Effective Date: 16 September 2026
Website: https://truestrengthandfitness.co.uk
True Strength & Fitness (“we”, “our”, or “us”) is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal data when you use our website, mobile applications (iOS and Android), and gym access services.
For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, True Strength & Fitness is the Data Controller responsible for your personal data.
1. Information We Collect
We only collect data necessary to provide you with facility access, process gym memberships, and manage your account.
- Account & Profile Data: Full name, email address, and encrypted account credentials.
- Payment & Financial Data: Payment card details, billing address, and transaction history. (Note: Credit/debit card details are processed directly and securely by Stripe. We never store full card numbers or security codes on our servers).
- Technical, Usage & Analytics Data: IP address, device model, operating system, app session logs, authentication tokens, and website usage statistics collected via Google Analytics and Google Search Console.
- Mobile Hardware & Device Permissions:
- Camera Access: Used strictly within the mobile app if required to scan facility QR codes or set up profile credentials.
- Local Storage / Keychain: Used to store secure authentication tokens so you remain signed in.
- Notifications: Used (if permitted) to send account alerts, gym updates, or membership notifications.
2. How We Collect and Use Your Data
We process your personal data under the following legal bases under UK GDPR:
| Data Type | Purpose | Legal Basis (UK GDPR) | Processor Used |
| Name, Email, Password | Account creation, identity verification, and app login access | Contractual Obligation | Supabase Inc. |
| Payment Details & Billing History | Subscription billing, membership processing, and tax records | Contractual Obligation & Legal Obligation (HMRC) | Stripe UK Ltd / Stripe Inc. |
| Dynamic Access / QR Data | Gym entry control, turnstile verification, and access logging | Contractual Obligation & Legitimate Interests | Supabase Inc. |
| IP Address & App Session Logs | App security, session management, and server logging | Legitimate Interests | Supabase Inc. |
| Website & App Telemetry | Analyzing site traffic, performance, and user interaction | Legitimate Interests | Google Analytics (Google LLC) |
| Search & Technical Performance | Website health, indexation tracking, and error monitoring | Legitimate Interests | Google Search Console (Google LLC) |
| Support Communications | Responding to customer service inquiries and support tickets | Legitimate Interests | Internal Systems |
3. Where Your Data is Stored and Shared
We do not sell, rent, or trade your personal data to third parties or advertising networks. Your data is strictly limited to our core operational service providers:
- Supabase Inc.: Used for secure database storage, user authentication, and profile management.
- Stripe Payments UK Ltd / Stripe Inc.: Used for secure payment processing, recurring membership billing, and checkout fraud prevention.
- Google LLC (Google Analytics & Search Console): Used to gather aggregate, non-personally identifiable site analytics and technical performance metrics.
All third-party processors maintain high security standards and utilize recognized international transfer mechanisms (such as the UK International Data Transfer Agreement / Standard Contractual Clauses) to protect data processed outside the UK/EEA.
4. Cookies, Tracking & Session Tokens
- Authentication Tokens (Essential): When you sign in via our website or mobile app, secure session tokens are saved locally on your device via Supabase. These allow you to stay signed in without re-entering credentials every time you open the app.
- Payment Cookies (Essential): Stripe sets necessary security and fraud-prevention cookies during payment checkout.
- Analytics Cookies (Performance): Google Analytics uses cookies and anonymous identifiers to analyze how visitors interact with our website. You can control or opt-out of web cookies via your browser settings.
- No Third-Party Advertising Trackers: Our mobile app does not track you across third-party apps or websites for targeted advertising, and we do not use Apple’s IDFA or Google Advertising ID for ad targeting.
5. Data Safety & App Store Disclosures (Apple & Google)
To comply with Apple App Store Privacy Details and Google Play Data Safety requirements:
- Data Collected: Name, Email Address, Payment Information, App Interactions, and Device Identifiers.
- Data Linked to You: Account information and purchase history are linked directly to your user account.
- Data Security: All communications between our app, website, and database are encrypted in transit using Transport Layer Security (TLS/HTTPS).
6. How Long We Retain Your Data
- Account & Profile Data: Retained for as long as your account remains active or as needed to provide you with active gym access.
- Financial & Transaction Records: Retained for 6 years following the end of the accounting year to satisfy UK legal and statutory obligations (HMRC).
- Inactive Accounts: Accounts that remain inactive without an active membership subscription for more than 24 months will be archived or permanently deleted.
7. Account and Data Deletion (iOS & Android Compliance)
In accordance with Apple App Store and Google Play Store developer guidelines, you have complete control over your account and data retention:
- In-App Deletion: You can initiate permanent account deletion directly within the mobile app by going to Settings > Profile > Delete Account.
- Web-Based Deletion Request: If you no longer have access to the app, you can submit an account deletion request online at https://truestrengthandfitness.co.uk/account-deletion or by emailing us directly at privacy@truestrengthandfitness.co.uk with the subject line “Account Deletion Request”.
What Happens Upon Deletion:
- Your authentication record and personal profile on Supabase will be permanently deleted within 30 days.
- Any active Stripe recurring membership billing will be cancelled immediately.
- Financial transaction logs required for HMRC tax reporting will be retained securely in accordance with UK statutory time limits.
8. Your Rights Under UK GDPR
Under UK data protection law, you have the following rights:
- Right to Access: Request a copy of the personal data we hold about you.
- Right to Rectification: Request correction of inaccurate or incomplete data.
- Right to Erasure (“Right to be Forgotten”): Request permanent deletion of your data (subject to legal retention requirements).
- Right to Restrict or Object: Limit or object to how we process your personal data.
- Right to Data Portability: Request transfer of your personal data to another platform.
To exercise any of these rights, please contact us at privacy@truestrengthandfitness.co.uk.
9. Children’s Privacy
Our services and mobile apps are not directed at individuals under the age of 16 without explicit parental or legal guardian consent. We do not knowingly collect personal data from children under 16.
10. Contact Us & Complaints
If you have questions regarding this Privacy Policy or wish to exercise your rights, please contact us:
- Email: privacy@truestrengthandfitness.co.uk
- Contact Form: https://truestrengthandfitness.co.uk/contact/
You also have the right to lodge a complaint at any time with the UK supervisory authority:
Information Commissioner’s Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Website: https://ico.org.uk | Helpline: 0303 123 1113