Legal

Privacy Policy

Last updated 23 August 2026

This policy covers the HypertrophyHQ mobile app and the HypertrophyHQ website. HypertrophyHQ is a gym in Enniskillen, Northern Ireland, and is the data controller for everything described here. If you want to talk to a person about any of it, the contact details are at the bottom.

What we collect, and why

Name and email address

Your account. Email is how you sign in and how we send you receipts, password resets and anything we have to tell you about your membership.

Date of birth

Asked once, because some equipment and some classes have an age rule and our insurance requires us to know. You type it in the app and it goes to our server; the app never receives it back, so it is not stored on your phone.

Your location, when you tap Unlock

A single location reading at the moment you tap the button, to confirm you are actually standing at the gym. See the section below - this one deserves its own explanation.

Your training log

Workouts, sets, weights, reps, your programs, session notes and exercise notes. This is the point of the app.

Body weight and weight goals

Only if you choose to use the weight tracker. You enter it yourself; we do not read it from Apple Health, Google Fit, a scale or any other app.

Your visits

The date and time the door opened for you, and whether it refused. It is how we know the gym is being used and how we spot a membership that is not working.

Membership and payment records

What you pay, when, on what plan, and whether a payment failed. We are required to keep financial records for tax purposes.

A notification token

If you allow notifications, your phone gives us an anonymous token so we can send you one. It is not a phone number and it cannot be used to identify you anywhere else.

What we do not collect

• No analytics or tracking of any kind. There is no analytics SDK, no crash reporting service, no advertising identifier and no tracking across other apps or websites in the mobile app.
• No card or bank details. The app never sees them. Payments are taken on our website by Stripe, and Stripe holds the card or Direct Debit mandate - we only ever see the amount, the date and whether it worked.
• No camera, photos, contacts or microphone. The app asks for none of these permissions. Your check-in QR code is drawn on your screen; the scanner is the reader on the gym's desk.
• No health app data. We do not connect to Apple Health or Google Fit and we do not read anything from them.
• No phone number. There is no field for one in the app.

Your location, in full

This is the permission people ask about, so here is exactly what happens - every step, including the part that is easy to leave out.

• Your location is read only when you tap Unlock. Never in the background, never while the app is closed, never on a schedule. The app does not have background location permission at all, so it could not do this even if it tried.
• It is one reading, at normal accuracy rather than the highest available, and the app gives up after five seconds.
• That reading is sent to our server, which checks whether you are within 150 metres of the gym.
• It is then passed to Kisi, the company that makes the door lock, because their system performs the same check independently before it will release the lock. The door cannot be opened without this.
• The coordinates are never saved. Once the check is done, all that is written down is the date, the time, and a yes/no for whether the location check passed. Where you were is not stored, and we could not tell you where you were last Tuesday because we do not have it.

Who else sees it

We do not sell your data and we do not share it for anyone else's marketing. These are the companies that process it on our behalf so the system can work at all:

Supabase

Hosts our database and handles sign-in. Servers in Ireland. Holds your account, membership, training log and visits.

PowerSync

Keeps your training log in step between your phone and the database so the app works with no signal.

Kisi

The door access system. Receives the location reading described above at the moment you unlock, and records that the door opened.

Stripe

Takes the payments. Holds your card details or Direct Debit mandate - we never do.

Expo

Delivers push notifications to your phone. Sees the notification token and the text of the message.

Resend

Sends our emails - receipts, password resets, membership notices.

Vercel

Hosts the website and the app's API.

We will also hand over information if the law requires it, and we would tell you unless we were legally prevented from doing so.

Notifications

If you allow them, the app sends you exactly one kind of notification: a message telling you a membership payment has failed and the door will not open until it is sorted. There is no marketing and there are no other notification types. Because it appears on your lock screen, anyone holding your phone could see that a payment failed - not the amount, and not any card details. You can turn notifications off in your phone's settings at any time and everything else keeps working.

Where it is kept, and for how long

Our database is hosted in Ireland. Your training log is also stored on your own phone so the app works without a signal.

• Your account and training data are kept while you have an account, and deleted when you delete it.
• Payment records are kept for six years after the payment, because tax law requires it. When you delete your account these records stay but your name is removed from them - what is left is an amount and a date attached to nobody.
• Door and visit records are deleted with your account.
• On your phone, signing out stops the app syncing but leaves your training log in the app's storage so nothing unsaved is lost. Deleting your account, or uninstalling the app, removes it. If you are handing the phone on to somebody else, uninstall the app.

Your rights

Under UK GDPR you can ask us for a copy of what we hold about you, ask us to correct it, ask us to delete it, object to how we use it, or ask us to restrict it. Ask by email and we will answer within one month.

Deleting your account

You can do this yourself, without asking anyone. Open your profile on the website, or Profile in the app, and choose Delete my account. It cancels any membership you are paying for and removes your account, your training log, your body weight entries, your notes and your visit history. Payment records are kept with your name stripped out, as described above. It cannot be undone.

The lawful bases we rely on are: contract for your membership, your payments and door access; legitimate interests for keeping the building secure and the gym running; consent for location and notifications, both of which you can withdraw in your phone's settings; and legal obligation for financial records.

If you think we have handled your data badly, please tell us first - but you have the right to complain to the Information Commissioner's Office at ico.org.uk.

Children

The app is not intended for under-16s, and we ask for a date of birth partly so we know. A membership for someone under 16 is arranged with a parent or guardian at the desk. If you believe a child has created an account, email us and we will remove it.

Changes to this policy

If we change what we collect or who we share it with, we will update this page and change the date at the top. If the change is significant we will tell members by email rather than rely on you re-reading it.

Contact us

HypertrophyHQ, 1B Blackstick Road, Enniskillen, BT74 4EJ.

• Email hypertrophyhq26@gmail.com
• Phone 07514071433