Legal
Privacy Policy
This English version is a translation provided for convenience. The Turkish original is the legally binding text; in the event of any discrepancy, the Turkish version prevails.
This Privacy Policy explains how your personal data is collected, used, shared and protected in connection with the GymA mobile app, connected wearable device apps and the gyma.charqe.io website (the "Services") provided by Charqe Bilişim Teknolojileri Sanayi Ticaret Limited Şirketi ("Charqe", "we").
In short: We do not sell your data or share it for advertising. By default, your workout, nutrition and measurement data are visible only to you. What you share on the social side, however, is visible to other users unless you choose otherwise. Location sharing is off by default and works only when you turn it on. We never see your payment details.
1. Data We Collect
| Category | Examples | Source |
|---|---|---|
| Account information | Email address, full name, password (stored in irreversibly hashed form), email verification record | From you, during registration |
| Profile information | Age, gender, weight, fitness level, training goals, weekly goal, username (@handle), profile photo, bio, the gym you select | From you, during profile setup and editing |
| Workout data | Workout plans and programs, set/rep/weight records, RPE, rest times, duration, estimated calories, cardio activities | From your use of the App |
| Body measurements | Weight, body fat percentage, fat mass, muscle mass, circumference measurements (waist, hip, chest, arm, leg, neck, shoulder) | From you (optional) |
| Nutrition data | Meal and food records, calorie and macro values, water intake, supplement list and daily check-offs, nutrition goals | From you (optional) |
| Social content | Posts, photos and videos, stories, comments, likes, saved posts, workout cards you share | From you (optional) |
| Social relationship data | The accounts you follow and your followers, blocked/restricted user lists, close friends list, story view records, account privacy preferences | From your use of the App |
| Messaging data | Direct message contents, sent/read times, conversation participants | From you (optional) |
| Event data | Events you create or join, event locations and coordinates, participation and invitation statuses | From you (optional) |
| Location data | Approximate device location (latitude/longitude) and the time it was last updated; location tags you add to stories | From your device — only if you have granted permission and turned the feature on |
| Smartwatch data | Heart rate and activity data, device pairing records | From a connected device (optional) |
| Device and usage | Push notification token, device model, operating system, app version, app language and theme preference, last seen time | Automatically from your device |
| Subscription data | Your subscription status and validity period, store transaction ID | From Apple / Google — card details are not passed to us |
| Support and complaint records | Emails you send us, reports and appeals, moderation decisions | From you and from other users |
Data such as body measurements, nutrition records and heart rate may be considered health-related / special categories of personal data under personal data protection legislation. We process this data only on the basis of your explicit consent and only to provide the service to you. The photos and videos you share, although not biometric in nature, also constitute personal data.
2. Device Permissions
The App requests the following device permissions only when you want to use the relevant feature. None of them is required for the App to work; if you decline, only that feature is disabled.
| Permission | What it is used for | Required? |
|---|---|---|
| Camera | Taking photos and videos for posts and stories, profile photo | No |
| Photo library | Selecting content from your library; if you allow it, saving your posts to your library | No |
| Microphone | Recording sound in video posts | No |
| Location | Showing nearby athletes and events, story location tags, gym search | No — off by default |
| Notifications | Like, comment, message, follow, event invitation, reminder and weekly summary notifications | No |
3. What Do We Use Data For?
- To create your account, verify your identity and keep you signed in;
- To provide core features such as workout logging, cardio tracking, statistics, personal record detection and calorie estimates;
- To run nutrition, water and supplement tracking and to show summaries based on your goals;
- To record your body measurements and chart how they change over time;
- To operate the social features: showing posts and stories to the audience you choose, establishing follow relationships, delivering messages and publishing events;
- If you have turned it on, to show nearby athletes and events;
- To create your weekly and program-based summary reports and, depending on your preference, send them to you by email;
- To send personal record, reminder and social interaction notifications (subject to your permission);
- To verify your subscription status and manage access to paid features;
- To review complaints, enforce the Community Guidelines and detect abuse and fake accounts;
- To keep the Services secure, diagnose and fix errors and improve the App;
- To fulfill our legal obligations and respond to requests from competent authorities.
