GymTracker ProPrivacy Policy
Last updated: October 28, 2026 · GymTracker Pro
GymTracker Pro ("we", "our", "us") is a workout tracker for iPhone and Apple Watch. This policy explains what we collect, why we collect it, which services help us run the app, and the choices you have, including your rights under the GDPR and the CCPA.
1. What we collect
- Account information: your email address, your password (stored only as a salted bcrypt hash, never in plain text) and the first name you add, if any. You can also use the app as a guest, with no email or password; a guest account has an anonymous account number instead.
- Sign in with Apple or Google: if you choose it, Apple or Google tells us an id for you, your email (with Apple's Hide My Email, a private relay address that forwards to you) and, the first time, your first name. We never get your Apple or Google password or your photo. For Sign in with Apple we also keep a token Apple gives us, only so we can tell Apple to stop when you delete your account.
- Your training: your plans, training days, exercises (including ones you create), logged sets (weight, reps and effort), workout times and the notes you write.
- Equipment and preferences: your plates, bars, machine names, rest timer settings, weight unit, theme and language.
- Body numbers, only if you add them: your weight, body fat, lean mass, waist and other measurements, height and goal, typed in or, if you connect it, read from Apple Health. From Apple Health we read only those and never write to it. Apple Health data is never used for advertising or marketing, never sold, and never given to data brokers. It goes to an AI company only if you turn on Share body trends, and then only as weekly averages for your check-in (section 3). You can stop the app reading it any time in your iPhone's Settings, then Health, then Data Access & Devices.
- Spot AI, only if you use it and agree: for a new plan, your goal, training days, session length, experience, equipment, split style, variety and focus areas, and anything you type about injuries or in notes; for a check-in, your answers to its questions; for Spot AI's chat, your messages and the things Spot remembers about your training (you can see, change and delete them in What Spot AI knows). See section 3.
- Your time zone, when you open the check-in, so it counts your weeks in your own days. It isn't sent to the AI.
- Pro status: whether you have GymTracker Pro, how (a subscription, or Pro we give, such as early access) and when it renews or ends. We never see or store your payment card.
- Emails we send: for each email (a password reset or an email confirmation), a scrambled (hashed) copy of the address, the kind of email and the time, kept for 2 days, only to stop too many emails going out. Not the address itself.
- Server logs: like most online services, our servers record basic details of each request (such as the time, the address requested and your IP address) for security, preventing abuse and fixing problems.
We do not collect your contacts, photos (a profile photo you pick stays on your phone), location, camera, microphone, advertising identifier or any other Apple Health data. The app has no advertising and no analytics or tracking software, and we don't track you across other companies' apps or websites. Rest-timer alerts, the Live Activity and the Apple Watch app run on your devices and don't send us anything extra.
2. How we use it
- To run your account and the app: saving and syncing your training, and showing your history, records and progress
- To sign you in and keep your account secure, including sending the password reset and email confirmation emails you ask for
- To build or change a plan, run a check-in, or answer you in Spot AI's chat, when you ask and agree to share (section 3)
- To check your subscription, when subscriptions are offered
- To answer you when you contact us
- To prevent and investigate abuse, fraud and security problems
We do not sell your personal information, share it for advertising, or use it to profile you.
3. Spot AI and the AI companies
Spot AI, the AI coach, answers your messages in its chat and during a workout, writes a training plan from your answers (the AI Plan Builder), suggests changes to a plan or a new day for it (Adjust plan, Add a day, and "Change it" on a suggestion), and runs the check-in: a look at your last 8 weeks, a few questions, then changes you can apply or skip. To do that, our server sends what's needed to one AI company, whose AI model writes the answer. It is one of these: OpenAI (through Replit's AI service), Anthropic, Google, or DeepSeek's model run by a hosting company outside China (never DeepSeek's own service). We choose the main one, with a backup from another company in case the first one fails. Before you share, the app names each company your request may go to.
- What is sent: for a new plan, your goal, days per week, session length, experience, equipment, split style, variety and focus areas, and anything you type under injuries or notes. To change a plan or add a day, that plan's days and exercises with their sets, reps, holds and rest, the names of your stretches, and what you type and pick. For a check-in, a summary of your last 8 weeks worked out by our server (workouts each week against your training days, the day missed most, which lifts went up or stalled, exercises that take longer than planned, how your workouts felt and how long they took), your plan's days and exercises, and your answers, including anything you type; and, only if you turn on Share body trends, your weight, body fat and measurements as weekly averages, and your goal. If you mention an injury or a health condition, that text is sent too, so only include what you're comfortable sharing.
