Privacy policy
Version 1 · effective 2026-10-26
Your Gym Bro · https://your-gym-bro.pages.dev · version 1, effective 2026-10-26
In short
- Your profile, weight, plan, workout log and machine photos stay on your phone, not with us.
- Only what is useful to everyone goes to our server: gyms and their machines (never home gyms), anonymous "busy" counters, reminders if you turn them on, and an encrypted backup if you save one. We never ask for your name, e-mail or phone.
- To build a plan, suggest a swap or recognise a machine, data without your name is sent to Google Gemini. It includes sex, age, height, weight, goal, level, gym equipment, tired muscles and the reason for swapping an exercise ("hurts", "discomfort"). This may count as health information.
- The app is for ages 14+, AI features for 18+. In the EEA, Switzerland and the UK AI works only through Google's paid tier; until it is connected, AI is switched off there.
- Analytics (Google Analytics) runs only after you press "Allow".
- You can delete everything in "Settings → My data": from the shared server and from your phone.
1. Who is responsible
Data controller: private individual Ivan, Ukraine. Privacy contact: 19thanks96@gmail.com. We reply within 30 days.
2. What is stored where
On your device (in the browser, IndexedDB / localStorage) — and nowhere else unless you decide otherwise:
- profile: sex, age, height, weight, goal, level, name (if you entered one);
- weight history, plan, set log, calendar, how you feel before a workout;
- your gyms, including home gyms, and machine photos;
- settings, recovery key (if created), queue of changes not yet sent.
Reading machine labels (OCR), QR codes and counting reps with the camera happen on the device: no frames are sent anywhere.
On our server (Cloudflare D1) — only this:
| What | Why | How long |
|---|---|---|
| Gyms added by people (name, type, address, map point; home-made gyms rounded to ~100 m), machines in gyms; with them, the anonymous device id that added them and an "added on site" flag (yes/no, no coordinates) | so others can see what a gym has; the id lets you delete your own entries | while the service runs or until deleted. Home gyms never leave the device. |
| Coach hand-off code (goal, sex, age, height, weight, level, schedule, gym equipment — no name, no log) or a plan from a coach | so a human coach can open it by code | 30 days |
| "Usually busy": only the number of taps per gym / machine / weekday / hour | show when a machine is freer | 8 weeks. No device id, no IP. |
| Reminder subscription: delivery address from your browser's push service, encryption keys, language, time zone, reminder days and time | send the reminder on time | until you unsubscribe or 60 days without opening the app |
| Encrypted backup (separate database): backup address, hash of a secret, ciphertext | restore your data on a new phone | until you delete it or 400 days without saving/opening. Only you have the key — we cannot read the backup. |
| Rate-limit counters: shortened hash of the IP address + day | abuse protection (daily request limits) | ~3 days. The IP itself is not stored. |
| AI technical stats: request type, duration, status, token counts, language, app version, random request number | see failures and stay within the free quota | 30 days. No IP, no device id, no request or answer text. |
The anonymous device id (x-device-id) is a random string created on your phone. It is not linked to a name, e-mail or advertising id and is only used to delete your own entries.
3. Who else receives data and why
| Service | What it receives | Why |
|---|---|---|
| Cloudflare (hosting, server, database; US/EU) | IP address and technical data of each request, like any host; the data in the table above | to run the site and server. Cloudflare keeps technical logs under its own rules. |
| Google Gemini API (AI) | a machine photo or walk-through frames — when you ask to recognise; for plans and swaps — sex, age, height, weight, goal, level, gym equipment, tired muscles, the reason for swapping an exercise (e.g. "hurts" or "discomfort"), a dictated plan. No name, no device id. | build a plan, suggest a swap, recognise a machine. On the free tier Google may use what is sent to improve its models, and Google's human reviewers may read it. So do not film people, faces or documents. There is no separate consent for this: if you do not want it, do not pick the "hurts" reason and do not use AI features — plans can be built from ready-made templates. |
| Google Analytics 4 | only after "Allow": page views (codes in links removed), events "gym added", "machine added", "plan built", "workout finished" (duration, mode) | understand what works. No name, weight, coordinates or text; Google signals and ad personalisation are off. Retention in GA — 2 months. |
| OpenFreeMap (map tiles), Photon / komoot (address search), Overpass API / OpenStreetMap (gyms nearby) | requests go directly from your device: IP address, map area, point coordinates or search text | show the map and find gyms. The app uses your location only with your permission and does not send it to our server. |
| Your browser's push service (Google, Apple, Mozilla, Microsoft) | an encrypted reminder | deliver the reminder. |
| Browser speech recognition (Google in Chrome, Apple in Safari) | your voice when you press "Dictate" | turn speech into text. The browser does this, not us. |
| Google Maps | only if you press "Open in Google Maps": the gym's coordinates | directions. |
We do not sell data, show ads or share data for advertising.
4. Age: the app 14+, AI 18+
- The app is meant for people aged 14+; younger children only together with a parent.
- AI features (plans, swaps, recognition) are for ages 18+ by the age in your profile, as Google Gemini API terms require. Under 18, ready-made plan templates without AI are available.
- If you are a parent and believe your child sent us data, write to the contact in section 1 and we will delete it.
5. European Economic Area, Switzerland, United Kingdom
Google's terms allow the Gemini API for these countries only on the paid tier, where Google does not use data to improve its models. So for users in the EEA, Switzerland and the UK, AI works only through the paid tier; until it is connected, AI is switched off there and the app offers ready-made templates. The server detects the country from a technical request header and does not store it.
6. Legal bases
- Your action / providing the service — when you add a gym, ask for a plan, save a backup, turn on reminders.
- Consent — analytics, sending photos to AI (you press "Recognise" yourself). You can withdraw consent at any time; this does not affect what was already done.
- Legitimate interest — abuse protection (limits by IP hash) and technical stats without personal data.
7. Your rights and how to use them
You may know what data exists, get a copy, correct, delete, restrict, object and withdraw consent.
- Delete data: "Settings → My data". Two buttons: "Delete from the server" (gyms and machines added by this device) and "Delete everything from this phone" (profile, log, photos, settings; optionally the cloud backup too).
- See and take everything from the device: "Settings → Backup" (JSON / CSV file).
- Delete your machine from the shared list: in the machine card.
- Delete the cloud backup: "Settings → Key and cloud backup" (gone immediately).
- Turn off reminders: "Settings → Reminders" — the subscription is deleted from the server.
- Analytics: "Settings → Analytics → Decline".
- Anything else on the server: write to 19thanks96@gmail.com. We do not know who you are, so we may ask for the device id.
- Data already sent to Google Gemini cannot be recalled by us — Google processes it under its own terms.
Complaints: Ukrainian Parliament Commissioner for Human Rights (ombudsman.gov.ua); in the EU — your local data protection authority.
8. Cookies and similar technologies
- The app itself sets no cookies. It keeps data in browser storage (IndexedDB, localStorage) — it cannot work without it, so no consent is needed.
- Google Analytics cookies (
_ga,_ga_*) appear only after "Allow"; before that, Google's script is not even loaded. Your choice is remembered on the device and can be changed in Settings.
9. Security
HTTPS everywhere; the cloud backup is encrypted on the device (AES-GCM), the server sees only ciphertext; the server keeps only hashes of secrets; API keys live only on the server. If you lose your recovery key, nobody can restore the backup — not even us.
10. Changes
A new version appears here with its date. If a change affects consents, we will ask for consent again in the app.