How we handle your data

Last updated 26 October 2026. This policy is for Garage Gym and this website, published by Harson Group Pty Ltd (Harson.ai). Harson Ballistics has its own policy.

1. Who we are

Harson Group Pty Ltd (ABN 20 674 654 132, GST registered) is an Australian private company. We trade as Harson.ai. We publish Garage Gym on the Google Play Store.

Contact for privacy, access, correction, and deletion: info@harsongroup.com.au.

We follow the Australian Privacy Principles under the Privacy Act 1988 (Cth), and the Notifiable Data Breaches scheme. This page is also the privacy URL we give to Google Play.

2. What this app is (and is not)

Garage Gym is a household workout log. You tick the equipment you have, log sets, and share that log with people in the same house.

It is not a medical device. It does not diagnose, treat, cure, or prevent any condition. It is not directed at children. It is not a social network and not a public feed of your sets.

3. What we collect

You give us this when you use Garage Gym. We do not scrape your Google or Apple account.

Account and house. A first name, Male or Female (used for colour in the house), and a household code you create or join. We do not ask for an email or password on first run. There is no Google or Apple login.

Training data. Equipment ticks, saved sessions, sets (exercise, weight, reps, time), and optional bodyweight if you type it. That is health and fitness data you choose to log. We do not read clinical records, Health Connect, or Apple Health.

On-device. The app stores a local copy of your log and a short-lived house token so this phone can sync that house. Notifications are only for the rest timer if you allow them.

Technical. To stop abuse of join (guessing house codes), our join server may process an IP-derived hash for a short rate-limit window. We do not use that for advertising. This website is served by Cloudflare. It may set a standard security cookie. This website does not run ads.

Analytics. To see which screens help people and which lose them, the Android app uses Google Analytics for Firebase, a Google service. It records how the app is used: which screens are opened, which buttons are tapped during set-up and on the subscription screen, whether a free month or a purchase was started (with the plan and its price), and when the first workout is logged. Firebase also collects, automatically, an ID for this install of the app, your device’s advertising ID, the device model, operating system, language and app version, and an approximate location (country and city) worked out from your IP address. It does not receive your name, your household code, your workouts, your notes, your bodyweight or your email.

We use this to improve the app and to measure our Google advertising (for example, counting how many people who installed from an ad started a free month). Google processes it under its own terms and privacy policy. We keep analytics data for 2 months. You can reset or delete your advertising ID in your phone’s settings (search Settings for “Ads”).

We never see or store your card details. Garage Gym needs a household subscription (the first month is free): payment is taken by Google Play, and the subscription is managed for us by RevenueCat. All we receive is whether a household is subscribed. We do not sell personal information. We do not buy data about you.

4. Why we collect it

To run Garage Gym: show your log, sync it to the household you joined, generate sessions from the gear you ticked, and (only if the house opts in) show House League totals. We also use it to fix bugs, keep the service stable, and answer support mail you send to info@.

Garage Gym needs a subscription. One household subscription covers everyone in that house: whoever creates the house subscribes (the first month is free), and anyone who joins with the house code uses that subscription. Without an active subscription you can still view what you have logged, but not log new workouts. Purchases are handled by Google Play under its in-app purchase rules, and we never receive your payment details.

5. Who can see it

Your house. Anyone who has the household code can join that house and see the shared log. The code is the join secret. Treat it like a password. Do not post it publicly.

House League. If a house opts in, we show public aggregates for that house (for example weekly tonnage and sessions). We do not publish a feed of other people’s individual sets.

Our processors. App data is stored with Supabase in Sydney, Australia (ap-southeast-2). Subscription status is managed by RevenueCat, Inc. (United States), which receives an anonymous purchase identifier and what was bought — not your name and not your log. App usage analytics (described in section 3) are processed by Google (Google Analytics for Firebase). This website is hosted by Cloudflare. They process data only to provide that infrastructure.

The store. Google Play may process install, crash, purchase and review data under its own policy. We do not get your Play password.

We do not share your log with advertisers or data brokers. We will disclose information if Australian law requires it.

6. Overseas disclosure

Your Garage Gym log is stored in Australia. Subscription status is processed by RevenueCat in the United States. App usage analytics are processed by Google, which can include servers in the United States and elsewhere. Support email and this website may be processed on Cloudflare’s network, which can include servers outside Australia. We take reasonable steps so those providers handle personal information in a way that is consistent with the APPs.

7. Security

Traffic uses HTTPS. After you join a house, the cloud only returns that house’s rows to a phone that has a valid house token. Knowing a house code as a URL is not enough to dump the database. No security is perfect. If we have reasonable grounds to believe a data breach is likely to cause serious harm, we will follow the Notifiable Data Breaches scheme, including notifying affected people and the OAIC where required.

8. How long we keep it

We keep house data while the household exists and the app needs it to sync. If you ask us to delete a house, we delete the cloud copy we hold for that house, unless we must keep a record (for example a legal claim). Device copies stay on a phone until that person leaves the house or uninstalls.

9. Access, correction, export, delete

You can export a backup in More. You can leave the household on a device so that phone stops syncing. You can delete the household from this device in More (that does not always wipe every cloud copy if other members still use the house).

To access, correct, or delete personal information we hold in the cloud, email info@harsongroup.com.au. We will handle it in a reasonable time. If we refuse (for example we cannot find you, or the law says we must keep something), we will say why unless the law stops us.

This is also the deletion path Google Play asks for. There is no login-walled form. Mail is enough.

10. Children

Garage Gym is for adults who share a garage. It is not directed at children under 16. We do not knowingly create kids’ accounts. If you believe a child has used the app, email us and we will delete that data.

11. This website

harson.ai is our company and product site. It does not require an account. If you email us, we keep that thread to answer you.

12. Complaints

Email info@harsongroup.com.au first and we will try to fix it. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner: oaic.gov.au.

13. Changes

If we change what we collect or how we use it in a material way, we will update this page and the date at the top. Keep using the app after a material change means you are using it under the new policy. If we ever need extra consent (for example a new data type), we will ask in the app.

Related: support.