Website terms & privacy

Privacy Policy

1. Who is responsible for your information?

Yury Tomachinskiy, operating as MyFitMate, is responsible for the personal information collected for this website. Where data protection law uses the term, I am the data controller. For privacy questions or requests, email [email protected].

2. Information we collect and why

• Accounts: your email address, a protected password hash, an account identifier, account creation and update dates, email-verification status, and sign-in session records. We use these to create and secure your account, sign you in, verify your email, and support password recovery.
• Bookmarks: the venues and events you bookmark and the dates you save them. We use these to show your private bookmark list across devices. Your bookmarks are not published or sent to gyms or event organisers.
• Messages and forms: the contact details, message, report, proposal or attachments you choose to send through email or our linked feedback and sponsorship forms. We use them to reply, investigate reports and manage enquiries. Please do not send passwords, full card details or unnecessary medical information.
• Newsletter: if you subscribe separately, your email address and subscription preferences, together with delivery and engagement information provided by the newsletter service. We use these to send and manage the newsletter. Creating a website account does not subscribe you.
• Support payments: Stripe processes your payment and may make your email, name, amount, currency, payment status, receipt, billing details and limited payment-method information available to us. We use these for payment administration, refunds, disputes and accounting. Your full card number and card security code are entered on Stripe’s checkout and are not received or stored by the MyFitMate website.
• Technical and security information: requests to our website and infrastructure may include your IP address, browser and device information, requested URLs, timestamps and response or error details. We use these to deliver pages, diagnose problems and prevent abuse. Account rate limits use protected identifiers derived from an IP address or account identifier.
• Website usage: we use Simple Analytics for page views, referring websites, campaign tags, broad device/browser information and approximate country. This helps us understand which pages and links are useful. We do not send your account email, password or bookmark list to this analytics service.
• Public listings: venue and organiser names, public contact details, event information and images may come from their websites, public social posts, booking schedules or information supplied to us. We use this material to maintain the directory and guides. Contact us to request a correction or discuss an image or listing.

You can browse without an account. An email and password are required if you want an account and synced bookmarks. Our website calorie calculator runs in your browser: it does not submit or save the age, sex, height, weight or targets you enter.

3. Our reasons for using personal information

Where UK or European data protection law applies, we rely on the following lawful bases:

• Contract (providing the service you request): managing your account and bookmarks, sending account emails and administering a support payment.
• Legitimate interests: keeping the site secure, preventing abuse, responding to enquiries, maintaining useful public listings and understanding aggregate website usage. We consider your privacy rights when using information for these purposes.
• Consent: sending an optional newsletter you subscribe to, and other optional processing where consent is required. You can withdraw consent without affecting the lawfulness of earlier processing.
• Legal obligations: keeping necessary financial records, responding to valid legal requests and meeting applicable legal requirements.

We do not sell your personal information or use your account or bookmarks for targeted advertising. We do not make decisions with legal or similarly significant effects about you based solely on automated processing.

4. Cookies, browser storage and analytics

We use essential cookies for sign-in, request security and email verification. The sign-in cookie can last up to 30 days; server-side sessions normally expire after seven days without use or 30 days from sign-in. Security and signup-verification cookies last up to 24 hours.

Your light/dark theme is stored in your browser. During signup and sign-in, temporary browser-tab storage may remember your email for the verification screen or a bookmark you want to save after signing in. You can clear this storage in your browser settings; blocking essential cookies prevents account features from working.

According to Simple Analytics’ data collection documentation, it does not use tracking cookies, fingerprint visitors, or store visitor IP addresses. This does not mean our hosting, security or payment providers never process IP addresses. Authentication, recovery and private account pages do not load our analytics script.

Maps, checkout and other external services may use their own cookies or browser storage when you open them. Their linked policies explain these practices.

