Privacy Policy

Effective date: 4 September 2026

Last updated: 4 September 2026

This Privacy Policy explains what personal data Gymothy ("we", "us", "the App") collects when you use the Gymothy mobile application, why we collect it, how it is stored, and the rights you have over it. Gymothy is a workout-tracking and fitness-social app. We built it to be small, honest, and boring about your data: we do not sell it, we do not run ads, we do not embed ad-tech, and we do not track you across other apps or websites.

This policy is written to comply with the EU General Data Protection Regulation (GDPR). If you are outside the EU, the same protections apply to you — we do not offer a lesser standard elsewhere. If you are in the United States, see §15 for the rights that apply to you specifically.

1. Who is responsible for your data (data controller)

The data controller is the individual operator of Gymothy. Full legal identity and contact details are published in the Impressum, as required for services offered to users in Germany. There is no separate data protection officer — the operator handles privacy requests personally.

2. What data we collect

We collect only what the App needs to function:

We do not collect: continuous or background location, your contacts or address book, advertising identifiers (no IDFA, no Android Advertising ID), browsing history outside the App, biometric identifiers, or clinical/medical records. Gymothy shows no advertising, so no ATT (App Tracking Transparency) prompt is needed and none is shown.

Some of the data above — body weight, workout and nutrition entries, heart rate, and anything a meal photo reveals — is health-related data in the sense of Art. 9 GDPR. We treat every one of those features as optional and consent-based (see §3, §4 and §5), and we never use them for advertising, scoring you against other users' health, or any purpose beyond the feature you switched on.

3. Location data (gym check-in)

Gymothy has one optional feature that uses your device location: gym check-in. It verifies that a workout actually happened at a gym you saved — a small anti-cheat measure that grants a modest XP bonus for a verified check-in. This is the only feature that uses location, and it is strictly opt-in. If you never save a gym, Gymothy never requests or reads your location at all.

Opt-in, twice over. Location is used only if both are true: (1) you have created at least one "saved gym" in Settings, and (2) you have granted the App "while using the app" (foreground) location permission. We never request background or "always" location, and the App is technically configured so that it cannot collect location in the background — no background location, no geofencing service, no foreground service.

When we read your location — and how often. We take a single, one-shot GPS fix at two moments only:

• when you tap to save your current location as a gym in Settings (to store that gym's coordinates); and
• when you finish a workout, and only if you already have a saved gym and have already granted permission — one fix, compared against your saved gym. It never prompts you at workout finish and never blocks finishing.

There is no continuous tracking, no route recording, no background collection, and no location read at any other time.

What we store. For a saved gym: the label you choose, its coordinates, and a check-in radius (80–300 m). For a workout check-in: the single coordinate fix, its reported accuracy, the computed distance to your nearest saved gym, a "dwell" flag (whether the workout lasted long enough to be plausible), the Android mock-location flag (see below), and a verdict of verified, unverified, or flagged. The verdict is computed on our server, never by your device — the App cannot mark its own check-in as verified.

Android mock-location disclosure. On Android, the operating system exposes a flag indicating whether a location reading was produced by a mock-location (GPS-spoofing) app. We read and store this flag solely to flag potentially faked check-ins for anti-cheat review. We do not use it for any other purpose. (iOS does not expose an equivalent flag.)

Legal basis. Consent (Art. 6(1)(a) GDPR). You give consent by saving a gym and granting the OS-level permission, and you can withdraw it at any time: revoke location permission in your device settings and/or delete your saved gyms in Gymothy (Settings → gyms), which stops all future location use.

Retention & deletion. Saved gyms and check-in records last as long as the account (or the associated workout) they belong to. Deleting a saved gym removes that gym definition. Deleting a workout deletes its check-in. Deleting your account deletes all of your saved gyms and all of your check-in records via the same server-side cascade as the rest of your data (see §13). Location data is never shared with third parties and never leaves our EU-hosted database.

One purpose only. To say it plainly: location data exists in Gymothy solely to verify gym check-ins. It is never used for advertising or analytics, never combined with other data for profiling, and never sold.

4. Apple Health (HealthKit)

Health sync is optional and off by default. You turn it on in Settings → Apple Health, and iOS asks you separately which categories you allow.

What Gymothy reads. One category only: your most recent body mass (body weight) sample, used to prefill the weight in your fitness profile. That synced value is then stored in your Gymothy account (in our EU database) like any other profile value. No other Health samples are read, and raw Health data otherwise stays on your device.

