Privacy Policy

The short version

• We collect what the App needs to work: your account, the training, body and nutrition data you enter, and the photos, videos and messages you choose to send.
• Some of this is health data. We process it only with your explicit consent, and you can delete it at any time.
• AI features send your request and the data it needs to our AI provider. That is not anonymous: messages, photos and videos go as they are. The App asks before anything is sent, and you can switch it off.
• Exercise videos and food photos are deleted automatically after 30 days.
• If you connect to a trainer, the trainer sees your email address, your nutrition logs and the workouts from routines they assign you. Sharing your other workouts is up to you, and you can disconnect at any time.
• No ads, no tracking, no analytics tools, and we never sell your data.

1. Who is responsible for your data

The controller of your personal data is Micron, the operator of the Gym AI Tracker app and the website gymaitracker.com, based in Latvia, European Union. For anything about your data or this policy, email support@gymaitracker.com.

This policy explains what personal data we process, why, on what legal basis, who receives it, how long we keep it, and your rights under the EU General Data Protection Regulation (GDPR). It covers the App, the website, the trainer marketplace and our support.

2. What data we collect, why, and on what legal basis

2.1 Account data

Your email address, your password (stored only as a secure hash, never in plain text), whether your email is verified, and when your account was created. If you use Sign in with Apple, we receive from Apple a user identifier and your email address (which may be a private relay address), and we store a token from Apple that lets us revoke the Apple sign-in when you delete your account. We don't receive your Apple ID password. We don't ask for your name.

Purpose: to create and secure your account, sign you in, sync your data, send the service emails described in section 2.8, and answer your requests.

Legal basis: performance of our contract with you (GDPR Art. 6(1)(b)).

2.2 Training, body and nutrition data

The data you enter in the App: routines, exercises (including custom ones), completed workouts with sets, reps, weights, durations, notes and ratings, 4-week plans, body measurements (such as weight, height and waist), nutrition logs, nutrition goals and daily trackers, and settings (such as units, language and your current body weight).

On the free plan this data stays on your device. If your plan includes sync, or you sync through a trainer, the App stores it on our servers so you can use it on several devices and keep it safe.

Purpose: to provide the App's tracking, statistics, sync and trainer features.

Legal basis: performance of our contract (Art. 6(1)(b)) and, because much of this is health data, your explicit consent (Art. 9(2)(a)), see section 3.

2.3 Exercise photos

Photos you attach to exercises in a workout. If your data syncs, the App uploads them to our server, where only you can open them (your trainer cannot). The server keeps a photo only while one of your synced workouts uses it. Without sync, photos stay on your device. Routine images always stay on your device.

Legal basis: performance of our contract (Art. 6(1)(b)).

2.4 AI features

When you use an AI feature, we process your request and the data it needs, send it to our AI provider, and store some results. Section 4 explains exactly what is sent. We store:

• AI Trainer conversations: your messages and the replies, so you can continue a conversation later.
• Exercise videos: the video you record or pick (including its sound), the exercise name, file details (name, size, length) and the analysis result. The video is stored with our storage provider. All of this is kept for up to 30 days (section 10).
• Food photos: the photo, file details and the analysis result. The photo is stored with our storage provider. All of this is kept for up to 30 days (section 10).
• AI results you save, such as a generated routine, a 4-week plan or a post-workout summary, become part of your training data (section 2.2).
• A count of your AI requests per day, to apply your plan's limits.

Legal basis: your explicit consent, which the App asks for before it sends anything to the AI provider (Art. 6(1)(a) and Art. 9(2)(a)). Usage counters: our legitimate interest in fair use and cost control (Art. 6(1)(f)).

2.5 Trainer marketplace and coaching

• Trainer profiles: display name, bio, specialisations, years of experience, certifications, languages, city, country and whether you coach remotely, as entered by the trainer, and whether the profile is public.
• Connections: who is connected to whom, when, how (invite code or marketplace), and the client's workout sharing choice. Invite codes, with a client email address if the trainer entered one when creating the code.
• Connection requests: the request and the optional message a client sends to a trainer.
• Reviews: star rating, text and dates.
• Reports and blocks: reports you send about a trainer profile, review or connection request (what you reported, the reason, any details and when), and the users you block. We don't tell the reported user who reported them.
• Trainer assignments: routines and nutrition plans a trainer assigns to a client, which are written into the client's data.

