Last Updated: December 2025
Welcome to HeySquad ("we," "our," or "us"). HeySquad is a fitness accountability mobile application that enables users to check in at gyms, create and join squads with friends, and communicate with fellow squad members to stay motivated on their fitness journey.
This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application (the "App"). Please read this Privacy Policy carefully. By accessing or using the App, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access or use the App.
We reserve the right to make changes to this Privacy Policy at any time and for any reason. We will alert you about any changes by updating the "Last Updated" date of this Privacy Policy. You are encouraged to periodically review this Privacy Policy to stay informed of updates.
Data Controller: HeySquad is operated by HeySquad LLC, based in the United States. For questions about this Privacy Policy or your data, contact us at support@heysquad.app.
We collect information that you provide directly to us, information that is collected automatically when you use the App, and information from third-party services. The types of information we collect include:
When you create an account with HeySquad, we collect the following personal information:
We collect location data only when you initiate a gym check-in within the App. This location data is used exclusively to verify that you are physically present at a gym or fitness facility at the time of check-in. We do not continuously track your location, collect location data in the background, or monitor your movements outside of the check-in process.
What we store: After location verification, we store only the gym's name, Place ID (a unique identifier from Google Places), and the timestamp of your check-in. We do not retain your raw GPS coordinates after the verification process is complete. Your check-in record shows which gym you visited and when, but not your precise location data.
We collect content that you voluntarily create, upload, or share through the App, including:
We automatically collect certain information about your interactions with the App, including:
When you access the App, we automatically collect certain device and technical information, including:
If you enable push notifications, we collect your device's push notification token. This token is used exclusively to deliver notifications about squad activity, messages from squad members, check-in reminders, and other App-related communications. You may disable push notifications at any time through your device settings.
We use the information we collect for various purposes related to providing, maintaining, and improving the App. Specifically, we use your information to:
For users located in the European Economic Area (EEA), United Kingdom, or other jurisdictions that require a legal basis for processing personal data, we rely on the following legal grounds:
We process certain personal data as necessary to perform our contract with you—specifically, our Terms of Service. This includes processing required to:
We process certain personal data based on our legitimate interests, provided that such interests are not overridden by your rights and interests. Our legitimate interests include:
In certain circumstances, we process your personal data based on your explicit consent. You provide consent when you:
Where we rely on consent as the legal basis for processing, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing conducted prior to withdrawal. You may withdraw consent by adjusting your device settings, disabling specific features within the App, or contacting us directly.
We may process your personal data as necessary to comply with applicable laws, regulations, legal processes, or enforceable governmental requests.
We do not sell your personal information to third parties. We share your information only in the following circumstances and with the following categories of recipients:
Certain information is shared with other users as part of the App's core functionality:
We engage trusted third-party companies and service providers to perform functions on our behalf and to help us provide, maintain, and improve the App. These providers have access to your personal information only to the extent necessary to perform their services and are obligated to protect your information. Our third-party service providers include:
Purpose: Authentication, database management, and file storage infrastructure.
Data Shared: Account information, user-generated content (including photos and messages), and associated metadata necessary to provide and maintain App functionality.
Privacy Policy: https://supabase.com/privacy
Purpose: Gym and fitness facility search, location data, and verification of check-in locations.
Data Shared: Location coordinates at the time of check-in and search queries for gym locations.
Privacy Policy: https://policies.google.com/privacy
Purpose: Real-time messaging infrastructure that enables instant communication between squad members.
Data Shared: Message content, user identifiers, and connection metadata necessary to deliver real-time messages.
Privacy Policy: https://ably.com/privacy
Purpose: Delivery of push notifications to your device.
Data Shared: Push notification tokens and notification content (such as alerts about squad activity and messages).
Privacy Policy: https://expo.dev/privacy
Purpose: Error tracking, crash reporting, and performance monitoring to identify and resolve technical issues.
