Privacy Policy

Privacy Policy

This privacy policy applies to the Gymaroo app for mobile devices, together with any related services operated by Pedro Gonçalves (collectively, the "Application"). Pedro Gonçalves is hereby referred to as the "Service Provider".

Information Collection and Use

The Application collects some information automatically when you use it:

Your device's Internet Protocol (IP) address, used to answer the Application's requests and to limit abuse. It is not saved with your account
Your time zone, sent with requests so that dates are correct
Your approximate location, only if you allow it and only while you look for gyms near you (My gyms). It is sent to the Service Provider's server, which rounds it to about 100 metres to look up gyms on OpenStreetMap. It is not stored
Crash and error reports, including your device model and operating system, without your name, email or IP address
Anonymous usage counts, such as how many workouts were finished, which do not identify you

Cookies and tracking technologies

The Application or its third-party SDKs may use cookies, SDKs, pixels, and similar technologies to support functionality, analytics, or service delivery. Where required by applicable law, the Service Provider will obtain consent before using non-essential tracking technologies.

Your Rights

You can delete your account in the Application (see Data Deletion), and export your workouts as a CSV file from Settings > Your data > Export workouts (the last 3 months on the free plan). You may also request access to, correction of, or deletion of your personal data held by the Service Provider. To exercise these rights, or to withdraw consent where processing is based on consent, contact the Service Provider at contact@gymaroo.app.

Your California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information is collected, the right to delete personal information, the right to opt out of the sale or sharing of personal information, and the right to non-discrimination for exercising these rights. To exercise your CCPA/CPRA rights, contact the Service Provider at contact@gymaroo.app.

Artificial Intelligence

Some features of the Application use Artificial Intelligence (AI):

Ask Gymaroo sends what you enter in its forms (your goal, focus muscles, schedule, experience, equipment, the name and your notes) to Anthropic, to build a split or a workout. Asking Gymaroo to change a split or a workout sends what you write and that plan as it is (its workouts and exercises) to Anthropic, to propose the changes; what you write there is not stored. Only write in the notes and requests what you are comfortable sharing
The weekly report sends your first name and that week's training numbers (such as workouts, sets, volume, records and the exercises involved) to Anthropic, to write the report
The exercise scan sends your photo to the Service Provider's server, where it is recognized by the Service Provider's own model or sent to Anthropic. The Service Provider does not store the photo
If you connect Gymaroo to an AI assistant, such as ChatGPT or Claude (only if you choose to, on gymaroo.app), that assistant can read your training data (workouts, records, splits, measurements and statistics) and, if you allow it, create splits and saved workouts in your account, when you ask it to in a chat. What it reads is then held by the company behind that assistant (for example OpenAI or Anthropic), under its own privacy policy. The Service Provider stores which assistants you connected and when they last used your account, never the conversations. You can disconnect an assistant at any time on gymaroo.app (Connected apps), and its access ends at once

All AI processing is performed in accordance with this privacy policy and applicable laws. If you have questions about the AI features or data processing, please contact the Service Provider.

The Service Provider may use the information you provide to send important information, required notices, and, where permitted by law, marketing communications.

Data Stored

To provide the Application, the Service Provider stores the following with your account, on servers in the European Union:

Account: your email address, display name, password (stored hashed), Google account ID or Apple ID user identifier, and when you accepted the Terms and Conditions
Sex, only if you choose to give it: male or female, used for one thing only, to compare your lifts with strength standards for your sex and body weight on an exercise's page. It is optional, never shown to anyone else, and you can change or remove it at any time
Training: your workouts and sets (exercises, weights, reps, dates, notes), personal records, the milestones and badges you reach, the gym of each workout if you choose one (your gyms: their names and, for a gym found on the map, its address and position), vacation periods and imported workout history (CSV files from Strong, Hevy or FitNotes) and, only if you turn it on in Settings, your body weight read from Apple Health or Health Connect. Also only if you turn it on, Gymaroo writes each workout you finish to Apple Health or Health Connect (its name, start and end time, as strength training) and deletes it there when you delete it in Gymaroo; it writes nothing else to them
Plans: your splits, templates and custom exercises (their text), your Ask Gymaroo requests, your weekly reports, and the names of your progress photo poses (such as "Front" or "Side": text you write, without the photos)
Subscription: your Gymaroo Pro plan and its status, from RevenueCat, the App Store and Google Play. Payment details stay with Apple and Google
Progress photo backup (Gymaroo Pro; on by default, and you can turn it off at any time next to your progress photos): a copy of each of your progress photos, its day and its pose. Before it is stored, the photo is resized and all its metadata is removed, including any location. The copies are kept in a private storage space in the European Union that only the Service Provider's server can read; nobody else can see them. They are not used for anything but giving them back to you, never for training AI. You can delete them at any time in the Application (deleting a photo deletes its copy, and turning the backup off lets you delete them all), and they are deleted with your account

A split you share by link can be seen by anyone who has the link, until you delete it or your account.

Split cover photos and custom exercise photos stay on your device: they are not uploaded to the Service Provider. So do your progress photos, unless their backup is on (above). They, and your settings such as language and weight unit, are removed when you uninstall the Application.

The information the Service Provider requests will be retained and used as described in this privacy policy.

