Reverfit Member app privacy policy

This is a translation for convenience; the Spanish version is the legally binding one.

Last updated: September 21, 2026.

This policy covers the mobile app Reverfit Member (on the stores, «Reverfit Socio»), the one you download from Google Play or the App Store and sign in to with the code your gym gives you. Inside it you have your gym’s home screen, your membership card, class bookings, and the Diet and Workout sections.

The most important thing

There are two kinds of data in this app, and the same party is not responsible for both:

• The data you have because you are a member of your gym: your name, your card, your bookings, the plan and the menu your gym gives you, and what you log so your trainer can see it. The controller of that data is your gym; Reverfit only stores it and processes it on your gym’s behalf. For anything about it, talk to your gym.
• The data you decide on yourself: creating your own account with your email to keep a copy of your things, buying Pro, using the meal photo, or joining the general ranking with an alias. All of that is optional, off by default, and the controller of that data is Reverfit.

Your weight, your heart rate and what you eat are health-related data. Only what you log is sent: what you don’t log never leaves your phone.

1. Who the controller is

For your data as a member, your gym: the gym that gave you the code. It decides what it uses the data for and has to inform you about it. Reverfit acts as a processor (art. 28 GDPR): it hosts and processes the data only to provide the service to your gym, following its instructions, and does not use it for its own purposes. Section 3 of the platform’s policy says so too.

For what you decide on yourself (section 3), Reverfit:

• Controller: Francisco José Fraile León
• Tax ID (NIF): 27313175P
• Postal address: Apartado de Correos 1313, 41012 Sevilla (Spain)
• Email: info@reverfit.com

2. What we process on behalf of your gym

a) Your code. It’s your key: with it the app knows which gym you belong to and who you are. It travels encrypted and never in the page address. When you sign in, the server returns the name your gym has for you, which parts of the app your gym has, and whatever you had already logged. To stop anyone trying random codes, the server records the IP address of attempts with codes that don’t exist, and only of those.

b) Your gym’s home screen. The app requests and shows: your gym’s name, logo and color, your name, your class bookings, how many people are in the gym right now (a number, no names), the opening hours, a summary of how you’re doing in Diet and Workout, and your gym’s ranking. The latest home screen is saved on your phone so the app opens without a connection. The app does not receive your membership fee or your payments: your gym handles that in its management dashboard.

c) Your entry card. It’s a QR code the server makes for you and that expires after a few minutes. When you show it at the door, your gym records your check-in. If your gym has it turned on, you can save it to Apple Wallet or Google Wallet: that pass carries your name, your gym’s name, your member number if you have one, and the code, and from then on Apple or Google keep it in your wallet.

d) Classes. The app shows your gym’s classes and the spots left, and sends your bookings, cancellations and waitlists. If you can’t book, the server only tells the app the reason in one sentence.

e) Your gym’s notifications. If you allow notifications, the app sends the server your phone’s notification identifier (the one Google or Apple provide), linked to your code and your gym, so you get your gym’s notifications and the ones about your bookings. Notifications are delivered through Google (Firebase) on Android and Apple on iPhone. When you remove your code from the app, that identifier is deleted from the server.

f) Workout. If your gym has Workout, the app downloads the plan your gym sets for you and uploads to your gym record what you log: the weight and reps of each set, the days you train with their duration, the estimated calories, your notes and, if you use a heart-rate strap, the session’s heart-rate summary (average, maximum and time in zone); also the plans you save and the details you entered in Workout (sex, date of birth, height, weight, level and goal). Your gym tells the app the sex and date of birth on your record, so you aren’t asked again. While you train, the app also sends the exercises you have today and the ones you’ve done, to tell you how busy the machines you’re about to use are; you only get numbers back.

g) Diet. If your gym has Diet, the app downloads the menu your gym sets for you, what you had logged on the web and your own foods, and uploads to your gym record the meals you mark as done, with their calories and macronutrients, and your weigh-ins. The Diet profile details you enter on your phone are not uploaded to your gym.

h) Your gym’s ranking. You only appear if you’ve joined. The other members of your gym see your first name with the initial of your last name and your weekly and monthly totals (days, weight lifted and sets). Never your weights per exercise or your code.

Purpose and legal basis: everything in this section is processed to give you your gym’s service. The legal basis is determined by your gym, as the controller, and that’s who you should ask about it. What you log in Diet and Workout is seen by your gym and its staff; if you don’t want them to see it, don’t log it in this app, or ask your gym to remove that part for you.