- Your recent workouts, only if you turn it on: with "Share recent workouts with Spot AI" on (it starts off), a summary of your last 8 weeks is sent too: how many workouts and how they felt, how often each day was done, and each exercise's best set, least help or longest hold. For Spot AI's chat it also gets what the check-in works out (lifts going up and stuck, the day missed most, how hard and how long workouts were) and your latest check-in from the last 90 days: its summary and points, your answers, and whether you applied its changes. Your notes are never part of it.
- What is not sent: your name, your email, your account number, or your notes. Your workouts only as the summary above, and only when you've turned it on.
- You're asked first: nothing is sent until you agree in the app, and the check-in asks every time. You can take that back any time with the "Share answers with the AI" switch in Settings, and the AI coach then asks again before sending anything.
- Not a medical coach: Spot AI doesn't advise on pain, injuries or health. If you mention one, it only tells you to stop and see a doctor or physio, and it no longer saves health details to what it remembers (you can see and delete everything it remembers in What Spot AI knows).
- What happens to it: the AI company processes it to write the answer, under its own terms (OpenAI's Privacy Policy, Anthropic's Privacy Policy, Google's Privacy Policy, or the DeepSeek host's own policy). A plan or change you keep is saved to your account like any other. We keep what you asked for and the answer with your request count, so you can apply or change it. For a check-in we also keep its summary, questions and your answers, so you can pick it up again or undo it. Your chat with Spot AI and what it remembers stay with your account until you clear them (Clear chat, Forget everything) or delete your account. We don't keep the workout summary sent with a plan request.
4. Services that help us run GymTracker Pro
Each one receives only what it needs for its job.
- Replit: hosts our servers and database, and carries our requests to OpenAI and to our email service.
- The AI companies (OpenAI, Anthropic, Google, or a host running DeepSeek's model outside China): write Spot AI's answers, plans, suggestions and check-ins, only when you use Spot AI and agree (section 3).
- Resend: sends the password reset and email confirmation emails you ask for. It receives your email address and the email itself (Resend's Privacy Policy). If Resend can't send, Twilio SendGrid sends it instead and receives the same (Twilio's Privacy Notice).
- RevenueCat: keeps track of GymTracker Pro subscriptions. Right after you buy or restore, our server asks RevenueCat about your purchase so Pro starts at once. The app identifies you to RevenueCat by your account number, and RevenueCat receives your App Store purchase history, not your name or email (RevenueCat's Privacy Policy).
- Apple: handles App Store purchases, and Sign in with Apple if you use it, under Apple's Privacy Policy. We never see your payment details.
- Google: handles Sign in with Google if you use it, under Google's Privacy Policy.
5. Sharing a plan
If you share a plan, anyone with the link can see that plan's name, days and exercises. Your name, email and workouts are not included.
6. Storage and security
Your data is stored in a PostgreSQL database on our hosting provider's servers. Everything between the app and our servers is encrypted in transit (HTTPS). Passwords are stored only as bcrypt hashes, so we can't see or recover them. Signing in uses signed tokens.
7. How long we keep it
We keep your data while your account exists. When you delete your account, the account and everything in it (plans, workouts, sets and settings) is deleted from our database straight away and for good. A guest account is deleted the same way, from Settings. The hashed email log is kept for 2 days. Server logs are kept only as long as needed for security and fixing problems.
8. Your choices and rights
- Get a copy: download all your data (your account, plans, workouts and settings) as a file in Settings (Export workout data). It's free for everyone, guests too. Or ask us for a copy.
- Correct it: change your name, email and password in Settings.
- Delete it: Settings, then Profile, then "Delete account & data" deletes your account and all of its data for good.
- AI sharing: turn off "Share answers with the AI" in Settings at any time.
- Notifications: turn off rest-timer alerts in your iPhone's Settings.
If you're in the EU or UK, you have rights under the GDPR, including access, correction, deletion, portability and objection, and you can complain to your local data protection authority. If you're in California, you have rights under the CCPA, including to know what we collect and to have it deleted; we don't sell or share personal information as the CCPA defines those terms. To use any of these rights, email us (section 12).
9. Where your data is processed
Our servers and some of the services above are in the United States, so your data may be processed there. AI requests never go to DeepSeek's own service or to servers in China.
10. Children
GymTracker Pro isn't meant for children under 13 (under 16 in the EU), and we don't knowingly collect their personal information. If you think a child has given us personal information, contact us and we'll delete it.
11. Changes to this policy
If we change this policy, we'll update the date at the top, and tell you in the app if the change is significant.
12. Contact us
Questions or requests about your privacy: gymtrackadmin@gmail.com