My gym forced a social media down my throat. I reverse-engineered its app.

A gym member reverse-engineered his gym's Flutter-based mobile app to extract its check-in QR code logic, after objecting to the app's mandatory social feed of member selfies. He found the QR code rotates every 15 seconds, screenshots are blocked via Android's FLAG_SECURE, and codes can be generated locally and remain valid for several days offline, indicating client-side rather than server-side generation. Using tools including blutter, jadx, OpenSSL, WebCrypto and zbar, with AI assistance from GLM 5.3 and DeepSeek v4.1 Flash, he decoded the QR contents; DeepSeek progressed faster while GLM burned 10–20 times the token cost for less headway. The exercise highlights a broader tension in consumer software, where companies bundle engagement features like social feeds into utility apps, and shows how reverse-engineering tools and AI assistants are lowering the barrier for users to strip out unwanted functionality. What to watch next: whether the gym or other app makers offer feed-free modes, and whether the member's extracted check-in method survives future app updates.