Privacy Policy

Who we are

This Privacy Policy explains how Gymli.app ("Gymli", "we", "us", or "our") handles information when you use the Gymli mobile app or visit gymli.app. For privacy questions, requests, or complaints, contact support@gymli.app.

Quick summary

• Gymli stores the training data you create so the app can show your progress.
• Gymli can be used with an anonymous account. You may link Sign in with Apple later.
• We use Supabase for authentication, database storage, and account deletion.
• We use PostHog EU Cloud for app and website product analytics. Session replay is disabled.
• We do not request GPS/location permission and do not track precise location.
• Photos access is requested only when you choose to save a sticker.
• You can delete your account or anonymous Gymli data from the app settings.

What Gymli does not collect

• Gymli does not request GPS or precise location permission.
• Gymli does not request camera, microphone, contacts, or calendar permission.
• Gymli does not read, scan, import, or upload your photo library.
• Gymli does not connect to Apple Health/HealthKit.
• Gymli does not show ads or use your data for third-party advertising.
• Gymli does not sell personal data to data brokers.

Information we collect and why

• Account identifiers. Gymli creates a user ID for your app session. If you use Sign in with Apple, we receive the account information Apple provides for sign-in, such as a stable Apple-linked identifier and, only if Apple provides it, an email address. We use this for authentication and account recovery.
• Training data you create. This includes exercises, body part and equipment labels, workouts, workout sessions, sets, reps, weights, targets, dates, notes/descriptions you enter, calculated volume, and personal record history. We use this to provide workout logging, history, progress, and sticker features.
• Settings. This includes your preferred units, language, onboarding state, review prompt state, and similar app preferences. We use this to personalize the app and avoid repeatedly asking the same questions.
• Feedback. If you send feedback, we collect your message, optional contact email, trigger/source screen, app version, build number, platform, OS version, locale, subscription ID if provided by the app, and limited debugging metadata. We use this to respond, investigate issues, and improve Gymli.
• Mobile product analytics. We collect events such as screen views, onboarding progress, settings changes, exercise and workout actions, workout completion, feedback actions, sticker sheet opens, sticker shares, and sticker saves. Event properties can include app version, build number, platform, locale, timezone, preferred unit, anonymous/signed-in status, the Gymli user ID, and limited numeric training summaries such as exercise count, set count, total reps, volume, or top weight. We use analytics to understand product usage, find friction, and improve reliability. We do not send raw feedback messages, photos, full set-by-set training logs, or user-entered exercise/workout names to analytics.
• Device and technical information. We may process platform, OS version, app version/build, locale, timezone, diagnostic events, and network information processed by service providers. We use this for app functionality, security, debugging, analytics, and abuse prevention.
• Website information. If you visit gymli.app, our hosting provider may process standard web server information such as IP address, user agent, requested URL, referrer, and timestamp to serve the website, protect it, and measure reliability. The Gymli website also uses PostHog EU Cloud to understand page views and app download button clicks. Website analytics may include page path, page title, referrer, campaign parameters such as UTM tags, and click identifiers provided in the URL. Website analytics do not include training logs, feedback messages, or user account data. The Gymli website does not run advertising trackers.

Training data and sensitive information

Gymli is a fitness logging app, so the training records you enter may be considered fitness data. Gymli is not a medical app, does not provide medical advice, does not connect to Apple Health/HealthKit, and does not ask you to enter medical conditions, diagnoses, injury details, or other sensitive personal information. Please avoid putting sensitive information in exercise names, workout names, descriptions, notes, or feedback messages.

Photos, stickers, and sharing

Gymli asks for Photos permission only when you choose to save a generated workout sticker. Gymli requests add-only/write access for this action where the platform supports it. Gymli does not read, import, scan, or upload your photo library.

If you choose to share a sticker to another app, that share is handled by your device and the destination app you select. The destination app's privacy practices apply after you share the sticker there.

Analytics and location

Gymli uses PostHog EU Cloud for product analytics in the mobile app and on gymli.app. PostHog helps us understand what features are used, where users get stuck, whether changes improve the product, which pages are visited, and whether website visitors tap app download buttons. PostHog session replay is disabled, touch autocapture is disabled, and website autocapture is disabled.

