Privacy Policy

Account data — when you sign up we store the email address and password you provide. Passwords are stored in hashed form by our authentication provider; we do not see your plaintext password. If you choose Sign in with Apple or Sign in with Google instead, we receive the basic profile details that provider shares with us — your name, your email address and, with Google, your profile picture — as your settings there allow. Apple lets you hide your real address behind a relay address. Profile data — display name, optional profile picture, gender, height, weight, experience level, and the preferences you set inside the app. Workout & body data — workouts you log (exercises, sets, reps, weights, duration, notes), body measurements you record, bodyweight history, and progress photos you upload. Community content — posts you publish, photos or videos you attach to those posts, comments, "fires" (reactions), follows, and any reports or blocks you submit. AI Coach inputs — when you use the AI Coach feature, the goals, equipment, experience level and other parameters you submit are sent to a server-side function that generates a routine. We log usage (timestamp, plan tier, success/failure) for rate limiting and abuse prevention, but we do not retain the generated prompts beyond what is needed to return your routine. AI Body Projection data — if you use the AI Body Projection (“Future You”) feature, the body photo you submit is sent to Google LLC’s Gemini API for processing to generate the visualization. Your photo and the generated visualization are processed transiently — they are never stored on our servers, written to our database, or written to our logs. Zero server-side retention applies: the generated result is returned to your device and saved only locally on your phone; it is deleted when you uninstall the app or clear app data. We record only a usage-count row (user ID and calendar month) for rate limiting. Google’s handling of the request is described in section 10. Purchase data — if you subscribe to Gym Journal Pro or buy Lifetime access, your purchase is processed by Apple App Store or Google Play. Our subscription provider, RevenueCat, receives the store receipt together with your account ID, so that Pro follows your account across devices; we never see your payment-card details. Emails — we send account emails (such as sign-up confirmations and password resets). We send comeback emails — a short series when you have not trained for a while — only if you switch on “Email me too” on the reminders screen or in Settings → Notifications. They are off by default, and every one carries a one-click unsubscribe link. If you send us feedback from inside the app, we receive what you write. Usage analytics — the app records which screens and features you use (for example, “workout started” or “paywall opened”), together with your platform, app language, plan and experience level and, if you have an account, the date you created it and the domain of your email address (for example, gmail.com — never the full address). When you finish a workout it also records a summary: the routine name, duration, number of sets, total volume and number of PRs — not the individual exercises, weights or reps. If you are signed in, these events are tied to your account ID, a random identifier that is not your name or email address; in Solo mode they use a random ID created on your device. Crash reports are tied to your account ID in the same way. Technical data — when the app communicates with our servers, standard request information (IP address, timestamp, app version, basic device type) is logged transiently by our hosting provider to deliver the service and prevent abuse. Apple Health data (iOS, optional) — Gym Journal can connect to Apple Health if you turn the integration on and grant permission in iOS. It is off until you enable it. When enabled we read your latest weight, height, body-fat percentage and dietary energy so your profile and bodyweight history stay current, and we write workouts you complete in Gym Journal back to Apple Health. Values read from Apple Health are stored in your Gym Journal profile and therefore sync to our servers like the rest of your profile data. We read only the categories listed here, we never read your medical records, and we do not use Apple Health data for advertising or share it with advertisers. You can revoke access at any time in iOS Settings → Privacy & Security → Health, or by turning the integration off in the app. Contacts (read on your phone only) — if you open Connect with Contacts and allow access, the app reads your phone’s contacts on the device so you can pick someone to text an invite to. The list never leaves your phone: it is not uploaded, hashed or matched against other users, and we never see it. You can revoke access at any time in your phone’s settings. We do NOT collect: precise location, contacts, microphone audio, advertising identifiers, or browsing data outside the app. Beyond the Apple Health categories listed above, which you switch on explicitly, we do not read health data from your device.