We do not sell or rent your data, and we do not share it with third parties for marketing purposes. The App contains no third-party advertising networks, analytics SDKs or tracking tools. We do not use your data for profiling that produces automated legal effects concerning you.
4. Who Can See What?
This section summarizes the visibility of data in the App. The table below shows the default behavior; you can change many of these settings under Settings > Privacy.
| Data | Who can see it? |
|---|---|
| Your workout, nutrition, water, supplement and body measurement records | Only you — they are not shown to anyone unless you share them as a post |
| Your statistics and reports | Only you |
| Username, name, profile photo, bio | Other users of the App (visible in search results) |
| Posts, comments, likes | Other users of the App; if your account is private, only the followers you have approved |
| Stories | The audience you choose (everyone / followers / close friends) — removed from the feed after 24 hours |
| Who viewed your story | Only you (the owner of the story) |
| Direct messages | Only the participants of the conversation (and competent authorities where legally required) |
| Follower / following lists | Other users of the App |
| Your blocked, restricted and close friends lists | Only you — the users concerned are not notified |
| Your approximate location (nearby athletes) | If you have turned on location sharing, users near you — shown only as a distance; your exact coordinates are not shown |
| Your gym membership | Other users — can be turned off in Settings |
| The days and times you usually work out | Other users — can be turned off in Settings |
| Last seen (online) information | Other users |
| Your events and their participant lists | Other users of the App |
Important note about media links: So that they load quickly, your photos and videos are served through the content delivery infrastructure via links that are hard to guess but directly accessible. This means that a person who obtains a link can access the media without signing in to the App. Users who see your content can also take screenshots. We therefore strongly recommend that you do not share intimate or sensitive images.
5. Location Data
Location data has a special place in the App, so we explain how it works separately:
- It is off by default. Your location is processed only when you have both granted device permission and explicitly enabled location sharing within the App.
- We do not track you continuously. Your location is updated only while the App is open in the foreground, at intervals of at least five minutes. We do not collect your location in the background and do not keep any route or movement history.
- Only your latest location is stored. No historical record of your location is kept in the database; each update overwrites the previous one.
- It is shown to other users as a distance. In the "nearby athletes" list, only an approximate distance is shared, not your exact coordinates.
- Stale locations drop out. Locations that have not been updated for a certain period are excluded from nearby user queries.
- You can turn it off. When you turn off Settings > Privacy > Show me nearby, your location is not used in discovery features. When you delete your account, your location record is deleted as well.
- Story location tags and event locations are information you add knowingly, and they are visible to the users who see that content.
6. Payment Data
Paid features are sold through the Apple App Store or Google Play. Payment details such as your card number, expiry date, CVV and billing address are processed directly by the relevant store operator; they are not passed to us and we do not store them. We only receive information on whether your subscription is valid, which package you use and its validity period.
7. Where Data Is Stored and Retention Periods
Your data is stored by our infrastructure provider Supabase on servers in the European Union (Frankfurt, Germany) region.
| Data | Retention period |
|---|---|
| Account, profile, workout, nutrition and measurement data | As long as your account is active; deleted or anonymized when you delete your account |
| Data of a frozen account | 30 days from the date of freezing. If you sign in within this period, the account is restored as it was; if you do not, the account and all data are deleted automatically |
| Posts and comments | Until you delete them or close your account |
| Stories | Removed from the feed 24 hours after posting; media files are cleaned up within a reasonable time |
| Direct messages | Until one of the conversation participants deletes them or closes their account |
| Location information | Only your latest location is kept; it is cleared when you turn sharing off or delete your account |
| Smartwatch pairing records | Valid for a few minutes; consumed once used |
| Notification tokens | As long as the device remains connected and notification permission is on |
| Moderation and complaint records | For as long as the review and any legal claims require |
| Invoice and transaction records | For the period required by tax and commercial legislation (as a rule, 10 years) |
You have two options for closing your account. Freezing signs you out and keeps your data as it is; if you sign in again within 30 days, your account is restored immediately, and if you do not, the account and all data are deleted automatically. Permanent deletion deletes your account and data without any waiting period. For your security, both actions are verified with your password.
When you delete your account, your personal data is deleted or irreversibly anonymized within a reasonable time. However, content in the conversation records of other users you have messaged, data that must be retained due to a legal obligation or an ongoing claim, and copies that remain in technical backups for a reasonable period may fall outside the scope of this deletion. Deleting your account does not automatically cancel your app store subscription.
