Boxly

Privacy Policy

Last updated: 26 October 2026 · Italiano · Français

Boxly is an app to book classes at your gym and a panel gyms use to manage schedules, members and memberships. Here we explain which data we process, why, who sees it, for how long and what your rights are. The terms of service govern the use of the app.

Who processes your data

• Your Boxly account (email, password, name, phone and photo if you add them, language, notification devices): the controller is Boxly, a service by Tommaso Rosso, reachable at [email protected]. The controller's full details are available on request at the same address.
• Your membership data at a gym (memberships, entries, fees, recorded payments, bookings, attendance, medical certificate, messages): the controller is the gym you join. Boxly processes it on the gym's behalf as a processor, under an agreement pursuant to Article 28 GDPR, only to run the service. For this data you can also contact the gym directly, which provides its own privacy notice.

Which data

• Account: name, email, password (stored only as a non-readable hash), phone and profile photo if you add them, preferred language.
• Gym: gyms you belong to and your role, memberships and entries, membership fee, payments recorded by the gym, bookings, waitlist, attendance and no-shows, gym messages, notes written by staff.
• Medical certificate: issue and expiry dates, type and, if you upload it, the file (PDF or image). It is health data (Article 9 GDPR).
• Events and competitions: if you register for an event published by a gym (page boxly.run/events/…): email, name, phone, category, team name and members (name, date of birth, sex, tax code, size and email if you enter them), documents the organiser requires (medical certificate or self-certification, waiver, parental consent, ID document, receipt), consents given with date, text version and IP address, scores and leaderboard, check-in code. The event account is separate from your Boxly account, even when you sign in "with Boxly": in that case we copy your name, email and phone into the form and you confirm them.
• The gym's Boxly subscription (only the owner who pays): business name, billing address, VAT number, SDI code or certified email, email, charge history and subscription status. Card details are entered directly on Stripe and never reach Boxly.
• Technical data: device code for push notifications (if enabled), active sessions (with device or browser type), IP address and security logs (logins, failed attempts, errors), staff actions in the panel.

We use no advertising, do not track you across other apps or sites, use no third-party analytics, do no profiling and sell data to no one. The fonts of the site and apps ship with the software: they are not downloaded from external servers.

Why and on what basis

• Creating and managing your account and letting you book: performance of the service you requested (Art. 6(1)(b)).
• Managing membership, plans, fees and attendance on the gym's behalf: performance of the contract between you and the gym (Art. 6(1)(b)), under its instructions.
• Medical certificate: the gym requires it for its sports-activity obligations or its own rules. Boxly stores it and shows it to authorised staff on the gym's behalf, based on your explicit consent (Art. 9(2)(a)), which the app asks for at upload and records with date and text version. You can withdraw it at any time by deleting a not-yet-verified certificate from the app, asking the gym to delete it, or deleting your account; without a valid certificate the gym may not let you book.
• Events and competitions: the controller of registration data is the organising gym; Boxly processes it on its behalf (Article 28 GDPR) to handle registration, documents, check-in and leaderboard: performance of the contract between you and the organiser (Article 6(1)(b)). The medical certificate or fitness self-certification is health data: we process it on the basis of your explicit consent (Article 9(2)(a)), requested at registration and recorded; whoever registers a team declares to have the members' consent and, if their email is entered, they receive a notice. Photos and videos of the event: optional consent. Leaderboards and the participants list are visible only if the organiser enables them, in the format it chooses (full name, team or initials); minors always appear anonymously on public pages and anyone can ask not to appear.
• Notifications (reminders, waitlist seats, cancelled classes, gym announcements): operation of the service; you can turn them off in the app or phone settings.
• Service security and abuse prevention (login attempt limits, logs, staff action tracking): legitimate interest (Art. 6(1)(f)).