Data Shared: Device information, App version, error logs, crash reports, and technical diagnostic data. We minimize personal data sent to Sentry and focus on technical information necessary for debugging.
Privacy Policy: https://sentry.io/privacy/
We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency). We may also disclose your information when we believe in good faith that disclosure is necessary to:
In the event that HeySquad is involved in a merger, acquisition, asset sale, bankruptcy, or other business transaction, your personal information may be transferred as part of that transaction. We will provide notice before your personal information is transferred and becomes subject to a different privacy policy.
We retain your personal information for as long as necessary to provide you with our Services and as described below:
You can delete your account directly within the HeySquad app by navigating to Settings → Delete Account. Alternatively, you may send an email to support@heysquad.app from the email address associated with your account, requesting account deletion. Upon deletion:
We implement appropriate technical and organizational measures to protect your personal information, including:
In addition to technical safeguards, we maintain organizational security practices including regular security assessments, employee training on data protection, and incident response procedures.
While we take significant measures to protect your data, you are responsible for maintaining the confidentiality of your account credentials and for any activities that occur under your account. We encourage you to use a strong, unique password and to notify us immediately if you suspect any unauthorized access to your account.
No method of transmission over the Internet or electronic storage is completely secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.
If you are a resident of the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR):
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):
To exercise any of the rights described above, you may:
When submitting a request, please provide sufficient information to allow us to verify your identity and respond to your request. We may require you to verify your identity before we can act on your request. We will respond to your request within the timeframe required by applicable law (typically within 30 days for GDPR requests and 45 days for CCPA requests).
HeySquad is based in the United States, and your personal information may be processed and stored in the United States or other countries where our service providers operate. These countries may have data protection laws that differ from the laws of your country of residence.
When we transfer personal information from the European Economic Area, United Kingdom, or Switzerland to countries that have not been deemed to provide an adequate level of data protection, we implement appropriate safeguards, including:
By using HeySquad, you acknowledge and understand that your personal information may be transferred to and processed in the United States and other jurisdictions. Such transfers are conducted in accordance with the safeguards described in Section 9.2 above and this Privacy Policy.
HeySquad is intended for users who are thirteen (13) years of age or older. We do not knowingly collect, use, or disclose personal information from children under the age of 13.
In compliance with the Children's Online Privacy Protection Act (COPPA), we do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under age 13 without verification of parental consent, we will take steps to delete that information as quickly as possible.
If you are a parent or guardian and believe that your child under the age of 13 has provided us with personal information, please contact us at support@heysquad.app. We will take steps to remove such information from our systems and terminate the child's account.
For users between the ages of 13 and 18, we encourage parents and guardians to be involved in their children's online activities and to discuss the importance of privacy and safe internet use.
You can review and update your account information at any time by accessing your profile settings within the app. This includes your name, profile photo, and other account details.
You can control whether HeySquad has access to your device's location through your device settings:
Please note that disabling location access may limit certain features of the app, such as the ability to check in at gyms.
You can manage your push notification preferences through your device settings or within the app:
You can request deletion of your account at any time by emailing us at support@heysquad.app from the email address associated with your account. Please include "Account Deletion Request" in the subject line. We will process your request within 30 days.
Please note that account deletion is permanent and cannot be undone. Refer to Section 6.2 for details on what happens when you delete your account.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we will revise the "Last Updated" date at the top of this Privacy Policy.
If we make material changes to this Privacy Policy, we will notify you by one or more of the following methods:
Your continued use of HeySquad after the effective date of any changes to this Privacy Policy constitutes your acceptance of the updated policy. If you do not agree to the changes, you should discontinue your use of the app and delete your account.
If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us at:
Email: support@heysquad.app
When contacting us, please provide sufficient information to help us understand and respond to your inquiry. We will make every effort to respond to your request in a timely manner.
For EU/EEA residents, you also have the right to lodge a complaint with your local data protection authority if you believe that we have not complied with applicable data protection laws.