How we protect your gym's data

• Sign-in uses email and password, with optional Google sign-in.
• Sessions are issued and refreshed by the auth provider; tokens are stored in the browser only.
• Each user belongs to one or more gyms with a specific role: gym owner, manager, receptionist, trainer, or accountant.
• Permissions are enforced at the database layer (row-level security) so users can only read and modify data belonging to their gym, scoped to what their role allows.
• Sensitive actions (managing staff, editing finances, recording payments) are restricted to the roles that need them.

• The app runs on the Lovable platform, which provides hosting, database, file storage, and serverless functions.
• Data is stored in a managed Postgres database. Database connections use TLS.
• Uploaded files (athlete photos, gym logos, ID card assets, landing media) are kept in private storage buckets and served through short-lived signed URLs.
• Backups and platform-level operational controls are provided by the hosting platform under shared responsibility — we configure the application and access rules; the platform manages the underlying infrastructure.

• Account data: name, email, and the gyms/roles you belong to.
• Athlete records: the personal and membership details your gym chooses to enter (name, contact, photo, memberships, attendance, payments).
• Operational data: invoices, expenses, inventory, and trainer sessions used to run the gym.
• Telegram link: if you opt in, an athlete's Telegram chat ID is stored so the gym can send them updates.

Each gym is responsible for what it collects from its members and for having the right to enter that information.

• Lovable Cloud (Supabase): database, authentication, file storage, serverless functions.
• Telegram Bot API: used only if a gym enables Telegram messaging for its athletes.
• Lovable AI Gateway: used for optional AI-assisted features routed through the hosting platform.

We use the minimum browser storage needed to keep you signed in and remember your language and theme. We do not run third-party advertising trackers on the app.

Gym data is retained for as long as the gym uses the service. Gym owners and managers can edit or remove athlete records, memberships, and other records from inside the app. To request full account deletion or an export of your gym's data, contact us using the security contact below.

If you believe you have found a security issue, please report it to us privately so we can investigate before any details are made public. Do not test attacks against other gyms' data.

security@gym.zdb.af

The Lovable platform is responsible for the underlying hosting, network, database engine, and platform security controls. We — the GymPro Afghanistan team — are responsible for application code, access rules, and how data is used inside the app. Each gym is responsible for keeping its own user accounts secure, granting the right roles, and only entering information it is allowed to collect.

This page describes current practices and may change as the app evolves. It is not a certification, regulatory compliance statement, or legal contract.