5. Who receives information and how it is shared

Information is shared when your browser requests a page or a third-party feature, when you submit a form, or when our server sends data needed to provide a service. Your browser connects to our public website, linked forms and checkout over HTTPS. Account emails are sent through the AWS SES service interface. The following providers receive the information needed for their roles:

• Amazon Web Services (AWS): website and database infrastructure, backups and account-email delivery through Amazon SES. SES receives the recipient email address and message content. AWS privacy information.
• Cloudflare: network delivery and website protection, including request and device information needed to serve and secure the site. Cloudflare privacy information.
• Simple Analytics: the limited website-usage information described above. Simple Analytics data collection.
• Tally: hosts the feedback, report and sponsorship forms linked from the site. When you submit one, Tally processes the form contents and makes your response available to us. Tally privacy information.
• Buttondown: handles newsletter subscriptions, delivery and unsubscribe requests. Buttondown privacy information.
• Stripe and your payment providers: handle checkout, payments, fraud prevention and receipts. Payment data goes directly to Stripe when you open or use checkout; the transaction information described above is made available to us through Stripe. Stripe privacy information.
• Apple iCloud Mail: handles messages sent to our contact email, including replies and email-delivery reports. Apple privacy information.
• Maps and external assets: map views may load Google Maps or OpenStreetMap tiles, and some pages load libraries or images from external servers. Those servers receive the network information needed to answer your browser’s request, such as an IP address and browser information. See Google’s Privacy Policy and the OpenStreetMap Foundation Privacy Policy.

Authorised people who maintain MyFitMate may access information when needed to operate the site, respond to you or investigate security issues. We may also disclose relevant information to professional advisers or authorities when required by law or necessary to protect legal rights.

Links to gyms, booking services, social networks and other websites take you to services with their own privacy practices. Saving a bookmark is not a booking and does not send your account details to that venue.

6. Where information is processed

Our website hosting, account database and account-email service use AWS infrastructure in the United Kingdom (London region). Other providers and their subprocessors may process information in additional countries, including the European Economic Area and the United States. Their linked privacy notices explain their international processing and transfer protections. Contact us if you want details of the transfer arrangements and safeguards relevant to your information.

7. Retention and account deletion

• Account and bookmarks: kept while your account exists. You can remove bookmarks individually or delete your account in Account → Settings. Deletion removes your email, password hash, bookmarks, sessions, action tokens and queued account emails from the live account database.
• Unfinished signup: pending accounts older than seven days are removed during routine cleanup. Verification links expire after 24 hours and password-reset links after 30 minutes. Expired tokens, sessions and rate-limit records are removed during routine cleanup.
• Account emails: queued content is removed after successful sending or expiry. Delivery or suppression records may remain with email providers where needed to manage bounces, complaints and abuse.
• Backups: deleted information may remain in backup copies until those copies expire or are removed. We retain a minimal account identifier and deletion date to prevent deleted accounts from returning when a backup is restored. This record is kept until all restorable backups that could contain the account have expired or been removed.
• Operational logs: our application logs are normally retained for 14 days, and nginx access logs rotate daily with ten retained rotations. Infrastructure providers may keep separate security and diagnostic records under their own policies.
• Enquiries, newsletter and payment records: kept for as long as needed to handle your request, maintain the subscription, administer payments, resolve disputes or meet legal record-keeping requirements. The purpose, applicable obligations and need to resolve outstanding issues determine the period. Newsletter providers may retain an unsubscribe record so they can respect your choice.

Deleting a website account does not automatically unsubscribe a separately managed newsletter or erase payment records required for accounting. Use the newsletter’s unsubscribe link or contact us for help with other information.

8. How we protect information

We use HTTPS, restricted administrative access, protected password hashes, secure sign-in cookies, request-forgery protections and rate limits. Verification and recovery tokens are stored as hashes, and queued account-email content is encrypted. Private account responses are excluded from shared website caches. These measures reduce risk, but no website or transmission method can guarantee complete security.

9. Your choices and rights

Depending on the law that applies, you may request access to your personal information, correction, deletion, restriction of processing or a portable copy of information you provided. You may also withdraw consent and object to processing based on legitimate interests, including explaining your particular circumstances. Some rights have exceptions, for example when records must be kept to meet a legal obligation.

To make a request, email [email protected]. We may ask for enough information to verify that the request concerns you. We respond within the time required by applicable law. You can also complain to your local data protection authority; where UK law applies, this includes the Information Commissioner’s Office.