What Gymothy writes. Finished strength workouts (as an Apple Health workout of type traditional strength training) and body-weight entries you log in the App, so your Apple Fitness history and weight trend stay complete.

What we never do with Health data. As required by Apple's HealthKit rules, and as our own commitment:

• Health data is never used for advertising, marketing, or any similar service — Gymothy has no advertising of any kind.
• Health data is never sold, rented, or disclosed to data brokers, insurers, employers, or any other third party.
• Health data is never shared beyond your own account: it is not posted to the feed, not shown to friends, and not visible to other users.
• Health data is never used for XP, levels, ranks, duels, leaderboards, or any competitive scoring.
• Health data is not used for AI features unless you separately enable them (see §5), and it is not written to iCloud by Gymothy.

Legal basis. Explicit consent (Art. 6(1)(a) together with Art. 9(2)(a) GDPR), given by switching the toggle on and granting the iOS Health permission. Withdrawing consent: switch Health sync off in Gymothy Settings, and/or revoke access in iOS Settings → Privacy & Security → Health → Gymothy. Withdrawal stops all future reads and writes; the body-weight value already stored in your fitness profile is removed when you delete your account (§13) and can be edited by you at any time.

5. AI features (meal estimates, weekly coach, training plans)

Gymothy has three optional features that use a third-party AI model:

• Meal estimation — you submit a photo of a meal and/or a text description, and get an estimated calorie and macro breakdown that you can edit before saving.
• Weekly coach — aggregated statistics from your recent training (and, if present, your body-weight trend) are summarised into highlights and suggestions.
• Training plan suggestion — a short description you write is turned into a suggested training split built from Gymothy's own exercise catalogue.

Nothing is sent until you agree. All three features are behind a single in-app consent gate. Before the first use, Gymothy shows you a consent screen explaining what is sent and to whom; if you decline, nothing is transmitted and manual logging works exactly as before. Your consent is recorded on your profile, and the server refuses AI requests when it is absent.

Who processes it. Requests are routed through our own Supabase edge function (so our API keys never ship inside the App) to Google's Gemini API (Gemini 2.5 Flash), operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, with Google LLC (United States) as a sub-processor. We keep a configured fallback to Anthropic PBC (Claude, United States) so the feature can stay available if the primary provider fails; if we make Anthropic the standing provider we will update this policy and the in-app consent notice. In either case the provider acts as our processor.

What is sent. Only what the feature needs: the meal photo and/or meal description you submitted, or the aggregated training statistics described above. We do not send your email address, your username, your social content, your friends list, or your location.

What happens to it. Meal photos and descriptions are transient — we transmit them for the estimate and do not store the image; what is stored is the meal entry you choose to save, which you can delete at any time. At the provider, the request is processed under Google's API data-processing terms; Google states that data submitted through the paid Gemini API is not used to train its models and is retained only briefly for abuse monitoring. We pass that on as the provider's own commitment — it is what those terms say, not a guarantee we are in a position to independently verify. We also apply a daily per-user request cap.

Legal basis. Consent (Art. 6(1)(a) GDPR), and — because a food photo or body-weight trend can reveal health information — explicit consent under Art. 9(2)(a) GDPR. Withdrawing consent: Settings → Withdraw AI consent. Withdrawal is immediate and blocks any further AI request server-side. It does not affect processing that already lawfully happened, and it does not delete meals you already saved (you can delete those individually).

Transfers. See §10 — the AI provider chain involves a United States entity, and we rely on the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework for that leg.

6. Product analytics

Gymothy measures how the App is used, never who you are. The goal is behavioural and diagnostic: which onboarding step loses people, which screen they bounce out of, which feature nobody finds. It is explicitly not a profiling or ad-targeting system, and it feeds no advertising ecosystem of any kind.

Two layers, both minimal.

• First-party events, written into our own Supabase database in the EU. Each row holds an event name from a fixed, typed list, a small property bag (screen name, feature key, plan id), the platform (ios/android/web), the app version, and your account id. It never contains free text you typed, your email, your name, your workout or meal content, your photos, or your location.
• PostHog, a product-analytics service used as our processor, running on PostHog EU Cloud in Frankfurt, Germany (PostHog, Inc. / its EU-hosted service). PostHog receives exactly the same shape of data: event names, screen names, app version, platform, and a pseudonymous user identifier. It receives no email address, no name, no workout, meal, photo, health or location data.