Purpose: to run the marketplace, connect trainers and clients, and let trainers coach their clients.

Legal basis: performance of our contract (Art. 6(1)(b)). Sharing a client's data with their trainer: the client's explicit consent, given by connecting and through the sharing setting (Art. 6(1)(a) and Art. 9(2)(a)), see section 5. Keeping the record of a past connection so that genuine clients can review a trainer: our legitimate interest in a trustworthy marketplace (Art. 6(1)(f)). Reports and blocks: our legitimate interest in keeping the marketplace safe (Art. 6(1)(f)) and our duties under the EU Digital Services Act (Art. 6(1)(c)).

2.6 Shared food products

If you add a product by barcode, its name, brand and nutrition values go into a product database shared with all users. Other users don't see who added it. We keep a link to your account so the entry can be removed when you delete your account.

Legal basis: performance of our contract (Art. 6(1)(b)).

2.7 Subscription data

Your plan, product, store (Apple or Google), transaction identifiers, renewal and expiry dates, status and any pending plan change, received from the App Store or Google Play when you buy or when your subscription changes. Payments are handled by Apple or Google; we never receive your card or bank details.

Legal basis: performance of our contract (Art. 6(1)(b)), and compliance with legal obligations where we must keep records (Art. 6(1)(c)).

2.8 Emails and support

We send only service emails: email verification, password reset and, if someone tries to sign up with your address when it already has an account, a notice telling you so. We don't send marketing emails. If you email us, we use your email address and the content of your message to answer you.

Legal basis: performance of our contract (Art. 6(1)(b)) and our legitimate interest in answering questions and handling complaints (Art. 6(1)(f)).

2.9 Security and technical data

When the App or the website talks to our servers, our systems record technical data: your IP address, date and time, the address requested (which can contain IDs, such as your account ID), the response status, response time and the app or browser type. Sign-in tokens are kept out of these records. To prevent abuse, we count requests, failed sign-ins and service emails for a short time. We also record when we send one of the emails in section 2.8 (with the address partly hidden), and errors that occur.

Purpose: to keep the Service secure and running, prevent abuse and brute-force attacks, and find and fix problems.

Legal basis: our legitimate interest in the security and reliability of the Service (Art. 6(1)(f)).

2.10 Data that stays on your device

• Guest mode data, and your training, body and nutrition data on the free plan (unless you sync through a trainer), is stored only on your device.
• When you sign out, the App keeps a copy of your data on the device so it is there when you sign back in. Deleting your account removes it.
• Your AI consent choice is stored on each device.
• Barcode scanning uses the camera on your device; camera images are not sent to us, only the barcode number when you look it up.
• Apple Health: see section 7.

2.11 Where the data comes from

Most data comes from you. We also receive data from Apple (Sign in with Apple, subscription status), from Google Play (subscription status, once the Android app is available), from your trainer (routines and nutrition plans they assign to you) and from other users (reviews about a trainer).

2.12 What you must provide

An email address (or Sign in with Apple) is needed to create an account. Everything else is optional, and you can use the App as a guest without giving us any personal data.

3. Health data

Some data in the App is "data concerning health", a special category under GDPR Article 9. In this App that includes body measurements (such as weight, height and waist), injuries or limitations you type into the workout generator or the AI Trainer, and, depending on what they reveal, workouts and nutrition logs. Photos and videos you send for analysis can show your body or health too.

We process health data only with your explicit consent (Art. 9(2)(a)):

• to store and sync it, you give consent when you create an account or sign in, as confirmed on that screen;
• to send it to our AI provider, you give consent in the separate AI permission prompt or the Settings switch;
• to share it with a trainer, you give consent by connecting to the trainer and through your sharing setting.

Entering health data is always optional. You can withdraw consent at any time without affecting what happened before: delete the data in the App, switch off Share data with AI, disconnect from your trainer, or delete your account. If you withdraw consent to storing health data, we can no longer sync it, so the App keeps it on your device only, or you can delete it.

We never use health data for advertising or sell it.

