Privacy Policy

Last updated: October 22, 2026

1. Who Is Responsible

The controller for GymPsycho (app and website) is:

Marc Berbet, 5600 Lenzburg, Switzerland — [email protected]

This policy applies to GymPsycho on iOS, watchOS, Android and Wear OS and to gympsycho.com. It is written to meet the Swiss Federal Act on Data Protection (FADP) and the EU General Data Protection Regulation (GDPR).

2. Overview: What Is Processed

• On your device only (never sent to us): workouts, exercises, sets, PRs, plans, gyms, your athlete name, health data, app settings.
• Pseudonymous technical data (sent to us or our processors): an anonymous subscription ID, hashed device, App Store account and network identifiers for the free Pro period, crash diagnostics, anonymous feature counters. Details in Sections 6–10.
• Never collected: name, email, phone number, precise location (GPS), contacts, advertising identifier (IDFA / Google Advertising ID), browsing history. The only location information is derived on our server from each request: the country for the anonymous app counters (Section 9), and country, region and city for the website statistics (Section 10). We do not store IP addresses in our databases or in our own server logs; our hosting providers keep request logs that contain IP addresses for a limited time (Section 11).
• Is anything mandatory? No data is legally required to use GymPsycho. The pseudonymous processing in Sections 6–10 runs automatically while you use the app or website; everything else (iCloud, health integration, creator codes) is optional.

3. Your Workout Data

GymPsycho works entirely on your device. All your workout data, including:

• Training sessions and exercises
• Personal records (PRs)
• Gym configurations
• Training plans
• Your athlete name (optional)

...is stored locally on your device. We have no server copy of it.

4. Data Sync & Backup

iOS: iCloud Sync

If you enable iCloud sync, your data is stored in your private iCloud container. Only you have access, it is encrypted by Apple, and we cannot access it.

Android: Auto Backup

On Android, your app data is backed up via Android Auto Backup to your own Google account. Backups are encrypted, only you have access, and we cannot access them. Data is restored automatically when you reinstall the app.

5. Health Data Integration

GymPsycho can optionally integrate with Apple HealthKit (iOS) and Health Connect (Android) to enhance your workout tracking experience. All health data integrations are optional and require your explicit permission before any data is accessed. Health data is processed entirely on your device and is never transmitted to external servers, collected by us, or shared with third parties.

iOS: Apple HealthKit

GymPsycho can optionally integrate with Apple HealthKit to:

• Read sleep data to calculate a recovery score
• Read body weight for calorie estimation and trend analysis
• Read step count to display daily activity
• Read heart rate during workout time windows
• Write finished workouts (strength and cardio) with active energy and distance
• Write the effort rating you give a workout (1–10) to that workout (iOS 18 or later)

Android: Health Connect

GymPsycho integrates with Health Connect using the minimum permissions required for its fitness tracking features. The app requests access to exactly seven Health Connect permissions:

Read Permissions (4):

• Steps (READ_STEPS): Reads your daily step count to display on the training screen, helping you track overall physical activity alongside your gym workouts. Step history is also used in PDF workout reports to show activity trends over time.
• Sleep (READ_SLEEP): Reads sleep session data, including sleep stages (light, deep, REM, awake), to calculate a sleep quality score (0–100). This score is displayed before your workout to help you understand recovery status and adjust training intensity accordingly.
• Weight (READ_WEIGHT): Reads your current body weight and weight history. Current weight is used to estimate calories burned during workouts (based on MET calculations). Weight history powers the Body Weight Intelligence feature, which detects phases (gaining, losing, maintaining) and analyzes trends over time. Weight data also appears in PDF workout reports.
• Heart Rate (READ_HEART_RATE): Reads heart rate samples recorded during your workout time window (from workout start to workout end) by connected devices such as fitness trackers or smartwatches. Average and peak heart rate are displayed in your workout summary after finishing a session.

Write Permissions (3):

• Exercise (WRITE_EXERCISE): After you finish a workout, GymPsycho saves it to Health Connect as an exercise session: a strength training session (titled with your training plan name) and, for each completed cardio exercise, a session of the matching type (for example treadmill running or rowing machine), each with its start and end time. If you rated how hard the workout was (1–10), that rating is stored on the session as its perceived exertion; when you change or remove the rating later in the app, the session is updated accordingly. GymPsycho only reads back the exercise sessions it wrote itself, to apply such a change — it never reads exercise data from other apps.
• Active Calories Burned (WRITE_ACTIVE_CALORIES_BURNED): After completing a strength or cardio workout, GymPsycho exports the estimated calories burned to Health Connect. This allows your workout energy expenditure to appear alongside data from other fitness apps in a unified view.
• Distance (WRITE_DISTANCE): After completing a cardio exercise (treadmill, stationary bike, rowing machine, elliptical, stair machine), GymPsycho exports the distance covered to Health Connect. This is only written when you log a cardio exercise with a distance value.