What we deliberately do not switch on. No session replay (we never record your screen), no autocapture (only the events we explicitly write are sent), no advertising identifier, no device fingerprinting, no cross-app or cross-site tracking, and no ad-network or data-broker integrations. Nothing collected here is combined with data from other services to build a profile of you.

Legal basis. Legitimate interest (Art. 6(1)(f) GDPR) — our interest in understanding and fixing our own product, balanced against your interests by keeping the data pseudonymous, minimal, EU-hosted, free of any advertising use, and switchable off in one tap. You may object at any time (Art. 21 GDPR); the switch below is the fastest way to do that.

Your switch. Settings → Analytics. It is on by default and turning it off stops both layers — no further events are collected or transmitted, from either the first-party pipeline or PostHog.

§ 25 TDDDG (device storage). Product analytics needs an identifier stored on your device to recognise repeat events from the same install. We do not claim that this storage is strictly necessary within the meaning of § 25(2) TDDDG. It is used solely for the pseudonymous product analytics described here, never for advertising or cross-service recognition, and switching the Analytics toggle off stops it being stored or read.

Retention. Analytics events are kept no longer than 12 months and are then deleted or aggregated. If you delete your account, your first-party analytics rows are detached from your identity (the user reference is nulled) so that aggregate funnels survive while the history stops being attributable to you.

7. Signing in with Apple or Google

You can create an account with an email address and password, or with Sign in with Apple or Sign in with Google. Sign-in is handled by our authentication provider (Supabase Auth); we never see or receive your Apple or Google password, and we get no access to those accounts beyond what sign-in returns.

• Sign in with Apple. We receive a stable Apple user identifier and an email address. On the first sign-in only, Apple may also pass the name you chose to share. Apple's "Hide My Email" is fully supported: if you use it, we only ever receive Apple's private relay address, never your real one, and everything we send you goes through that relay. You can revoke Gymothy's access at any time in iOS Settings → your name → Sign-In & Security → Sign in with Apple.
• Sign in with Google. We receive a Google user identifier, your email address, and, where Google provides them, your name and profile picture. You can revoke access at any time in your Google Account's third-party connections settings.

We use this data solely to create and authenticate your account. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

8. How we use your data (purposes & legal basis)

• To provide the service (Art. 6(1)(b) GDPR — performance of a contract): storing your workouts, computing PRs, rendering your feed, running the XP/level/achievement/mission progression, running the nutrition tracker, authenticating you, and sending notifications you'd expect from a social fitness app.
• To keep the community safe (Art. 6(1)(f) — legitimate interest): processing reports, enforcing blocks, allowing moderator review of reported content, and reviewing check-ins flagged by the anti-cheat system.
• To secure your account (Art. 6(1)(f)): authentication, session management, abuse prevention, per-user request caps.
• To understand and improve the App (Art. 6(1)(f)): the pseudonymous product analytics in §6, which you can switch off.
• With your consent (Art. 6(1)(a), and Art. 9(2)(a) where health data is involved): push notifications, uploading a photo to a post, Apple Health sync (§4), the AI features (§5), and the optional gym check-in location feature (§3). You can withdraw any of these at any time.

We do not use your data for advertising, for automated decision-making with legal or similarly significant effects, or for any purpose beyond operating the App as described above. We do not sell, rent, or trade your personal data to any third party.

9. Who can see your data

Gymothy is a friends-only social app, enforced by server-side access rules (Row Level Security), not just app-side logic:

• Your workouts, sets, PRs, XP, nutrition entries, body weight, gym check-ins, and location data are private to you unless you post them (and location, check-in and health data is never posted).
• Posts are visible to your confirmed friends only (or to nobody, if you mark a workout "private"). Your achievements and equipped cosmetics are visible to your confirmed friends.
• If you block someone, all content between you becomes mutually invisible — this is enforced at the database level, not just hidden in the UI.
• A designated moderator account (the app operator) can view content you report, content someone reports about you, and check-ins the anti-cheat system has flagged, solely to resolve reports and investigate suspected cheating.

10. Where your data is hosted, and international transfers

The core of Gymothy stays in the EU. All account, workout, nutrition, social, gamification, health-profile and location data is hosted on Supabase, running in the eu-central-1 (Frankfurt, Germany) AWS region. Product analytics sent to PostHog stays in the EU as well, on PostHog EU Cloud in Frankfurt. The public website (gymothy.de) is served by Cloudflare and holds no account data at all.

Some processing necessarily involves entities outside the EU:

Where we rely on Standard Contractual Clauses, you may request a copy of the relevant terms using the contact details in the Impressum.

