Privacy Policy

Effective Date: 2026-09-07

1. Introduction

Welcome to GymTrack. We value your privacy and are committed to protecting your personal information. This Privacy Policy outlines how we collect, use, and safeguard your data when you use our fitness tracking service.

2. Information We Collect

Account Information: Your email address, username, and password (stored only as a salted hash). Signing up and signing in are verified by a six-digit code sent to your email.
Profile Information: Display name, profile picture, bio, and, if you choose to provide them, your date of birth, height, sex and activity level, which are used to estimate your energy needs.
Training Information: Workouts you log or plan, including date, duration, exercises, sets, reps, weights, distances, times, free-text notes, and any images you attach.
Nutrition Information: Meals and foods you log, their quantities and nutrition values, your saved food library, and your nutrition goals.
Body Information: Weight entries, body measurements, and progress photos you upload.
Coaching Information: If you connect with a coach in the app, the training and nutrition plans shared between you.
Purchase Information: Records of Pro Membership purchases, including the store, the transaction identifier, and the start and end of the subscription period. Payment card details are handled by Apple, Google and our payment provider and never reach us.
Device and Usage Data: The platform you use the app on and in-app events such as sign-ins, screen views and workouts logged, which we use to understand how the app is used.
Contact Information You Provide: If you write to us through the contact form, the in-app feedback form, or by email, we receive the name, email address and message you submit.

3. How We Use Your Information

To Provide Services: To deliver the app, show you your history and statistics, share your activity with the groups and coaches you have chosen, and respond to your requests.
To Power AI Features: When you use an AI feature — logging a meal from a description or photo, transcribing workout notes, importing training data, or converting coach notes into a plan — the text and any photos you supply for that feature are sent to our AI provider so it can return a structured result. We do not send your data to an AI provider unless you use one of these features.
To Communicate: To send you account emails such as verification codes and password resets, and app notifications you can turn off in settings.
To Enhance Security: To keep your account secure, detect and prevent abuse, and diagnose technical problems.
To Improve the App: To produce aggregate usage statistics. These statistics are about the service as a whole, not about you individually.

With Your Groups: Your profile and the activity you have chosen to share are visible to the other members of the groups you join. You control what is shared — workouts, food, weight and progress photos each have their own switch in settings, and progress photos are off by default.
With Your Coach: If you connect with a coach, they can see the training and nutrition data needed to coach you. Ending the relationship ends that access.
Workout Images: Images you attach to a workout are stored so that anyone holding the image link can open them, without needing to be signed in. Progress photos are stored separately in a private location and are only ever served through short-lived, signed links.
Service Providers: We use a small number of providers to run the service: Cloudflare (image and file storage), our database and server hosting provider, Postmark or Brevo (account emails), RevenueCat together with Apple and Google (purchases and subscriptions), and Anthropic or OpenAI (the AI features described above). Each receives only the data it needs for its part of the service.
Open Food Facts: When you scan a barcode or search for a food, we send the barcode or search term to the Open Food Facts database. We do not send your identity with it.
Internal Notifications: New signups, contact messages, feedback and account-deletion requests are forwarded to our team through Discord so that a person sees them.
Legal Requirements: We may disclose your information if required to do so by law or in response to a valid request from a public authority.

5. Data Security

We employ industry-standard security measures to protect your personal information. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

6. Data Retention and Deletion

We keep personal data only for as long as we need it for the purposes described above, or for as long as the law requires us to.

Account, profile, training, nutrition and body data: Kept for as long as your account exists. You can delete any individual workout, meal, weight entry, measurement or photo from within the app at any time, and it is removed when you do.
Login sessions: A session expires 30 days after you sign in, and the cached login token expires after 24 hours. Signing out ends the session immediately.
Email verification codes: Kept for 15 minutes and then automatically discarded.
Usage data: In-app events (the event name, the platform, the date, and which account it belongs to) are kept for as long as your account exists and are used only for aggregate statistics.
Purchase records: Kept for as long as tax and accounting law requires us to keep them, which under German law can be up to 10 years.
Support messages: Contact and feedback messages are kept for as long as we need them to handle your request and to keep a record of the conversation.
Backups: Our backups may still contain your data for up to 30 days after it is deleted from the live service, after which they are overwritten.

Deleting your account. Open Account → Data in the app and choose Request Account Deletion. We email you a verification code to confirm it is really you. The request then waits 24 hours, during which you can cancel it from the same screen. After that we process the deletion, and in every case within 30 days of your request. If you cannot get into the app, email us at contact (at) gymtrack (dot) gg and we will handle it for you within the same 30 days.

What deletion removes. Permanently and irreversibly: your email address, your username (replaced with an anonymous placeholder), your password, all active sessions, your display name, bio, profile picture, date of birth, height, sex and activity level, the notes on your workouts, every image you uploaded to a workout, every progress photo, your saved food library, your group memberships and invitations, group goals you created, and your coaching relationships. Groups you created continue to exist for their remaining members but no longer have an owner.

What we keep afterwards. Your training, nutrition and body records — dates, durations, exercises, sets, weights, measurements and food entries — are kept without anything that identifies you, attached only to an anonymous placeholder account, and are used solely for aggregate statistics about the service. They are no longer visible to other users. We also keep purchase records with the transaction identifier removed, for the legal periods above, and a minimal record of the deletion itself so that it cannot be reversed or repeated fraudulently.

7. Your Choices and Rights

Your Data: You can view, edit and delete your workouts, meals, weight entries, measurements and photos at any time in the app, and you can copy your benchmark history out as JSON from Account → Data.
What You Share: Sharing of workouts, food, weight and progress photos with your groups is controlled by separate switches in settings, and can be turned off at any time.
Account Deletion: You can request deletion of your account from Account → Data. See Data Retention and Deletion above for exactly what is removed and when.
Communication Preferences: You can turn app notifications off in settings, and unsubscribe from non-essential emails using the link in the email. We still need to send you account emails such as verification codes.
Your Rights: Depending on where you live, you have the right to access, correct, export or delete your personal data, to object to or restrict how we use it, and to complain to your local data protection authority. To exercise any of these rights, email us at contact (at) gymtrack (dot) gg; we respond within 30 days.

8. Children's Privacy

Our service is not intended for children under the age of 16. We ask for a date of birth at sign-up and do not create accounts below that age, and we do not knowingly collect personal information from children under 16.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the effective date.

10. Contact Us

If you have any questions or concerns about this Privacy Policy, please contact us at contact (at) gymtrack (dot) gg.