Gymli does not request location permission and does not track precise GPS location. PostHog or other service providers may infer approximate country or region from network information such as IP address. We use approximate country/region only for analytics, debugging, understanding unit preferences, and product planning.

Legal bases for processing

If privacy law requires a legal basis, we rely on the following bases depending on the context:

• Contract / app functionality: to provide accounts, workout logging, syncing, history, progress, stickers, settings, and support.
• Consent: for optional actions such as saving stickers to Photos, sending feedback, providing an optional contact email, and choosing to share content to another app.
• Legitimate interests: to keep Gymli secure, understand app usage, improve usability, debug problems, prevent abuse, and maintain the website and app.
• Legal obligations: when we must keep or disclose information to comply with applicable law, platform rules, tax/accounting rules, dispute resolution, or valid legal requests.

Service providers

We use service providers to operate Gymli. They process information only as needed to provide their services to us, subject to their own terms and data processing commitments.

• Supabase: authentication, anonymous sessions, database storage, and account deletion support.
• PostHog EU Cloud: product analytics for the mobile app and website.
• Apple: Sign in with Apple, App Store distribution, in-app review prompts, and platform services.
• Vercel or other hosting providers: website hosting and related security/reliability logs.

When we share information

We do not sell your personal data. We do not share personal data with advertising networks or data brokers. We may share information:

• with service providers listed above so they can operate Gymli for us;
• with platforms or apps you choose, such as when you share a sticker;
• to comply with law, enforce our terms, respond to valid legal requests, or protect rights, safety, security, and the integrity of Gymli;
• in connection with a merger, acquisition, financing, reorganization, or sale of assets, if Gymli is ever involved in such a transaction.

Data retention and deletion

• Account and training data: kept while your Gymli account or anonymous session exists, unless you delete it or we no longer need it to provide the service.
• Anonymous sessions: anonymous data is still tied to a Gymli user ID. You can delete anonymous Gymli data from the app settings.
• Feedback: kept as long as needed to understand, respond to, and improve the product, unless deletion is required or requested and we can reasonably delete it.
• Analytics and technical logs: kept according to our service provider settings and operational needs, then deleted, aggregated, or de-identified.
• Local device data: remains on your device until you delete it in the app, delete the app, reset app data, or the operating system removes it.

You can request account deletion from inside Gymli. Deletion removes Gymli data tied to that account from active systems, subject to backups, technical logs, legal obligations, security, fraud prevention, dispute handling, and other legitimate retention needs.

Your privacy rights and choices

Depending on where you live, you may have rights to access, correct, delete, export, or restrict processing of your personal data; object to certain processing; withdraw consent where processing is based on consent; and complain to a data protection authority. To exercise rights, email support@gymli.app. We may need to verify your request before acting on it.

• You can change units and language in app settings.
• You can delete your account or anonymous data in app settings.
• You can choose not to send feedback or not to provide a contact email.
• You can deny Photos permission; sticker saving will not work unless permission is granted.
• You can use your device and platform settings to manage app permissions and review prompts.

International transfers

Gymli may be operated from, and service providers may process information in, countries other than your country of residence. Where required, we rely on appropriate safeguards, such as data processing agreements, regional hosting choices, and standard contractual clauses or equivalent mechanisms used by our service providers.

App Store privacy labels

Apple requires developers to disclose data collected by the app and third-party SDKs in App Store Connect. Gymli's privacy labels should be kept consistent with this policy. Based on current app behavior, relevant categories may include Health & Fitness, User ID, Product Interaction, Diagnostics/technical data, Contact Info if you provide a contact email or Apple provides one, User Content for feedback and free-form text, and approximate/coarse location inferred from network information by service providers. Gymli does not use data for third-party advertising or tracking as Apple defines tracking.

Security

We use technical and organizational safeguards intended to protect information, including authentication, database access controls, row-level access policies where applicable, transport security, and limited service provider access. No online or mobile service can be guaranteed to be perfectly secure.

Children

Gymli is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If a higher age is required by law in your country, Gymli is not directed to children under that age. If you believe a child has provided personal information, contact us so we can take appropriate action.

Changes to this policy

We may update this Privacy Policy as Gymli changes. If we make material changes, we will update the effective date and, where appropriate, provide additional notice in the app or on the website.

Contact

For privacy questions, contact support@gymli.app.