Privacy Policy

We read event start/end times, titles and locations on your device to find workout windows, spot classes you’ve booked, and fire habit-stacking nudges (like "your meeting just ended"). When you connect a calendar, GymTime also reads your last eight weeks of events on your phone to show how your days have gone — which days were back-to-back, which gaps held — and to put the windows that usually stay free first. It keeps only counts (no titles, people or places), on your device, and re-reads them about once a week. We never store calendar event content on our servers. The only calendar info synced to your account is which calendars you've selected (their names + IDs), so your selection carries across your devices. Three exceptions leave the device: when an event changes (moves or cancels) and triggers a nudge, that event's title may be included in the prompt our AI uses to draft the nudge copy; and when you confirm a class, that event's address is sent to our maps proxy to look up the real drive time to the studio. And when an in-person meeting that day has a street address, that address is sent to our maps proxy to look up the trip from there to your gym, so a window right after a meeting across town is priced from where you’ll be. Room names and call links are never sent. If you connect Google Calendar directly (Settings → Google Calendar), we store only the connection itself (before you have an account, it’s kept against a random key on your phone — we store only a fingerprint of that key — and moved to your account when you create one; one unused for 30 days is deleted) — your phone fetches the events straight from Google and they stay on the device, the same as calendars read through iOS. That access is read-only and you can revoke it from the app at any time. GymTime’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

If you type a home, work or other address (Settings → My Places, or the onboarding location step), that address and the coordinates Google returned for it are stored in your account so travel math works on any device. They are used only to compute your drive and never for analytics, aggregates, buddies or licensing. Change or clear them in My Places; they are deleted with your account. If you pick a toll pass there, we keep it with your travel settings and, when you choose a gym while set to drive, ask Google Maps once — there and back — what the tolls on that route are at your pass rate, so the drive’s real cost shows beside its minutes. The estimate is kept with that gym and re-priced about weekly, or when you change the pass, while the gym stays saved; it is never used for analytics.

Used to calculate travel time, detect gym arrival, and trigger proximity nudges when you're near your gym with free time. Your coordinates are sent to Google Maps to compute travel time and live ETA. After you commit to a workout and tap "On my way," location continues updating in the background until you arrive, so your lock-screen countdown stays accurate. While a workout is locked in we also watch a circle around your gym, so the app knows when you arrive and when you leave — that is what keeps a session you actually did from being recorded as a miss, and it is removed as soon as the session is over. We don't store your live GPS trail; your selected gym's coordinates are briefly stored on our servers (deleted within 24 hours) to power your leave-for-gym reminder. We never track you outside of a locked-in workout. We also record an approximate region — your state and country only, derived on your device from your selected gym (your coordinates never leave your phone), with product analytics, so we can see which areas our users are in and prioritize regional features. This is covered by the analytics toggle in Settings. If you commute by transit and set it up (Settings → My Places → Your commute), we keep on your device how you get to the train, the station you board at, and the stops you ride between; your home, station and work coordinates go to Google Maps about once a week to look up your route’s real departures. When you’ve saved a work address, the app also notes on your device — when you open it on a weekday between 8 and 6 — whether your phone is at that address: one yes or no per date, about eight weeks’ worth, so it can learn which days you’re usually at the office. That never leaves your phone and is cleared when you sign out.

Your goal, fitness level, gym type, preferred workout time, and injury notes. Stored locally and synced to your account when signed in.

Your injuries and any free-text physical or medical notes are included in the workout prompt sent to our AI provider so it can avoid movements that could hurt you (training opt-out enabled). Injuries are saved to your account as part of your profile; free-text medical notes are kept on your device. Neither is ever shown to buddies or included in analytics.

Completed workouts, durations, ratings, skip reasons, per-exercise sets with weights and reps. Used for streak tracking, time-of-day insights, skip-pattern detection, and progressive overload suggestions. Your per-set log (exercises, weights, reps) syncs to your account so it's available across devices, scoped to your user ID.

Your fitness goal, planning style, work rhythm (including a custom rhythm you can name), daily waking window, evening schedule shape, accountability level, workout preference (guided / plan / self-directed), and "vibe" answer drive every AI recommendation. Stored as a JSON blob on your account, scoped to your user ID. Visible to you in Settings → What we remember.

