Security

Draft. These pages need review by a lawyer before launch and are not yet terms you can rely on.

Each gym’s data kept apart

Every record belongs to one gym. Gymie checks this twice: once in the application and again on every database query, which is refused if it does not name the gym.

Every change recorded

Changes to members, money and access are written to an audit log with who made them, when, and what changed.

Staff roles and PINs

Owners, managers, front desk staff and trainers see only what their role allows. Shared desk devices use a PIN per person, and sensitive actions need a manager’s PIN.

Money never held

Payments go to the gym’s own payment provider account. Gymie does not hold member funds.

Passes that rotate

Member passes change every 30 seconds, so a copied code stops working.

Reporting a problem

To be written: how to report a security issue.