Privacy Policy
GymLog AI is a training and nutrition log. That makes it one of the more intimate datasets on your phone, so this page says plainly what leaves the device, what doesn't, and how to get rid of any of it.
On this page
1 · Who we are
GymLog AI ("the app", "we") is published by Uniyapps. We are the data controller for the information described here. You can reach us any time at privacy@gymlogai.app.
This policy covers the mobile and desktop app and this website. It does not cover anything you reach by leaving them.
2 · What we collect
Almost everything below is something you typed, scanned or photographed yourself. We collect it to run the app for you — to keep your log, sync it between your devices, restore it if you lose your phone, and let the coach reason about it.
| Data | Examples | Required? | Why |
|---|---|---|---|
| Account | Name, email address, account ID. Sign-in with email, Google or Apple. | Required | To create your account, sign you in and attach your log to it. |
| Profile | Goal, experience level, training days, gender, date of birth, injuries. | Optional | To size your plan and calculate calorie and macro targets. |
| Training | Workouts, sets, weights, reps, RPE, rest, plans, personal records. | Optional | The log itself, and the input to every recommendation. |
| Nutrition | Food entries, custom foods, meal templates, grocery items, water. | Optional | Macro tracking and diet planning. |
| Body | Weight, body fat, girth measurements, progress photos. | Optional | Progress tracking and trend forecasting. |
| Health signals | Steps, active calories, exercise, sleep, resting heart rate, HRV — read from Apple Health or Health Connect. | Optional | The recovery score and the overtraining guard. See section 5. |
| Device | Push notification token, app install identifier, app version, OS version. | Required | To deliver reminders you asked for and to tell you an update is available. |
| Diagnostics | Screen views and feature usage, crash stack traces, performance traces. | Optional — you can switch it off | To find out which parts of the app break or go unused. |
Diagnostics record which screens get used, never what you logged. Crash reports carry a hashed account ID, not your email. Both are toggles in Settings → Privacy, and turning one off stops collection entirely rather than merely hiding it.
3 · What we never collect
- Your location — neither precise nor approximate. The app asks for no location permission.
- Financial or payment information. There is no paid tier, so there is no payment system.
- Your contacts, calendar, SMS, call logs, files or browsing history.
- Audio or video recordings.
- Coach chat transcripts. What you say to the coach is stored on your device and is not synced to our servers — deliberately, because it is the most sensitive free text in the app.
4 · AI processing
GymLog AI answers at the most private tier that can do the job, and only escalates upward when it has to.
- Tier 1 — the rules engine. Deterministic sports-science logic running on your device. No model, no network.
- Tier 2 — Gemma, on your device. A small language model running locally. Nothing you ask leaves the phone; answers are produced there, from data stored there.
- Tier 3 — Gemini, in the cloud. Off by default. If you switch Cloud AI on in Settings → Privacy, questions the on-device model can't handle are sent to Google's Gemini through Firebase AI Logic, together with a compacted training context: your goal, experience, bodyweight, age, injuries and recent training, nutrition and recovery facts. Your name and email are not included. Turn Cloud AI off and everything stays on the device again.
The app tells you which tier answered — Settings → Privacy shows the current source in plain language before you ask anything.
The coach is not a doctor
It is a language model working from your logged data. It can be wrong, and it can be confidently wrong. Nothing it produces is medical advice, a diagnosis or a treatment plan. Talk to a doctor before changing how you train or eat.
5 · Health and wearable data
If you connect Apple Health or Health Connect, GymLog AI reads steps, active calories, exercise, sleep, resting heart rate and heart-rate variability. This access is read-only — the app writes nothing back to your health store — and it is entirely optional; you can skip it during setup and revoke it later in your system settings.
HRV, sleep and resting heart rate are used on the device for the recovery score and the overtraining guard, and are not uploaded. If you enable Cloud AI, a summarised recovery fact (for example "recovery is low this week") can form part of the context sent for a coaching answer — never the raw readings.
Health data is never used for advertising, and is never sold or shared with third parties for their own purposes.
6 · Progress photos
Progress photos are encrypted on your device with AES-GCM before they are backed up. The key is 256-bit, held in the platform keystore (Android Keystore / iOS Keychain) and never transmitted. What reaches our storage is ciphertext we cannot open — only your signed-in device can decrypt it.
Photo analysis, where you ask for it, runs against the image on your device.
7 · Where your data lives
Every workout, meal and measurement is written to your device first, into a local database, which is why the app works with no connection at all. It is then synced to your account so you can restore it on a new device.
The cloud side runs on Google Firebase — Authentication, Firestore, Cloud Storage and related services — under Google's infrastructure and security controls. Every transport is HTTPS/TLS; there are no plaintext endpoints. Data may be processed on servers outside your country, including in the United States, under Google's standard contractual clauses.
8 · Sharing and processors
We do not sell your data, and we do not share it with data brokers. Your workouts are visible to nobody but you. We use the following processors, who handle data on our instructions only:
- Google Firebase — authentication, database sync, file storage, push notifications, crash reporting, analytics, remote configuration and app attestation.
- Firebase AI Logic (Google Gemini) — tier-3 coaching answers, only when you have switched Cloud AI on.
- Google AdMob — advertising, as described below.
We may also disclose data where the law requires it, or where it is necessary to protect someone's safety.
9 · Advertising
The app is free with every feature included and no paid tier. That is paid for by two ads: a full-screen one after a finished workout, and an optional one you start yourself in the coach in exchange for extra AI answers. The second is never shown unless you ask for it.
Those ads are non-personalised. Google is not given your training, meal, body or health data, and never sees what you log. Where the law requires a consent choice for personalised advertising, you will be asked before any such ad is served.
10 · Your rights: export and deletion
Everything you log belongs to you. Depending on where you live you may have rights to access, correct, export, restrict or erase your data, and to object to some processing. You can exercise the main ones directly in the app, without asking us:
- Export — Settings → Export my data gives you the whole log as CSV or JSON. No ticket, no waiting period.
- Correct — every entry in the log is editable or deletable individually.
- Turn off collection — Settings → Privacy toggles analytics, crash reports and Cloud AI independently.
- Delete — Settings → Delete account, or the request form on our account & data deletion page, which also lists exactly what is removed and what is kept.
We answer requests within 30 days. You also have the right to complain to your local data protection authority.
11 · Retention
We keep your log for as long as your account exists, because that is the product — a training history is only useful if it is long. Once you ask for deletion, your account and synced data are removed as described on the deletion page. Aggregated, anonymised statistics that cannot identify you may be retained.
12 · Children
GymLog AI is not intended for anyone under 13, and we do not knowingly collect data from children. If you are under 18, talk to a parent or guardian before starting a training programme. If you believe a child has given us data, write to us and we will delete it.
13 · Changes to this policy
Features change, and this policy will change with them. The date at the top says when it last did. Material changes are announced in the app before they take effect.
14 · Contact
Privacy questions, data requests and complaints:
privacy@gymlogai.app.
Everything else: support@gymlogai.app.
Want it gone right now?
The account & data deletion page walks through the in-app route in four taps, and gives you a written request route if you no longer have the app installed.