GymPad Privacy Policy
This policy explains how we process data when you use GymPad, its trainer features and related services. It is a privacy notice; reading it or accepting the Terms does not give consent to advertising, optional analytics or processing health data.
1. Controller and contact
The controller is MatCode Mateusz Arczyński, ul. Portowa 10, 86-200 Chełmno, Poland, tax ID (NIP) 875-156-25-99, REGON 383604557. Send privacy questions and requests to matcode.help@gmail.com or this postal address.
2. Data we process
- Account: user ID, email, display name, sign-in method, settings, user role, plan and trial information. Sign-in may use Firebase Authentication, Google or Apple. Apple sign-in may provide an email relay address.
- Training journal and profile: exercises, sets, weights, repetitions, duration, plans, goals, schedules, notes, perceived effort and wellbeing, supplements, dosages, schedules and intake history; depending on the feature, also weight, body measurements, sex, recovery information, limitations and injuries you provide. Not every entry is health data, but its content or combination with other information may reveal your health status.
- Trainer features: trainer profile and contact details, country and city, invitation code, client relationship, messages, inquiries, appointments, assigned plans, shared workout history, questionnaires, goals, summaries and coaching notes. A trainer may provide some of this information; you may also ask them about its content.
- Purchases: transaction IDs and tokens, product, store, entitlement status and duration, verification and refund history, and information required for accounting and preventing transaction reuse. Payment card or bank account details are provided to the store operator; GymPad does not receive your full card number.
- Technical data: IP address, installation and device identifiers and, depending on permissions, advertising identifiers, operating system and app version, usage events, crash reports, security logs and notification tokens. Analytics events may be associated with your account ID; we do not describe them as anonymous.
- Support: contact address, correspondence and information supplied with your request. Do not send passwords, card details or medical records unless needed for the matter.
Data is stored locally on your device and, for synchronisation and trainer collaboration, in Firebase services. Local copies may also exist on a paired watch. Sharing a file or image through the system share sheet sends selected information to the recipient or app you choose.
3. Purposes and legal bases
- Account operation, journal synchronisation, trainer features and purchased plans: performance of a contract or steps you request before entering one (GDPR Article 6(1)(b)), for ordinary data necessary for the selected service. This also covers publishing a trainer profile at the trainer's request when they enable visibility and generating requested AI outputs from data that is not health data.
- Optional health data, AI analysis of it and sharing it with a trainer: consent (GDPR Article 6(1)(a) and explicit consent under Article 9(2)(a)), separately for the relevant purposes. Entering data, choosing a feature, granting a system permission or accepting documents does not replace the required explicit consent. Processing health data for these purposes must not start without it.
- Optional usage analytics, personalised advertising and nonessential SDK access to information on your device: prior consent (GDPR Article 6(1)(a) and, where applicable, Article 399 of the Polish Electronic Communications Law). Apple ATT permission is additional and does not replace other required consents.
- Essential diagnostics, security, transaction verification and fraud prevention: our legitimate interest in maintaining a secure, reliable service and preventing fraud (GDPR Article 6(1)(f)). This does not replace consent for optional analytics, device access or health data.
- Accounting and handling statutory rights and complaints: legal obligations (GDPR Article 6(1)(c)), particularly tax and consumer law. Other contractual correspondence relies on Article 6(1)(b); other inquiries rely on the legitimate interest in responding (point (f)).
- Establishing, exercising and defending legal claims: legitimate interest (GDPR Article 6(1)(f)); where special-category data is necessary, also Article 9(2)(f).
Information needed for an account or purchase verification is necessary for those functions. Other information is optional; withholding it may limit only the function that needs it. You may withdraw consent without affecting the lawfulness of earlier processing by contacting the controller; device permissions can also be revoked in device settings. Withdrawal does not allow us to continue the same consent-based processing under legitimate interest.
The system automatically checks transaction status and promotion eligibility; fraud controls may restrict access to purchases. If you dispute a result, contact the controller to request an explanation and human reassessment. Exercising a lawful right to complain or withdraw is not itself abuse.
4. AI features
GymPad uses Google Gemini models through Firebase AI Logic and the Google Cloud backend (Agent Platform / Vertex AI). Generating a plan, progress or recovery analysis, or coaching summary may send relevant journal entries, goals, measurements and other profile data, questionnaire responses and notes, where the selected feature uses them. Removing your name or email from a prompt does not make training data anonymous.
Outputs may evaluate and predict progress or recovery, which may constitute profiling. They are suggestions for the user or trainer to assess. GymPad does not use them to make solely automated decisions producing legal or similarly significant effects under GDPR Article 22.
Under Google Cloud's AI data policies, Google does not use customer data to train or fine-tune models without prior permission or instruction. This is not a guarantee of no retention: security logs, abuse monitoring and configured monitoring may apply. Do not include other people's data or medical information unnecessary for the feature in free text.
5. Apple Health, Health Connect and Apple Watch
This integration is optional and requires device permissions. On the phone, GymPad writes completed workouts to Apple Health (iOS) or Health Connect (Android), without reading those systems' existing history. Records include workout type, start and end times and, when available from the watch, energy and heart rate.
The Apple Watch app may read heart rate and energy from HealthKit during a workout and send the phone a summary and samples for export to the health system. This data may be temporarily stored in a local export queue. We do not use data obtained from HealthKit or Health Connect for advertising or marketing profiling.
