Privacy Policy

Introduction

Gymex Fitness Ltd ("we", "our", or "us") is the owner and operator of the Gymex app and website, and the data controller responsible for your information. We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use the Gymex Fitness mobile application or website.

Information We Collect

When you use Gymex, we may collect the following types of information:

• Account Information: Your name, email address, username, avatar, date of birth, sex, and profile details when you create an account. If you sign in with Apple or Google, we receive your name and email (or Apple's private relay email) as authorised by you.
• Fitness Data: Workout logs, exercises, sets, reps, weight lifted, RIR (Reps in Reserve), personal records, failed attempts, training volume, workout duration, recovery estimates, and program configurations that you enter into the app.
• Nutrition Data: Calories, macronutrients, meals logged, food items (including barcode scans and food database searches), photos of meals or nutrition labels you choose to scan, and daily nutrition goals.
• Body Metrics: Body weight, height, and body measurements that you choose to record.
• Photos and Camera: Progress photos, photos you submit for AI physique ranking, meal photos, nutrition-label photos, and workout screenshots you choose to import. The camera is also used for form check, which analyses your movement on your device.
• Health and Wearable Data: If you connect Apple Health, Health Connect, Apple Watch, Garmin, Whoop, Oura, or Fitbit / Google Health, we receive the data you authorise, such as workouts, heart rate, heart-rate variability, resting heart rate, sleep, steps, active energy, and body weight. Where you allow it, we also write your Gymex workouts back to Apple Health or Health Connect.
• Location: If you allow location access, we use your location during a workout to recognise the gym you train at and record gym visits. We store the gym's approximate location and your visit history, not a continuous location trail.
• Voice Data: Voice recordings you provide when using voice features. These are sent to ElevenLabs for speech-to-text processing. ElevenLabs handles the recordings under its own data-retention terms.
• AI Interaction Data: Conversations and queries you submit to the AI Coach and other AI features, including contextual fitness data sent alongside your messages to generate personalised responses.
• Social Content: Posts, comments, messages, clan activity, gym check-ins shared with friends, shared workouts and programs, rank cards, and other content you share.
• Usage and Diagnostics Data: How you interact with the app (for example screens viewed, features used, onboarding steps, and paywall views), app version, device model, crash reports, performance data, and recordings of app screens around errors (with all text and images masked).
• Advertising and Attribution Data: Information about the ad, referral link, or campaign that led you to install Gymex, such as campaign click identifiers and, where you permit it, your device's advertising identifier.
• Referral Link Data: When someone opens a Gymex referral or creator link in a web browser, we record the link code, IP address, and browser user agent so we can credit the right person if the app is then installed. Creator sponsor links also keep a hashed click record (see Referrals, Creator Links & Emails).
• Purchase Data: Subscription status, plan, trial and renewal events, and paywall interactions. We never receive your full card details.
• Device Identifiers and Tokens: A device-level identifier used for account security, device-ban enforcement, and preventing misuse, plus push notification tokens used to deliver notifications.
• Partnership Application Data: If you apply to partner with Gymex, we collect your name, email, organisation, country or region, partnership interests, audience information, social-media and website links, previous partnership information, your proposal, and your reasons for applying.

How We Use Your Information

We use the information we collect to:

• Provide and maintain the Gymex app and all of its features.
• Track your workouts, nutrition, body metrics, recovery, progress photos, and personal records.
• Provide personalised AI coaching, workout recommendations, program generation, training analysis, and AI image features you choose to use.
• Sync with the health platforms and wearables you connect.
• Recognise your gym and show gym check-ins to your friends, where you use those features.
• Enable social features including the community feed, friends, clans, leaderboards, and direct messaging.
• Send push notifications and emails about your training, your account, and (where permitted) offers and features you may be interested in.
• Personalise the timing of reminders and which offers we show you, using engagement and subscription predictions (see Personalised Offers & Predictions).
• Manage your subscription and purchases.
• Measure which ads, campaigns, and referral links bring people to Gymex, and credit referrers and creators.
• Understand how the app is used, diagnose crashes and bugs, and improve and develop features.
• Enforce our Terms of Service, including preventing misuse, moderating content, and enforcing bans.
• Review and respond to partnership, press, reviewer, creator, coach, gym, event, club, athlete, and technology-collaboration applications.

Data Storage and Security

Your data is stored securely using Supabase, an industry-standard cloud infrastructure provider with PostgreSQL databases, row-level security (RLS) policies, and encrypted connections. Authentication tokens are stored securely using your device's native keychain (via Expo SecureStore).