4. AI features in detail

AI features use a third-party AI provider. Our server sends it only what the feature needs:

• Workout generator: your goal, level, days per week, workout length, equipment, focus areas, workout style, the preferences and injuries or limitations you type in, and the names of exercises in your library.
• Smart Coaching: number of workouts, average duration and streak, sets per muscle group, recent personal records and possible plateaus (exercise names and figures), and 7-day average calories and macros with your goals.
• Post-workout summary: routine and day name, duration, exercises with sets, reps and weights, personal records, and your body weight.
• Warm-up: exercise names, types and muscle groups.
• 4-week plan: day name, exercises with your last weights, reps or times, goal, level and body weight; for weekly adjustment, your easy/hard rating and the sets you did compared with the plan.
• AI Trainer chat: your message, earlier messages from the same conversation, and a summary of your training: total workouts, your recent workouts (with dates, routine names, exercises and sets), your best sets, routine names, body weight, and 7-day nutrition averages and targets.
• Video form analysis: the video (including its sound) and the exercise name.
• Food photo analysis: the photo.
• Trainer client analysis: when a trainer uses it, the client data that trainer can see (section 5): recent workouts, personal records and 7-day nutrition averages and targets.
• Every request includes the language for the answer.

What is not sent: your name, email address, account ID or IP address (the provider sees our server, not your device). But the content itself is not anonymous: messages, photos and videos are sent as they are and can identify you or reveal health information. Don't put things in them that you don't want analysed.

How the AI provider handles it: the provider processes these requests on our behalf under its data processing terms. Under the terms that apply to us, it does not use our requests or the answers to improve its products. It may keep requests and answers for a limited period to detect abuse and meet legal obligations. Videos are uploaded to the provider for the analysis; we delete the file as soon as the analysis is done, and the provider deletes such files automatically within 48 hours in any case. We will tell you which provider we use on request.

Your control: the App asks for your permission before it sends anything to the AI provider. If you decline, nothing is sent and AI features stay off. You can change your choice at any time in Settings → Share data with AI. The choice is stored per device, so set it on each device you use. AI features are only for users aged 18 or over.

No automated decisions with legal effect: AI output, such as a form score, a nutrition estimate or a suggested routine, is information for you to use or ignore. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. Plan limits (for example, the number of AI requests per day) are applied automatically but only control access to features you choose to use.

5. Sharing with your trainer

If you connect to a trainer, through an invite code or a marketplace request that the trainer accepts, the trainer can see the following while you are connected.

Always

• your account email address (when you send a marketplace connection request, the trainer sees it partly hidden, together with your message, until they accept);
• the date you connected;
• the routines the trainer assigned to you, the workouts you did from those routines (with sets, notes, ratings and AI summaries), and 4-week plans for those routines;
• your nutrition log entries and nutrition goals, and the nutrition plan the trainer assigned.

Only if you turn on "Share all my workouts"

All your other workouts too (marked as done from your own routines), all your routines, all your 4-week plans and the custom exercises you created. This is off by default, and it switches off again if you reconnect after a disconnect. Change it in My Trainer.

Never

Your settings, the entries on your Measurements screen, your body-weight log, your water, vegetable and fruit trackers, your exercise photos, food photos, exercise videos and their analyses, your AI Trainer conversations, your password and your purchases. The trainer's email address is never shown to you; a trainer without a profile appears as "Your trainer".

What the trainer can do

The trainer can assign routines and nutrition plans to you (they appear in your App and are read-only, though you can copy or delete them), and can run an AI client analysis that sends the data they can see to our AI provider (section 4). The trainer uses your data as an independent controller for their coaching and is responsible for what they do with it outside the App.

Disconnecting

You or the trainer can disconnect at any time, and the connection also ends automatically if the trainer's plan ends. The trainer immediately loses access to your data in the App. Routines the trainer assigned stay with you as your own, and the trainer's nutrition plan is removed. A review you left stays until you or the trainer deletes their account or it is removed. We can't recall copies the trainer may have made while you were connected.

Legal basis: your explicit consent (Art. 6(1)(a) and Art. 9(2)(a)), which you withdraw by disconnecting or by turning off "Share all my workouts".

6. What other users can see

• Trainer profiles marked public are shown in the marketplace to all users of the App while the trainer's plan is active, with the trainer's average rating, number of reviews and number of active clients. Connected clients can see their trainer's profile even if it isn't public.
• Reviews (star rating, text and date) are shown on the trainer's profile to all users of the App, without the reviewer's name or email address. The trainer may still be able to tell who wrote a review.
• Shared food products are visible to all users, without the name of the person who added them.

Everything else in your account is private to you and to the trainer you connect with, as described above.

