GymTrack

GymTrack legal

Privacy Policy

Effective and last updated:

1. Who is responsible

This policy covers GymTrack (the app developed in the GetHot project) and these legal pages. The GymTrack development team is responsible for the personal information it processes to operate the app. For privacy questions, access or deletion requests, contact angelsbite.dev@gmail.com. This policy describes the current app; the information handled depends on the features you choose.

2. Information stored on your device

The app stores your onboarding answers, such as age, height, weight, fitness goals, experience, available equipment and schedule, to personalize training. It can also store your profile and injury notes, plans, saved workouts, exercise logs, body measurements, selected progress photos, reminders and AI technique reports. These records are primarily kept in app storage on your device. Signing in does not automatically upload your full training history, progress photos or generated plan. Device or operating-system backup settings may separately copy app data to your Apple or Google backup account.

3. Accounts and cloud sharing

Email/password, Google and Apple sign-in use Google Firebase Authentication. The authentication provider processes the credentials or identity tokens needed to authenticate you. The app receives an account identifier and available identity details, such as name and email. Passwords are not stored in local profile preferences. Google sharing also writes a name, account ID and email lookup entry to Cloud Firestore. Authenticated users who know an exact registered email can look it up to find a sharing recipient; the app does not offer a downloadable directory. Friend requests record the participants’ identifiers, names, emails and request status. Shared deliveries store the sender identity, selected workout or plan and delivery time. Participants can see the information needed to handle their friendship or delivery. Sharing excludes your progress photos, injury notes, profile biography and completed training history.

4. AI Coach and exercise videos

When you send a Coach message, its text, conversation history and prepared training-plan context are sent directly from your device to DeepSeek’s API to generate a response. When you request technique analysis, the app extracts JPEG images on your phone and sends sampled images with the exercise name and timing information directly to DeepSeek. The app stores review counts and bonus redemption status on your device for each signed-in account. The full video and its audio are not sent by this feature. Images may reveal your face, body, surroundings or other people. Preparation and trimming happen on the device. Chat and reviewed-video playback are kept for the current app session; text technique reports are saved locally until removed or app data is cleared. Service providers receive network information needed to handle requests; chat and technique analysis connect directly from your device. Each provider applies its own processing and retention rules. Do not assume requests are anonymous, immediately deleted or excluded from provider model improvement. Avoid unnecessary personal or medical details and include only people who have agreed to appear.

5. Permissions, network requests and external links

Camera and media access are used when you choose or record photos or exercise clips. A camera recording may include audio locally, but technique analysis sends only sampled images. Notification permissions, where requested, support workout reminders. You can change permissions in device settings; related features may then be unavailable. Online services receive ordinary connection information such as IP address and request timing. Remote profile images may be loaded from your sign-in provider. Update checks use Google Play on Android and Apple’s App Store lookup service on iOS. Opening external YouTube or GIPHY links is subject to those providers’ policies. The current app does not integrate an advertising SDK or an analytics/crash-reporting SDK.

6. Purposes and legal grounds

We use account information to provide sign-in and the sharing features you request, and selected training information to personalize and display your workouts. Where the GDPR or similar law applies, processing necessary to provide requested account services relies on performance of the service contract; proportionate security, abuse prevention and support rely on legitimate interests; and legally required records rely on legal obligations. Optional permissions and optional sensitive-data processing require consent where applicable. Health-related information, including injury notes or images revealing health details, may require explicit consent under local law. Agreeing to the Terms or reading this policy is not, by itself, explicit consent to sensitive-data processing or an international transfer.

7. Providers and international processing

Google Firebase provides authentication and Cloud Firestore. RevenueCat manages purchases, restores and paid-plan entitlement checks. The app identifies your RevenueCat account using your Firebase account identifier. RevenueCat processes that identifier, store purchase receipts or purchase tokens, subscription and trial status, and technical information such as device type and operating system to provide these services. Apple or Google handles store payments; GymTrack does not receive your full payment-card details. Firebase account and sharing-data deletion runs from the app; keep the app open and online until it finishes. The configured Firestore database is in Europe; this does not mean all Google authentication, support or operational processing remains in Europe. RevenueCat stores customer data in the United States. Google and Apple provide their respective sign-in and store services. DeepSeek provides AI responses and can process request data in China. GitHub hosts these legal pages and processes visitor connection information under its own privacy statement. We do not add advertising, analytics scripts, forms or cookies to these pages. Provider processing can involve countries with different data-protection rules. Applicable law may require contractual safeguards and additional protections for international transfers; this policy does not itself establish those safeguards or replace any required separate consent.

8. Retention

Local training and profile records remain until you remove them, clear app data or delete the account successfully on that device. Temporary video copies are released when replaced or the review session is cleaned up; original recordings in your photo library remain under your control. Review counts and bonus-code redemption status are stored locally and can be removed by clearing app data. Review frames are sent directly from your device to DeepSeek. RevenueCat and the app stores retain subscription and transaction records under their applicable service arrangements and legal requirements. Deleting your Firebase account in the app does not automatically delete RevenueCat or app-store transaction records; contact us to request removal of associated personal information. Cloud account, directory, friendship and delivery records remain while needed for the account or sharing feature, until dismissed or removed as supported, or until account deletion. Copies another person imported into their local library remain under that person’s control. Support messages are retained while needed to resolve your request and any related legal obligations. Provider security logs, backups and AI requests follow the relevant provider’s retention rules; deleting your GymTrack account does not automatically erase a past request from DeepSeek or third-party backups.

9. Deletion and your choices

Use Profile → Delete account to request removal of your Firebase account, cloud directory entry, friendships and associated deliveries, and clear saved training, profile, photos and technique reports on the current device after successful deletion. Recent sign-in is required. If the service is unavailable or deletion fails, email angelsbite.dev@gmail.com from the account address with the subject “GymTrack account deletion”; do not send your password. Deleting your GymTrack account does not cancel a store subscription. Manage or cancel subscriptions through your Apple App Store or Google Play account. Sign-out alone does not delete data. Uninstalling the app alone does not delete cloud records. Data on other offline devices, original camera-roll files, device backups and copies saved by recipients need separate removal. You can avoid AI transfers by not using Coach and avoid sharing by not sending plans or workouts. Revoke camera, photo and notification access in device settings at any time.

10. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete or obtain a portable copy of personal information, restrict processing, object to processing based on legitimate interests, and withdraw consent without affecting prior lawful processing. Contact angelsbite.dev@gmail.com to exercise these rights; we may need proportionate verification of your identity. You may complain to your local data-protection authority, including the authority in your EEA country of residence or the UK Information Commissioner where applicable. We do not sell personal information or share it for cross-context behavioral advertising. The app does not use AI to make decisions producing legal or similarly significant effects about you.

11. Children and safety

Use must comply with the legal minimum age and parental-permission requirements where you live. Young people should use fitness features with appropriate adult guidance. We do not intend to collect information from children where legally required authorization is absent. If you believe a child has provided information without the required permission, contact angelsbite.dev@gmail.com so we can investigate and remove it as appropriate.

12. Security and policy updates

Online requests use HTTPS, and cloud access is controlled through authentication and database access rules. No storage or transmission method is completely secure; protect your device and sign-in credentials. We will update this page as features or processing change and give additional notice where required. The date above identifies the current policy. Questions: angelsbite.dev@gmail.com.

13. Provider privacy information