Data cached locally on your device for offline use is encrypted using AES-256 encryption. We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction.

Third-Party Services

We do not sell your personal data. We use the following service providers to operate the app. Each only receives the data needed for its purpose:

• Supabase: Cloud database, authentication, file storage, server functions, and real-time messaging.
• Apple, Google, and Stripe: Apple App Store and Google Play process in-app purchases. Where we offer purchases on our website, Stripe processes the payment.
• RevenueCat: Subscription management and purchase validation. RevenueCat does not receive your card details.
• DeepSeek: AI language model used for the AI Coach, AI Program Builder, workout analysis, and other text-based AI features, either directly or through OpenRouter.
• Google (Gemini): AI analysis of photos you submit (meal photos, physique ranking, workout screenshots), the AI Coach's deep research feature, and some other AI requests, either directly or through OpenRouter.
• OpenRouter: AI routing service used for some requests and fallbacks. OpenRouter receives the request data and forwards it to the selected model provider, which may be Google or DeepSeek.
• Web search providers (Tavily and DuckDuckGo): When the AI Coach researches a question, search queries derived from your question are sent to these services. Your name and account details are not included.
• Google Cloud Vision: Automated safety checks on images uploaded to community features.
• ElevenLabs: Speech-to-text and AI voice features.
• OpenFoodFacts and USDA FoodData Central: Food databases for search and barcode lookups. No personal data is sent.
• OpenStreetMap services (Overpass and Nominatim): Looking up the name of a nearby gym. Only coordinates are sent, never your identity.
• Health and wearable platforms: Apple HealthKit, Google Health Connect, Garmin, Whoop, Oura, and Fitbit / Google Health, only if you connect them.
• Firebase (Google): Product analytics, crash reporting, and remote configuration.
• Sentry: Error and crash monitoring, including screen recordings around errors with all text and images masked.
• PostHog: Product analytics (which features are used and where people drop off).
• Tenjin, TikTok, and Reddit: Measuring the effectiveness of our advertising (see Advertising & Attribution).
• Resend: Sending account and service emails.
• Expo: App updates and push notification delivery (via Apple Push Notification service and Firebase Cloud Messaging).
• Apple Sign-In and Google Sign-In: Optional sign-in methods.

Each of these services has its own privacy policy governing its handling of your information.

AI-Powered Features

Gymex uses AI throughout the app, including the AI Coach, AI Program Builder, AI-generated workouts, smart weight recommendations, auto periodization, plateau detection, overtraining alerts, post-workout analysis, weekly recaps, AI meal photo scanning, AI physique ranking, and workout screenshot import.

Depending on the feature and provider availability, an AI request may go to DeepSeek or Google Gemini directly, or through OpenRouter to a model provider such as Google or DeepSeek. The request may contain your question or instructions and relevant information from your profile, workouts, training programs, nutrition logs, body metrics, injuries or recovery notes, connected health or wearable data, or the photo or screenshot you choose to submit. This information is sent through our server functions. Our API keys never reach your device.

Some features run entirely on your device and do not send images to us: nutrition-label scanning uses on-device text recognition, and form check analyses your movement on your device.

AI physique ranking is only available to adults. We do not use photos of users under 18 for physique ranking.

AI-generated data is used to provide the feature you requested. It is not used for advertising or sold to third parties.

AI Coaching & Data Processing

AI Coach requests may include your name, date of birth, sex, height, weight, body measurements, workout history, nutrition data, personal records, injuries or recovery notes, connected health or wearable data, and the messages you send. These may be sent to DeepSeek, Google Gemini, and OpenRouter as described above to generate personalised coaching responses. The AI Coach can also suggest modifications to your programs, nutrition goals, and training schedule.

These requests are transmitted through encrypted connections. You can choose not to use AI features and continue using features that do not require AI processing. Provider retention and use of request data depend on the provider's terms and our account settings; we cannot promise that every provider deletes request data immediately after processing.

Connecting Gymex to ChatGPT, Claude & Gemini

You can choose to connect your Gymex account to an AI assistant you already use — such as ChatGPT (OpenAI), Claude (Anthropic) or Gemini (Google) — so you can ask it about your own training. This is off unless you turn it on: you start the connection from the assistant, sign in on gymex.fitness, and approve the request on our consent screen.

Once connected, the assistant can read data from your account when you ask it something: your profile and goals, injuries you've logged, workouts and sets, personal records and lift progress, training programs, recovery and training stats, nutrition logs, body weight, and data synced from connected health apps and wearables. It cannot change your account, see your password, or see payment details. We only share data in response to the assistant's request on your behalf.

