Privacy Policy

Last updated 8 October 2026

This notice explains how Gymrapp (“we”, “us”) collects and uses personal information when you use the Gymrapp iOS and Android app or visit gymrapp.com.

Gymrapp is a training app for people who lift and run. It stores the workouts and health metrics you log or sync. Generated programs can use selected stored training, profile, and health history. Coaching chat, if you use it, uses the messages you type, relevant conversation history, and tool results.

We are based in Taipei City, Taiwan. Questions and data-rights requests: [email protected].

1. Information we collect

You give us

When you sign in and use the app we may collect:

Account details from your sign-in provider: name, email address, and profile photo, plus the name and handle you enter. Sign-in is Google or Apple through our account-authentication service. We do not collect or store a Gymrapp password.
Profile details you enter or choose to import from Apple Health: date of birth, gender, height, weight, and other body measurements. An account and the following profile details are required to complete setup: name, handle, date of birth, height, and weight. Gender disclosure and a profile photo are optional.
Training data you log: exercises, sets, repetitions, loads, distance, duration, effort (rate of perceived exertion), personal records, templates, and programs.

Gym directory

The gym directory at `/gyms` uses your Google or Apple sign-in and the same Gymrapp account as the app. Directory use does not require the app's profile setup details. If you create your account from the directory, we store the name and profile photo your sign-in provider supplies, record that you signed up from the directory, and record any source, medium, and campaign values in the link you arrived from. Signing in from the directory with an existing account does not change these details. We process your gym searches, filters and map area to show venues. Training, access, purchase and equipment observations, anonymous support counts, and recent whole-report dates may be public without your account name or email. We keep the account linkage needed to manage your current reports and prevent abuse private.

Missing-venue proposals contain the venue name and address or Maps link you submit. Gymrapp reviews these privately; submitting one does not publish it. Do not include unrelated personal information. We do not automatically fetch submitted Maps links.

When you search, your search text, the centre of the map you are viewing and a coarsened map area go to Gymrapp. Unless the text exactly matches a listed gym or brand name, our server sends the search text and the coarsened map area to Geoapify to find the place you mean. It does not send your account identifier, sign-in token, browser IP or the map centre to Geoapify. The provider receives our server's network information and processes API requests under its privacy policy. The place found is used only to rank listed gyms and is not shown; the map centre ranks results when no place is found. If you use Show my location, your device position stays in your browser: it moves the map and calculates the distance shown on each gym, and it is never sent to Gymrapp or stored. Because Show my location moves the map to you, a search made afterwards sends a map centre near your position.

The map loads directly from OpenFreeMap, using OpenStreetMap data and OpenMapTiles. Those requests reveal your browser's network information and the map tiles needed for the area you view to the map provider. MapLibre renders the map in your browser. Map credit links identify the data sources. Directory application diagnostics record operational metadata rather than your search text, coordinates, report/proposal content, account identifier or authentication material.

Health and fitness data

When you enable a health connection, you authorize access through the device or connected service's permission flow. Available controls over data categories depend on the source. We process body measurements (such as height, weight, body-fat percentage, and circumference measurements); workout and exercise activity; performance records; and metrics you record or sync from Apple Health, Google Health Connect, Garmin, a paired BLE heart-rate monitor, or the Apple Watch companion (for example resting heart rate, heart rate during activity, heart-rate variability, sleep, VO₂ max, and steps). Apple Health can also supply date of birth, biological sex, and height. Outdoor or wearable-synced activities may include GPS route points.

We use this information to show your training and health in the app, compute progress (including estimated 1RM and personal records), personalize generated programs, and sync with a wearable you connect. Health connections are optional; declining one prevents imports from that source. We do not sell this information or use it for advertising. You can disconnect Health, Health Connect, or Garmin to stop new imports into your profile; revoke Gymrapp on Garmin's site to stop Garmin transmissions. Disconnecting does not delete history already stored in your Gymrapp profile. An account-deletion request also stops connected imports and starts deletion of stored history as described in How we protect and keep information.

This is sensitive health data. We process it to provide the health, training, and connected-source features you choose to use, subject to the permission and other legal requirements that apply.

