Privacy policy

The data controller is Bastien Carcat EI, who operates the GymFit API. Contact: contact@gymfit-api.com.

This policy covers the website gymfit-api.com, your dashboard account and the GymFit API. If you subscribe through RapidAPI, RapidAPI’s own privacy policy applies to the data it processes.

• Account: your name, email address and password. The password is stored as a one-way hash, never in clear text.
• API keys: stored as a hash with their name and the first characters shown in your dashboard. A key is displayed only once, when it is created.
• Usage: for your account, daily totals per API endpoint (number of requests, response status categories, response times). We do not store your requests one by one.
• Technical logs: IP address, requested path, status code, user agent and a request identifier, for security and troubleshooting.
• Billing: your plan, the status of your subscription and your Stripe customer identifier. Your payment details are collected by Stripe; we never see them.
• Support: the messages you send us by email.
• Website analytics: anonymous page views and performance measures, without cookies (Vercel Web Analytics and Speed Insights).

• Providing your account, API keys, quotas and usage statistics, and billing paid plans: performance of our contract with you.
• Securing the service (rate limits, abuse prevention, logs), monitoring errors and improving the API from aggregated statistics: our legitimate interest in running a reliable and secure service.
• Keeping accounting records: our legal obligations.
• Sending transactional emails (email confirmation, password reset, account notices): performance of our contract. We do not send marketing emails.

• Account, API keys and billing information: until you delete your account. Deletion is immediate and can be done at any time from the Settings page of your dashboard.
• Usage statistics: kept for the service and billing while your account exists. After deletion, the remaining daily totals are no longer linked to any person.
• Technical logs: 7 days. Error reports: 90 days at most.
• Payment records: kept by Stripe as required by law. Our own accounting records are kept for the legal period of 10 years.

We do not sell your data. It is processed on our behalf by the following providers, each for its own purpose:

• Vercel Inc. (USA): website hosting and anonymous analytics.
• Railway Corporation (USA): hosting of the API, the database and the technical logs.
• Resend, Inc. (USA): sending of transactional emails.
• Functional Software, Inc. / Sentry (USA): error monitoring.
• OVH SAS (France): email hosting for our support inbox.
• Stripe: payments. Stripe acts as the merchant of record for paid plans and processes your payment data under its own privacy policy.

Exercise images are stored by Scaleway SAS (France); no personal data is stored there.

Some providers are located in the United States. These transfers rely on the EU-U.S. Data Privacy Framework or on the standard contractual clauses of the European Commission.

We only use a strictly necessary cookie that keeps you signed in to your dashboard. It requires no consent. We use no advertising or tracking cookies, and our analytics work without cookies.

All traffic is encrypted (HTTPS). Passwords and API keys are stored as hashes, access to production systems is restricted, and requests are rate limited to prevent abuse.

You can access, correct or delete your data, object to or restrict its processing, and ask for a copy in a portable format. You can delete your account yourself at any time from your dashboard. For any other request, write to contact@gymfit-api.com; we answer within one month.

If you think your rights are not respected, you can lodge a complaint with the French data protection authority, the CNIL (cnil.fr).

The service is intended for developers and businesses. It is not directed at children under 15, and we do not knowingly collect their data.

We may update this policy. The date at the top shows the latest version; significant changes are announced by email.