To run the app: keep you signed in, sync your workouts and routines across your devices, and serve you the leaderboards and community feed. To verify and manage your subscription. To send you account emails, and the comeback emails if you switched them on. To understand which features get used and to find and fix crashes. To detect, prevent and respond to abuse, harassment or terms violations, including keeping bots out of sign-up and sign-in. To respond to support requests and feedback you send us. We do not sell your personal data, share it with advertisers, or use it to build cross-app advertising profiles.

Supabase (database, authentication, storage) — stores your account, workouts, photos, and community data on our behalf. RevenueCat (subscription management) — verifies your in-app purchases and keeps your subscription status, tied to your account ID. Apple (in-app purchases, Sign in with Apple) — Apple's own privacy policy applies to data handled by Apple. Workout reminders are scheduled on your phone itself; they do not pass through Apple's or Google's push servers. Google (Sign in with Google) — if you choose it, Google confirms your identity and shares the basic profile details described in section 1. Google's own privacy policy applies to data handled by Google. Cloudflare Turnstile (bot check) — when you sign up, sign in, or reset your password, a Cloudflare Turnstile check runs to keep automated sign-ups out. Cloudflare receives your IP address and technical information about your device to tell people from bots; we receive only a pass/fail result. Resend (email delivery) — delivers the emails we send you and passes the feedback you send from inside the app to our inbox. Resend receives the recipient's email address and the content of the message. Apple Health (iOS, optional) — if you enable the integration, health data stays between your device and Apple Health except for the profile values described in section 1 (weight, height, body-fat percentage), which sync to our servers as part of your profile. Apple is not our processor for this; data in Apple Health is governed by Apple's own privacy policy and your iOS permissions. Google Play (in-app purchases on Android) — Google's own privacy policy applies to data handled by Google Play. Google Gemini (Google LLC) (AI Coach & AI Body Projection) — when you submit an AI Coach request or an AI Body Projection photo, the data you provide is processed by Google LLC via the Google Gemini API as a third-party processor to generate the routine or visualization. Google LLC processes it under Google's data processing terms; neither prompts nor photos are retained by us beyond what is needed to return your result. Body Projection photos and generated visualizations are processed transiently with zero server-side retention and are never stored on our servers. Gemini processing may occur on Google servers outside the EEA (such as the United States) under Standard Contractual Clauses (SCCs). Google's privacy policy and data processing terms apply to data handled by Google. Anthropic (Claude API) (AI Coach backup) — if Google's service is unavailable when you submit an AI Coach request, the same request is sent to Anthropic, PBC instead, so you still get a routine. Anthropic processes it as our processor under its Commercial Terms and Data Processing Addendum. AI Body Projection photos are never sent to Anthropic. Processing by Anthropic may occur outside the EEA (such as the United States) under Standard Contractual Clauses (SCCs). Anthropic's privacy policy applies to data handled by Anthropic. PostHog (product analytics) — receives the usage analytics described in section 1, tied to your account ID when you are signed in, so we can see how people use the app and what to improve. It receives the workout summary described there, but not the individual exercises, weights or reps, and never your body data, photos, posts or email address. Sentry (crash & error monitoring) — receives crash reports and performance diagnostics so we can find and fix bugs: error stack traces, device type, OS version and app version, tied to your account ID when you are signed in so we can match a crash to a support request. It does not receive your workout data, photos, or personal content. Fonts (this website) — our typefaces (Inter, IBM Plex Mono, Bebas Neue) are served from our own domain. They are open-source fonts bundled into the site itself, so viewing a page contacts no font provider and sends your IP address to no third party. Earlier versions of this site loaded them from Google’s font servers; that is no longer the case. Website analytics (this website) — gymjournal-app.com uses Vercel Web Analytics and Vercel Speed Insights to count page views, referrers and page load performance. Both are cookieless: they set no cookies, store nothing in your browser, assign you no identifier, and do not track you across sites or sessions. Vercel derives an anonymous hash from the request that is discarded daily and cannot be reversed to identify you. This is why the site shows no cookie banner — there is nothing to consent to. None of this applies to the app, which is covered separately above. YouTube (tutorial video on our website) — the “Watch Demo” video on gymjournal-app.com is embedded from YouTube’s no-cookie domain (youtube-nocookie.com). Nothing is requested from YouTube until you open the video; once you do, your IP address and browser information reach Google so the player can load, and Google may set cookies or similar storage when playback starts. The app embeds nothing — the Quick Start Guide and the Settings link simply hand off to the YouTube app or your browser. Google’s privacy policy applies to what happens after that. Each provider's own privacy policy applies in addition to ours. Beyond these providers, we disclose personal data only when the law requires it — for example, to answer a valid order from a court or public authority — or to establish or defend legal claims. If Gym Journal is ever transferred to another business — for example, a company set up to run it, or a buyer — your data would move with it and remain covered by this policy, and we would tell you before that happens.