How Health Data Is Handled

• Local processing only: All health data is read from HealthKit or Health Connect, processed on your device, and displayed in the app. It is never sent to any server.
• No collection: We do not collect, store, or retain copies of your health data. Data is read on demand and displayed in the current session only.
• No sharing: Health data from HealthKit or Health Connect is never shared with third parties, advertisers, or any external services. This includes RevenueCat (our subscription service), which has no access to health data.
• No selling: We do not sell health data. We will never sell health data.
• User control: You can revoke health data permissions at any time through your device settings (iOS: Settings > Health > GymPsycho, Android: Settings > Health Connect > App permissions). The app continues to function fully without health data access — all core features (workout logging, PR detection, training plans) work independently.
• Data deletion: Since we do not store copies of health data, there is nothing to delete on our side. To remove data written by GymPsycho to Health Connect (exercise sessions, calories, distance), you can delete it directly in the Health Connect app.

6. Subscriptions (RevenueCat)

Subscriptions are handled by Apple (App Store) or Google (Google Play); we never see your payment details. To manage your Pro status we use RevenueCat (RevenueCat, Inc., USA) as our processor:

• RevenueCat assigns an anonymous app user ID (a random string — no name, no email) and receives your store purchase receipts to confirm and manage your subscription (purchase history).
• On iOS, the app passes Apple's privacy-preserving AdServices attribution token to RevenueCat so we can measure which Apple Ads campaigns lead to installs and purchases (Apple "standard" attribution — no IDFA, no App Tracking Transparency prompt, no cross-app tracking).
• RevenueCat never receives workout or health data.
• Legal basis: performance of the contract (your subscription) and our legitimate interest in measuring our own advertising.

See RevenueCat's Privacy Policy.

7. The Free Pro Period (60 Days)

Everyone without a subscription receives GymPsycho Pro free for 60 days, once. To grant it and to stop the same person from claiming it again and again (for example by reinstalling the app), our own server (Cloudflare, see Section 11) processes the following:

• Your RevenueCat anonymous user ID — so the free period is granted to the right subscription account.
• A SHA-256 hash of your device's app identifier (iOS: identifier for vendor; Android: ANDROID_ID). The original identifier is not stored. Purpose: one free period per device.
• iOS: a hash of Apple's App Transaction ID, computed with a secret salt and kept separately for each App Store environment (production or sandbox). Apple assigns this ID once per Apple Account and app; it does not reveal your Apple ID, name or email. The app reads the App Transaction signed by Apple on your device and sends it to our server, which checks Apple's signature and stores only the salted hash — neither the signed App Transaction nor the ID itself is stored. Purpose: one free period per Apple Account, also after reinstalling or on a new device.
• A salted hash of your IP address — used only to rate-limit automated abuse. We never store the IP address itself (for the request logs of our hosting provider, see Section 11).
• Details of the free period: the platform (iOS or Android), the App Store environment (production or sandbox), the status (pending, granted or denied) and, if denied, the reason (for example "this device or Apple Account has already used its free period"), whether it is a new free period or one carried over after a reinstall, its start and end date, and when the record was created and last changed.
• Anti-abuse event log: when a request is refused or fails, our server records an event with its type, the time and your RevenueCat anonymous user ID, plus, depending on the event: the device hash and the first 8 characters of the anonymous ID that already used this device's free period; the App Store environment and the first 8 characters of the anonymous ID that already used this Apple Account's free period; the IP hash and the number of free periods recently requested from the same network when the rate limit was reached; the reason, the platform and the IP hash when an App Store signal could not be verified; the error reason and status code when RevenueCat could not grant the free period; the code type when a creator code could not be confirmed; when your anonymous user ID changes after a purchase restore: the first 8 characters of the previous and of the new anonymous ID, plus the number of records moved and whether the new ID already had a free period or creator extension of its own (in which case that one is kept and nothing is overwritten); and, when the change could not be confirmed by RevenueCat, the first 8 characters of both IDs and the reason (at most one such event per anonymous ID per day). Repeated events of the same kind from the same network (a failed App Store signal check, the rate limit) are recorded at most once per day.
• Creator codes: if you redeem a creator's code, the app sends your RevenueCat anonymous user ID and the code directly to our partner WinWinKit (which, like any web service, sees the technical connection data of that request) so the creator's attribution is recorded; our server confirms the code with WinWinKit using your anonymous user ID and then stores the extension of your free period (status, code type, old and new end date, timestamps) (WinWinKit is operated by Osta Ventures ApS, Copenhagen, Denmark — see WinWinKit's Privacy Policy).
• Purchase restore: if restoring your purchases changes your RevenueCat anonymous user ID, your free-period records (the details of the free period, a creator extension, the device and Apple Account records and the related anti-abuse events) follow your new ID — but only after RevenueCat confirms that both IDs belong to the same customer. To check this, our server asks RevenueCat for the customer's original anonymous ID; nothing else is stored from that answer. If the change cannot be confirmed, the records stay with your previous ID.

