Who sees what, and who doesn't

One of Cookrange's design principles is that data access is scoped to relationships that already exist in real life: a gym sees its own occupancy, a coach sees their own athlete, nobody can access someone else's body data. This page summarizes how those boundaries are enforced technically.

Infrastructure

• Hosting: static/edge deployment on Vercel.
• Data store: Firebase (Google Cloud infrastructure), with per-user access rules.
• Location data: nearby gym/coach ranking is computed on-device; no coordinate is sent to or stored on a server.

Who can see what

Gym businesses see only their own aggregate occupancy and peak-hour data by default — no individual user data by default. A member can separately turn on a tiered, default-off permission that shares a narrow summary with their gym or coach — check-in frequency, logging consistency, or the direction their weight is moving — with raw data never shared through that path either, and the member can turn it off at any time. Squad members only see each other's streak status and check-ins, not nutrition history. See the gym ecosystem, community and progress analytics pages for details.

Sub-processors

The full list of third parties that process data is kept on the sub-processors page and published as it's updated.

Reporting a vulnerability

If you find a security vulnerability, please report it to contact@cookrangeapp.com before disclosing it publicly. A structured /.well-known/security.txt file also points to this address.

Accessibility & compliance

For KVKK/GDPR compliance details, see the Privacy Policy; for accessibility targets, see the Accessibility Statement.