11. How long we keep your data

We keep your data for as long as your account exists. If you delete your account (see §13), your data is deleted immediately and permanently — there is no "soft delete" grace period, no backup retention window we can restore from, and no way for us or you to undo it. Individual items you delete yourself (a workout and its check-in, a saved gym, a meal, a post) are removed at the moment you delete them. Product analytics events are kept no longer than 12 months (§6). Meal photos submitted to the AI estimator are not stored by us at all (§5).

12. Your rights

Under GDPR you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate data (most of this you can already edit yourself in Settings).
• Erasure ("right to be forgotten") — delete your account and all associated data, in-app, at any time (§13).
• Restriction & objection — ask us to limit or stop certain processing, including objecting under Art. 21 GDPR to anything we base on legitimate interest (such as the product analytics in §6, which you can also simply switch off).
• Data portability — request your workout data in a structured, machine-readable format.
• Withdraw consent — for anything based on consent (push notifications, photo uploads, Apple Health sync, AI features, gym check-in location), at any time, without affecting past lawful processing.
• Lodge a complaint with your local data protection supervisory authority.

To exercise any right not available directly in-app, contact us using the details in the Impressum. We answer within one month, as GDPR requires.

13. Deleting your account (in-app)

You can permanently delete your Gymothy account at any time from Settings → Delete account. You will be asked to type your username to confirm. On confirmation, your account and all data linked to it — profile, fitness profile, workouts, sets, PRs, nutrition entries, posts, comments, reactions, attestations, friendships, blocks, reports you filed, notifications, XP events, achievements, missions, cosmetics, saved gyms, and gym check-in records — are deleted immediately via a server-side cascade. This action cannot be undone and we cannot recover the data afterward, so please be certain.

14. Children

Gymothy is not directed at children. You must be at least 16 years old (or the age of digital consent in your jurisdiction, if that is higher) to create an account and use the App.

We do not currently verify age at sign-up. The birth year you may enter during onboarding is used only to estimate calorie needs and heart-rate zones — it is not an age check, and it is optional. If we learn that an account belongs to someone below the applicable minimum age, we delete that account and its data. If you are a parent or guardian and believe a child has created an account, contact us using the details in the Impressum and we will delete it.

15. Users in the United States

If you are a resident of California or another US state with a comprehensive privacy law (Colorado, Connecticut, Virginia, and others), the following applies in addition to everything above — we apply one standard worldwide rather than a weaker one outside the EU.

• We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding 12 months and have no plans to. There is no "Do Not Sell or Share My Personal Information" mechanism because there is nothing to opt out of.
• No targeted advertising and no profiling that produces legal or similarly significant effects.
• Sensitive personal information (health and fitness data, precise geolocation) is collected only for the optional features you switch on, and used only to provide those features — never to infer characteristics about you, and never disclosed for anyone else's purposes.
• Your rights: to know/access what we collect and why, to delete it, to correct it, to obtain a portable copy, and to be free from discrimination for exercising any of these rights. We will not degrade the service because you exercised a right.
• How to exercise them: deletion is instant and self-service in-app (Settings → Delete account, §13). For access, correction, or portability, email us at the address in the Impressum. We verify requests by checking that you write from the email address on the account, and we respond within 45 days. An authorised agent may act for you with written proof.

16. Ads, tracking, and every third party we use

No ads. No ad-tech. No cross-app tracking. No sale of your data. Gymothy embeds no advertising SDK, no ad network, no attribution or ad-measurement SDK, no tracking pixel, and no advertising identifier. Nothing in the App tracks you across other apps or websites, which is why iOS never shows you an App Tracking Transparency prompt. We share nothing with data brokers.

What we do use is privacy-friendly, EU-hosted product analytics that you can switch off (§6), plus the processors the App needs to run. Here is the complete list:

All of these act as processors on our instructions (or, for Apple/Google sign-in and push delivery, in their own defined roles as platform operators), not as independent controllers who may use your data for their own purposes.

17. Changes to this policy

If this policy changes materially, we will update the "Last updated" date above and, where required, notify you in-app. Where a change concerns processing based on your consent, we will ask for consent again rather than assume it.

18. Language versions

A German-language version of this Privacy Policy (Datenschutzerklärung) is available in-app and at privacy-policy.de.md. If the two versions ever conflict, the English version governs for legal interpretation, but we intend them to say exactly the same thing.

19. Contact

See the Impressum for the legally responsible party and contact details.