My gym recently decided to “outlaw” their physical membership/access cards, replacing them with a mandatory app (iPhone or Android only, of course), with a generated QR code that we’re supposed to scan in order to gain access.
I really like the gym so I’d prefer not to leave them, and I’m all for being constructive.
So when I send them an email to complain, I’d like to include some alternatives for them to consider. (Of course I’m not expecting them to change their system for me, but at least it might open a dialogue and a reflection on their side).
Here are the reasons they have for switching to App only :
too much fraud (people would share their access cards with their friends) → this is their official reason
too expensive / too much of a hassle to deal with 2 systems → they didn’t say this but I suppose it’s a fair reason - except that they are keeping the card system for people under 16
data collection → they explicitly denied this………… but…
Here are some alternative that I though of :
photos on the membership cards → would reduce the risk of fraud, but makes their job more difficult
a QR code generated not through the App but on a mobile website, that could be accessed with any phone (non-iPhone or Android) with a basic web browser
an App that runs on de-googled phones (I haven’t tested theirs), or on Linux phones, or feature phones (like the first Mudita)
make their App open source so at least it can be verified for data collection and/or ported to other platforms
biometrics (i.e. face/eye/finger scans) : obviously out of the question, I heard some place are experiencing with this. Utter madness.
Any other idea ?
Another thing I would like to include is a list of reasons for rejecting their App. Here’s what I have :
Apple and Google → I am paying for my gym subscription, it should not come with a requirement to register with those companies
Smartphone addiction (a subject we’re familiar, here!)
Data protection, their App is closed source and therefore un-trustable
Being a private company, I’m afraid they won’t be very receptive to those arguments. I read the earlier post about the parking/road access in the Alps that required scanning a QR code. When governments start doing it too it becomes much more problematic, but at least in that case there might be legal arguments to fight it.
Any input from you all is welcome in fighting this daily battle against invasive digitalisation !
Sorry to hear you’re facing this, it sucks when you’re forced to use your phone to do anything. Not only does it increase our reliance on phones but it also deliberately prices out a portion of the population who can’t afford access to a phone and the resources needed to run that app. Maybe someone has an older phone that doesn’t support the app and they can’t afford to upgrade, or maybe they can’t afford a cellular connection required to generate the QR code. It’s so hostile.
Do you know if the QR code changes every time you sign in, almost rotating like a one time password? If it isn’t rotating, you could put it into an app like CalmQR and scan it from the Mudita Kompakt. I’m sure you’ve already considered this route though, but I thought it was worth mentioning.
Depending on their implementation for this QR code generation and scanning, you could potentially intercept the API requests made from the app and map out the API endpoints so you can reproduce them on your own. Then you could create a custom version of the app that calls those API endpoints in order to fetch the QR code data and display it on your device of choice. This would at least make it possible to run the app on a de‑Googled device. I recently went this process with a bike share app we use in Philadelphia called Indego – mapping out all of the API endpoints and recreating them in a custom app built for the Mudita Kompakt.
The fact they’re keeping the card system for people under 16 is a dead giveaway that they could still support this for you if they wanted to. Would they really rather lose a member of their gym (and potentially more members of their gym) over a restriction this permissive?
I’m interested in the API request interception method, if you have more info send it my way !
About your first point, it’s true that people with an impediment of any kind (poor, old, disabled…) are affected, but while very true and important it misses the larger argument of our individual freedom being eroded (freedom from forced participation in a corporate-led system).
Actually I’d be interested in any info on how the App manages my “identity”. I assume it is somehow bound to my phone or sim card, and contacts the QR code generation API with some kind of identifier ?