Privacy Policy

GymApp (the "App") is made by www Holding AB, org. no. 559515-3668, Anundsgatan 22, 753 34 Uppsala, Sweden ("we"). We are the data controller for the personal data described here. Contact: william@www-holding.com.

This policy says what the App stores, why, where, and for how long, in plain words. Last updated 7 September 2026.

What we store and why

Your account. The App creates an anonymous account the first time it opens, tied to a random device identifier stored in your phone's keychain. If you sign in with Apple, Google or an emailed code, we store the identifier that provider gives us and, if you share it, your email address. Sign-in exists so your data survives a lost phone and follows you to a new one. Legal basis: performance of our contract with you.

Your training data. Workouts (exercises, sets, weights, reps, distances, times, rests, notes), templates, body measurements you enter, and the gyms you add with their equipment lists. This is synced to our server so it is backed up and available on your other devices. Legal basis: performance of our contract.

Where a workout happened. If you allow location access, the App reads your position when a workout starts to pick the gym you are at, and stores that position with the workout. It is visible only to you. When you add a gym and place it, the gym's name, city and position are stored with the gym. If you publish a gym so others can find it, only its name, city, position and equipment list are shared. Your own position is never shared with anyone. Legal basis: consent (the iOS location permission), which you can withdraw in iOS Settings.

The AI coach (only if you turn it on). When you use Machine busy suggestions, Plan with AI or the Coach tab, the exercises you log (names, sets, reps, weights), your recent workouts, body measurements you entered, your gym's equipment list and your chat messages are sent to our server and on to an AI provider to produce the answer. Chat threads and answers are stored on our server so you can reopen them and so we can act on abuse. The AI coach is off by default. Legal basis: consent, which you can withdraw in Settings at any time; stored threads remain until you delete them or your account.

Usage data. To see what is hard to use and fix it, the App records how it is used: which screens you open and for how long, which buttons and menus you tap and where, when sets and rests start and end and how long they take, the exercises you add, swap or remove, how long your notes are (never their text), and how many characters you send to the coach (never the text). Each record carries your account and device identifier. We also keep a log of the requests your phone makes to our server (path, status, timing, your account identifier). Legal basis: our legitimate interest in understanding and improving the App. This data is kept for as long as your account exists and is deleted with it.

Feedback you send. If you write to us from the App (Settings › Send feedback, the "Deleting? Tell us why." action on the home screen, or after answering "Not great" when the App asks how it is working), we store the text you wrote, the email address if you typed one, the App version and your account identifier, so we can read it and, if you asked, reply. Legal basis: our legitimate interest in improving the App. If the message cannot reach our server, the App offers to open it as an email from your own mail app instead.

Notifications. If you allow notifications, rest reminders are scheduled on your phone. For the lock-screen Live Activity, the App sends a push token to our server so it can update the countdown; tokens are deleted when the activity ends or the device is revoked.

Payments (only if you subscribe on our website). Payment is handled by Stripe, which acts as the merchant of record: Stripe takes your card details, charges you, issues the receipt and handles VAT. We never see or store card numbers. We store the email address you gave at checkout, your subscription status and plan, the currency and amount, and Stripe's identifiers for the customer, subscription and checkout so that we can unlock the App on your account and handle refunds and cancellations. The eight-digit code shown after payment is stored hashed and expires after 7 days. If you delete your account, we cancel the subscription and delete these records; Stripe keeps its own accounting records under its terms. Legal basis: performance of our contract with you.

The website quiz and ads (only if you come through our website). When you start on our website we give your browser a random session identifier for that visit and record which step you are on, which answer you chose (goal, equipment, days per week, previous app, import), how long each step was on screen and whether you went forward, back or left. If you arrived from an ad we also store the campaign parameters in the link and the click identifier the ad network attached (Meta, TikTok or Google), and, only if you accepted marketing cookies, Meta's browser cookies, so the ad network can be told which ads led to a purchase. Nothing you type freely is recorded. When you sign in or pay, the session is joined to your account. Legal basis: our legitimate interest in seeing which steps lose people and which ads pay for themselves; consent for the marketing cookies, which you can decline in the cookie bar with no effect on the site.

Rate limiting and security. Your IP address is used for at most 24 hours to limit abusive request rates and is not stored beyond that.

Who processes data for us

• Hetzner Online GmbH, Germany: hosting of our server and database, within the EU.
• Apple Inc.: Sign in with Apple and push notifications, under Apple's terms.
• Google LLC: Sign in with Google, under Google's terms, only if you use it.
• OpenRouter, Inc. (United States) and the AI model provider it routes to: the AI coach, only if you turn it on. Transfers outside the EU rely on the safeguards in the provider's data processing terms (the EU standard contractual clauses).
• Postmark (ActiveCampaign, LLC), United States: sending the email sign-in code, only if you sign in by email.
• Stripe Payments Europe, Ltd. (Ireland) as merchant of record for subscriptions bought on our website, under Stripe's terms and privacy policy; Stripe decides what it keeps for its own accounting.
• Meta Platforms Ireland Ltd. and TikTok Technology Ltd. (Ireland): only if you accepted marketing cookies on our website, they receive that a purchase happened together with the click identifier and a hashed email, so their ad reporting can match it to an ad.

We do not sell data, show ads, or share your data with anyone else.

How long we keep it

Everything above is kept for as long as your account exists. Deleting your account in the App (Settings › Account › Delete account) permanently deletes your account, training data, gyms, chat threads, usage data, feedback you sent and request logs from our server. The one exception is the reason you can optionally type when deleting: that line is kept, with the App version and nothing that links it to you, because reading it is the point of asking. Local data on your phone is deleted when you delete the App. Server backups are overwritten within 30 days.

Your rights

Under the EU General Data Protection Regulation you can access, correct, export and delete your data, object to processing based on legitimate interest, and withdraw consent. Most of this is built in: export your workouts as CSV in Settings, turn the AI coach off in Settings, and delete your account in Settings › Account. For anything else, email william@www-holding.com. You can also complain to the Swedish Authority for Privacy Protection (IMY, imy.se).

Children

The App is not directed at children under 13, and we do not knowingly collect data from them. If you are under the age at which you can consent to online services where you live (13 in Sweden, up to 16 in some EU countries), a parent or guardian must agree for you; the consent-based features (location, the AI coach) then need their permission. If you believe a child has given us data, email william@www-holding.com and we will delete it.

Changes

If this policy changes in a way that matters, the App will tell you the next time it opens. The current version is always at https://gym-api.www-holding.com/privacy.