We receive from others

We do receive personal information from third parties you connect or buy through:

Apple Health, Google Health Connect, and Garmin — health and activity data you authorize.
Google and Apple — account identifiers when you sign in.
Our subscription-management provider, the App Store, and Google Play — subscription and purchase status. Apple and Google handle payment cards. Neither Gymrapp nor our subscription-management provider receives card numbers.

Collected automatically

App and API: device model, operating system, app version, language, and IP address, and when your account first and most recently used the app and the gym directory.
Optional app product analytics: account-linked app activity, plus install and device identifiers. With your permission, we also store your platform, hardware model, OS and app versions, a random installation identifier, and device capabilities such as whether an Apple Watch is paired. An unknown pairing state remains unknown. We do not collect your Watch name, serial number, or health data for this purpose. See Cookies and analytics. We do not collect an advertising identifier (IDFA or AAID).
Subscription management: an installation or device identifier assigned by that provider, your Gymrapp account identifier, and subscription activity so we can activate access and analyze subscription performance.
Crash and performance diagnostics: crash and error reports. If you are signed in, those reports can include your account ID, email, diagnostic identifiers, and device or network context.
Marketing website (gymrapp.com): Google Analytics records page views, referrer, and campaign parameters (including UTMs). See Cookies and analytics.
Website errors: if a page on gymrapp.com fails, or a link meant for the app opens the website instead, our crash, performance, and infrastructure-diagnostics provider receives an error report with the page address (without query parameters), browser and operating system, and error details. The provider also sees the IP address the report is sent from and stores an approximate location (city, region, and country) derived from it with the report.
Push notifications: a device push token associated with your account so our push-delivery provider can send training or account messages. A token may be registered even if notification display is disabled. You control display in your operating-system settings.

Automatic diagnostics sent to our crash, performance, and infrastructure-diagnostics providers are limited to stack traces, diagnostic identifiers, error codes, timings, and the device, network, and account-linked context needed to investigate a failure. Automatic logs exclude raw health values, activity routes, injury content, prompts, request and response bodies, authentication material, and other secrets.

If you contact support or send feedback, we receive the message and the address you send it from. In-app feedback can also include your name, account email, a diagnostic-event identifier, and an optional screenshot; screenshots can contain information visible in the app, including health or training details. Feedback may be copied to a support and issue-handling provider. The website contact link opens your email app with a handle, request type, and message you provide.

If you joined a beta or waitlist, we may hold your name, email, platform, submission time, and delivery state. Registration can also record source, medium, and campaign attribution, and whether you signed up in the iOS app, the Android app, or the gym directory.

You may optionally tell us where you first heard about Gymrapp. This self-reported answer is separate from measured registration attribution, can be skipped or corrected, and does not overwrite that measured information. You may also optionally allow Gymrapp to contact you at your account email about experience interviews and invitations to test features so we can improve the product. This consent does not cover promotional messages and can be withdrawn in Settings → Privacy.

2. How we use it

Create and keep your account, and sign you in.
Provide the app: store workouts, show progress, sync wearables, run programs.
Generate tailored programs from your request and selected stored training, profile, and health context, and provide coaching replies from the messages you type, relevant conversation history, and tool results (see Generated programs and coaching).
Process subscriptions and prevent fraud or mismatched purchases (see Subscriptions).
Send beta invitations you request and respond to support requests.
If you allow it, contact you at your account email about experience interviews and feature testing to improve Gymrapp. This is not promotional email.
Understand how people first hear about Gymrapp using optional self-reported acquisition answers, separately from measured registration attribution.
With your optional product analytics consent, understand account-linked app activity and device capabilities to improve Gymrapp, never for advertising.
Keep the app and site secure and debug crashes.
Comply with law, and with the App Store and Google Play rules that apply to us.

We do not sell personal information. We do not share it for cross-context behavioral advertising.