Your account, workouts, photos, and community data are stored in the European Union (Supabase, eu-central-1, Frankfurt, Germany). Product analytics (PostHog) and crash reports (Sentry) are also processed in the European Union. Some providers process limited data outside the EU: in-app purchases and sign-in are handled by Apple or Google, subscription status by RevenueCat (United States), AI Coach and AI Body Projection requests by Google LLC (Gemini API), AI Coach requests by Anthropic (United States) when Google's service is unavailable, emails by Resend (United States), the sign-in bot check by Cloudflare, and this website by Vercel (United States). Where data is transferred outside the EU/UK (including transient Gemini processing by Google LLC on servers in the United States), we rely on the providers' Standard Contractual Clauses (SCCs), the Data Processing Addenda of Google and Anthropic, and equivalent safeguards.

We keep your data for as long as your account is active. When you delete your account from inside the app (Settings → Account & Data → Delete Account), we erase your workouts, body data, progress photos, community posts and reactions, profile, and the underlying authentication record. Some safety-related records (e.g., blocks or reports involving other users) may be retained in an anonymized form to keep the community safe. Backups roll off within 30 days. Records our providers hold under your account ID rather than your name — usage analytics (PostHog), crash reports (Sentry) and subscription history (RevenueCat) — are not erased automatically when you delete your account. Once the account is gone, nothing on our side links that ID back to you, and those records expire under each provider's retention schedule. If you want them erased straight away, email us and we will delete them at the provider.

You can: Access & export your data (portability) — Gym Journal Pro includes a one-tap CSV export under Settings → Account & Data. You do not need Pro to exercise this right: email contact@gymjournal-app.com from your account address and we will send you a copy of your data, in a machine-readable format, free of charge, within 30 days. Correct your profile information at any time in Settings. Delete your account and all associated data from Settings → Account & Data → Delete Account. This is permanent and cannot be undone. Section 5 explains what deletion does not erase automatically, and how to ask us to erase it. Restrict processing — ask us to pause using your data while we check its accuracy or consider an objection you have made. Object to specific processing — contact us at the address below. Withdraw consent at any time for anything you switched on — see section 9. If you are in the EU/UK you have rights under the GDPR/UK GDPR including the right to lodge a complaint with your local data-protection authority.

Gym Journal is not directed to children under 13 (or under 16 in some jurisdictions). We do not knowingly collect data from children below this age. If you believe a child has provided us data, contact us and we will delete it. The two AI features, AI Coach and AI Body Projection, are for adults only (18+); see section 10.

Connections between the app and our servers use TLS. Passwords are hashed. Per-user data is isolated using row-level security on our database. No system is 100% secure, but we apply standard industry practices to protect your data.

