App privacy policy

The “Gym141” member app for Android and iOS is provided, and the gym141.com platform is operated, by:

For privacy questions about the app, please contact us at this email address. For data held by your club, your club is the right point of contact (see section 2). Your club's website and administration are covered by the club's own privacy policy.

The app is your personal tool: you connect it to one or more clubs that use Gym141 to manage their members. This results in three roles:

• The app on your device – DevWorld LLC as provider. Whatever the app stores locally (section 4) stays on your device and under your control. DevWorld LLC provides the app but does not receive this data and has no access to it.
• Your club – controller. For all data held by the club – your member details, your membership fee, events and your RSVPs, and any weight and workout data you have chosen to share – the respective club is the controller within the meaning of Art. 4(7) GDPR. The purposes for which the club processes this data and how long it keeps it are set out in your club's privacy policy.
• The gym141.com platform – DevWorld LLC as processor. If your club uses the hosted edition of Gym141 (addresses such as club.gym141.com, gym141.com/club or the club's own domain on the platform), DevWorld LLC operates the servers and processes the club data on behalf of the club (Art. 28 GDPR), only on the club's instructions; the club remains the controller (section 9). If a club runs Gym141 on its own server, DevWorld LLC is not involved – the app then talks exclusively to the club's server.

• No DevWorld account. You do not need an account with us to use the app. You sign in directly with your club – using the login for the members' area of the club website or an invitation from the club. The app can also be used without any club; everything then stays on your device.
• No ads, no tracking. The app contains no advertising and no analytics, statistics or tracking tools, sends no crash reports to us or to third parties and does not use an advertising ID.
• No sharing for advertising. We do not sell data and do not share it with third parties for advertising or marketing purposes.
• No automated decisions. There is no profiling and no automated decision-making within the meaning of Art. 22 GDPR.

Google (Play Store) and Apple (App Store) process data under their own responsibility when you download the app and – depending on your device settings – for their own diagnostics and crash statistics; their privacy policies apply to this.

The app stores the following on your device, in the app's protected data area:

• Profile: name, address, phone number, email address and, where applicable, date of birth, gender, membership number and joining date – entered by you or taken over from your club.
• Weight history: date, time, weight and your note for each measurement.
• Workouts: type, title, exercise, note, start time, duration and distance; also the heart rate curve (from the connected sensor), the GPS track (position, altitude, accuracy, speed) and the name of the sensor used. While a recording is running, the app regularly saves an interim state so that nothing is lost after an interruption; it is deleted once the workout is saved or discarded.
• Copies of your club data for offline use: member details, fee (plan, interval, amount, outstanding amount), events including RSVPs, the club's name and logo, and changes not yet transmitted.
• Access key (token) per club in the operating system's secure storage (Android: encrypted via the Android Keystore; iOS: Keychain). The app does not store your password.
• Settings: the most recently connected heart rate sensor (identifier and name), whether the screen should stay on during a recording and – only if you enter one – your own key for the Geoapify map service.

This processing takes place exclusively on your device and serves only you; DevWorld LLC does not receive the data. It is sent to a club only in the cases described in sections 5 and 6.

Device backup: If you have enabled backups on your device (e.g. Android backup to Google Drive or iCloud Backup), the app data may be included in that backup. This depends on your device settings and the terms of the respective provider.

The app communicates directly with your club's server over an encrypted connection (HTTPS). The following data is transmitted:

• Sign-in: the email address and password of your member login – or the code of an invitation from your club (QR code or link, valid for 10 minutes, single use) – as well as a device label such as “Gym141-App (Android)”. The club then issues an access key; the server stores only a check value (hash) of this key together with the device label and the times it was created and last used. Failed sign-in attempts are recorded by the server to protect against password guessing (section 9).
• Sync: the app retrieves your member details, your fee information, the club's name and logo and – if the club offers them – events.
• Your changes: changes to your address, phone number and email address made in the app are sent to the club (without an internet connection, at the next sync). Name, date of birth and fee can only be changed by the club. A password for the club website set in the app is also sent to the club.
• Events: your RSVPs (attending / not attending) are sent to the club. For events with RSVP, the other members of the club can see who has accepted or declined – shown with first name and the initial of the last name (e.g. “Anna B.”). Likewise, the app shows you the responses of the others.
• Removing a club: the app signs out from the club and the access key becomes invalid there (if a connection is available).

The club processes this data as controller, usually to administer your membership (Art. 6(1)(b) GDPR). For details, please refer to your club's privacy policy.

Your weight history and workouts stay on your device unless you choose to share them. In the app under Club → “Datenfreigaben” (data sharing) you decide per club, separately for weight and workouts. Both are switched off by default.

• Weight: when sharing is on, the weight history recorded in the app (date, time, weight, note) is sent to the club and kept in sync – new, changed and deleted entries are carried over. Measurements recorded by your coach at the club are not affected.
• Workouts: when sharing is on, your recorded workouts with duration, distance, heart rate curve, GPS track, title, note and sensor name are sent to the club and kept in sync in the same way, so that your coach can view them.

Legal basis is your consent given to the club (Art. 6(1)(a) and Art. 9(2)(a) GDPR), which you give by switching sharing on. Sharing is voluntary; it is not required for your membership or for using the app.