3. Legal bases (EEA, UK, Switzerland)

Where those laws apply, we rely on:

Contract — account, training log, subscriptions, delivering the app, and responding to support requests about the Services.
Explicit consent — we obtain explicit consent for sensitive health and fitness data you enter or import, and separately before health context is sent to a model provider. Connected-source permissions control imports. You can withdraw through the consent controls presented by the feature or contact us at any time. Withdrawal does not affect the lawfulness of consent-based processing already completed. It stops the processing covered by that consent, subject only to retention that applicable law permits under the narrow cases in section 7. You can also request deletion of stored history.
Legitimate interests — security and fraud prevention. You can object; see Your rights.
Consent — optional account-linked app product analytics and device capabilities to improve Gymrapp, never for advertising. You can withdraw in Settings → Privacy. Website analytics choices are separate; see Cookies and analytics.
Consent — where you choose to allow it, we use your account email to invite you to experience interviews or feature testing for product improvement. This consent is optional, excludes promotional messages, and can be withdrawn in Settings → Privacy.
Your choice — an optional self-reported answer about where you first heard about Gymrapp helps us understand acquisition. It is separate from measured registration attribution and can be skipped or corrected.
Legal obligation — when we must keep or disclose a record.

4. Generated programs and coaching

We use AI model providers we contract with to build your programs and write your coaching replies. We send them your information only while you allow “Personalized coaching.” This one permission covers every feature that sends your information to a model provider: program building, including queued and retried builds; coaching replies; and training summaries and suggestions. It is separate from your subscription.

When you build a program, we send a model provider your age, gender, height, and weight; your questionnaire answers, including goals, schedule, equipment, and injuries with any injury notes; your personal records and strength estimates; and summaries of your workouts from the last 12 weeks, from Gymrapp and from connected apps such as Garmin, Apple Health, and Health Connect. From connected activity, only training summaries are shared, never routes, heart rate, or sleep data. We store program-request snapshots. Where saved inputs are available, choose “View inputs” in your generated program’s menu to see the questionnaire answers and profile details saved for that program. This view does not include the training summaries or personal records also sent to the provider.

If you use coaching chat, we send the messages you type, relevant conversation history from the session, and the results of exercise, equipment, and muscle-group lookups and workout-template or program creation tools to a model provider so it can reply. Chat does not retrieve your stored workouts, profile details, health metrics, or connected-app data. Information you type in chat is included in the messages we send. We can store the chat messages, conversation history, and tool results used to provide the feature.

Model providers process this information to answer our requests. Our current approved provider is Google Gemini API. Its data-use and retention terms are linked here. We use this service under terms and settings that do not use these requests to train its models. The provider may retain information for purposes described in those terms, including abuse prevention; this is not a promise of zero retention.

The app asks for this permission during sign-up and, if you have not allowed it, when you next build, regenerate, or retry a program. It explains what we share, why, and who receives it. If you choose “Not now,” nothing is sent. We record the disclosure version you allowed, when you allowed it, and when you withdraw it. We ask again only if the purpose or categories of information change. Changing providers within the same role and equivalent data-use terms does not require a new permission.

You can withdraw permission at any time in Settings → Privacy by switching off “Personalized coaching.” We record the withdrawal on our servers and refuse every later model-provider request before any information is sent, including queued requests, retries, and coaching requests. A request already in progress may finish, and information already sent cannot be recalled. Withdrawal does not delete your existing programs or imported history. Without this permission, sync, workout logging, connections such as Garmin and Apple Health, and your existing programs keep working, but you cannot build or regenerate programs or get coaching replies until you allow it again.

We send selected context for the result, not a live HealthKit or Health Connect dump. The selected context can still contain sensitive health information. We do not train our own models on this content.

These features are not medical advice and do not replace a coach or clinician you hire.

5. Subscriptions

We process your Gymrapp account identifier, installation or device identifiers assigned by our subscription-management provider, and your subscription or purchase status and history. We share those identifiers and transaction or status data with that provider so we can activate access, prevent fraud and attribution errors, and see subscription analytics. Apple and Google process the payment; neither Gymrapp nor the subscription-management provider receives your card number. This data is not sold or shared for advertising.