If you are in the EU or UK, we rely on the following legal bases under the GDPR / UK GDPR: Performance of a contract (Art. 6(1)(b)) — to create and run your account, store and sync your workouts and routines, process your subscription, and provide the community features you choose to use. Legitimate interests (Art. 6(1)(f)) — to keep the service secure, prevent abuse and fraud, enforce our Terms, and operate features such as leaderboards and the community feed. You may object to processing based on legitimate interests (see "Your rights"). Consent (Art. 6(1)(a)) — for optional features you switch on, such as making your profile public, enabling notifications, or receiving comeback emails. You can withdraw consent at any time in Settings, or through the unsubscribe link in any comeback email. Legal obligation (Art. 6(1)(c)) — where we must retain or disclose data to comply with applicable law. Health-related data — explicit consent (Art. 9(2)(a)). Some of what you choose to give us may qualify as data concerning health under Article 9(1) GDPR: body measurements, bodyweight history, body-fat percentage, progress photos, the body photo you submit to AI Body Projection, and any values synced from Apple Health. We process this special category data solely on the basis of your explicit consent, which you give by choosing to record that data, submit that photo, or switch on the relevant feature — never by default. None of it is required to use Gym Journal; you can log workouts without entering any of it. We use this data only to show it back to you and to provide the specific feature you asked for. We do not use it for advertising, we do not sell or share it with advertisers, we do not use it to train AI models, and no human at Gym Journal reviews your photos. You can withdraw your consent at any time — delete the individual entry or photo in the app, turn the feature off, or delete your account entirely (Settings → Account & Data → Delete Account). Withdrawing consent stops any further processing but does not affect processing already carried out while consent was in place.

Gym Journal uses artificial intelligence in exactly two places. Both are optional, and both are for adults only (18+). This section explains what those features do, what they do not do, and what happens to the data you give them. Which features use AI. (1) AI Coach — you describe your goal, equipment and experience, and a generative model returns a suggested routine or split. (2) AI Body Projection ("Future You") — designated strictly for adult fitness tracking (18+), you submit a body photo and a generative model returns a speculative, illustrative visualization of potential physique changes. No other part of the app uses AI. Your workout logs, statistics, leaderboards, badges and progression suggestions are produced by ordinary deterministic code, not by an AI model. Where we describe "smart progression", that is a double-progression algorithm, not artificial intelligence. Which provider. Both features call Google LLC's Gemini API. Google LLC acts as our third-party data processor and processes your inputs (prompts and user-submitted body photos to generate the visualization) under Google's Cloud / API Data Processing Addendum and privacy policy. Processing by Gemini may occur outside the EEA (including on Google servers in the United States) under Standard Contractual Clauses (SCCs). AI Coach has one backup: if Google's service is unavailable, the request goes to Anthropic's Claude API instead, and Anthropic then acts as our processor for that request under its Commercial Terms and Data Processing Addendum. AI Body Projection has no backup, so a body photo is never sent to Anthropic. Your data is not used to train AI models. We do not train models on your data, and we do not permit our AI providers to use your prompts, photos, workouts or any other content to train or improve their models. This is a contractual restriction on the API tiers we use, not merely a setting. What Google keeps. Under its API terms, Google may log prompts, photos and results for a limited period solely to detect and prevent abuse of its service, and may disclose them where the law requires. It does not use them to train or improve its models. What Anthropic keeps. When the backup is used, Anthropic deletes the request and the result from its systems within 30 days, unless it has to keep them longer to enforce its usage policy or to comply with the law. It does not use them to train its models. No human review. Nobody at Gym Journal reads your AI Coach prompts or looks at your AI Body Projection photos. We store only a usage counter (your user ID and the calendar month) so we can enforce rate limits and detect abuse. What we keep. On our side, AI Body Projection photos and generated visualizations are processed transiently: sent, processed in memory, and discarded. There is zero server-side retention: they are never written to our database, our file storage, or our logs, and photos do not generate or store biometric identifiers, facial geometry, or facial recognition templates. The generated image is returned to your device and saved only locally on your phone, deleted when the app is uninstalled or app data is cleared. AI Coach prompts are not retained beyond producing your routine. AI output is labeled and may be wrong. Content produced by these features is generated by a machine, is presented as such inside the app, and is not reviewed by a human before you see it. It can be inaccurate, generic, or unsuitable for your body, your equipment or your injury history. The AI Body Projection in particular is an illustration, not a prediction, not a forecast, and not a promise of results — real outcomes depend on genetics, diet, sleep, consistency and factors no model can see. Nothing either feature produces is medical, physiotherapeutic or nutritional advice. No automated decisions with legal effect. We do not use automated processing or profiling to make decisions that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR. AI output is a suggestion you are free to ignore; it never determines your pricing, your access to the app, or your account standing. Declining AI entirely. These features only run when you deliberately open them and submit something. If you never use them, no data of yours is ever sent to an AI provider, and every other feature of the app continues to work normally.