7. Apple Health

On iPhone, if you turn on Apple Health in Settings and give permission, the App saves finished workouts, active energy and body measurements (weight, height and waist) to Apple Health. If you also turn on "Import workouts", it reads workouts and active energy from Apple Health to show calories burned on your nutrition dashboard. Data read from Apple Health is only shown on your device: it is not stored by the App, not sent to our servers, not shared with your trainer and not sent to the AI provider. We never use Apple Health data for advertising. You can change Health permissions at any time in the Health app or in iOS Settings → Privacy & Security → Health.

Legal basis: your explicit consent, given through Apple's permission screen (Art. 6(1)(a) and Art. 9(2)(a)).

8. Who receives your data

We don't sell or rent your personal data and don't share it for advertising. We share it only as follows.

Service providers who process data for us

They may use the data only to provide their service to us, under data processing terms. We will tell you which companies they are on request.

• Our hosting provider runs our servers and stores our database, exercise photos, logs and backups.
• Our cloud infrastructure provider stores exercise videos and food photos, hosts our website and receives email sent to our gymaitracker.com addresses.
• Our AI provider processes AI requests (section 4).
• Our email provider delivers our service emails (section 2.8).

Companies that act on their own responsibility

• Apple provides Sign in with Apple, App Store purchases and Apple Health, and Google provides Google Play purchases once the Android app is available. They process your data under their own privacy policies; we exchange with them only what is needed to sign you in and check your subscription.

Other recipients

• Your trainer, if you connect to one (section 5), and other users for public content (section 6).
• Authorities, courts and advisers, when the law requires it or when needed to establish, exercise or defend legal claims or protect the safety of users (Art. 6(1)(c) and (f)).
• A buyer or successor, if the App or our business is transferred; the new operator must continue to protect your data as described here, and we will tell you before this happens.

Services that receive no personal data

Food searches and barcode lookups are sent from our server to USDA FoodData Central, Open Food Facts and, where enabled, FatSecret. They receive only the search term or barcode, not who you are.

9. Transfers outside the EU/EEA

Some of our providers, in particular our AI and cloud infrastructure providers, may process data in countries outside the European Economic Area, including the United States. Where that happens, the transfer is protected by an adequacy decision of the European Commission (such as the EU-U.S. Data Privacy Framework for certified companies) or by the European Commission's Standard Contractual Clauses included in the provider's data processing terms, together with additional safeguards where needed. You can ask us for more information about these safeguards at support@gymaitracker.com.

10. How long we keep data

Data	How long
Account data	Until you delete your account.
Synced training, body and nutrition data	Until you delete the item or your account. A deleted item leaves a small deletion marker (its ID and time) so another device can't bring it back; the marker goes when your account does.
Exercise photos on our server	While one of your synced workouts uses the photo. Unused photos are removed automatically, usually within two days.
Exercise videos and their analyses	30 days after upload, then deleted automatically within a few hours. If you delete a video in the App, the video and its analysis are deleted at once; a bare record of the upload, without the video, the analysis or the exercise name, stays until the 30 days are up so it still counts toward your monthly limit. Uploads without a finished analysis are removed after about a day.
Food photos and their analyses	30 days after upload, then deleted automatically within a few hours. Uploads that are never analysed are removed after about a day.
AI Trainer conversations	Until you delete the conversation in the App or delete your account. Very long conversations keep only their most recent messages.
AI requests at our AI provider	Video files are deleted right after the analysis, and by the provider within 48 hours at the latest. The provider may keep requests and answers for a limited period for abuse monitoring (section 4).
Daily AI usage counters	7 days.
Trainer profile	Until you delete your account. It is hidden from the marketplace while it isn't public or your Trainer plan isn't active.
Reviews	Until the reviewer or the trainer deletes their account, or we remove the review.
Reports and blocks	Reports: until the reporter deletes their account, or the user whose content was reported deletes theirs. Blocks: until you unblock the user or either of you deletes your account.
Connections, connection requests and invite codes	Until the trainer or the client deletes their account. Past connections are kept so genuine clients can review a trainer and so we can handle disputes.
Shared food products you added	Until you delete your account or we remove the entry.
Subscription records	Until you delete your account.
Sign-in tokens and email links	Sign-in sessions until you sign out or after 30 days without use, then deleted within days; email verification links 24 hours; password reset links 1 hour.
Server logs	Only as long as needed for security and troubleshooting, then deleted through regular log rotation.
Backups	Database backups are replaced on a rolling basis, keeping only the most recent copies. Deleted data can remain in a backup until that backup is replaced. Backups are used only to restore the Service after a failure.
Support emails	As long as needed to handle your request and any follow-up.
Data on your device	Until you delete it, reset the App's data, delete the App, or delete your account. Device backups you make (for example iCloud) are under your control.