Data the assistant receives is processed by that provider under its own privacy policy and your settings with them (for example, chat history and model-training controls). Gymex does not control how the provider stores it. We record how many questions you ask each day so we can apply the daily limit for your plan.

You can disconnect at any time from the assistant's settings (for example, ChatGPT → Settings → Plugins, or Claude → Settings → Connectors), or ask us to revoke access by contacting us. Deleting your Gymex account also ends all connections.

Voice Data & ElevenLabs

When you use the AI Voice Logger or custom AI voice features, your voice recording is sent to ElevenLabs for speech-to-text processing. Voice data is transmitted through encrypted server functions for the voice feature you request. ElevenLabs may retain request data according to its terms and our account settings.

Voice features are available on eligible paid plans. You can choose not to use voice features, and no voice recording will be collected for them.

Body Metrics & Progress Photos

Body metrics (weight, height, and body measurements) and progress photos are stored securely in your account. Progress photos are uploaded to Supabase Storage with access controls that ensure only you can view your photos unless you explicitly choose to share them.

Body metrics data may be shared with the AI Coach when you use coaching features, to provide more personalised recommendations. You can delete your progress photos and body metrics data at any time from within the app.

Health & Wearable Integrations

You can connect Apple Health, Health Connect (Android), Apple Watch, Garmin, Whoop, Oura, and Fitbit / Google Health. When you do, we receive only the data types you approve, and we use them to power your recovery, readiness, training, and coaching features. Where available and you allow it, Gymex also writes your completed workouts to Apple Health or Health Connect.

For services that use sign-in (Garmin, Whoop, Oura, Fitbit / Google Health), we store access tokens securely on our servers so we can sync your data. You can disconnect any integration at any time in the app, and you can also revoke access from the provider's own settings.

Data from Apple HealthKit and Health Connect is never used for advertising or marketing, never shared with advertising partners, and never sold. We are not responsible for the accuracy of data received from third-party devices.

Location

Location is optional. If you allow it, Gymex checks your location during workouts to recognise the gym you train at, count gym visits, and (if you use it) let friends see that you checked in at the same gym today. To name a gym, we send its coordinates to OpenStreetMap services; no account information is included.

We store your saved gyms (name and approximate coordinates) and visit history. We do not track your location in the background or keep a continuous location history. You can rename or delete saved gyms in the app and turn off location access at any time in your device settings.

Data Sharing

Information you post on the community feed is visible to other Gymex users. Your profile information (username and profile picture) is visible to other users. Workout data, body metrics, nutrition data, progress photos, and personal statistics are private unless you choose to share them (for example, by sharing a workout or program via the community feed or direct messages).

Programs can be shared with other users via secure share links. Shared programs do not include your personal performance data — only the program structure (exercises, sets, reps, and rest periods).

Community Features

Your username, profile picture, posts, clan membership, leaderboard position, and ranks you choose to publish are visible to other users. Rank cards you share by link can be viewed by anyone with the link.

Push Notifications

With your permission, Gymex sends push notifications including workout reminders, smart calorie notifications, hydration reminders, overtraining alerts, and important account updates. You can manage notification preferences within the app's Settings or through your device's system settings. Disabling notifications does not affect other app functionality.

Advertising & Attribution

We advertise Gymex on other platforms and use attribution partners (Tenjin, TikTok, and Reddit) to measure which campaigns lead to installs, sign-ups, and subscriptions. To do this, we may share limited information with them, such as app events (for example "completed onboarding" or "started a trial"), the campaign click identifier, and, where you permit it, your device's advertising identifier. For Reddit, we may also send a hashed (scrambled) version of your email address and account ID so Reddit can match the event to an ad click.

On iOS, we only use your advertising identifier if you allow tracking when asked. You can change this at any time in Settings > Privacy & Security > Tracking. On Android, you can reset or delete your advertising ID in your device settings. You can also ask us to stop sharing your data with advertising partners by emailing support@gymex.fitness.

We never share health, body, nutrition, photo, or workout data with advertising partners.

Personalised Offers & Predictions

The app estimates how engaged you are and how likely you are to subscribe, based on how you use Gymex (for example how often you train and how you interact with subscription screens). These estimates are calculated on your device and stored with your account.

We use them to decide when to send reminders and which offers or subscription screens to show you. We do not use them to charge you a different price than other users in your region, and they never produce decisions with legal or similarly significant effects.

We do not create subscription-likelihood estimates for users under 18 or whose age we do not know. You can object to this processing by emailing support@gymex.fitness.