If we change this policy materially we will update the "Last updated" date above and tell you in-app or by email before the change takes effect. This policy describes what we do; it is not something you agree to by using the app, and a change never counts as your consent. Where a change needs your consent — for example, a new use of health data — we will ask you for it. What changed on 12 October 2026. We added Anthropic (Claude API) as a backup provider for AI Coach. If Google's service is unavailable when you ask for a routine, the request is sent to Anthropic instead. Sections 3, 4 and 10 say what Anthropic receives and what it keeps. AI Body Projection is unchanged: photos go to Google only. What changed on 9 October 2026. We checked this policy against the app line by line and corrected what it had wrong or left out. Usage analytics (PostHog) and crash reports (Sentry) are tied to your account ID, not anonymous as we had said, and PostHog receives a summary of each finished workout; section 1 now says exactly what it receives. Both providers process data in the EU, not outside it. RevenueCat links your subscription to your account ID. We added three providers we had not listed: Sign in with Google, Cloudflare Turnstile (the bot check on sign-up and sign-in) and Resend (email delivery). We described the comeback emails, which are off unless you switch them on, and the Connect with Contacts screen, which reads your contacts on your phone and never uploads them. We stated that Google may keep AI requests for a limited period to detect abuse, explained what account deletion does not erase automatically, added your rights to restriction and portability, explained when we would disclose data to authorities or in a business transfer, and made AI Coach adults-only (18+), as AI Body Projection already was. We also removed two statements that treated using the app as agreeing to this policy. Apart from the AI Coach age limit, none of this changes what the app does; it describes what it already did more accurately. What changed on 10 August 2026. We renamed the AI Body Scan feature to AI Body Projection throughout this policy — the same feature, the name the app now uses. We added a description of the optional Apple Health integration (what it reads, what it writes, and how to turn it off) and removed the earlier blanket statement that we collect no Apple Health data. We also added an explicit legal basis for health-related data under Article 9(2)(a) GDPR. None of these changes expanded what we collect or what we do with it; they describe existing and upcoming features more accurately. What changed on 15 August 2026. We stated explicitly that this policy covers our website as well as the app, and we listed the two third parties the website itself contacts: Google Fonts, which loads our typefaces on every page view, and the YouTube embed behind the “Watch Demo” video. Both were already in use; they had simply never been written down. Nothing about the app’s data collection changed. What changed on 16 August 2026. We updated third-party processor disclosures for AI features to explicitly identify Google LLC (Gemini API), clarified zero server-side retention for AI Body Projection photos and visualizations with explicit non-generation/non-storage of biometric or facial recognition templates, and referenced Google's data processing terms and international transfer safeguards (Standard Contractual Clauses) for processing outside the EEA. We also stopped loading our typefaces from Google’s font servers and now serve them from our own domain, so viewing this website no longer sends your IP address to Google; the disclosure above was updated to match. What changed on 18 August 2026. We explicitly documented the adult fitness designation (18+) for the generative AI Body Projection feature under Section 10, reiterating zero server-side retention, zero biometric or facial template generation, and strict non-medical classification.

Gym Journal is operated by STANICHEVICI TUDOR PFA (Romania, EU). For any question or request about your data — including access, correction, deletion, or objection — contact us at contact@gymjournal-app.com. EU/UK users also have the right to lodge a complaint with their local data-protection authority (in Romania, the ANSPDCP).