Legal basis: our legitimate interest in offering a free period fairly and preventing its abuse (GDPR Art. 6(1)(f); FADP Art. 31(1)). Reading your device's app identifier and the App Store transaction on your device serves solely to grant you the free period you receive and to protect it against repeated claims; it is strictly necessary to provide this free period.

How long we keep it: our server runs its deletion job once a week (on Sundays), so each deletion below happens within one week after the stated time. IP hashes are deleted 30 days after they were recorded, including those in the anti-abuse event log. The free-period records (device and account hashes, details of the free period, creator extension) are deleted 24 months after your free period ended; denied or unfinished requests 24 months after their last change. Anti-abuse events are deleted 24 months after the event. Without these records, the once-per-person rule could not work.

Not used for: tracking, advertising, profiling, or anything other than granting and protecting the free period.

8. Crash Reporting (Sentry)

To keep the app stable, GymPsycho uses Sentry (Functional Software, Inc., USA) as our processor:

• What is sent: crash and error diagnostics — error type, stack trace, app version, OS version, device model — and a small sample (~5%) of performance traces (screen-load timings, freezes).
• What is NOT sent: no workout data, PRs, plans, gym names, athlete name, health data, email, or advertising IDs. The app's internal log messages and the labels of buttons you tap are never sent, and user IDs are removed from the web addresses recorded with a report.
• No IP address: the app does not send default personal data to Sentry, and Sentry stores no IP address with the reports.
• Identifier: a random per-install ID generated by Sentry, used only to count sessions and crash-free rates per release (no account, no email).
• Retention: crash and error reports 90 days, performance traces 30 days, then automatically deleted. Sentry stores this data in the USA.
• Legal basis: our legitimate interest in a reliable, crash-free app.

See Sentry's Privacy Policy.

9. Anonymous Feature Counters (self-hosted)

To understand which features matter (and keep improving the free app), GymPsycho counts a small set of feature events — for example "a workout was completed" or "a training plan was created". We deliberately built this ourselves instead of using a tracking SDK:

• No identifiers of any kind: no user ID, no device ID, no install ID, no session ID, no fingerprinting. Each counter increment is an isolated, anonymous event — events cannot be linked to each other, to a device, or to you.
• What an event contains: the event name, the app version, the platform (iOS/Android), whether the app is in Free or Pro mode, a coarse gym-count bucket (1/2/3+), and the country derived from the request on our server. We never store your IP address — neither in the counter database nor in our server logs.
• Never included: workout data, exercise names, weights, reps, PRs, plans, gym names, your name, health data, or any free-text content. Our server rejects anything outside a fixed whitelist of counter values by design.
• Self-hosted, no third parties: events go exclusively to our own server (Cloudflare, see Section 11) and are never shared or sold. Raw events are deleted after 30 days; only daily aggregate totals (e.g. "workouts completed per day per country") are kept.
• Because these counters are fully anonymous (no identifier is stored or read from your device), they do not require consent under GDPR/ePrivacy — there is simply nothing that could identify you.

GymPsycho contains no advertising and no third-party analytics, tracking or advertising SDKs (no Google Analytics, Facebook SDK, Mixpanel, Amplitude, Segment or similar).

10. Website Statistics (gympsycho.com)

Our website uses Umami, a cookieless, self-hosted statistics tool. It sets no cookies and does not track you across other websites. It records page views (address and title of the page), the referring page, campaign parameters in links (for example ?ref=), clicks on download buttons, your browser, operating system, device type, screen size and language, and the country, region and city derived from the request. Visitors are counted with a hash of the request data that uses a secret changing every month, so visits cannot be linked across months; Umami does not store the IP address in its database. Legal basis: our legitimate interest in understanding how the website is used. The statistics run on Vercel (USA) with the database at Neon in Frankfurt (Germany) and are deleted 24 months after collection (by a monthly job, so at the latest one month later). The website itself is hosted by Cloudflare. Like any web host, Cloudflare and Vercel keep request logs that include your IP address — see Section 11.

