SmartGym · Digital fitness platform
From QR access to gym operations. One system, 24/7.
We helped the SmartGym team design and build one platform covering members, operations and the door scanner. Mobile, web and the reader at the entrance all read the same membership state.
Information
- Platform
- Web, iOS, Android, and kiosk
- Duration
- January to May 2026
- Our role
- We developed the platform together with the SmartGym team. We worked on the web, the mobile app, and the backend.
- Status
- Public service in operation
Technology
- React
- TypeScript
- Capacitor
- iOS
- Android
- Express
- Bun
- YugabyteDB
- Drizzle ORM
- Tailwind CSS
- GoPay
- Cloudflare R2 & Stream
- FCM / APNs
What you will learn
- 01A door cannot trust a QR image. The decision belongs to a short-lived signature and the current membership state.
- 02A payment webhook only notifies. It is not the source of truth, so payment state gets read back from GoPay.
- 03Face validation checks that a photo has a detectable face and sane landmarks. It never identifies anyone at the door.
- 04Three product surfaces need consistent permissions, audit trails, and disciplined mobile and web releases.
01
From a 24/7 promise to one system
SmartGym has three surfaces. A member app, an operations web and a kiosk or scanner at the door. Members buy a membership and open QR on their phone. Staff handle clients, training and payments.
These are not three separate products. They share a React and Vite foundation, Capacitor packages it for iOS and Android, and one YugabyteDB-backed API holds membership, payment and visit state.
02
Access without blind trust
The QR rotates every 15 seconds under HMAC-SHA256, so a photographed code dies at once. The scanner takes only the adjacent step. A daily limit, a 15-minute grace and one device per account close it.
The same flow accepts MultiSport and UpBalansea cards plus equipment QR codes. A profile photo runs face detection and landmark checks, which is not the same as recognising a person at the door.
03
One data trail for payments and operations
GoPay OAuth2 handles one-off and ON_DEMAND payments, 21% VAT, partial refunds and mandate cancellation. No webhook overwrites blindly. The backend refetches from GoPay before changing a membership.
Apple PKPass, Google Wallet and an offline HOTP code carry a pass outside the app. YugabyteDB with Drizzle holds about 92 tables. Cloudflare R2 and Stream serve files and video, FCM and APNs push.
04
How we extended the system with the SmartGym team
From January to May 2026, we worked with the SmartGym team to develop the platform for members and operations.
Rise contributed to the web, mobile app and backend. Together, we refined how the product worked and prepared it for day-to-day operation.
05
A live service and a parked development branch
The public service still runs and SmartGym still lists active locations and 24/7 self-service. The branch we analysed has been parked since May. That is not the product ending.
What is left is one product foundation covering members, operations and physical access. The value is not the screen count. It is that QR, payment, permission and visit meet in one verifiable record.