Analytics & Crash Reports

We use Firebase and PostHog to understand how the app is used, and Sentry to find and fix problems. This includes app events, device and app information, crash reports, and, through Sentry only, recordings of app screens around errors. All text and images are masked in these recordings, so your messages and photos are not captured.

This data is linked to your account so we can investigate issues you report. We use it only to operate and improve Gymex.

Referrals, Creator Links & Emails

When you open a referral or creator link in a web browser, we record the link code, your IP address, and your browser's user agent. If the app is installed shortly afterwards, we use this to credit the referrer or creator. We do not use it for any other purpose, and we automatically delete it within 24 hours.

Creator sponsor links (gymex.fitness/code) also keep a click record so we can measure each creator's results and pay them commission. When the page opens we create a random tracking ID (it is not derived from your device) and record the link code, a one-way hashed device identifier (derived from your IP address and browser, plus your time zone, language and screen size if you accepted cookies), your device type, the app or website that sent you, any campaign tags on the link, and the steps you take afterwards: creating an account, starting or cancelling checkout, subscribing, and tapping an app store button. The tracking ID is kept in your browser for that tab, and for up to 30 days only if you accepted cookies. On Android, it is also passed to Google Play so a new install can be matched to your click. We never store your IP address in this record, and we delete it after 12 months.

We send emails about your account (for example sign-in codes and security notices). We may also send occasional emails about your training, new features, or offers. Every marketing email includes an unsubscribe link, and you can also opt out at any time by emailing support@gymex.fitness.

Partnership Applications

When you apply through our partnership page, we use the information you provide to assess the proposed relationship, verify audience or professional fit, contact you about the application, and administer a partnership if we agree to work together. Your application is stored in Supabase and the application notification and acknowledgement are sent through Resend.

For applicants in the UK or EEA, we rely on our legitimate interests in finding and managing suitable commercial, media, community, and product partners and, where relevant, taking steps at your request before entering a contract. We rely on consent for optional marketing emails. Supplying an application does not guarantee a partnership.

We do not use the social links or audience information in your application for unrelated marketing unless you separately opt in. Declined or inactive applications are normally deleted or anonymised within 12 months. If we enter a partnership, we may retain relevant records for the life of the relationship and afterwards where needed for legal, tax, accounting, fraud-prevention, or contractual purposes.

Legal Bases for Processing (UK/EU)

If you are located in the United Kingdom or European Economic Area, we process your personal data only where we have a lawful basis to do so under the UK GDPR and EU GDPR. The bases we rely on are:

• Performance of a contract: to create and operate your account and provide the core features of the app (workout tracking, nutrition logging, subscriptions).
• Consent: for optional features that you actively choose to use, such as AI coaching, AI photo analysis, voice processing, health/wearable integrations, location, advertising tracking (where required), and push notifications. You may withdraw consent at any time by discontinuing use of the feature or contacting us.
• Legitimate interests: to secure our service, prevent fraud and abuse, enforce our Terms, moderate community content, understand and improve the app, measure our marketing, credit referrals, and personalise reminders and offers — balanced against your rights and freedoms. You can object to any processing based on legitimate interests.
• Legal obligation: where we must retain or disclose data to comply with applicable law.

Certain data we process (such as body metrics and health-related fitness data) may constitute "special category" data under the UK/EU GDPR. Where it does, we rely on your explicit consent, which you provide by choosing to enter this data and use the related features. You can withdraw that consent and delete the data at any time from within the app.

Our AI features generate suggestions and recommendations but do not make legally or similarly significant decisions about you without human involvement. You are always free to disregard AI-generated recommendations.

Data Retention

We keep your personal data only for as long as necessary for the purposes described in this policy:

• Account and fitness data (workouts, nutrition, body metrics, progress photos, personal records) is retained for as long as your account is active.
• When you delete your account, we delete or irreversibly anonymise your personal data, typically within 30 days, except where we are required to retain certain records to comply with legal, tax, accounting, or fraud-prevention obligations.
• Voice recordings sent to ElevenLabs may be retained according to its terms and our account settings.
• AI request data may be retained by providers according to their terms and our account settings. The retention period can differ between DeepSeek, Google, OpenRouter, and the model provider selected by OpenRouter.
• Backups containing your data are cycled and overwritten on a rolling basis; residual copies in backups are deleted in the normal course of backup rotation.
• Saved gyms and gym visit history are kept until you delete them or your account.
• Wearable access tokens are deleted when you disconnect the integration or delete your account.
• Analytics, crash, and session-replay data are kept by our providers for limited periods under their retention settings.
• Limited records relating to bans, abuse, or safety enforcement may be retained longer where necessary to protect the service and other users.
• Partnership applications that do not progress are normally retained for no more than 12 months. Records for accepted partners may be kept for the relationship and any additional period required for legal, tax, accounting, fraud-prevention, or contractual purposes.

