Orion Gym Privacy Policy

Effective 12 October 2026

This privacy policy applies to the Orion Gym mobile app (Google Play package com.orion.gym, also on the Apple App Store) and to the Orion Gym web dashboard at gym.orion-fit.com. The app is developed and published by Mars Solutions s.p., the developer name shown on its Google Play listing.

Orion Gym is check-in and membership software for gyms: a web dashboard for the gym, a phone app for its staff, and the same app as a membership card for its members. This policy explains what data Orion Gym processes, why, who sees it, how long it is kept, and what you can do about it.

Who we are

In this policy "we" means Mars Solutions s.p., the developer and operator of the Orion Gym app and service.

Two roles: your gym and us

• Your gym decides what it records about its members (for example your name, phone and membership) and why. For those records the gym is the data controller and we process them on its behalf, only to run the service for it.
• We are the controller for your Orion Gym app account (the account you sign up with in the app) and for the technical data we need to keep the service working and secure.

Questions about what your gym records about you are best sent to your gym first; we will help it answer.

What we process

Member records kept by a gym

• first and last name, member number, phone, e-mail and date of birth, if the gym enters them;
• a photo, if the gym takes one at the desk (it is used to recognise you at the entrance);
• memberships, prices, payments and debts, as the gym records them;
• visits: the time of each entry or refusal, the desk it happened at, and the staff member involved;
• notes the gym's staff write, and the history of changes to your record;
• membership cards or key fobs (stored only as a one-way hash of the card's code).

Your app account

• first and last name, phone and e-mail;
• your password, stored only as a salted scrypt hash, never in readable form;
• the phone model and the public half of your card key. The private key is created on your phone, stays in its secure hardware (Secure Enclave on iPhone, Android Keystore) and never leaves it;
• a push notification token, if you allow notifications;
• which gym you joined, and your member record there.

Gym staff

• name, e-mail, role and password (as a hash);
• sign-in sessions: device name, IP address and browser, to keep accounts secure;
• what each staff member did: sales, payments, entries let in and changes to member records (an audit log the gym can review).

Technical data

• IP addresses and request times in server logs and in the audit log, to secure the service and investigate abuse.

We do not use advertising, analytics or tracking tools, we do not build profiles, and we do not sell or rent anyone's data. The app does not use your location.

Why we process it

• to let you into the gym: the app shows a QR code that changes every few seconds and the desk checks it against your membership;
• to let the gym run memberships, payments, reminders and its front desk;
• to show you your membership, visits and the gym's news in the app;
• to send notifications you allowed: membership reminders and messages from your gym (you can turn offers and reminders off in the app);
• to keep the service secure: sign-in protection, rate limits and the audit log.

Legal bases: providing the service you or your gym asked for (contract), the gym's and our legitimate interest in a secure and abuse-proof entry system, and your consent for notifications, which you can withdraw at any time in your phone's settings or in the app.

Who receives data

• Your gym: its staff see the member record they keep and your visits. A gym never sees another gym's data.
• Hetzner Online GmbH: our servers and database are hosted in its data centre in Helsinki, Finland (EU).
• Apple and Google: only to deliver push notifications (Apple Push Notification service, Firebase Cloud Messaging). They receive the device token and the notification text.
• Authorities, only when the law requires it.

How long we keep it

• App account: until you delete it. "Delete account" in the app removes your name, phone, e-mail, password and push token at once and disconnects your phone from the gym.
• Gym records: as long as the gym keeps you as a member and as its own legal obligations (for example accounting) require. Payments and entries are kept as an unchangeable record so they cannot be altered afterwards. The gym can archive a member; ask your gym if you want your record removed.
• Staff sessions: a session ends after 14 days without use or 60 days after sign-in; it is deleted 30 days after it ends.
• One-time activation codes: deleted 30 days after they expire or are used.
• Backups: kept for a limited time for recovery, then overwritten.

Security

• all traffic is encrypted (HTTPS);
• passwords, sign-in tokens and card codes are stored only as hashes;
• QR codes are signed by your phone, are valid for less than a minute and work only once, so a screenshot cannot be reused;
• each gym's data is kept apart, and staff accounts have roles with limited rights.

Your rights

You can ask for a copy of your data, its correction or deletion, restrict or object to its processing, and receive it in a portable form. You can delete your app account yourself in the app (Account → Delete account). For anything else, write to milanblaz2580456@gmail.com; we answer within 30 days. You can also complain to your data protection authority (in Bosnia and Herzegovina, the Personal Data Protection Agency).

Children

App accounts are for people aged 16 and over. A gym may keep records of younger members with their parents' or guardians' consent; that is the gym's responsibility.

Changes

If this policy changes, we update it here and change the date above. Important changes are also announced in the app.