Privacy Policy

1. Information We Collect

When you sign up for GymText, we collect information you provide on the signup form: your name, email address, mobile phone number, date of birth, fitness goals, experience level, training availability, training location, equipment access, and your preferred daily message time. We also collect your timezone (detected from your browser) and a timestamp recording when you provided SMS consent.

When you receive or send SMS messages, we and our messaging provider (Twilio) process the message body, sender and recipient phone numbers, and delivery status information.

When you make a payment, our payment processor (Stripe) collects payment card information directly. We do not store full payment card numbers on our servers.

For clarity, the categories of personal information we collect are:

• Identifiers and contact information — name, email address, mobile phone number.
• Demographic and fitness profile information — date of birth, fitness goals, experience level, training availability, training location, and equipment access. Date of birth determines which age-band protections apply (under 13, 13–17, or 18+).
• Commercial information — programs you have enrolled in and subscription status (payment card details are processed by Stripe and not stored by us).
• Internet or other electronic activity information — timezone detected from your browser at signup.
• SMS opt-in record — the timestamp at which you provided SMS consent and the consent text shown to you on the signup form.
• SMS message content and delivery metadata — the body of messages we send to and receive from you and the associated delivery status information from our messaging provider.
• Verifiable parental consent (VPC) record — for athletes under 13, the method (Stripe payment or parent email link) and a timestamped audit trail of the parent’s consent action. See Section 9.

2. How We Use Information

We use the information we collect to:

• Deliver daily workout messages to the recipient’s phone via SMS;
• Personalize the workouts based on the answers you provided at signup;
• Apply the right age-band protections (different defaults for under 13, teens, and adults);
• Process subscription payments and send billing-related notifications;
• Honor opt-out requests and other support requests;
• Diagnose and fix problems with the messaging service; and
• Comply with legal obligations.

3. Mobile Information and SMS Opt-In Data — No Third-Party Sharing

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing to subcontractors in support services, such as customer service, is permitted. All other categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

For clarity, “mobile information” as used above includes your mobile phone number, your SMS opt-in record (the timestamp at which you consented and the consent text shown to you on the signup form), the contents of SMS messages you send to or receive from us, and any associated delivery metadata. We do not sell, rent, lease, or trade this information, we do not share it with data brokers, and we do not use it for cross-context behavioral advertising.

In plain language: we do not sell, rent, or share your phone number or your SMS opt-in consent information with any third party for marketing. We share it only with the service providers strictly necessary to deliver the SMS service to you (today: Twilio, our messaging provider).

4. Service Providers

We share information with the following service providers solely to operate the service:

• Twilio — SMS delivery, inbound message handling, delivery status callbacks.
• Stripe — subscription billing and payment processing. For under-13 enrollments, Stripe’s monetary-transaction record also serves as our verifiable parental consent (see Section 9).
• Resend — transactional email delivery (parent-approval links, COPPA receipts, age-up notices). Used only for emails directly required to operate the service.
• Hosting and infrastructure providers — serve the GymText website and store the database. These providers act on our behalf as data processors and are bound by confidentiality and data-protection terms.

We do not share information with third parties for their own marketing or advertising purposes.

5. Coaches and Programs

Coaches and trainers who author programs on the GymText platform do not have access to your phone number, SMS replies, or personally identifying information. The coach authors the program content; GymText sends the messages. Inbound SMS replies are handled by GymText; the coach does not receive them.

6. Data Retention

We retain account and messaging records for as long as your account is active and for a reasonable period afterward to support customer service, comply with legal obligations, resolve disputes, and enforce our agreements.

For athletes under 18, daily message records older than 12 months are deleted automatically. Account records (name, contact, consent receipt) are retained for the life of the enrollment plus a reasonable audit period after cancellation. Parents can request earlier deletion at any time by emailing admin@gymtext.co.

Adult account holders can request deletion of their account and associated personal information at any time by emailing support@gymtext.co.

7. Data Security

We use industry-standard administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, alteration, disclosure, or destruction. The subprocessors named in Section 4 are contractually obligated to maintain comparable safeguards. No system is perfectly secure, however, and we cannot guarantee the security of information transmitted to or from the service.

8. Your Rights

Depending on your jurisdiction, you may have rights to access, correct, delete, or port the personal information we hold about you, and to object to or restrict certain processing. To exercise these rights, email support@gymtext.co. For requests concerning a child under 18, email admin@gymtext.co. You can also opt out of SMS at any time by replying STOP to any message we send.

We do not sell personal information and we do not share personal information for cross-context behavioral advertising, as those terms are defined under California law. California residents may exercise their rights under the California Consumer Privacy Act (including the CPRA amendments) by contacting us at the email address above.

9. Children Under 13 (COPPA)

GymText offers programs to athletes 10 and up. Under the Children’s Online Privacy Protection Act (COPPA), we obtain verifiable parental consent before collecting personal information from a child under 13. See our standalone COPPA Direct Notice for the full direct-notice required by 16 CFR § 312.4.

9.1 What we collect from a child under 13

A parent enrolls the child on the child’s behalf. From the child, we collect only what is reasonably necessary to address the child in messages and apply age-band protections: first name and date of birth. We do not collect the child’s phone number, email address, photos, geolocation, or persistent identifiers from the child directly.

The recipient phone number for daily messages is the parent’s phone, not the child’s. Daily coaching messages are addressed to the child but delivered to the parent’s device.

9.2 Verifiable parental consent (VPC)

We use one of two FTC-approved consent methods, depending on the program:

• Monetary transaction (16 CFR § 312.5(b)(2)(ii)) — for paid programs, the parent’s payment via Stripe is the consent record. Each consent is captured as a Stripe checkout session, subscription, customer, and invoice ID, paired with the timestamp the first invoice was paid.
• Parent email link (16 CFR § 312.5(b)(2)(iv)) — for the teen flow (13–17), we send a signed approval link to the parent’s email; the parent’s click is the consent action and is timestamped along with the click’s IP address and user agent.

Free programs are restricted to athletes 13 and up so that a Stripe payment is always present in the under-13 path.

9.3 Parent rights

A parent may, at any time, request that we:

• Review the personal information we have collected from their child;
• Delete that information and the child’s account;
• Refuse further collection (which will end the child’s enrollment); or
• Receive a copy of the consent record on file.

Send requests to admin@gymtext.co. We respond within 14 days and complete deletion within 30 days of request, or sooner where required by law.

9.4 Age-up

When a child reaches their 13th birthday, we email the parent a link the child can use to claim their own GymText account. Until the child claims, the account remains under the parent. When the child reaches 18, parental consent is automatically revoked and the user owns their own account.

10. Teens 13–17

A user signing up at age 13–17 must provide a parent’s name and email. We send the parent a signed approval link and do not deliver SMS messages to the teen until the parent clicks. The approval link expires after 14 days; if a parent does not approve within that window, the enrollment is automatically cancelled and any subscription charge is refunded.

A teen account is the teen’s own account. The parent does not have a portal to view the teen’s messages. The parent’s role is limited to providing consent at signup; if a parent later wishes to revoke consent, they may email admin@gymtext.co.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make a material change, we will update the “Last updated” date at the top of this page and, where appropriate, notify you by SMS or email.

12. Contact

Questions about this Privacy Policy or our data practices can be sent to support@gymtext.co. For requests concerning a child under 18 (including data export, deletion, or revoking parental consent), email admin@gymtext.co.