11. Where Data Is Processed

• Our server (free Pro period, feature counters, and the promo code program of earlier app versions): Cloudflare Workers and Cloudflare D1. The databases are located in Cloudflare's Eastern Europe region; requests are processed at the Cloudflare location nearest to you. Data is encrypted in transit (HTTPS) and at rest. The website gympsycho.com is hosted on Cloudflare Pages. See Cloudflare's Privacy Policy.
• Server and hosting logs: Cloudflare processes your IP address to deliver each request. Our own server logs (Cloudflare Workers Logs) contain only the time, the request method, the requested address and error or status messages — no IP address and no request headers — and are deleted after at most 7 days. For one address used by app versions before 2.77.0, the requested address contains your RevenueCat anonymous user ID; for the address that looks up a shared promo code, it contains that code. In addition, Cloudflare keeps request analytics for our domain gympsycho.com (the website and our server at squad.gympsycho.com, not the feature counters), which we can view for 31 days: for each recorded request, the IP address, the requested path, the browser identification (user agent) and the country. Cloudflare also keeps network log data, mostly IP addresses, for a limited period to operate and secure its network. Vercel, which runs our website statistics server, records the IP address in its request logs; in our account these logs are kept for at most 30 days. Vercel may additionally process IP addresses for its own security purposes, such as protection against attacks.
• Processors in the USA: Sentry, Cloudflare, Vercel and Neon (Neon, LLC, a Databricks company; the website statistics database is located in Frankfurt, Germany) are certified under the EU-U.S. Data Privacy Framework and its Swiss-U.S. and UK extensions; RevenueCat transfers data under the EU Standard Contractual Clauses (with the Swiss adaptation) of its data processing agreement.
• Processor in the EU: WinWinKit (Denmark).
• Apple and Google process store purchases, iCloud, Google backup and App Store data under their own privacy policies.

12. Data Deletion

Your workout data lives only on your device (and optionally in your own iCloud or Google backup), so you control its deletion completely:

1. In-app reset: Settings → Management → Reset App ("Delete all training data and start fresh"). All gyms, plans, sessions, PRs and personal info are deleted from the device.
2. Uninstall the app: removes all local data. iCloud data: iOS Settings → [your name] → iCloud → Manage Account Storage → GymPsycho → Delete Data. Android backup: Google account → Backup → App data.
3. Server-side data (free Pro period, promo code program of earlier app versions): email support@gympsycho.com with the subject "Data Deletion Request". Because there is no account, send it from the app via Settings → Feedback (the prepared email contains your anonymous support ID) so we can find your records. We delete them within 30 days. We keep only the record needed to stop the free period from being granted again — the device hash and, on iOS, the App Store account hash, each with the dates of the free period and the date on which we carried out your deletion request, but without your anonymous ID — for as long as Section 7 allows (24 months after the free period ended).

In the app, deleted gyms, plans and workouts first go to a 30-day trash bin and can be restored; after 30 days they are deleted permanently.

13. Your Rights

You can request access to, correction or deletion of your data, restriction of processing, data portability, and you can object to processing based on legitimate interest. Write to [email protected]. You also have the right to lodge a complaint with a supervisory authority — in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EU the authority of your country of residence.

14. GymPsycho Squad (app versions before 2.77.0)

Until version 2.77.0, GymPsycho offered a promo code program ("Squad"): you could share a code with up to 5 friends, who each received 3 months of Pro. Version 2.77.0 replaces creating and sharing new codes with the free Pro period (Section 7); codes shared before remain redeemable until December 31, 2026. For existing codes and redemptions, our server stores: your RevenueCat anonymous user ID, your 7-character code, a counter (0–5), your reward state (pending or granted 12-month Pro reward) and timestamps; for a friend redeeming a code, their RevenueCat anonymous user ID, the code, the result (redeemed or blocked, with the reason), a SHA-256 hash of the device's app identifier (iOS identifier for vendor / Android ANDROID_ID) and a salted hash of the IP address. Every redemption attempt is also logged with the entered code, the device hash and the IP hash (to limit attempts to guess codes). An anti-abuse event log records refused or failed redemptions, reward steps and changes of the anonymous user ID after a purchase restore: the event type, the time, the code and anonymous user ID concerned and, depending on the event, the device hash and the IP hash (for example when an entered code does not exist), counters, or the first 8 characters of another anonymous user ID. Purpose: granting the reward and preventing repeated redemptions and code guessing. Legal basis: GDPR Art. 6(1)(f) / FADP. Our weekly deletion job (on Sundays) deletes IP hashes 30 days after they were recorded and the log of redemption attempts completely after 30 days, each within one week after that time. The program ends on December 31, 2026: shared codes can be redeemed until 23:59 UTC that day and are no longer accepted from January 1, 2027. All remaining program data is deleted 12 months after the program ends, that is within one week after January 1, 2028; until then, a reward that is still pending (for example while a paid subscription is running) can still be granted, also after a purchase restore changes your anonymous user ID, once RevenueCat confirms that both IDs belong to the same customer.

15. Children

GymPsycho is not directed at children under 13. We do not knowingly process data of children.

16. Changes to This Policy

We update this policy when the app changes. The current version is always on this page with its date.

17. Contact

[email protected]