Privacy Policy

Effective date: October 18, 2026

This Privacy Policy explains how collects and uses personal data when you use GymNavi — our website and web app at https://gymnavi.app and our iOS and Android apps (the "Service"). We have tried to keep it short and clear. If anything is unclear, write to us at contact@gymnavi.app.

The short version

• We use your data to build and adjust your training and nutrition plan, run your account, take payments and keep the Service secure.
• Injuries, limitations and other health information are used only with your explicit consent and only to personalise the Service for you.
• Progress photos are private. They are analysed by AI only when you use the comparison feature.
• We don't sell your personal data. Ad measurement with the Meta Pixel runs on our website only if you press Accept in the cookie banner.
• You can delete your account and data yourself at any time in Settings.

1. Who is responsible for your data

The controller of your personal data is , , tax ID . For anything related to your data, contact us at contact@gymnavi.app.

2. What data we collect

Questionnaire

When you take our questionnaire, we collect your answers: sex, age, height, current and target weight, goal, training experience, training availability, focus areas, injuries or limitations, sleep, activity level and diet preference. Before the first question about your body or health, we ask for your explicit consent on a separate screen (an unticked box). Nothing from those questions is stored or sent to our AI provider before you give it. We save your answers as you go so you don't lose your progress. At the end you give us your email address and first name and can choose whether to receive marketing emails.

Using the Service

• Account data: email address, first name, language, units, time zone, settings and notification preferences.
• Training data: workouts, exercises, sets, weights, repetitions, workout ratings, streaks, strength ranks and weekly reports.
• Body and progress data: weight, body measurements (such as waist or body fat percentage), progress photos and their AI comparisons.
• Nutrition data: food logs, barcodes you scan, and photos of meals and nutrition labels you submit for analysis. We use these photos to create the food entry and do not keep them in your account.
• Coach and check-ins: your messages with the AI coach, and mood, energy, sleep and soreness check-ins with any notes.
• Referral data: your referral code, who invited you, and rewards granted.
• Support: messages you send us.

Payments

• Web purchases are processed by Stripe. We receive the payment status, plan, amount, currency and Stripe customer and subscription identifiers. We never see or store your full card number.
• In-app purchases are processed by Apple or Google. Through RevenueCat we receive your subscription status, plan and transaction identifiers. We don't receive your payment card details.

Collected automatically

• Technical data: IP address, device and browser type, operating system, app version, language, approximate country, and server logs (for example request times and errors).
• Marketing attribution: if you arrive through an ad or a link, we record the campaign parameters in the link (such as UTM parameters and the Meta click ID "fbclid"), the referring website and the landing page, together with your questionnaire record.
• Questionnaire statistics: which questionnaire steps were viewed and completed, linked to a random identifier rather than your name.
• Push token: a device identifier for notifications, if you allow notifications in the app.
• Cookies and local storage: see our Cookie Policy.

3. Why we use your data and our legal bases

Under the GDPR and the UK GDPR we need a legal basis for each use of your data:

• Providing the Service — your account, plan preview, personalised plan and its adjustments, AI coach, food logging, photos, reports, streaks, reminders and support. Basis: performing our contract with you, or steps you ask for before entering into it (Art. 6(1)(b) GDPR). For health data: your explicit consent (Art. 9(2)(a) GDPR, see section 4).
• Payments, subscriptions, AI packs and referral rewards. Basis: contract (Art. 6(1)(b)).
• Accounting and tax records. Basis: legal obligation (Art. 6(1)(c)).
• Service emails and messages — payment confirmations, account, security and important changes. Basis: contract (Art. 6(1)(b)) and legal obligations.
• Reminders if you leave the questionnaire or checkout unfinished. Basis: our legitimate interest in helping you finish what you started (Art. 6(1)(f)). Every email has a one-click unsubscribe link, and we stop after 3 reminders.
• Educational emails for customers about getting the most out of GymNavi. Basis: legitimate interest (Art. 6(1)(f)). You can unsubscribe at any time.
• Marketing emails such as offers and news. Basis: your consent (Art. 6(1)(a)).
• Ad measurement on our website with the Meta Pixel and Conversions API. Basis: your consent, given by pressing Accept in the cookie banner (Art. 6(1)(a)).
• Security and preventing fraud and abuse, including referral abuse and the AI fair-use limit. Basis: legitimate interest (Art. 6(1)(f)).
• Understanding and improving the Service, for example questionnaire completion statistics, error logs and aggregated usage. Basis: legitimate interest (Art. 6(1)(f)).
• Handling complaints and establishing or defending legal claims. Basis: legitimate interest (Art. 6(1)(f)).
• Respecting your opt-outs by keeping unsubscribed email addresses on a suppression list. Basis: legitimate interest (Art. 6(1)(f)).