Free-text messages you send to GymTime via the onboarding "Anything else?" prompt or the Settings → Tell GymTime screen. The last 20 are kept; older ones are pruned automatically. Used to refine personalization and surfaced in Settings → What we remember so you can review or remove them. We may also analyze these messages in aggregate — AI-summarized into de-identified themes (e.g. common scheduling pains or feature requests) for product insight; this never exposes your individual messages or links a message to you.

Whether you have kids and their school hours, who does drop-off and pickup, whether you have a partner and when they work, when you stop for lunch, the hours that are family time, and the hour after which a workout keeps you up. The engine treats these like meetings so it never proposes the hour that costs your family. Stored with your profile; never shown to a buddy, referee or cohort, never sent to the AI provider, never in any statistic we share.

We may share or license statistics built from the app's engagement events — how many people trained by region, weekday and hour, which reasons people give for skipping, kept-versus-skipped rates, and weekly claimed-versus-done totals — and, from October 5, 2026, from the setup answers you give: your goal, fitness level, schedule type, how many training days you picked and the time of day, the kind of gym and how far you'd drive, how you get there, what makes a workout count for you, your shortest worthwhile session, and which accountability stakes you keep on. From the same date, the statistics may also use the context of each booking: the gym as a business, one-way drive time and travel mode, how much slack the window had, the kind of day, the hour and weekday of the slot, the planned length, whether it was a backup gym, and your energy answer — so we can report, for example, kept rates by drive time. Never your location, address or calendar. About the gym as a business, we may also report which gym visits happened at and how long they lasted, how busy people said it was, why people joined or passed on a gym, switches between gyms, and sessions owed per gym — always counts of at least 20 people, never a member. We may also report, per gym, the hours members plan to arrive against when they actually arrived, which equipment gets used at which hour, how often sessions are completed and rated well, how often sessions are kept with company, how many members have gone quiet, and how the weather at lock-in time relates to kept sessions. Counts of people only, by answer. Region is state and country only. Every figure covers at least 20 people; smaller groups are dropped, not rounded. These statistics never include anything from Apple Health, the body statistics, calorie or protein targets, weigh-ins or health flags you enter, your buddies, referee or cohort, free text, device identifiers or coordinates — those never enter the pipeline. We do not re-identify anyone, recipients are contractually barred from trying, and every export is logged. Turning analytics off in Settings → Data & Privacy removes you from all future statistics — the setting is stored on your account and every export checks it. This is not a sale of your personal information and it is not tracking.

If you join, your gym, the days and time of day on your word, and your join date go into a cohort of up to four people matched on exactly that — never on a photo, age or gender. Members see a label for you ('Member A' until you've each kept three sessions, then your first name), how many sessions you've kept, and whether you kept the slot this week; misses are never named. When you check in inside the slot the others get one templated line; the only reply is 'On my way'. There is no free text. Nothing about where you are in the building, your home, your live location or your other visits is shared, and we never verify identity — meet only at the gym, at the slot, and use block and report.

Matching with people you don't know and the referee are for adults. Once, before that door opens: on iOS 26 and later Apple tells us whether your account is 18 or over (a range you consent to share; set by the parent on a managed account), otherwise you enter a birth date. We keep only the yes-or-no, the method and the time — never your birth date or the range — and the server won't make you discoverable without it. Never shown to anyone.

When you accept the Terms or the health and nutrition acknowledgment, we store the version and the time on your account so we don't re-ask on a reinstall or a second device, and so there is a record that you did. Guests keep it on-device only.

If you turn them on, photos you take of yourself are stored in GymTime's own folder on your phone with the date and that day's weight on record. They are never uploaded, never synced, never exported, never shown to a buddy or referee, and never used by us for anything — including marketing. We count how many you've taken, never the image. Delete any or all at any time; they go with 'Clear my numbers', with Forget, on sign-out, on account deletion, and with the app. There is no cloud copy for us to delete — deleting your account on the phone is the deletion.

If you set a weight goal you can enter sex, age, height and current weight; the app computes a maintenance and daily calorie target and a protein estimate from them with standard formulas (Mifflin-St Jeor, 3,500 kcal per lb, about 0.8–0.9 g protein per lb) and shows them back to you as what the date needs and what a gym session covers. Before any number we ask how familiar you are with calories and protein, whether you'd rather see portions or no counts, and whether you want to flag pregnancy, diabetes or a history with food — those flags (and being under 18 or already light for your height) make the app refuse to set a deficit. If Apple Health is connected (Pro), GymTime reads the calories another app logged (read only) and your weight when a scale writes it, shows both against your target, and writes the weigh-ins you type back to Health. Health data: optional, stored with your profile, never shown to a buddy or referee (they see session counts only — never weight, calories or flags), never sent to the AI provider, and cleared with one tap in Settings → Your Goal → Clear my numbers. Never a diet.