Newsletter subscriptions are optional. Unsubscribe using the link in any newsletter. Withdrawing newsletter consent does not stop account verification, recovery or necessary security messages.

10. Children and changes to this policy

Our account and payment features are intended for adults. We do not knowingly collect personal information from children through these features. If you believe a child has provided information, contact us so we can investigate and remove it where appropriate. Guides about children’s activities do not require a child to create an account.

We may update this policy as the website changes. The date above identifies the current version. If a change materially affects how account information is used, we will provide an appropriate notice.

Terms & Conditions

1. About the website

MyFitMate is an independent fitness directory and information website operated by Yury Tomachinskiy. These terms apply to your use of myfitmate.app and its website account features. By using the website, you agree to these terms. If you do not agree, please do not use the service.

2. Listings, schedules and guides

We try to keep information useful and current, but class times, prices, availability, opening hours and event details can change. Confirm important details directly with the venue or organiser before travelling, booking or paying. Availability shown on MyFitMate is informational and does not reserve a place.

MyFitMate does not run the listed venues or events and is not the seller or booking agent for their services. Any booking, purchase or participation agreement is between you and the relevant provider, under their terms, cancellation policy and safety requirements.

3. Fitness and health information

Guides, class descriptions and calculators provide general information. They are not personal medical advice, a diagnosis or an individual training prescription. Consider your health, experience and the provider’s requirements before participating. Seek qualified advice when you need it.

4. Accounts and bookmarks

You must be at least 18 to create a website account or make a support payment. Use an email address you control, keep your password private and let us know if you believe someone has accessed your account without permission.

Bookmarks are a private convenience feature. They do not book a class, guarantee availability or entitle you to a particular price. A listing can change, become unavailable or be removed. You can delete your account in Account → Settings.

5. Acceptable use and content

Do not misuse the website, attempt unauthorised access, disrupt its operation, send spam, or submit unlawful, abusive, misleading or infringing material. Reports, proposals and other submissions should be accurate to the best of your knowledge, and you must have the right to share any material you send.

Submitting feedback does not make it public. If you submit venue or event information for publication, you permit us to use that material to maintain the relevant listing. This permission does not transfer ownership of your material.

MyFitMate’s original text, design and software belong to their owners. Third-party names, logos, images and other materials remain the property of their respective owners. Contact us about corrections, attribution or removal requests at [email protected].

6. Coffee and other voluntary support

“Buy me a coffee” is optional, one-time support for maintaining MyFitMate. It is not a gym booking, subscription, product purchase or charitable donation, and it does not unlock paid features or promise a particular future service.

The suggested and preset amounts are in GBP. You can choose another amount in checkout. Stripe may offer another payment currency; check the final amount, currency and any conversion information before confirming. Your bank or payment provider may apply additional charges.

Your card statement may show APPLANTIDA, the payment account’s statement descriptor.

Payments are processed on Stripe’s checkout. No recurring payment is created by the coffee link. If you make an accidental or duplicate payment, contact [email protected] promptly with your receipt or transaction reference. We review refund requests individually, subject to any rights you have under applicable law. Do not email card numbers or security codes.

7. External services and sponsorship

External websites, booking systems, newsletters, forms and payment services have their own terms and privacy policies. We do not control their availability or how they operate. Any paid sponsorship or promoted placement will be identified as such; a listing or link does not guarantee a provider’s quality or suitability.

8. Availability and responsibility

We may update the website, correct or remove listings, change features or temporarily interrupt access for maintenance or security. We may restrict accounts that misuse the service, taking reasonable account of the circumstances. You can contact us if you believe a restriction is a mistake.

To the extent permitted by law, we do not guarantee uninterrupted access or complete accuracy and are not responsible for losses caused by a third-party venue, event, booking service or an external website. Nothing in these terms excludes liability for fraud, for death or personal injury caused by negligence where that liability cannot lawfully be excluded, or limits any other liability or consumer right that the law does not allow us to exclude or limit.

9. Changes and contact

We may revise these terms as the website develops. The date above identifies the current version, and we will give appropriate notice of material changes affecting account users. These terms do not override mandatory rights under the law that applies to you.

Questions, complaints, payment issues and legal requests can be sent to [email protected].