This Privacy Policy explains how Gurnser Limited ("we", "us", "our"), the company behind the Gymzer app, collects, uses, stores, and shares your personal information when you use our mobile application and related services (collectively, the "Service"). By using Gymzer, you agree to the practices described in this policy.
Gurnser Limited is a New Zealand registered company that operates the Gymzer mobile application. Gymzer connects gym-goers with compatible workout partners, allows users to share fitness content (posts, lifts, personal records), discover nearby gyms, and communicate via in-app chat.
For questions about this Privacy Policy, please contact us using the details in Section 14.
We collect information you provide directly, information generated by your use of the Service, and information from third-party services you connect.
When you create an account, we collect:
When you log lifts or posts, we collect:
We collect your precise GPS location (latitude and longitude) when you:
Location data is collected only in the foreground when you actively trigger these features. We do not track your location in the background. Your precise coordinates are temporarily stored in our matchmaking queue (see Section 4) while a search is active and are deleted when the match is found or when you leave the queue.
When you search for workout partners, we temporarily store:
When you subscribe to Gymzer Premium, we store:
| Purpose | Data Used | Legal Basis |
|---|---|---|
| Creating and managing your account | Name, email, username, age, gender, profile photo, fitness level, location | Contractual necessity |
| Displaying your profile to other users | Username, name, bio, photo, fitness level, privacy setting, posts, lifts, PRs | Contractual necessity / Legitimate interest |
| Matchmaking – finding workout partners | Gender, age, location (GPS), preferences, gym selections, fitness level | Contractual necessity |
| Gym discovery | GPS location (sent to Google Maps API) | Contractual necessity |
| In-app messaging | User ID, name, profile photo, chat messages | Contractual necessity |
| Personalised matching filters (Premium) | Age range preference, partner gender preference | Contractual necessity / Consent (opt-in subscription) |
| Subscription management | User ID, transaction IDs, subscription status | Contractual necessity |
| Safety – blocking and reporting | Block lists, user IDs | Legitimate interest |
| Rate limiting and abuse prevention | User ID, daily action counts | Legitimate interest |
| Audit and compliance | User ID, action type, timestamp (audit log) | Legal obligation / Legitimate interest |
| Improving the Service | Aggregated, anonymised usage data | Legitimate interest |
| Communicating with you | Email address | Contractual necessity / Legitimate interest |
We do not use your personal data for advertising, sell it to third parties, or use it for purposes incompatible with those described above.
We do not sell your personal data. We share your information only in the following circumstances:
Certain information is visible to other users of the app as part of the core features:
| Provider | Purpose | Data Shared | Location |
|---|---|---|---|
| Google Firebase (Firebase Authentication, Firestore, Cloud Functions, Firebase Storage) | Authentication, database, serverless backend, file storage | All profile and content data, authentication credentials, GPS coordinates during searches | USA (and regions per Google Cloud's infrastructure) |
| Google Maps Platform (Places API) | Gym discovery and location search | Latitude & longitude coordinates, search radius, gym name queries | USA |
| RevenueCat | In-app purchase management and subscription lifecycle | Firebase UID (as subscriber ID), purchase receipts, subscription events | USA |
| Cloudflare R2 | Media storage for images and videos | Uploaded photos and videos (posts, lifts, profile pictures) | Global CDN (data stored in Cloudflare's infrastructure) |
| Apple App Store / Google Play | In-app purchase processing | Purchase transactions (handled natively by device OS; we receive transaction IDs only) | Varies by store |
We may disclose your information if required to do so by law, court order, or governmental authority, or if we believe in good faith that such disclosure is necessary to protect the rights, property, or safety of Gymzer, our users, or the public.
If Gymzer is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your personal data is transferred and becomes subject to a different privacy policy.
| Data Type | Storage Location |
|---|---|
| User profiles, posts, lifts, comments, messages, matchmaking data, subscription records | Google Firestore (primary database) |
| Profile photos (older uploads), post and lift images (older uploads) | Google Firebase Storage |
| Profile photos (new uploads), post images, lift images, post videos, lift videos | Cloudflare R2 |
| Authentication credentials | Firebase Authentication |
| Subscription & purchase records | RevenueCat servers (external) |
Gymzer requests the following device permissions:
| Permission | Why We Need It |
|---|---|
| Location (Foreground) | To power radius-based matchmaking searches and to find nearby gyms. We do not access your location in the background. |
| Camera | To allow you to take photos or videos for your profile, posts, and lift records. |
| Photo Library / Media Library | To allow you to select existing photos and videos for upload. |
| File System (Android) | To read video files from your device for upload. |
You can revoke any of these permissions at any time through your device settings. Revoking location access will prevent matchmaking radius search and gym discovery features from working.
Gymzer is intended for users aged 18 and over. We do not knowingly collect personal information from individuals under the age of 18. If you become aware that a child under 18 has provided us with personal data, please contact us immediately. If we become aware that a child under 18 has registered, we will promptly delete their account and all associated data.
We take the security of your personal data seriously and implement appropriate technical and organisational measures, including:
However, no method of transmission or storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee its absolute security. Please notify us immediately if you believe your account has been compromised.
Depending on your location, you may have the following rights regarding your personal data:
| Right | Description | How to Exercise |
|---|---|---|
| Access | Request a copy of the personal data we hold about you | Contact us at the email in Section 14 |
| Correction | Request correction of inaccurate or incomplete data | Edit your profile in-app, or contact us |
| Erasure (Right to be Forgotten) | Request deletion of your personal data | Delete your account in-app (Settings → Delete Account) or contact us. This deletes your profile, posts, lifts, comments, chat messages, match history, personal records, and all media files. |
| Data Portability | Request your data in a structured, machine-readable format | Contact us at the email in Section 14 |
| Restriction of Processing | Request that we limit how we process your data in certain circumstances | Contact us at the email in Section 14 |
| Object to Processing | Object to processing based on legitimate interests | Contact us at the email in Section 14 |
| Withdraw Consent | Where processing is based on consent, you may withdraw it at any time | Contact us or delete your account |
When you delete your account, the following data is permanently deleted:
Note: Subscription and purchase records held by RevenueCat and Apple/Google are managed by those platforms respectively and may be retained by them independently of our deletion.
We will respond to all legitimate requests within 30 days (or as required by applicable law).
Our app integrates with third-party services whose privacy practices are governed by their own policies:
We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies.
Your personal data may be transferred to and processed in countries other than your country of residence, including the United States, where our primary service providers (Google Firebase, RevenueCat) are based. These countries may have different data protection laws than your home country.
When we transfer your data internationally, we rely on appropriate safeguards including standard contractual clauses, adequacy decisions, or other legally recognised transfer mechanisms.
We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the "Last updated" date at the top of this page. For material changes, we may also provide in-app notification. We encourage you to review this policy periodically. Your continued use of the Service after changes are posted constitutes your acceptance of the revised policy.
If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:
Gurnser Limited (trading as Gymzer)
11 Mary Street, Mt Eden, Auckland, New Zealand
Email: admin@gymzer.app
Gymzer is a product of Gurnser Limited | 11 Mary Street, Mt Eden, Auckland, New Zealand | admin@gymzer.app
© 2026 Gurnser Limited. All rights reserved.