Privacy Policy — Gymbrutal

Last updated: 7 August 2026

Gymbrutal is a training and nutrition log for iPhone. This policy describes exactly what the app does with your data. It was written from the source code, not from a template: every statement below matches a specific behaviour you can verify by using the app offline.

If you have a question, write to gymbrutalofficial@gmail.com.

The short version

Nothing leaves your phone unless you create an account. The app is fully usable with no account, no network, and no sign-in. In that mode, your workouts, records and meals exist only in a database on your device.
We do not track you. There is no analytics SDK, no advertising identifier, no attribution framework, no third-party tracker of any kind in this app. Not a reduced set — none.
We never sell or share your data with advertisers or data brokers.
You can delete everything, from inside the app, in two taps and a typed confirmation.

1. What the app stores on your device

Whether or not you have an account, the following is written to a private database inside the app's own storage area:

Data	Why
Exercises, routines and programs	Your training plan
Sets: weight, repetitions, RPE/RIR, timestamps	The log itself
Personal records and estimated 1RM	Progress tracking
Food entries: name, quantity, calories, macronutrients	The nutrition diary
Body weight and biological sex	Strength ranks compare what you lift to what you weigh
Display name, preferences, weekly goal	App settings

This data is protected by iOS file encryption when your device is locked. It is included in your iPhone backup if you have iCloud Backup or encrypted local backups enabled — that backup is governed by Apple's terms, not ours.

If you never sign in, this data never reaches any server of ours.

2. What leaves your device, and when

2.1 If you create an account (optional)

Signing in enables synchronisation between your devices and restores your data if you lose your phone. It is never required to use the app.

When signed in, the categories listed in section 1 are copied to our hosting provider so they can be sent back to your other devices. In addition we store:

your email address, which identifies the account;
an internal account identifier.

We use Supabase for hosting (database and authentication). They process this data on our instructions as a service provider. Data is stored in the European Union.

2.2 If you use the social features (optional)

The social features are off until you take a specific action.

Choosing a public handle makes that handle, and your weekly workout count, visible to people you have accepted as friends. Nothing else is shared: not your weights, not your records, not your food diary.
Sending or accepting a friend request stores the link between the two accounts.

You can change or remove your handle at any time.

2.3 If you subscribe (optional)

Subscriptions are handled by Apple and by RevenueCat, which manages subscription status across devices.

Apple processes the payment. We never see your card details, and never receive them at any point.
RevenueCat receives a pseudonymous identifier and the status of your subscription, so the app knows whether Premium is active.

2.4 If you enable Apple Health (optional)

With your explicit permission, the app:

reads your latest body weight, to fill in the value used by the strength ranks;
writes your finished workouts, so they count towards your activity rings.

Health data is exchanged only with Apple Health on your own device. It is never sent to our servers, and never to any third party. You can revoke this permission at any time in iOS Settings → Privacy & Security → Health.

2.5 If you share a record card (optional)

Personal-record cards are drawn on your device and saved as an image. What you then do with that image — share it, post it, delete it — happens entirely through iOS and the app you choose. We are not involved and receive nothing.

3. What we deliberately do not do

No tracking. No analytics SDK, no crash-reporting SDK, no advertising identifier (IDFA), no attribution framework, no fingerprinting. The app's privacy manifest declares NSPrivacyTracking = false, and there is no tracking code to declare.
No advertising. The app shows none, and contains no advertising framework.
No sale of data. We do not sell, rent or trade your data. We do not share it with data brokers.
No profiling and no automated decision-making producing legal effects.

4. Notifications

Notifications are local: they are scheduled on your device by the app itself. There is no push server, and no notification content is sent over the network. You can turn them off in iOS Settings.

5. How long we keep your data

On your device: until you delete the entry, or delete the app.
On our servers (only if you have an account): as long as the account exists. When you delete your account, the associated records are erased.
Backups held by our hosting provider are rotated and disappear within 30 days.

6. Deleting your data

Inside the app: Account → Delete account. You will be asked to confirm twice, the second time by typing DELETE. This erases your data on our servers and then on the device. It cannot be undone.

If you use the app without an account, uninstalling it removes everything, because nothing was stored anywhere else.

You can also write to gymbrutalofficial@gmail.com and we will delete the account for you.

7. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your data, to object to or restrict processing, and to lodge a complaint with a supervisory authority. Residents of the European Economic Area and the United Kingdom have these rights under the GDPR; residents of California have comparable rights under the CCPA/CPRA — including the right not to be discriminated against for exercising them.

The app already gives you direct access to the two that matter most: you can see every piece of data it holds, and you can delete all of it yourself.

For anything else, write to gymbrutalofficial@gmail.com. We reply within 30 days.

8. Legal basis for processing (EEA and UK)

Performance of a contract — storing and syncing your training data is the service you asked for.
Consent — Apple Health access and the social features. You can withdraw it at any time, and the rest of the app keeps working.
Legitimate interests — keeping the service secure and preventing abuse.

9. Children

Gymbrutal is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child has given us data, write to gymbrutalofficial@gmail.com and we will delete it.

10. Security

Traffic to our servers uses TLS. Access to your rows is restricted at database level so that one account cannot read another's data. Payment details never transit through our systems.

No system is perfect. If you find a vulnerability, please report it to gymbrutalofficial@gmail.com before disclosing it publicly.

11. Health disclaimer

Gymbrutal is a logbook, not a medical device. Strength ranks, one-rep-max estimates, recovery indicators and nutrition figures are informational only. They are not medical, dietary or training advice. Talk to a qualified professional before starting or changing a training or eating programme.

12. Changes to this policy

If we change this policy in a way that affects you, we will update the date at the top and, for significant changes, tell you in the app before the change takes effect.

13. Contact

Nobel-Thomas gymbrutalofficial@gmail.com