Privacy policy
What Curly collects, why we have it, who can see it, and how to get rid of it.
Last updated 27 October 2026
Curly is a fitness app for gym members, run by AZZOUNI LTD (company number 17538609), 19 Aspen Close, St. Mellons, Cardiff, Wales, CF3 0BT. We are the data controller for the information described here. Email us at support@curlyworkout.com.
The short version: we keep what the app needs to work, we show your training only to you, we never sell anything to anybody, and you can delete the lot from inside the app at any time.
What we collect
| What | Why |
|---|---|
| Email address and password | To create your account and sign you in. Passwords are stored hashed; nobody at Curly can read them. |
| Username, display name, profile photo, bio | So gym-mates and friends can recognise you. |
| Date of birth | Only to check you are at least 16. It is kept apart from the rest of your profile and is never shown to anyone — not to other members, not to your gym. |
| Your gym, and your role at it | To show you your gym's page, timetable and feed. |
| Workouts: dates, exercises, sets, reps, weights, notes, and classes you attended | The point of the app. This is yours: no other member, trainer or gym owner can see it. |
| Posts, photos, comments, likes, friends, direct messages, blocks and reports | The social side, shown only to the people you shared them with. |
| A notification token for your phone | To send you the notifications you allowed. Deleted when you sign out. |
| Technical logs (IP address, timestamps, errors) | Kept briefly by our hosting providers to keep the service secure and working. |
We do not collect location, contacts, advertising identifiers or health data from Apple Health or Google Fit, and there is no analytics or advertising tracking in the app or on this site.
Who can see what
- Your workouts are private to you. Gym staff see attendance-style figures — how many members trained this week, and how long it has been since someone last trained — never what anyone lifted.
- Your gym-mates see your profile and anything you post to the gym feed. You can take yourself off the public member list in Settings.
- Friends see your posts and can message you. Messages are between you and the other person; only your own gym's trainers can also message you.
- Nobody sees your date of birth, your password, or the contents of your direct messages except the person you sent them to.
Why we are allowed to hold it (lawful bases)
- Performing our contract with you — your account, your workouts, the social features you choose to use.
- Our legitimate interests — keeping Curly safe and working: moderation, preventing abuse, security logs.
- Legal obligation — the age check, and dealing with reports of illegal content.
- Your consent — notifications, a profile photo, and appearing on your gym's member list. Each can be withdrawn in Settings or in your phone's settings.
Who we share it with
We do not sell your data or share it for advertising. We use these providers to run the service:
- Supabase — the database, sign-in and photo storage, hosted in London.
- Vercel — this website.
- Expo, Apple and Google — delivering push notifications. A notification includes the first line of what it is about, so a message notification includes the start of the message. Expo's service is in the United States.
- Our email provider — sign-up confirmations and password reset codes.
- Sentry — if the app crashes, we receive the error, your phone model and its operating system version. No names, workouts, messages or photos are included.
Where a provider is outside the UK, the transfer is covered by the safeguards in their terms (standard contractual clauses or the UK addendum). We also share information where the law requires it.
How long we keep it
For as long as you have an account. Delete your account and it goes immediately: workouts, posts, comments, messages, photos and medals are removed, not archived. Encrypted database backups are kept for up to 7 days and overwritten after that. Content someone else has reported may be kept a little longer if we need it to act on the report.
Deleting your account
In the app: Profile → the cog → Delete my account, or on this website. No email, no waiting.
Your rights
Under UK data protection law you can ask for a copy of your data, ask us to correct it, delete it, restrict or object to how we use it, or ask for it in a portable form. Email support@curlyworkout.com and we will answer within one month. If you are not happy with our answer you can complain to the Information Commissioner's Office at ico.org.uk.
Children
Curly is for people aged 16 and over. The age check happens when the account is created and cannot be skipped. If we find out an account belongs to someone younger, we delete it.
Security
Every connection is encrypted. Who can read which row is enforced by the database itself, not by the app, so a faulty or modified app still cannot reach someone else's data. Passwords are hashed by our sign-in provider.
Cookies
This website uses one kind of cookie: the one that keeps a gym owner signed in to the dashboard. There is no analytics, advertising or third-party tracking, which is why there is no cookie banner to click.
Changes
If we change this policy we will update the date at the top, and tell you in the app if the change matters.