Who sees your data

• Your gym's staff, by role: the owner, admins and front desk see your membership data, notes and medical certificate (file included) and verify it; coaches see name, email, bookings and attendance and, of the certificate, only whether it is valid.
• Other members of the same gym see your first name, last initial and profile photo among class attendees, but only if you enable "Show me to other attendees" in your profile; for new accounts it is off and you appear as "Athlete". Coaches' names are shown to members in classes.
• Boxly: the people running the platform may access a gym's data only for support, maintenance or security, in a logged way and within the agreement with the gym.
• Technical providers, only as needed (see below).

Providers and transfers outside the European Union

Servers and backups are in the European Union (Hetzner Online GmbH, Germany). We also use: Cloudflare, Inc. for network, protection and certificates of the site and the API; Google's Firebase Cloud Messaging and the Apple Push Notification service to deliver push notifications; Resend, Inc. to send service emails; Stripe Payments Europe, Ltd. (Ireland) to collect the gyms' subscription, which receives the owner's billing data and card details under its own privacy policy. Cloudflare, Google, Apple and Resend are based or have servers in the United States: transfers go to providers certified under the EU-US Data Privacy Framework or rely on the European Commission's standard contractual clauses, and involve only the technical data needed (IP address and encrypted traffic for Cloudflare, device token and notification text for Google and Apple, email address and email text for Resend). The medical certificate never leaves servers in the European Union.

Push notifications

When you enable notifications, your phone generates a device code (token) that we store on our servers; Google and Apple use it only to deliver notifications. The token is pseudonymous data: on its own it does not identify a person, but it is linked to your account on our servers. Notification text (for example the class name and time) passes through Google's and Apple's servers; for the medical certificate, the expiry notification only says a document is about to expire, without naming it or the gym. We do not use Firebase for analytics, profiling or advertising. The token is deleted when you sign out, use "Sign out everywhere" or uninstall the app.

Cookies and local storage

The site uses no tracking or analytics cookies; Cloudflare may set technical cookies needed for security. The app and the panel store session tokens, the selected gym and the language on the device or in the browser, in the system's protected storage (Keychain, Keystore or encrypted browser storage); they are removed at sign-out. None of this is used to track you.

For how long

• Account: while it is active. When you delete it from the app, personal data is erased immediately and backup copies within 30 days; payments and attendance the gym must keep by law stay with the gym, without your name.
• Medical certificate: record and file are deleted automatically 12 months after the certificate expires, or earlier if you, the gym or an account deletion remove it.
• Events and competitions: uploaded documents (medical certificate included) are deleted automatically after the event ends within the period chosen by the organiser, normally 30 days and at most 90 (they can also delete them earlier); account, registration data and scores are deleted automatically 180 days after the event ends (the organiser can choose between 30 days and 2 years; automatic deletion cannot be turned off), with an email notice 7 days before. Backup copies are overwritten within 7 days. You can delete your event account, or download its data, at any time from the event page.
• Membership data: follows the gym's instructions and is in any case deleted within 30 days after the Boxly service ends for that gym.
• Technical logs (notifications, events, staff actions, security): at most 12 months. Sessions expire after 30 days of inactivity.

How we protect data

Encrypted connections (TLS), argon2id password hashing, role-based panel access with the certificate restricted to the owner, admins and front desk, login attempt limits, staff action logging, uploaded files checked and served only to authorised people, daily encrypted backups, servers in the European Union.

Your rights

You can request access, rectification, erasure, restriction, portability and object to processing. Much of this you can do yourself in the app: from your profile you can edit your data, download all your data as JSON ("Download my data"), withdraw consent on the certificate, change your password, sign out everywhere and delete your account. For anything else write to [email protected]: we reply within 30 days. For your membership data you can also contact the gym. If you believe your data is handled improperly you can lodge a complaint with your supervisory authority (in Italy, the Garante per la protezione dei dati personali, garanteprivacy.it).

Minors

You must be at least 14 to create an account; under 14 the account must be created and managed by a parent or, with the parent's consent, by the gym. For events, a minor is registered by a parent or guardian (or by the team captain with their consent) and the organiser may require a parent's written consent; on the event's public pages minors appear without their name.

Changes

If we change this policy we update the date at the top and, for important changes, let you know in the app.