

6. Retention

We retain your personal data only for as long as necessary:

• ▸Account and profile data: for as long as your account is active, and for a short period after deletion to meet legal obligations.
• ▸Logs and activity data: for as long as your account is active.
• ▸Technical and usage logs: up to 12 months.

You can delete your account at any time, which removes your profile, logs and saved items.

7. Your rights

Under the UK GDPR you have the right to:

• ▸Access: request a copy of the personal data we hold about you.
• ▸Rectification: correct inaccurate or incomplete data.
• ▸Erasure: request deletion of your data (the “right to be forgotten”).
• ▸Restriction: limit how we process your data in certain circumstances.
• ▸Data portability: receive your data in a structured, machine-readable format (available via the Export feature).
• ▸Object: object to processing based on legitimate interests or for direct marketing.
• ▸Withdraw consent: where processing is based on consent, at any time.
• ▸Complain: lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

If you are resident in California, the California Consumer Privacy Act (CCPA/CPRA) provides analogous rights, including the right to know, delete and opt out of the “sale” or “sharing” of personal information. We do not sell or share your personal information.

8. Children

The Service is not intended for children under 18 and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

9. Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit (TLS), encrypted storage, access controls and regular reviews of our security posture. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. Cookies

We use essential cookies to operate the Service (including Clerk session cookies) and, with your consent, optional categories. See our Cookie Policy and manage your choices on the Cookie Settings page.

11. Changes to this policy

We may update this policy from time to time. Material changes will be notified in-app or by email before they take effect. The “last updated” date at the top of this page reflects the latest revision.

12. Contact

For privacy enquiries, contact us at [email protected] or by post at the registered address of CodeOps Ltd (operating GymTribe). You may also contact our Data Protection enquiries channel at the same address. We aim to respond within 30 days.