If you ask a buddy to be your referee and they accept, they receive one line each Monday — sessions you said vs did, your kept-bookings rate, sessions owed — and you receive theirs. Numbers only; the reasons you give are never shared. Either side can stop it.

The commitment sentence you held to record at setup (days a week, gym, time of day, date), your own “last month, be honest” answer as a range, your accountability level, and which accountability stakes you’ve switched on. Quoted back to you on Today; never shown to anyone else.

Running counts of your own bookings — kept, cancelled, no record (a locked-in workout whose day ended with nothing logged; recorded as an inference you can correct with one tap), excused, and owed sessions settled or lost — plus your most recent miss with the reason you gave. These power lines like “Kept 9 of your last 10 bookings.” Counts only; never compared to other users; synced with your profile.

Lifecycle of each workout window: when it was offered, accepted, started, completed, skipped, or extended past planned time. Powers learnings like "you tend to skip Wednesdays." Synced events are pruned at 90 days; unsynced events stay on device until they upload.

When you generate a workout or receive a memory-aware notification, your profile context (goals, recent vibe, skip pattern, accountability tone), your injuries and free-text medical/physical notes, and — for gym equipment detection — your gym's name and address are sent to our AI provider as part of the prompt. We don't store prompts ourselves; the provider's policy governs their retention. Provider training opt-out is enabled.

A monthly counter of how many AI generations you've used, for fair-use rate limiting on free and pro tiers. Counter resets monthly; 12 months of history kept.

If Health is connected, a workout your Watch or another app recorded that overlaps a slot you locked in confirms that session as kept — you're not asked the next morning, and your cohort sees 'made it'. Last night's sleep from Health is shown as one line on the tank card and in the morning push, and counts in the readiness score. Read only, cached on your device for the day; the sleep figure itself is never sent to the AI provider or anyone else — only the readiness score it feeds, as described below.

Heart rate, HRV, resting heart rate, step counts, and active energy, read with your explicit permission. Your raw Apple Health readings stay on your device — we never store them. The last 14 days of HRV and resting heart rate are read so last night can be compared with your own two-week median ("HRV 31 ms against your usual 44"); that comparison, plus last night's sleep, is reduced on-device to a single "readiness" score, and when that score shows you're under-recovered, the score alone (e.g. "62/100") is included in the workout prompt sent to our AI provider so it can suggest a lighter session. The readings, the baseline and the sleep figure are never transmitted. Workouts you log are written back to Apple Health.

When proximity alerts are enabled, your current gym (name + coordinates) is stored briefly — from when you head out ("on my way") through your session — so buddies can see you're there. Auto-expires after 2 hours.

Display name, username, workout completions, streak milestones, and quick messages shared only with buddies you've explicitly accepted. Sharing tier controls what's visible.

Your planned workout windows — date, departure and workout times, gym, drive time, weather forecast, and the generated workout itself — are saved to your account so they're ready across devices. Scoped to your user ID.

When you flag a constraint (e.g. "need gym clothes," "kids," "dinner," "tired") with an optional time window and free-text note, it's saved to your account so recommendations respect it. Scoped to your user ID.

If you block or report another user, the reason and any free-text context you provide are stored so we can act on abuse. Scoped to your account and retained for safety.

An Expo push token is stored with your profile so we can notify you about buddy activity. Never used for marketing or third parties.

All social features (buddies, matchmaking, schedule sync, proximity) are off until you explicitly turn them on. You can disable any or all at any time in Settings → Data & Privacy.

You control exactly what each buddy sees via your sharing tier: Full (workouts, streaks, schedule), Workouts Only, Streaks Only, or Private. Schedule sync only works if set to Full.

Matchmaking requires a separate opt-in toggle. When enabled, users at your same gym with similar goals can see your display name, gym, and stats — nothing else until you accept a buddy request from them.

Buddy messages (pings) are limited to 6 pre-written options — no free-text chat. This protects against harassment, spam, and abuse.

There is no public feed, leaderboard, or global discoverability. Your profile is only visible to accepted buddies and (if opted in) same-gym matching candidates.