Giving us your email address is necessary to create an account. The questionnaire on our website needs your consent and your body and health answers to build your personalised plan. In the app you can decline consent, and you can withdraw it at any time later (see section 4). Without it, your plan uses general settings, so it is less personalised. Whether you tell us about injuries is up to you.

4. Health data and your explicit consent

Some information you give us is data concerning health, a special category of data under Art. 9 GDPR — in particular injuries and physical limitations. Information such as weight, body measurements, progress photos, sleep and mood check-ins can also reveal something about your health, so we protect it in the same way.

• We process health data only with your explicit consent. You give it on a separate screen before the first question about your body or health: in the questionnaire on our website by ticking an unticked box, and in the app by choosing to agree (no option is preselected). Nothing from those questions is stored or sent to our AI provider before that. If you haven't given it (for example, in the app), you can give it later in Settings or when you first enter such data.
• We use it only to provide and personalise the Service for you, for example to avoid exercises that load an injured joint. We never use it for advertising and never send it to Meta.
• You can change or clear your injuries and limitations at any time in Settings. If you clear them, your plan no longer takes them into account, so please train with extra care.
• You can withdraw your consent at any time with the "Health data processing" switch in Settings or by writing to contact@gymnavi.app. When you withdraw it, we permanently delete the health data we hold: your height, current and target weight, bodyweight log, injuries and limitations, sleep information and progress photos, including the body and health answers from your questionnaire. Your account, workouts and subscription stay, and your plan continues with general settings, so it is less personalised. Withdrawal does not affect processing that took place before it.

5. AI features and automated processing

• To provide AI features, we send the data needed for the specific feature to Google's Gemini API — for example your profile and training history for coaching, your chat messages, meal and label photos, and progress photos when you request a comparison. Your questionnaire answers may also be sent to create your plan preview.
• Google processes this data on our behalf under its terms for paid API services, which do not allow it to use the data to train its models.
• Your plan is created and adjusted automatically based on your answers, history and ratings. This is profiling for personalisation only: it does not produce legal effects or similarly significant effects for you. You can always change your plan, swap exercises or contact us.
• We don't use your photos or messages to train AI models.

6. Emails and notifications

• Service emails (payment confirmations, account and security messages) are part of the Service.
• Unfinished questionnaire or checkout reminders: at most 3 emails, each with a one-click unsubscribe link.
• Educational emails for customers: you can unsubscribe at any time.
• Marketing emails: only with your consent, which you can withdraw at any time through the link in each email or by writing to us.
• Push notifications (workout reminders, mood check-ins, coach messages): only if you allow notifications on your device. You can turn them off in the app's Settings or in your device settings.

7. Who we share data with

We share only what each provider needs. Our processors act on our instructions under data processing agreements.

• Supabase Inc. (USA) — database, sign-in and private file storage, including progress photos. Our project is hosted in an EU region; any access from outside the EEA is covered by Standard Contractual Clauses.
• Google (Google LLC and Google Ireland Limited) — Gemini API for AI features. Data may be processed in the USA under Standard Contractual Clauses or the EU–US Data Privacy Framework.
• Stripe (Stripe Payments Europe, Limited, Ireland) — web payments, subscription management and fraud prevention. For some purposes, such as fraud prevention and legal compliance, Stripe acts as an independent controller (see the Stripe Privacy Policy). Transfers to the USA are covered by Standard Contractual Clauses or the Data Privacy Framework.
• RevenueCat, Inc. (USA) — management of in-app subscriptions, under Standard Contractual Clauses.
• Apple and Google (app stores) — when you buy in the app, Apple or Google processes your payment as an independent controller under its own privacy policy. They also deliver push notifications to your device.
• Expo (650 Industries, Inc.) (USA) — sending push notifications to the app, under Standard Contractual Clauses.
• Meta Platforms Ireland Ltd. — ad measurement through the Meta Pixel and the server-side Conversions API, only if you pressed Accept in the cookie banner on our website. We send Lead events (when you complete the questionnaire and give your email) and Purchase events (with the purchase value), together with technical data, the ad click ID and a hashed (irreversibly encoded) version of your email address for matching. For collecting and sending this data, we and Meta are joint controllers (Art. 26 GDPR) under Meta's controller addendum; Meta is responsible for its own further use of the data, described in the Meta Privacy Policy. Meta may transfer data to the USA under the Data Privacy Framework or Standard Contractual Clauses.
• OVH (France) — hosting of our servers in the EU.
• LH.pl (Poland) — email sending and mailboxes.
• MuscleWiki — exercise videos are streamed from its service. We don't send it any information about you.
• Open Food Facts — when you scan a barcode, we send only the barcode number.