We share personal information with third-party providers only as needed for these roles:

Cloud hosting, managed database, and file storage providers — account, training, health, and activity records, plus activity files and media, to run the app and store its data.
Account-authentication providers — name, email, profile photo, and account identifiers to sign you in with Google or Apple.
Push-delivery provider — your push token and account link to deliver notifications. Operating-system settings control whether notifications are displayed.
Subscription-management provider — Gymrapp account, installation or device identifiers, and store transaction, entitlement, and subscription status to activate access, prevent errors, and provide subscription analytics. It does not receive payment-card numbers.
Crash, performance, and infrastructure-diagnostics providers — account ID, email, diagnostic identifiers, and limited device, network, error, and performance context to investigate failures.
Product-analytics provider (Google, our processor) — account identifiers, install or device identifiers, app usage events, and website traffic and campaign data to measure and improve the product. First-party device capability snapshots stay in our database and are not sent to Google Analytics or advertising providers.
Support and feedback providers — your message, name, email, diagnostic-event identifier, and any screenshot you choose to send to handle your request; screenshots may include health data.
Email-delivery provider — email address and delivery events to send beta invitations you request.
Model-inference providers — the request and selected sensitive context described in section 4 to generate a program or coaching reply you permit.
Apple, Google, and Garmin services you choose to connect — account, health, activity, wearable, and purchase information needed for the sign-in, sync, store, or beta-distribution feature.

Google provides website hosting, account authentication, push delivery, and product analytics. Google, Apple, and Garmin also act under their own terms when you use their sign-in, store, health, or wearable products. Other providers process information under our instructions for the roles above. We require third parties receiving your information to provide protection at least equivalent to that described in this notice and required by applicable App Store guidelines.

We may also share information if the law requires it, or if we sell or merge the business. We will require the buyer to honor this notice or obtain any consent required for a different use.

7. How we protect and keep information

Traffic to the app and API uses HTTPS. Data in our managed database and file storage is encrypted at rest. We use access controls for production systems and the service accounts that run the app's online services. Health and fitness data is held under the same controls. Diagnostic processing is minimized as described above.

We keep each type of information only while it is needed for the purposes in this notice, then delete it or irreversibly anonymize it. The period depends on the purpose, the sensitivity of the data, legal requirements, and security or dispute needs. Provider retention can also apply. For model inference, the applicable provider terms may include limited retention to detect abuse or policy violations; we disclose those provider-specific terms before asking for consent.

We keep a product-research contact consent and a self-reported acquisition answer with your account while they are needed for those purposes. You can withdraw the contact consent in Settings → Privacy; withdrawal stops future research-contact eligibility but does not recall a message already sent. Account deletion removes these consent and survey records, subject to the narrow legal, security, and backup exceptions described above. The self-reported answer remains separate from measured registration attribution and can be corrected before account deletion.

You can request account deletion in the app (Settings → Manage account), by emailing [email protected], or through the contact page. The in-app request is sufficient; you do not have to send a second email. We stop connected imports and callbacks, revoke connected providers and sign-in credentials where applicable, erase associated personal data or irreversibly anonymize eligible records so they can no longer identify or be linked to you. We also ask relevant processors to delete their copies. We will tell you the expected completion timing and confirm when the request is complete.

Where applicable law permits it, we may retain a specific record only when necessary to meet a legal obligation, establish or defend a legal claim, or investigate and prevent fraud or a security incident. We limit it to that purpose, restrict access, and delete or anonymize it when the reason ends. We do not keep an identifiable copy of all account content merely because the profile was deleted.

Protected backups are isolated from ordinary use and expire under our backup schedule. If a backup is restored before expiry, we reapply completed deletion requests. A processor may retain a copy when law requires it; where applicable, we will explain that exception and its expected duration.

The same account-deletion and support channels apply to the directory and app. Directory cleanup removes your current support positions and request bindings, scrubs private proposal content and account attribution, and preserves immutable venue facts without identifying you. A private participation block may be retained only as needed to investigate or prevent abuse or security incidents under the restricted retention exceptions above; it is not public attribution. The directory does not provide a separate account-deletion or recovery process.

Deleting the Gymrapp account does not cancel an App Store or Google Play subscription.