When you delete your account

Deleting your account in Settings → Account → Delete Account removes your account and all associated data from our live database at once: training data, measurements, nutrition logs, AI conversations, subscription records, your trainer profile, connections, connection requests, invite codes, reviews you wrote and reviews about you as a trainer, reports you sent or that are about your content, your blocks, and products you added. Your exercise photos, videos and food photos are deleted from storage at the same time; if a storage deletion fails, we retry it automatically every few hours until it succeeds. If you used Sign in with Apple, we revoke the Apple sign-in. If you are a trainer, your clients are disconnected. Copies in backups disappear as the backups are replaced. Deleting your account does not cancel a store subscription.

11. How we protect your data

• All connections to our servers are encrypted (HTTPS).
• Passwords and sign-in credentials are stored only as secure hashes, and sign-in sessions renew regularly.
• Repeated failed sign-ins are blocked for a while, suspicious sign-in sessions are ended, and a password reset signs you out everywhere.
• Administrative functions are not publicly accessible.
• Request limits protect the Service against brute-force attacks and abuse.
• Exercise photos can only be opened by their owner. Videos and food photos are stored privately and accessed only through short-lived links.
• Sign-in tokens are kept out of our logs.
• AI requests do not include your name, email address or account ID.
• Access to the servers is limited to the people who run the Service.

No system is completely secure. If a personal data breach is likely to put your rights at risk, we will notify the supervisory authority and, where required, you.

12. Your rights

Under GDPR you have the right to:

• Access your personal data and get a copy of it;
• Rectification of inaccurate or incomplete data;
• Erasure of your data;
• Restriction of processing in certain cases;
• Data portability: receive the data you gave us in a machine-readable format, or have it sent to another controller where technically feasible;
• Object to processing based on our legitimate interests;
• Withdraw consent at any time, without affecting processing before the withdrawal.

How to use them in the App

What you want	Where
Correct your data	Edit or delete the item in the App.
Get a copy (export)	Settings → Export Data (JSON or CSV, Premium plan and above). On any plan, or for data the export doesn't cover, email us.
Stop AI data sharing	Settings → Share data with AI (per device).
Control what your trainer sees	My Trainer → Share all my workouts, or Disconnect.
Delete an exercise video	Open the analysis in your list of video analyses and delete the video.
Delete an AI Trainer conversation	AI Trainer → conversation history → Delete Conversation. This works on any plan, also after a downgrade.
Stop Apple Health access	Settings → Apple Health, or the Health app.
Delete everything	Settings → Account → Delete Account.

For anything else, including deleting food photos or a review before their normal deletion, email support@gymaitracker.com from the address on your account. We will answer within one month. If a request is complex, we may extend this by up to two more months and will tell you why. We may need to confirm your identity first.

13. Complaints

If you think we handle your data unlawfully, please contact us first so we can try to fix it. You also have the right to complain to a data protection supervisory authority, in particular in the EU country where you live, work or where the issue happened. In Latvia this is the Data State Inspectorate (Datu valsts inspekcija), www.dvi.gov.lv.

14. Children

The App is for people aged 18 and over. We don't knowingly collect data from anyone under 18. If you believe someone under 18 has given us personal data, email us and we will delete it.

15. Cookies and tracking

App: no advertising, no analytics or crash-reporting tools, no advertising identifiers, and no tracking across other apps or websites. The App stores data on your device only to work (your data, settings and sign-in session).

Website: gymaitracker.com sets no cookies, uses no analytics and loads no third-party scripts or fonts. Our website host processes technical data about each visit, such as IP address and requested page, to deliver the site and protect it from abuse (section 2.9).

16. Changes to this policy

We will update this policy when our processing changes. The date at the top shows the latest version. If we make material changes, we will tell you in the App or by email before they take effect, and we will ask for your consent again where the law requires it.

17. Contact

Micron, operator of Gym AI Tracker, Latvia

support@gymaitracker.com

See also Your Privacy Choices, the App Privacy summary and our Terms & Conditions.