We may also disclose data to authorities when the law requires it, to our professional advisers (such as accountants and lawyers) who are bound by confidentiality, and to a buyer or successor if our business is transferred, in which case we will inform you.

8. International transfers

Most of your data is stored in the European Economic Area (EEA). When a provider outside the EEA or the UK processes it, we rely on an adequacy decision of the European Commission (including the EU–US Data Privacy Framework for certified companies) or on Standard Contractual Clauses approved by the European Commission, with the UK Addendum for UK data. You can ask us for a copy of these safeguards at contact@gymnavi.app.

9. How long we keep data

• Account data: as long as you have an account. When you delete your account in Settings, we delete your profile, training, nutrition, check-in and chat data and progress photos, and anonymise your questionnaire record.
• Health data: until you withdraw your consent (see section 4) or delete your account, whichever comes first.
• Questionnaire data of people who didn't buy: 12 months from your last activity, then deleted.
• Payment and invoicing records: as long as tax and accounting law requires — in Poland, 5 years from the end of the year in which the tax became due.
• Consent records and the unsubscribe list: as long as needed to prove consent and respect your opt-out.
• Complaints and legal claims: until they are resolved or time-barred.
• Backups: deleted data may remain in encrypted backups for a short time until they are overwritten.
• Anonymous statistics that cannot identify you may be kept longer.

10. Security

We protect your data with encryption in transit (HTTPS), access controls, database rules that separate each user's data, private storage for photos and limited internal access. Our providers are bound by confidentiality and security obligations. No system is completely secure; if you notice anything suspicious, please tell us. If a data breach puts your rights at risk, we will inform you and the authorities as the law requires.

11. Your rights

You have the right to:

• access your data and receive a copy;
• correct inaccurate data;
• delete your data — you can delete your account yourself in Settings;
• restrict processing;
• receive your data in a portable format;
• object to processing based on our legitimate interests, and at any time to direct marketing;
• withdraw any consent at any time, without affecting earlier processing.

To use your rights, write to contact@gymnavi.app. We reply within one month; for complex requests this may be extended by up to two more months, and we will tell you if so. We may ask you to confirm your identity.

You can also complain to a data protection authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw — uodo.gov.pl. You may also contact the authority in the EU country where you live or work.

12. Children

GymNavi is not intended for anyone under 16, and we don't knowingly collect data from them. If you believe a child under 16 has given us data, contact us and we will delete it.

13. Additional information for UK users

We process the data of UK users in line with the UK GDPR and the Data Protection Act 2018. Transfers from the UK rely on UK adequacy regulations or the UK Addendum to the Standard Contractual Clauses. You can complain to the Information Commissioner's Office — ico.org.uk.

14. Additional information for US users

• No sale of personal information. We don't sell personal information for money. We use the Meta Pixel for ad measurement only if you opt in through our cookie banner. Under some state laws (such as California's), this may count as "sharing" for advertising; you can turn it off at any time via Cookie settings at the bottom of our website.
• Sensitive data. We use health-related data only to provide the Service you request, not to infer characteristics about you.
• Consumer health data. Under laws such as Washington's My Health My Data Act, consumer health data includes information like injuries, weight, body measurements, photos, sleep, mood and nutrition logs. We collect it only with your consent and only to provide the Service, we never sell it, and we share it only with the processors in section 7 that need it to provide the Service.
• Your rights. Depending on your state, you may have the right to know, access, correct and delete your data, to opt out of sale, sharing or targeted advertising, and to limit the use of sensitive data. You won't be treated differently for using these rights. Send requests to contact@gymnavi.app; you may use an authorised agent. If we decline a request, you can appeal by replying to our answer, and if you are still not satisfied, contact your state attorney general.

15. Changes to this policy

We may update this policy when our Service or the law changes. We will publish the new version with a new effective date and, for important changes, inform you by email or in the app.

Contact: , — contact@gymnavi.app