Withdrawal: you can switch sharing off at any time. The app then asks what should happen to the data already transmitted: “Beim Verein löschen” (delete at club) – the app has the data it transmitted deleted at the club – or “Behalten” (keep) – the data transmitted so far remains with the club, and nothing new is sent. If deletion is not possible at that moment (e.g. without an internet connection), the app tells you; please try again later or contact your club. Withdrawal takes effect for the future; processing carried out until then remains lawful (Art. 7(3) GDPR).

The app only asks for a permission when you use the related feature. All permissions are optional and can be revoked at any time in your system settings; the other features remain available.

Maps

Only when you open a saved workout with a GPS track does the app show a map. The map library is included in the app; only the map tiles (map images) are loaded by your device directly from one of these providers:

• OpenStreetMap (tile.openstreetmap.org, OpenStreetMap Foundation, United Kingdom) – map tiles, if you have not entered your own Geoapify key. Privacy policy
• Geoapify (maps.geoapify.com) – map tiles only if you have entered your own Geoapify key in the app; this key is then transmitted as well. Privacy policy

The respective provider receives your IP address, technical information about your device and browser component, and the requested map sections – from which the area of your route can be recognised. The GPS track itself, your heart rate and your name are not transmitted. The legal basis is our legitimate interest in displaying the map you requested (Art. 6(1)(f) GDPR). The European Commission has adopted an adequacy decision for the United Kingdom. If you do not open a workout with a track, nothing is transmitted.

Export

You can export a workout as a TCX or GPX file. This only happens when you choose to, via the system “Share” dialog; the app briefly places the file in its cache for this. You choose the recipient yourself (e.g. a training platform, email or a folder) – the recipient processes the data under its own responsibility.

Links

Links in the app – for example to this privacy policy – open your browser. The gym141.com server keeps no access logs of these visits (section 9).

If your club is hosted on gym141.com, DevWorld LLC processes the club data on the server on behalf of the club (Art. 28 GDPR); the club remains the controller.

• Hosting: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany – data centre in Falkenstein (Germany). Hetzner is engaged as a sub-processor.
• Separate databases: each club has its own database; clubs cannot see other clubs' data.
• No access logs: the server does not log your requests. Your IP address is processed only for the duration of the connection. There are only technical operating and error logs of the application, and these contain no IP addresses.
• Protection against sign-in attempts: if a sign-in fails (in the app, with an invitation or in the members' area of the website), the server stores the IP address, the email address entered (for invitations only the note “invitation”) and the time in the club's database. After 10 failed attempts within 15 minutes, sign-in from that IP address is temporarily blocked. A successful sign-in from the same IP address deletes these entries immediately; entries older than 24 hours are deleted automatically at the next failed sign-in attempt at the same club. The purpose is to protect accounts against password guessing (Art. 6(1)(f) GDPR).
• No own use: DevWorld LLC does not use the clubs' data for its own purposes and does not pass it on.

• On your device: until you delete the data in the app (e.g. a measurement or a workout) or uninstall the app – the operating system then removes the app data. On iOS, Keychain entries may survive an uninstall for technical reasons; it is therefore best to remove your clubs in the app first.
• Removing a club: deletes the local copies for that club (member details, fee, events, logo) and the access key, and ends access at the club. Your own profile, weight history and workouts remain in the app. Data you have already shared with the club is not deleted automatically – switch sharing off with “Beim Verein löschen” (delete at club) beforehand or contact the club.
• At the club: the club decides how long it keeps data (e.g. for the duration of the membership and statutory retention periods). Please contact your club about this. If a club stops using gym141.com, DevWorld LLC deletes its data as instructed by the club.

• All connections to clubs are encrypted via HTTPS.
• Access keys are kept in the device's secure storage; the server stores only a check value (hash) of them. Your password is not stored in the app.
• Access can be ended at any time – by removing the club in the app or by the club.
• Your local data is only as safe as your device: use a screen lock and keep your operating system up to date.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21), as well as the right to withdraw consent or sharing at any time with effect for the future (Art. 7(3)).

• Data in the app can be viewed, changed, deleted and exported as TCX/GPX by you at any time.
• Data held by the club: please contact your club as the controller. If you write to us, we will forward your request to the club without delay and support the club in handling it.
• Questions about the app: office@devworld-llc.com.

Many clubs have members under the age of 18. The app does not ask for your age; access is granted by the club.

We recommend that parents set up sharing together with their child. Parents or legal guardians can exercise the rights set out in section 12 on behalf of their child.

In addition to the Gym141 app, there are club apps with their own name and design, currently “Novo Athletics” (novoathletics.at) and “ATUS Weiz” (atus-weiz.at). They are based on the same technology; this privacy policy applies to them unchanged.

The only difference: the club is fixed. The app connects only to that club's server; no other club can be added. The controller for the club data is that club. DevWorld LLC is the provider of the app and – if the club is hosted on gym141.com – processes the club data on the platform on behalf of the club.

We update this policy when the app or the legal situation changes. The version published here applies – you will always find the current version at this address; the date at the top shows when it was last updated.