Invite links contain a short referral code — no personal data. The recipient must still accept before any information is shared.

Gym check-ins expire automatically after 2 hours. Only accepted buddies can see your check-in status. Turn it off in Settings → Data & Privacy to stop sharing entirely.

Habit stacking, location proximity, and vibe check nudges run on your device and fire local notifications. They never send data to our servers.

Every notification type has a toggle in Settings → Notifications: leave reminders, morning briefing, buddy requests, buddy messages, workout alerts, streak milestones, quiet hours.

Configure a window (e.g. 10pm–7am) to suppress all non-critical notifications. Departure alarms at T-0 still fire for workouts you've committed to.

We do not sell, rent, trade, or share your personal data with advertisers, data brokers, or third parties for marketing purposes. Ever.

Your raw Apple Health readings, injury notes, and medical notes never leave your device and are never synced to our servers. The only health-derived value ever transmitted is a single readiness score sent to our AI provider to adjust workout intensity (detailed under "Apple Health data" above) — never the underlying readings.

We see start/end times, titles, and locations — the location is how we spot a class you booked, compute the real drive to the studio, and price a trip from a meeting at another address. To leave out meetings you declined, your phone checks an invite for your own reply and ignores everyone else’s; nothing about the guest list is kept. We never read descriptions, attachments, or meeting notes.

Location is accessed when the app is active, and in the background only while a workout is locked in: during the trip to the gym, to keep your lock-screen ETA accurate, and as a circle around your gym, so we know when you arrive and when you leave. Both end when the session does. We never follow you anywhere else and never build a history of where you have been — the one exception is a yes or no per weekday for whether your phone was at your saved work address when you opened the app, kept on your phone to learn which days you’re at the office.

Your workout activity is never visible to anyone except buddies you've accepted. Matching candidates see your display name + stats only, never your schedule or workouts.

We do not access microphones, cameras, photos, or any other media.

We never access your contact list, phone numbers, or emails of anyone other than you.

Used for gym search, travel time, and live arrival ETA. Receives your search text and your coordinates (current location + gym) to compute routes — including background location updates during a committed trip. Subject to Google's privacy policy.

Used to generate workouts, draft memory-aware notifications, and detect gym equipment. Receives your fitness goals, gym type, available time, personalization profile context (vibe, skip pattern, accountability tone), the free-text messages you've sent to "Tell GymTime," and — when you're under-recovered — a readiness score derived from Apple Health (a single number only, never the underlying readings). Never receives your raw email, name, phone, exact GPS coordinates, or raw Apple Health readings. Provider training opt-out is enabled at the API level.

Hosts your account, buddy data, and sync state. Data is encrypted at rest. Row-level security ensures each user can only access their own data and their buddies'.

Used to factor weather into workout recommendations. Only receives approximate coordinates, no personal identifiers.

Delivers buddy activity notifications and silent travel-refresh pushes. Receives the push token, notification content, and — for travel-refresh pushes — your destination gym's coordinates (to recompute your ETA). Never your name, email, or other personal identifiers.

Receives crash reports and error events so we can fix bugs quickly. Includes your account user ID (a random UUID, not your name or email), app version, OS version, device model, and error stack trace. Never receives your email, name, location, calendar content, health data, or any other personal information.

Manages your subscription and in-app purchases. Receives your account user ID and your subscription/purchase status (which plan, renewal state) so Pro unlocks across your devices. Apple processes the actual payment — RevenueCat never receives your card details, name, or email. Subject to RevenueCat's privacy policy.

Settings → Data & Privacy lets you toggle every data-sharing feature individually, or disable social features entirely with one tap.

Use Settings → Delete Account to permanently remove all data from our servers. Local data on your device is also cleared. This cannot be undone.

Contact [email protected] with your account email to request a full export of your data in JSON format. We respond within 30 days.

EU/UK residents have the right to request deletion under GDPR. California residents have equivalent rights under CCPA. Email [email protected] to exercise these rights.

Anonymous usage analytics can be disabled in Settings → Data & Privacy.

GymTime is for people 13 and older; the social features are 18+. We do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has created an account, email [email protected] and we will delete it.

We may revise this Privacy Policy from time to time as the app evolves or the law requires. When we make material changes, we'll update the "Last updated" date at the top of this page and notify you in-app or by email. Your continued use of GymTime after an update means you accept the revised Policy. We encourage you to review this page periodically.