International Data Transfers

Gymex Fitness Ltd is based in the United Kingdom, and some of the third-party services we use to operate the app are located outside the UK and European Economic Area. This means your personal data may be transferred to, and processed in, countries whose data-protection laws differ from those in your country, including the United States and other jurisdictions.

In particular, AI requests may be processed by DeepSeek, Google, and OpenRouter or the model provider it selects; voice features are processed by ElevenLabs; and our analytics, crash reporting, attribution, and email providers are largely based in the United States. Our core infrastructure is provided by Supabase. Some of these providers, or their sub-processors, operate outside the UK/EEA.

Where we transfer personal data outside the UK/EEA, we take steps intended to ensure it remains protected, such as relying on providers that offer appropriate safeguards (for example, standard contractual clauses or equivalent mechanisms) and limiting the data shared to what is necessary for the feature you are using. If you do not wish for your data to be processed by these services, you can choose not to use the AI and voice features.

The specific transfer mechanism and safeguards for each provider (including any provider located in a jurisdiction without a UK/EU adequacy decision) should be confirmed and documented with qualified data-protection counsel.

Your Rights

You have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your account and all associated data (including workout history, body metrics, progress photos, and social content). See how to delete your account.
• Export your data in a portable format.
• Withdraw consent for data processing at any time.
• Opt out of AI-powered features and voice data collection by not using those features.
• Manage or disable push notifications at any time.

To exercise any of these rights, please contact us at support@gymex.fitness.

UK & EU Privacy Rights (GDPR)

If you are located in the United Kingdom or European Economic Area, you have the following rights under the UK GDPR and EU GDPR, in addition to those listed above:

• Right of access to the personal data we hold about you.
• Right to rectification of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten").
• Right to restrict processing in certain circumstances.
• Right to data portability — to receive your data in a structured, commonly used, machine-readable format.
• Right to object to processing based on legitimate interests, and to object to direct marketing at any time.
• Right to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
• Rights in relation to automated decision-making — we do not subject you to legally significant decisions made solely by automated means.

We are the data controller for your personal data. To exercise any of these rights, contact us at support@gymex.fitness. You also have the right to lodge a complaint with a supervisory authority. In the UK this is the Information Commissioner's Office (ICO) at ico.org.uk; in the EEA it is your local data-protection authority.

California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) gives you the following rights:

• Right to know the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and any third parties with whom we share it.
• Right to delete the personal information we have collected from you, subject to legal exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of the "sale" or "sharing" of personal information.
• Right to limit the use of sensitive personal information.
• Right to non-discrimination for exercising your privacy rights.

We do not sell your personal information for money. We do share limited identifiers and app events with advertising partners to measure our ad campaigns, which may count as "sharing" for cross-context behavioural advertising under California law. You can opt out of this sharing by emailing support@gymex.fitness or by turning off tracking on your device. We never share health, body, or photo data with advertising partners. The categories of personal information we collect are described in the "Information We Collect" section above, including identifiers, account information, health and fitness data, body metrics, progress photos, voice data, and usage data.

To exercise your California rights, contact us at support@gymex.fitness. We will not discriminate against you for doing so. You may use an authorised agent to submit a request on your behalf, subject to verification.

Children's and Teen Privacy

Gymex is not intended for children under 13, and we do not knowingly collect personal information from children under 13. If we learn that we have, we will delete it promptly.

Users aged 13 to 17 may use Gymex, with a parent or guardian's permission where the law of their country requires it. For users under 18, we do not create subscription-likelihood estimates and we do not use photos for AI physique ranking. If you are a parent and believe your child has provided us with information, contact us at support@gymex.fitness.

Subscriptions

Gymex offers auto-renewable subscriptions (Core, Premium, and Pro Premium) managed through RevenueCat. Payment is processed through Apple's App Store or Google Play, or by Stripe where we offer purchases on our website. We do not have access to your full payment card details. Subscription management, billing, and cancellation are handled through your Apple ID or Google Play settings.

RevenueCat processes subscription events (purchase, renewal, cancellation) to manage your access to premium features. RevenueCat's privacy policy governs their handling of this data.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the new policy within the app or via email. Your continued use of Gymex after changes are posted constitutes acceptance of the updated policy.

Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

support@gymex.fitness