Privacy Policy

Last updated: 7 August 2026

The short version

GymDIY is a training app. We collect what we need to build your programs and remember your training, and nothing else. We do not run ads, we do not track you across other apps or websites, and we do not sell or share your data with data brokers.

What we collect

Your account. Your email address, and a display name if you choose to set one. Authentication is handled by Supabase.

Your training. The programs we generate for you, the workouts you complete, and the sets, reps, loads and effort ratings you log — along with personal records derived from them. This is the core of the product; without it there is nothing to progress.

Your equipment. The gym equipment you tell us you have, including anything you type in yourself — names, manufacturers, model numbers, product links and descriptions — plus your training goals and any travel profile you set up.

Your subscription status. Whether you are on the free or premium tier and when any trial ends. We never receive your card details. Purchases made in the iOS app are processed by Apple; we are told only that a subscription exists.

Limited usage records. We record that an AI-powered action happened, when, and what it cost us to run — used to enforce free-tier limits. These records contain no content from the action itself.

Photos

When you scan a piece of equipment with the camera, the photo is sent to our server and passed to Google Cloud Vertex AI to identify what it is. We do not store the photo. It is used to produce the identification and then discarded — nothing is written to our database or to any file store. We keep the result (for example “adjustable bench”), not the image.

We only ever access the camera when you choose to scan something, and only after you grant permission.

Apple Health

If you turn on Apple Health in Settings, GymDIY writes your completed workouts to the Health app. That is all it does.

GymDIY never reads any data from Apple Health. We request write access only — no read permission is requested, and the app has no capability to read your health records. We also deliberately write no calorie or energy figure, because GymDIY does not measure energy expenditure and we would rather record nothing than record a guess in your permanent health history.

Health data written this way stays on your device and in your iCloud Health store. It does not come to us, and it is never used for advertising. This feature is off by default and you can turn it off at any time in Settings.

Notifications

Workout reminders are scheduled entirely on your device. There is no push server, no push token, and nothing about your notifications reaches us. They are off unless you turn them on.

Who we share it with

We use a small number of service providers to run GymDIY. They process data on our behalf and are not permitted to use it for their own purposes:

  • Supabase — accounts, authentication, and the database your training is stored in.
  • Render — hosting for our API.
  • Google Cloud (Vertex AI) — generates your programs and identifies equipment from photos and descriptions.
  • RevenueCat — manages subscription state. Receives your account identifier and your subscription status.
  • Apple — processes in-app purchases. We never see your payment details.
  • Tavily — looks up equipment specifications from the names and model numbers you enter.
  • Stripe — processes billing for subscriptions purchased on our website, not in the iOS app.

We do not sell your personal information, and we do not share it with data brokers or advertising networks.

How long we keep it

For as long as you have an account. Usage records used for rate limiting are pruned on a rolling window.

Deleting your account

Settings → Delete Account, in the app. This deletes your account and the training, equipment and profile data associated with it. It is immediate and it is not reversible. You do not have to email us to ask.

Your rights

Depending on where you live you may have rights to access, correct, export or delete your personal data. Account deletion is built into the app; for anything else, email us at support@gymdiy.fit and we will respond within 30 days.

Children

GymDIY is not directed at children under 16. We do not knowingly collect data from them. If you believe a child has created an account, contact us and we will remove it.

Security

Data is encrypted in transit. Authentication credentials are stored in the iOS Keychain rather than in ordinary app storage. No system is perfectly secure, and we will not pretend otherwise.

Changes

If we change this policy we will update the date above. Material changes — particularly any change to what we collect or who we share it with — will be surfaced in the app rather than left for you to notice.

Contact

support@gymdiy.fit