Privacypolicy.

You can read every page of this site without telling us anything about yourself. There is no analytics package, no advertising network, no tracking pixel and no consent banner, because there is nothing here to consent to.

We hold personal information in exactly two situations: you submit a club, or you send an enquiry to one. Both are things you chose to do, and both are covered in detail below.

Gymsss operates Gymsss.com and is the controller of the personal information described here. Anything in this policy — a question, a correction, a request to delete something — reaches us at hello@gymsss.com.

Club submissions. When you submit a listing we keep what you type into the form: the business name, its city, address, description, website and social handles, and the contact email and phone number you give for it. If that contact information is personal rather than a business line, we treat it as personal data.

Enquiries. When you contact a club through the site we keep your name, your email address and your message, so the club can reply and so we have a record of what was sent.

Administration. The editorial side of the site sits behind a password. That produces a session cookie for whoever is signed in — which is us, not you.

Server logs. Our hosting provider records ordinary request data — IP address, timestamp, path, user agent — as every web server does, for security and to keep the site up. We do not use it to build any profile of you, and we do not join it to anything else.

This list is the point of the policy, so it is explicit:

• no analytics or measurement product of any kind;
• no advertising, retargeting or conversion pixels;
• no third-party trackers, social widgets or embedded scripts that phone home;
• no profiling, scoring or automated decision-making about you;
• no selling, renting or trading of personal information, ever;
• no marketing emails you did not ask for.

Two, both strictly functional:

• Theme preference. If you switch between light and dark, that choice is saved in your browser’s local storage so the site does not forget it. It never leaves your device.
• Admin session. A cookie set only after a successful sign-in to the editorial tools. It exists so the person editing the index stays signed in.

Neither is used for tracking, and there are no others. Clearing them costs you nothing but your colour scheme.

Submissions are held so we can review, publish and maintain a listing, and come back to you about it. Enquiries are held so they can be delivered to the club and so there is a record of the exchange. Logs are held to keep the site secure and working.

Where data-protection law requires a lawful basis, ours is your consent for information you volunteer through a form, and our legitimate interest in running an accurate, secure directory for everything else. You can withdraw consent at any time by asking us to delete what you sent.

The club you contacted. An enquiry only means anything if it arrives, so your name, email and message go to that business. They then hold it under their own privacy policy.

The companies that run our infrastructure. The site is hosted on Vercel, the index lives in a Neon Postgres database, and uploaded images sit in Vercel Blob storage. They process data on our instructions in order to provide those services, and for no purpose of their own.

Nobody else — except where we are legally required to disclose something, or need to in order to establish or defend a legal claim.

Published listings stay as long as the listing does. If we remove a club from the index, the submission behind it goes with it.

Enquiries are kept while they are useful — typically no more than twelve months — and then deleted. Submissions we decline are deleted once we have told you. Server logs are kept for the short retention period our host applies. Anything you ask us to delete, we delete.

Wherever you are, you can ask us to show you what we hold about you, correct it, delete it, or stop using it — and we will do it. One email to hello@gymsss.com is the whole process; there is no form and no portal.

If you are in the UK or the EEA, the UK GDPR and GDPR give you those rights formally, along with the rights to restrict or object to processing, to data portability, and to complain to your data protection authority. If you are in California, the CCPA gives you rights of access, deletion, correction and to opt out of the sale or sharing of personal information — we do not sell or share it, so there is nothing to opt out of.

We will not treat you any differently for exercising any of this.

Our hosting and database providers operate internationally, so the information described here may be processed outside your country, including in the United States. Where that involves a transfer out of the UK or the EEA, it relies on the standard contractual protections those providers put in place.

This site is written for adults choosing where to train and is not directed at children. We do not knowingly collect information from anyone under 16 — if you believe we have, tell us and it will be deleted.

Everything is served over HTTPS, the database is access-controlled and credentials are held as environment secrets, and the editorial tools are behind authentication. The best protection, though, is holding almost nothing in the first place — which is the design here, not an accident.

If we add anything that changes this picture — a newsletter, member accounts, any measurement at all — this page is updated before it goes live, and the date at the top will tell you. We will not quietly start collecting something and mention it later.

hello@gymsss.com reaches a person. Privacy questions, deletion requests and complaints all go to the same place.