8. Third-Party Service Providers
We work with a limited number of service providers to deliver the Services:
| Provider | Purpose | Data processed |
|---|---|---|
| Supabase | Database, authentication, file storage and server infrastructure | All account, app and media data |
| Expo | Push notification delivery and app updates | Notification token, device and app version information, notification content |
| Resend | Sending emails (weekly and program reports, account emails) | Email address, name, report content |
| Sightengine | Checking shared photos for compliance with the Community Guidelines (detection of sexual content / obscenity) | Only the photo you upload to share; your name, email or account information is not transmitted. The provider does not store the photo after the check |
| Google (Places API) | Place search suggestions for gyms, events and story locations | The search text you type and —if you use the feature— your approximate location; your account information is not transmitted |
| Apple / Google | App distribution, purchases and subscription management | Store account and payment details (not passed to us), subscription status |
These providers process your data only on our instructions, to the extent required by the service and within the framework of the contracts between us.
9. Sharing of Data
We share your personal data only in the following cases:
- With other users in the social features, in line with your sharing preferences;
- With the service providers listed above, to the extent necessary to provide the service;
- In response to lawful requests from competent public institutions and organizations under applicable legislation;
- Where necessary for the establishment, exercise or protection of a right, or to prevent a danger to life;
- With the acquiring party in the event of a merger, acquisition or business transfer (this will be announced in advance);
- In other cases where you have given your explicit consent.
10. International Data Transfers
Since your data is hosted on servers in the European Union (Frankfurt, Germany) region, this processing constitutes a cross-border transfer within the meaning of Article 9 of Law No. 6698. The transfer is carried out on the basis of the appropriate safeguards provided for in the legislation (standard contractual clauses, a letter of undertaking or other applicable transfer conditions) or, where necessary, your explicit consent. For details, see the KVKK Information Notice.
11. Data Security
Your data is encrypted in transit with TLS. Database access is limited by Row Level Security rules to the data associated with your account only. Passwords are stored in irreversibly hashed form; not even we can see your password. Smartwatch pairing records are valid for only a few minutes and can be used only once. Access permissions are limited to the minimum level needed to do the job.
Direct messages are not end-to-end encrypted; they are stored on our servers to provide the service, ensure security and fulfill legal obligations. Please remember that no system is 100% secure; we recommend choosing a strong password for your account that you do not use for any other service. In the event of a security breach affecting your personal data, we will inform you and the Personal Data Protection Board within the time and in the manner prescribed by the legislation.
12. Your Rights
Under Law No. 6698 on the Protection of Personal Data (KVKK) and related legislation, you have the right to access, correct and delete your data, to object to processing, to withdraw your explicit consent and to learn which third parties your data has been transferred to. For the full list of rights and the application procedure, see the KVKK Information Notice.
Controls you can use directly within the App:
- Editing your profile and goal information;
- Deleting or archiving your posts, stories and comments;
- Making your account private, blocking and restricting users, and managing your close friends list;
- Turning off location sharing, gym visibility, workout schedule visibility and event invitations;
- Managing your notification and weekly email report preferences;
- Freezing your account, or permanently deleting your account and data.
You can send your requests to info@charqe.io.
13. Children's Privacy
The Services are not directed at users under the age of 18, and we do not knowingly collect data from anyone under 18. The accounts and data of users found to be under 18 are deleted. If you believe your child has provided us with data, contact us at info@charqe.io.
14. Cookies
This promotional website does not use cookies and contains no third-party analytics or tracking tools. The mobile app uses only local session and settings information stored on your device to keep you signed in and remember your preferences; this information is not used for advertising or profiling.
15. Changes
Material changes to this policy will be announced within the App or by email before they take effect. The current version of the policy is always published on this page, and the date of the last update is shown at the top of the page.
16. Contact
For any questions and requests regarding privacy:
Charqe Bilişim Teknolojileri Sanayi Ticaret Limited Şirketi
Email: info@charqe.io
Address: Kavaklı Mah. Gaffar Okkan Sk. Mesken No: 3 İç Kapı No: 5, Beylikdüzü / İstanbul, Türkiye