Who sees what, and who doesn't

One of Cookrange's design principles is that data access is scoped to relationships that already exist in real life: a gym sees its own occupancy, a coach sees their own athlete, nobody can access someone else's body data. This page summarizes how those boundaries are enforced technically.

Infrastructure

• Hosting: static/edge deployment on Vercel.
• Data store: Firebase (Google Cloud infrastructure), with per-user access rules.
• Location data: nearby gym/coach ranking is computed on-device and that coordinate never leaves the phone. Checking in by GPS is the one exception: your coordinate goes to a server function that confirms you are actually at the gym. The coordinate itself is not stored — only the rounded distance is written to our server logs.

Who can see what

A gym sees its own member list and its own check-in records — each carrying the member's display name, photo and the time — plus its aggregate occupancy and peak-hour figures. That is attendance data about its own members, and it is what a gym needs to run. What a gym never sees is your nutrition history or your weight history. A member can separately turn on a tiered, default-off permission that shares a narrow summary with their gym or coach — check-in frequency, logging consistency, or the direction their weight is moving — with raw data never shared through that path either, and the member can turn it off at any time. Squad members only see each other's streak status and check-ins, not nutrition history. See the gym ecosystem, community and progress analytics pages for details.

Sub-processors

The full list of third parties that process data is kept on the sub-processors page and published as it's updated.

Reporting a vulnerability

If you find a security vulnerability, please report it to contact@cookrangeapp.com before disclosing it publicly. A structured /.well-known/security.txt file also points to this address.

Accessibility & compliance

For KVKK/GDPR compliance details, see the Privacy Policy; for accessibility targets, see the Accessibility Statement.