Privacy policy

Who we are

Gymist Ltd (company number 13669059) is the data controller for everything described here. Write to us at our registered office, 17 Sibella Road, London SW4 6JA, or email privacy@gymist.co.uk. The contact form reaches the same people.

What we collect when you are just looking

Nothing that identifies you, unless you agree to it. There are no third-party embeds and no social media widgets on our pages, and our typefaces come from our own servers. Our hosting provider keeps short-lived technical logs of requests, including IP addresses, which is what makes it possible to keep the site up and to deal with abuse.

We ask you two separate questions on your first visit. Analytics lets Google Analytics record which pages you visited, roughly where in the country you were, and what kind of device you used. Advertising lets Google Ads tell that somebody who clicked one of our adverts arrived here. Agreeing to one is not agreeing to the other, and you can change either at any time.

If you refuse, Google’s tag still loads but is instructed to store nothing on your device — no identifier, and no way to connect this visit to your last one. Google still receives the fact that a page was viewed. Our cookie policy names every cookie involved and explains that in full.

What we collect when you have an account

Signing in is by emailed link, so we hold your email address and no password. Everything else is something you chose to add:

• A display name, which is how you appear to other people. It does not have to be your real name.
• Your date of birth.It is never displayed. If you switch on an age band, other members see something like “30s” — never the date.
• A short bio and a profile photo, if you want them.
• Your gender, if you choose to give it. It is hidden unless you switch it on, it is never shown to logged-out visitors at all, and nobody can filter or search for people by it.
• Your home area and home gym, and what and when you train — activities, goals, experience, the days and times you are usually free.

Why we are careful with that last part

Taken together, a home gym and a set of usual training times describe where a person is, alone, at predictable hours. That is worth more care than a list of interests, and it is the reason for two decisions that might otherwise look arbitrary:

• You have to be signed in to search for members at all. An individual profile being visible is one thing; being a row in a list a stranger can filter by area, availability and age band is a different thing, and it is not available to anyone without an account.
• Profiles are hidden from logged-out visitors by default. If you have not turned that on, someone who is not signed in sees “Member” and a generated pattern in place of your name and photo — not a blurred version of them, but genuinely nothing, decided before the page is built rather than hidden by styling.

Member profile pages are also excluded from search engines whether or not you have made yours public. Choosing to appear beside your reviews is not the same as asking for a page about yourself to appear in Google.

What you publish, and who can see it

Some things you write are public to anyone on the internet, and some are only visible to signed-in members. The difference matters, so it is spelled out beside the button every time — but in summary:

• Reviews and articles are public, with your display name attached, and can be found by search engines.
• Group posts, comments and gym wall posts are for signed-in members, and the images in them are served through short-lived private links rather than published to the open web.
• Joining a group or a gym makes you visible to signed-in members as one of its members.
• Suggesting a gym, or claiming one, sends what you submit to us for review, along with who sent it.

Connections and messages

A connection request can carry a short message, and that is the only way somebody you have not connected with can reach you — messaging itself is closed until a connection is accepted. Messages and their attachments are stored so they can be delivered and read, and attachments are never published to the open web.

We do not read your messages as a matter of course. We can access them when we have to: to investigate something reported to us, to deal with a safety problem, or where the law requires it.

Blocking someone is invisible to them. If you block a member, they are not told, and nothing on the site indicates it.

Email we send you

Sign-in links, notifications about things that happen to you on the site, and — if you want it — a digest summarising them. Every one of those is a switch you control, the digest can be set to off entirely, and every message carries a one-click unsubscribe that works without signing in. We do not send marketing email.

Why we are allowed to hold it

• Because you asked us to run the service — your account, your profile, your connections, your messages, the email that makes those work. Without this information there is no service to provide.
• Because you consented — analytics, advertising measurement, and showing your gender or age band to other members. Consent you can withdraw, and withdrawing it is as easy as giving it.
• Because it is in our legitimate interests — keeping the platform safe, dealing with spam and abuse, investigating reports, and keeping the site working. We use the least information that does the job.
• Because the law requires it — responding to a valid legal request, and keeping records we are obliged to keep.

Your gender is special category data under UK GDPR where it relates to gender identity. We ask for it only because it matters to some people choosing who to train with, it is optional, it is hidden by default, and the lawful basis for showing it is your explicit consent.

Who else handles it

We do not sell personal information and we do not share it for anyone else’s marketing. These companies process it on our instructions, to run the site:

• Supabase — our database, sign-in and file storage. Our data is held in their London region.
• Vercel — hosting. This is what actually serves the pages you are reading.
• Resend — sending the emails described above.
• Google — Analytics, and Google Ads, each only if you have agreed to that one. Nothing you write on Gymist is used to target adverts at you.

The servers that build and serve these pages run in Vercel’s London region, and our database is in Supabase’s London region, so the day-to-day handling of your information happens in the UK. Supabase, Vercel, Resend and Google are all United States companies though, and some processing — platform operations, support, logging — can still happen outside the UK. Where it does, we rely on the safeguards in each provider’s data processing terms, including the UK addendum to the standard contractual clauses.

We may also disclose information where we are legally required to, or where it is necessary to protect somebody’s safety.

How long we keep it

Your account and everything in it stays while your account is open. When you close it, the section below is exactly what happens. Reports made about behaviour on the platform outlive the account they concern, because a safety record that disappears when somebody deletes and re-registers is not a safety record.

Analytics and advertising measurement data is held by Google under the retention settings on our properties, and is not linked to your account.

Getting a copy, and deleting your account

You can download everything we hold about you from your account settings, as a file, without asking us.

Deleting your account does all of this, in one go:

• Your name, bio, photo, date of birth, gender, home area and home gym are erased.
• The text of your reviews, group posts, comments and messages is removed. Other people keep the shape of a conversation they took part in, not its content.
• Star ratings you left stay, as numbers with nobody attached, so gym scores do not silently change.
• Your sign-in account is deleted, and everything hanging off it — interests, saved gyms, connections, notifications, uploaded files — goes with it.

What survives is what has to: reports made about you, and anonymous numbers that no longer point at a person.

Your rights

Under UK data protection law you can ask us for a copy of your information, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, object to us using it, and ask us to hand it to you or to somebody else in a portable form. Where we are relying on your consent, you can withdraw it.

There is no charge, and we will answer within one month. Email privacy@gymist.co.uk.

Under 16s

Gymist is for people aged 16 and over. It is not designed for younger children and we do not knowingly hold information about them. If you believe someone under 16 has an account, tell us and we will remove it.

Automated decisions

We do not make decisions about you by automated means that have a legal or similarly significant effect. Buddy search ranks people by the filters you chose; it does not decide anything about you.

Changes and complaints

When this policy changes we update the date below, and if the change affects something you consented to we ask you again rather than treating your old answer as covering it.

If you are unhappy with how we have handled your information, please tell us first — but you can complain to the Information Commissioner’s Office at any time. Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, 0303 123 1113, ico.org.uk.

Last updated: 29 August 2026