Privacy policy

Last updated 11 November 2026

ScanIron is run by Themicroforge Ltd, trading as The Microforge (registered in England and Wales, company number 17490600, registered office 71–75 Shelton Street, Covent Garden, London WC2H 9JQ), which decides what is kept and why. Gym members need no account; the people who manage a gym do, and this page covers both.

If you scan a code at your gym

Scans are counted, people are not. When you open a machine's guide we record which machine and when, so the gym can see which guides are used. Nothing about you or your phone is kept with it.
Your IP address isn't kept in our database. Like any website, our servers see it when you open a page. It is used to limit how often one address can ask, and appears in the servers' request logs, which are kept only as long as it takes to deal with faults and abuse.
On your phone, your browser remembers the steps you have ticked and that this visit was counted, until you close the tab. That stays on your phone and isn't sent to us.
Videos load from YouTube or Vimeo only when you tap play. From then on that service sees your request, as it would if you watched there, under its own privacy policy.

If you manage a gym

Your account: your email address and a salted hash of your password. Links we email you, to reset a password or accept an invite, are stored only as hashes.
Your gym: its name, web address, time zone, logo and colours, its own domain if it has one, and the categories, machines, instructions, photos and video links you add.
Your team: the email addresses of the people invited to manage the gym, and who its owner is.
Billing: your gym's plan, whether it is paid monthly or yearly, and when it renews.

What we use it for

To run the service: showing your gym's guides, counting scans, signing you in and keeping your plan. We also use it to keep the service secure and free of abuse, and to understand how many gyms sign up and pay. We don't sell personal data and we don't use it for advertising.

How long we keep it

A gym's content, team and scan counts are kept for as long as the gym has an account. Deleting a machine deletes its scans, and removing a teammate deletes their account. Links we email expire after an hour (password resets) or seven days (invites). To delete a gym and everything in it, write to us.

Who else handles it

Paddle, which sells our paid plans. It collects what it needs to take a payment and charge tax (your name, email, card and billing address) and handles it under its own privacy policy. Paddle and we each answer for our own part. We never see your card.
Resend, which delivers our email.
Our hosting provider, which runs the service and stores the database, its backups and the photos and logos gyms upload.
YouTube or Vimeo, only when someone plays a gym's video.

Cookies and advertising

None. No cookies, no advertising and no trackers, and the fonts are served from our own servers. If you sign in to manage a gym, your browser keeps the token that keeps you signed in, in its own storage for the dashboard, until you sign out.

Your rights

You can ask what we hold about you, and to have it corrected or deleted, by writing to hello@scaniron.com. You can also complain to the Information Commissioner's Office.