3. What you decide, and what Reverfit is responsible for

a) Your own account (optional). It’s so you don’t lose your things if you change phones or the day you leave your gym. You’re still a member just the same: your gym sees what it always saw, and the account only keeps a copy. If you create it, we keep:

• Your email and your password (encrypted: we can’t see it).
• The Diet copy: your profile (weight, height, age, sex, goal and activity level), your meals and your diary, your weigh-ins, your measurements, the foods you created and your saved diets.
• The Workout copy: your plan, your sets, the days you trained (with the heart-rate summary, if you use a strap), your saved plans and your archive.
• If you tick the news and offers box, which is unticked by default, that choice and its date.

Legal basis: performance of the service you ask for (art. 6.1.b GDPR) and, as this is health-related data, your explicit consent (art. 9.2.a), which you give by ticking the box that asks for it when you create the account (without ticking it the account isn’t created) and which you withdraw whenever you want by deleting the account, which deletes the copy. News emails, only if you tick their box (art. 6.1.a). When you create the account we send you a welcome email.

b) If you go Pro. Inside the Member app you can buy Diet Pro and Workout Pro. You pay through Apple (App Store) or Google Play: the store holds your card details and we never see them. To know whether your Pro is active we use RevenueCat, which receives the purchase from the store (which plan, when it starts, renews or is cancelled) together with your Reverfit identifier: your account’s or, if you don’t have an account, one made from your gym’s identifier and your member code. Neither your name nor your email. The app identifies itself to RevenueCat this way when you open Diet or Workout, to check whether you have Pro. The subscription is cancelled from your Apple or Google account settings; neither deleting your Reverfit account nor leaving your gym cancels it. Legal basis: performance of the contract (art. 6.1.b). Your gym plays no part in that purchase.

c) The meal photo (Pro only). If you take a photo of your plate or pick one from your camera roll, that image does leave your phone: it is shrunk on the phone and sent to our server, which sends it to Anthropic so its artificial intelligence model can recognize the foods and estimate the grams and calories. The photo is not stored anywhere: it is analyzed and discarded. It isn’t used to train models either. Anthropic receives only the image, without your name, your email or your code. What is recorded is that you made a request (date, your identifier, which is your account or your code and your gym, and the cost) to keep track of spending and apply the limits: with Pro, up to four a day and ninety a month (three a day and sixty a month in the countries where Pro costs less, worked out from the country your phone connects from, without storing it); and during the trial days, fifteen in total. The same happens with the text of the foods if you bring in a diet from elsewhere and ask for an estimate of what the app doesn’t recognize: only that text is sent. Legal basis: performance of the contract (art. 6.1.b GDPR) and, as this is food data, your explicit consent (art. 9.2.a).

Two honest warnings. First: what the photo returns is an estimate made by a machine, not a measurement; it can be wrong, and you should check the grams. Second: point only at the plate. If another person gets into the frame, you’d be sending data about someone who hasn’t given permission.

d) The general ranking (optional). It’s different from your gym’s: it compares people from anywhere who want to join, with the alias you choose. If you join, the app sends your alias, your sex, a random identifier the app creates on your phone, your weekly and monthly totals (days, weight and sets), and your relative strength (your best estimated max divided by your body weight). Never your weights per exercise, your name or your code. Legal basis: your consent, which you give by joining. Tapping Salir del ranking (Leave the ranking) deletes your row.

4. Your phone’s permissions

• Camera. For a product’s barcode: the image isn’t stored and doesn’t leave the phone; only the code number is sent. To count reps: everything happens on the phone and nothing is stored. For the meal photo: see section 3.c. For the image of your workout you can share: it doesn’t leave the phone unless you share it.
• Apple Health and Health Connect. Only if you turn it on and give permission. The app reads your weight so you don’t have to log it by hand and writes the calories you eat each day. That weight goes into the app as one more weigh-in, so, like the rest of your weigh-ins, it reaches your gym and your copy if you have an account. On iPhone, and only if you turn it on, the app also reads your watch’s heart rate during the workout and the latest glucose reading from your sensor, and saves your workout to Health without calories: the watch’s heart rate and the glucose are only shown to you, not stored or sent. You can turn it off whenever you want in your phone’s settings.
• Bluetooth. To read your heart-rate strap, which connects directly to your phone. The session summary is saved with the day you trained (section 2.f). The app does not read your location.
• Microphone. Only while you hold the button to log a set by voice. Speech-to-text is done by your phone’s own speech recognition (Apple or Google), under its own terms; we don’t receive or store the audio.
• Notifications. See section 2.e. You can say no and the app works just the same.

