SmartGym · Digital fitness platform
From QR access to gym operations. One system, 24/7.
We helped the SmartGym team design and build one platform covering members, operations and the door scanner. Mobile and web read the same membership state as the reader at the entrance.
Information
- Platform
- Web, iOS, Android, and kiosk
- Duration
- January to May 2026
- Our role
- We developed the platform together with the SmartGym team. We worked on the web app, mobile app and backend.
- Status
- Public service in operation
Technology
- React
- TypeScript
- Capacitor
- iOS
- Android
- Express
- Bun
- YugabyteDB
- Drizzle ORM
- Tailwind CSS
- GoPay
- Cloudflare R2 & Stream
- FCM / APNs
What you will learn
- 01A door cannot trust a QR image. The decision belongs to a short-lived signature and the current membership state.
- 02A payment webhook only notifies. It is not the source of truth, so payment state gets read back from GoPay.
- 03Face validation checks that a photo has a detectable face and sane landmarks. It never identifies anyone at the door.
- 04Three product interfaces need consistent permissions and audit trails. They also need a controlled release process for mobile and web.
01
From a 24/7 promise to one system
SmartGym has three surfaces. A member app, an operations web and a kiosk or scanner at the door. Members buy a membership and open QR on their phone. Staff handle clients and training, plus payments.
The interfaces share a React and Vite foundation, packaged by Capacitor for iOS and Android. One API backed by YugabyteDB maintains membership, payment and visit records.
02
Access without blind trust
The HMAC-SHA256 QR rotates every 15 seconds. Copies soon expire. The scanner accepts an adjacent time step. Access has a daily limit, a 15-minute grace period and one device per account.
The same flow accepts MultiSport and UpBalansea cards plus equipment QR codes. A profile photo runs face detection and landmark checks, which is not the same as recognising a person at the door.
03
One data trail for payments and operations
GoPay OAuth2 handles one-off and ON_DEMAND payments, 21% VAT, partial refunds and mandate cancellation. No webhook overwrites blindly. The backend refetches from GoPay before changing a membership.
Apple PKPass, Google Wallet and offline HOTP work outside the app. YugabyteDB with Drizzle has about 92 tables. Cloudflare R2 and Stream serve files and video. FCM and APNs send notifications.
04
How we extended the system with the SmartGym team
From January to May 2026, we worked with the SmartGym team to develop the platform for members and operations.
Rise contributed to the web and the backend, and to the mobile app as well. Together, we refined how the product worked and prepared it for day-to-day operation.
05
A live service and a parked development branch
The public service still runs and SmartGym still lists active locations and 24/7 self-service. The branch we analysed has been parked since May. That is not the product ending.
The collaboration left a shared foundation for members, access and operations. QR codes, payments, permissions and visits meet in one verifiable record.