Third Party Access

The Service Provider does not sell your personal data. It uses these service providers (processors) to run the Application, each for the purpose given:

Render: the servers and the database, in the European Union
Cloudflare: the website, the exercise images and, while the backup is on, your backed-up progress photos (stored in the European Union)
Brevo: emails such as address verification and password reset
Anthropic: the AI features described above
Sentry: crash reports and anonymous usage counts
RevenueCat, Apple and Google: subscriptions and purchases
Google and Apple: signing in, if you choose them
komoot (Photon, an OpenStreetMap search): the gym search. It receives what you search and, if you allow it, your rounded location, from the Service Provider's server, never from your device

The Service Provider may share your information with third parties in the ways that are described in this privacy statement.

International Data Transfers

The Service Provider or its third-party service providers may transfer personal data to countries outside your country of residence, including outside the European Economic Area (EEA). Where applicable law requires safeguards for international transfers, the Service Provider will use appropriate mechanisms.

Standard Contractual Clauses (SCCs) approved by the European Commission
Adequacy decisions or other legally recognized transfer mechanisms
Your consent, where required and legally permitted

Data protection laws in other countries may differ from those in your jurisdiction. Where required by law, the Service Provider will apply appropriate safeguards and obtain any consent required for the transfer.

Please note that the Application utilizes third-party services that have their own Privacy Policy about handling data. Below are the links to the Privacy Policy of the third-party service providers used by the Application:

The Service Provider may disclose User Provided and Automatically Collected Information:

as required by law, such as to comply with a subpoena, or similar legal process;
when they believe in good faith that disclosure is necessary to protect their rights, protect your safety or the safety of others, investigate fraud, or respond to a government request;
with their trusted services providers who work on their behalf, do not have an independent use of the information the Service Provider discloses to them, and have agreed to adhere to the rules set forth in this privacy statement.

Opt-Out Rights

You can stop further collection of information from your mobile device by uninstalling the Application. Uninstalling will stop the Application from collecting data from your device, but it does not automatically delete information that has already been transmitted to the Service Provider or to third parties.

To request deletion of your personal data, to withdraw consent, or to exercise any of your rights, contact the Service Provider at contact@gymaroo.app.

Data Retention Policy

The Service Provider retains personal data based on its necessity for the stated purposes:

User Provided Data: Retained until you delete your account, then deleted as described under Data Deletion, unless longer retention is required by law
Automatically Collected Data: Retained for up to 24 months from collection, unless longer retention is required for legal compliance
Aggregated and Anonymized Data: Retained indefinitely as it no longer identifies you
Data required for legal compliance: Retained as long as required by applicable law

You may request deletion of your personal data, subject to any legal obligation to retain it. You can delete your account and its data in the Application (see Data Deletion), or contact the Service Provider at contact@gymaroo.app. Please note that some User Provided Data may be required for the Application to function properly.

Data Deletion

You can delete your account in the Application: Settings > Account > Delete account. You will be asked to confirm it is you, with your password, Google or Apple.

Your account is deleted 30 days later. In the meantime you are signed out and links to your shared splits stop working, and signing in again cancels the deletion. For an Apple account, Gymaroo is removed from your Apple ID right away.

After the 30 days, the Service Provider permanently deletes your account and the data listed under Data Stored (backed-up progress photos included), and asks RevenueCat to delete its record of you. Two things remain:

Custom exercises that appear in other people's splits or workout history stay, no longer linked to you, so that their plans and history keep working
Records of your purchases, renewals and refunds, which hold your account's random ID but not your name or email address

Backups of the database are replaced on their regular cycle, which removes deleted data from them too.

Deleting your account does not cancel a Gymaroo Pro subscription: cancel it in your App Store or Google Play subscriptions. Data that stays on your device remains until you uninstall the Application.

You can also request deletion of your personal data or account by contacting the Service Provider at contact@gymaroo.app. The Service Provider will process your request within the timeframes required by applicable law.

Upon verification of your identity, the Service Provider will delete your personal data from its systems, except where retention is required for legal compliance or legitimate business purposes.

Children

The Application is not intended for children under 16 years of age, or such higher age as required by applicable law. The Service Provider does not knowingly solicit data from children or market the Application to them.

Where parental or guardian consent is required under applicable law, the Application is not intended for use without that consent. The Service Provider does not knowingly collect personally identifiable information from children under 16 years of age in violation of applicable law. In the event the Service Provider discovers that a child has provided personal information, the Service Provider will immediately delete this from their servers. If you are a parent or guardian and you are aware that your child has provided the Service Provider with personal information, please contact the Service Provider (contact@gymaroo.app) so that they will be able to take the necessary actions.

Security

The Service Provider is concerned about safeguarding the confidentiality of your information. The Service Provider provides physical, electronic, and procedural safeguards to protect information the Service Provider processes and maintains.

Data Breach Notification

If a data breach occurs that affects your personal data, the Service Provider will notify you in accordance with applicable legal requirements, including, where required, providing information about the nature of the breach and the steps being taken to address it.

Changes

The Service Provider may update this Privacy Policy from time to time. The Service Provider will notify you of material changes by posting the updated Privacy Policy with an effective date. Where required by law, the Service Provider will seek your consent to material changes before they take effect.

Previous versions of this Privacy Policy will be maintained and made available upon request by contacting the Service Provider at contact@gymaroo.app.

This privacy policy is effective as of 2026-11-13

Your Consent

Where processing is based on consent, you provide that consent by affirmatively opting in to the relevant feature or action. You may withdraw consent at any time without affecting processing carried out before withdrawal. Processing based on other lawful bases is carried out as described above.

Contact Us

If you have any questions regarding privacy while using the Application, or have questions about the practices, please contact the Service Provider via email at contact@gymaroo.app.

This privacy policy page was generated by App Privacy Policy Generator