Revoke permissions in Health, Health Connect or watch settings. Revoking permission or deleting your GymPad account does not automatically remove records already written to the health system or copies shared with other apps. Manage those records in the relevant system.
6. Recipients and visibility
- Google — Firebase and Google Cloud: authentication, database and synchronisation, server functions, App Check, Remote Config, Cloud Messaging, In-App Messaging, Crashlytics, Analytics and AI. Scope depends on features and configuration. See Firebase privacy information.
- Google AdMob and advertising technology providers used in the app: advertisements in the Standard plan. Premium does not display ads, but SDK packages may still be included in the installation. Absence of ads does not itself mean SDKs process no data. See Google advertising policies.
- Google Play and Apple App Store: purchases, subscriptions and refunds; Google and Apple also for the selected sign-in method. They also act as independent controllers for their own services: Google and Apple.
- Photon / komoot and OpenStreetMap: city suggestions in trainer search. A request includes typed text and technical connection data, including IP; the selected city may be stored in a profile. This feature does not obtain the phone's GPS location. See Photon.
- Trainer and client: information needed for an active coaching relationship, including shared workouts, messages, questionnaires and summaries. Other directory users can view a visible trainer profile; hiding it does not erase relationship history. A trainer may be a separate controller for data processed in their own service and should provide their own privacy information.
- Email, legal and accounting service providers and authorised authorities: only as needed for communications, handling matters or meeting legal obligations. Data is also received by a recipient you select when exporting or sharing it.
7. Transfers outside the EEA
Not all services are restricted to the European Economic Area. Providers may process data in the United States and elsewhere; the AI path used is not restricted in code to a European region. Transfers use an applicable European Commission adequacy decision covering the recipient, or standard contractual clauses and required supplementary measures. Ask the controller for information about the applicable mechanism and a copy of safeguards. See also Firebase transfer clauses.
8. Retention and deletion
- Account, journal and coaching data: while the account and selected functions are maintained, until the data or account is deleted, subject to the exceptions below. Signing out, uninstalling the app, hiding a profile or ending a trainer relationship does not automatically erase every cloud record.
- Account deletion: starts staged deletion from GymPad's active resources. It does not instantly erase all providers' copies. Instructions and requests without the app: GymPad account deletion.
- Minimal security and purchase records: after account deletion, the system provides a five-year retention period for trial and fraud controls, purchase bindings, transaction reuse prevention and records of handling erasure. These may include a hash of an account identifier or address and entitlement and transaction status; a hash is not automatically anonymous. These records are not used to restore your journal or for marketing. Continued retention must be necessary and proportionate to the stated purpose.
- Tax and accounting documents: for the period required by applicable law; for Polish tax liabilities, generally five years from the end of the year in which the tax payment deadline falls, allowing for suspension or interruption of the limitation period. This does not mean retaining your entire account.
- Claims and correspondence: as needed to resolve the matter and for the applicable limitation period; if disputed, until the dispute ends. Retained information is limited to what is necessary.
- Local AI results: a result's validity period is not its physical deletion deadline. Expired results are cleaned up when another result is saved or local session resources are cleared; a closed app does not erase them automatically when their validity expires. Health export jobs older than 14 days become eligible for deletion when the queue is next processed.
- Firebase: the provider states that Crashlytics retains reports and identifiers for 90 days, then begins removal from its resources and backups. Deletion of certain Authentication data and installation identifiers may take up to 180 days in the provider's resources. Other logs and backups follow the particular service's deletion cycles; we do not promise a single deadline for all copies. Administrative backups may include account and journal data; they are intended for disaster recovery, not ordinary operation of a deleted account. Erasure requests must be reapplied when a backup is restored.
- Analytics and advertising: retention depends on data type, service configuration and user choices. For detailed GA4 user and event data, standard settings are 2 or 14 months; these do not cover all aggregated reports. Withdrawal stops future consent-based operations but does not automatically delete all earlier recipients' data. Where there is no basis for continued retention, we erase data covered by the request and notify recipients as required by the GDPR. Provider information: Analytics retention.
9. Your rights
Subject to GDPR conditions, you have rights to access and obtain a copy of your data, rectification, erasure, restriction, portability and withdrawal of consent. You may object to legitimate-interest processing for reasons relating to your particular situation; you may object to direct marketing at any time.
Send requests to matcode.help@gmail.com. We respond without undue delay, generally within one month; complex or numerous requests may require two additional months, with reasons given during the first month. If we have reasonable doubts, we may request minimal information needed to confirm your identity. Do not send your password. You may complain to the President of the Polish Personal Data Protection Office or another competent supervisory authority.
10. Security and minors
We apply technical and organisational measures appropriate to the risks, including encrypted transmission and access controls. No system can eliminate all risk. We notify supervisory authorities of breaches where GDPR Article 33 requires it, and affected individuals where the conditions in Article 34 are met.
GymPad is not intended for children under 16. Rules for minors entering a contract are set out in the Terms. Where processing a child's data requires parental consent, the threshold and conditions under applicable law apply; there is no separate “consent to the policy”. Contact the controller if you suspect a child's data is processed without a required legal basis.
11. Changes to this policy
The current version is available on this page. We explain material changes to the scope, purposes or recipients before new processing starts. Where new consent is required, publishing a policy or continued app use does not replace it.