5. What the app always sends, without your data

• One signal a day that the app has been opened, to know how many people use it. It only carries the app’s name: no identifier, no code, nothing that could tell who you are.
• How many people are in your gym is requested with the gym’s identifier, without any data of yours.
• The exercise drawings are requested by their file name.
• When you scan a barcode, the public Open Food Facts database is queried with the code number and nothing else.

6. What we DON’T do

• There is no advertising and no ad trackers.
• We don’t sell or hand over your data to anyone.
• We don’t collect your location, your contacts or your messages.
• We don’t store the photos the app analyzes, and we have no access to your camera roll: only the image you choose is sent.
• We don’t use your data or your photos to train any artificial intelligence.
• We don’t make automated decisions that affect you legally.
• Reverfit does not use for its own purposes the data it keeps on behalf of your gym.

7. Who it’s shared with

No one, except the companies strictly needed for the app to work, which act under contract as processors:

• Supabase: the database and the account system. The data is stored on servers in the European Union (Frankfurt, Germany).
• Vercel: where our server runs. It doesn’t store the images.
• Google (Firebase) and Apple: delivering notifications to your phone. They receive your phone’s notification identifier and the text of the notification.
• Anthropic (United States): the artificial intelligence model for the meal photo. It receives only that image or that text, without your name, your email or your code. It doesn’t keep the content and doesn’t use it to train its models. The transfer is covered by the European Commission’s standard contractual clauses.
• RevenueCat (United States): keeping track of Pro subscriptions. It receives the purchase and your identifier, never your card. Standard contractual clauses.
• Resend (United States): sending the welcome email and the account emails. It receives your email address only to send them. Standard contractual clauses.

Apple and Google charge the subscription and keep your card in their wallet, if you add it, as controllers of their own processing, under their own privacy policies. And your gym sees your member data because it’s its data: it is the controller.

If a court or a public authority legally required us to hand over information, we would have to comply.

8. How long it’s kept and how to delete it

• Your data as a member: while your gym keeps the service and according to its instructions. To delete it, ask your gym.
• Your own account and its copy: while you have the account. From the app, inside Diet or Workout: You → Your account → Delete my account and my data. Your account, your email and your copy are deleted right away; you are still a member of your gym and what you have on your phone stays on your phone.
• The general ranking: while you take part. When you leave, your row is deleted.
• The notification identifier: until you remove your code from the app.
• What is only on your phone: while you have the app. To delete it, uninstall the app or use Clear data in your phone’s settings.

Deleting the account does not cancel the subscription: that’s done in the store (Apple or Google), which is who charges you. The steps, what is kept, and the other way, by email, are on the account deletion page.

9. Your rights

You can ask to access your data, correct it, delete it, restrict or object to its processing, ask for portability, and withdraw your consent at any time, without affecting what was done before.

• About your data as a member (section 2): contact your gym, which is the controller. We help it respond to you.
• About what you decide on yourself (section 3): write to info@reverfit.com, from your account’s email if you have one. We reply within one month at most.

If you think it isn’t being done properly, you can file a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).

10. Minimum age

The app is not intended for anyone under 16. To create your own account, buy Pro or join the general ranking you must be at least 16.

11. Security

Everything that leaves your phone travels encrypted (HTTPS). Passwords are stored encrypted, each account can only read and change its own copy, and each gym’s data is kept separate from the others’. Your member code is your key: don’t share it. If you think someone has it, ask your gym to give you another one.

12. Important health notice

Reverfit Member is not a medical device and does not replace the advice of a doctor, a dietitian-nutritionist or a trainer. Calories, goals and heart rate are estimates for guidance only. Training with weights carries a risk of injury. If you have an injury or an illness, are pregnant, are breastfeeding or are under treatment, talk to a professional before changing your diet or starting to train.

13. Artificial intelligence

The meal photo and the food estimate for a diet brought in from elsewhere use artificial intelligence: what you see on screen is an automatically generated estimate, which you can correct before logging it. The final numbers for your day are calculated by the app with its own formulas. There is also a tip and a summary that work with the artificial intelligence built into your own phone: there, nothing leaves the phone. None of these features makes decisions about you or does profiling. If an answer seems wrong or offensive to you, write to us at info@reverfit.com.

14. Changes to this policy

If the app starts handling data different from what is described here, we’ll say so on this page before it happens and, when needed, we’ll ask for your permission. The date at the top tells you which version you’re reading.