How we handle your data

Last updated 26 August 2026. This policy is for Garage Gym and this website, published by Harson Group Pty Ltd (Harson.ai). Harson Ballistics has its own policy.

1. Who we are

Harson Group Pty Ltd (ABN 20 674 654 132, GST registered) is an Australian private company. We trade as Harson.ai. We publish Garage Gym on the Google Play Store and, later, the Apple App Store.

Contact for privacy, access, correction, and deletion: info@harsongroup.com.au.

We follow the Australian Privacy Principles under the Privacy Act 1988 (Cth), and the Notifiable Data Breaches scheme. This page is also the privacy URL we give to Google Play and Apple.

2. What this app is (and is not)

Garage Gym is a household workout log. You tick the equipment you have, log sets, and share that log with people in the same house.

It is not a medical device. It does not diagnose, treat, cure, or prevent any condition. It is not directed at children. It is not a social network and not a public feed of your sets.

3. What we collect

You give us this when you use Garage Gym. We do not scrape your Google or Apple account.

Account and house. A first name, Male or Female (used for colour in the house), and a household code you create or join. We do not ask for an email or password on first run. There is no Google or Apple login.

Training data. Equipment ticks, saved sessions, sets (exercise, weight, reps, time), and optional bodyweight if you type it. That is health and fitness data you choose to log. We do not read clinical records, Health Connect, or Apple Health.

On-device. The app stores a local copy of your log and a short-lived house token so this phone can sync that house. Notifications are only for the rest timer if you allow them.

Technical. To stop abuse of join (guessing house codes), our join server may process an IP-derived hash for a short rate-limit window. We do not use that for advertising. This website is served by Cloudflare. It may set a standard security cookie. We do not run ads or an ads SDK.

We do not collect payment card numbers in the current app (there is no paywall yet). We do not sell personal information. We do not buy data about you.

4. Why we collect it

To run Garage Gym: show your log, sync it to the household you joined, generate sessions from the gear you ticked, and (only if the house opts in) show House League totals. We also use it to fix bugs, keep the service stable, and answer support mail you send to info@.

If a later version adds a paid House plan, we will update this policy before we collect billing details, and Play / App Store in-app purchase rules will apply.

5. Who can see it

Your house. Anyone who has the household code can join that house and see the shared log. The code is the join secret. Treat it like a password. Do not post it publicly.

House League. If a house opts in, we show public aggregates for that house (for example weekly tonnage and sessions). We do not publish a feed of other people’s individual sets.

Our processor. App data is stored with Supabase in Sydney, Australia (ap-southeast-2). This website is hosted by Cloudflare. They process data only to provide that infrastructure.

The stores. Google Play and Apple may process install, crash, and review data under their own policies. We do not get your Play or App Store password.

We do not share your log with advertisers or data brokers. We will disclose information if Australian law requires it.

6. Overseas disclosure

Your Garage Gym log is stored in Australia. Support email and this website may be processed on Cloudflare’s network, which can include servers outside Australia. We take reasonable steps so those providers handle personal information in a way that is consistent with the APPs.

7. Security

Traffic uses HTTPS. After you join a house, the cloud only returns that house’s rows to a phone that has a valid house token. Knowing a house code as a URL is not enough to dump the database. No security is perfect. If we have reasonable grounds to believe a data breach is likely to cause serious harm, we will follow the Notifiable Data Breaches scheme, including notifying affected people and the OAIC where required.

8. How long we keep it

We keep house data while the household exists and the app needs it to sync. If you ask us to delete a house, we delete the cloud copy we hold for that house, unless we must keep a record (for example a legal claim). Device copies stay on a phone until that person leaves the house or uninstalls.

9. Access, correction, export, delete

You can export a backup in More. You can leave the household on a device so that phone stops syncing. You can delete the household from this device in More (that does not always wipe every cloud copy if other members still use the house).

To access, correct, or delete personal information we hold in the cloud, email info@harsongroup.com.au. We will handle it in a reasonable time. If we refuse (for example we cannot find you, or the law says we must keep something), we will say why unless the law stops us.

This is also the deletion path Google Play asks for. There is no login-walled form. Mail is enough.

10. Children

Garage Gym is for adults who share a garage. It is not directed at children under 16. We do not knowingly create kids’ accounts. If you believe a child has used the app, email us and we will delete that data.

11. This website

harson.ai is our company and product site. It does not require an account. If you email us, we keep that thread to answer you.

12. Complaints

Email info@harsongroup.com.au first and we will try to fix it. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner: oaic.gov.au.

13. Changes

If we change what we collect or how we use it in a material way, we will update this page and the date at the top. Keep using the app after a material change means you are using it under the new policy. If we ever need extra consent (for example a new data type), we will ask in the app.

Related: support.