8. Cookies and analytics

Marketing website. When enabled in production, the marketing pages use Google Analytics. Visitors in the EEA, the United Kingdom, and Switzerland are defaulted to denied analytics storage. While storage is denied, the tag does not set analytics cookies but can send cookieless measurement pings. Other regions may receive Google analytics cookies (for example `_ga`) so we can see traffic and campaigns. The site has no third-party ads or advertising pixels. Your selected website language is saved in browser local storage on your device when available; this preference is not sent to a server.

Gym directory. Directory pages do not load Google Analytics. Our sign-in service uses browser storage to keep you signed in. Search results and report drafts are held in memory; signing out or changing accounts clears that directory state. The directory page's address includes the gym you are viewing, the search text you submit and the filters you choose, so reloading the page, going back or opening a shared link returns to the same view. That address stays in your browser history, is part of any link you share, and reaches our hosting provider with the page request. When you sign out, we remove the gym, search text and filters from the current address. Your device position and map area are never added to it. The directory holds the name and photo from your sign-in provider and the source, medium, and campaign values from the link you arrived from in this tab's session storage, which the browser clears when the tab closes; the name and photo are removed once your account exists. They are sent only to our server, in the request that registers your account. Map and address recipients process the requests needed for the features described above.

App. Product analytics is optional and off until you explicitly agree and our server confirms current consent. Google processes app usage analytics for us, linked to your account. We separately store bounded device capability snapshots in our database, including Apple Watch pairing state, without requiring a push token. We use this information only to improve Gymrapp, never for advertising. You can change your mind in Settings → Privacy. Withdrawal stops new optional collection; it does not erase historical records automatically. We retain history only as needed for the disclosed purpose under Retention and deletion; deleting your account removes our device snapshots and consent records. Google retention and deletion are subject to its applicable terms and our processor obligations.

On-device storage also keeps you signed in and remembers preferences. Diagnostics remains a separate purpose and may associate error reports with account identifiers while you are signed in. These services are not website cookies.

For both the website and app, Google processes analytics information under our instructions to measure usage and provide reports to us. Google explains this processing in How Google uses information from sites or apps that use our services.

9. International transfers

Gymrapp is based in Taiwan and offers the Services globally. Providers in the United States, the European Union, and other countries may process information outside the country where you live. Where required, we use a lawful transfer mechanism, such as Standard Contractual Clauses or an adequacy decision. You may request a copy of the applicable safeguards through the contact methods below.

10. Your rights

Depending on where you live, you may have the right to know what personal information we collect, its sources, purposes, and recipients; access or export it; correct or delete it; withdraw consent; restrict or object to processing; obtain a list of third parties that received it where required; and complain to a regulator. If we deny a request, you may also have a right to appeal.

The fastest path:

Correct profile and training data in the app.
Stop new health imports: disconnect Apple Health or Health Connect in Connected Apps, and revoke Gymrapp in iOS Settings → Health or in the Health Connect app. Disconnect Garmin in Connected Apps; you can also revoke Gymrapp on Garmin’s own site.
Withdraw health consent using the controls presented by the feature, or model-transfer consent by switching off “Personalized coaching” in Settings → Privacy. If you allowed product-research contact, switch off “Product improvement” there to stop future invitations. You can also contact us.
Submit an access, correction, deletion, export, third-party-list, or appeal request in the app where available, by emailing [email protected], or using the “data” option on the contact page. You do not need to create a new account to make a request.
Submit account deletion in the app (Settings → Manage account); that request starts the deletion process described above without a second email.

We authenticate a request using only the information reasonably needed to protect your account and data. We will not discriminate against you for exercising these rights. If we deny an appeal, we will give a written explanation and, where required, tell you how to contact the relevant regulator. We do not sell or share personal information as those terms are used in California law, and we do not use sensitive information to infer characteristics about you beyond providing the training features you requested.

11. Children

The Services are intended for people 18 or older. If you think a child has provided personal information, email [email protected] so we can investigate and handle the request.

12. Changes

We will update this notice when our practices change. The “Last updated” date at the top is the published version. Material changes will be posted here; we may also notify you in the app or by email.

13. Contact

Gymrapp
Taipei City, Taiwan
[email protected]