Privacy policy

1. About this policy

This policy explains what information about you GymDay processes, why, who receives it, how long it is kept and how you can control it. It applies to the gymday.fit website, the GymDay iPhone app and connecting an AI assistant to your account.

This policy is part of the Terms of use. The terms "account", "your data", "health data" and "AI assistant" mean the same here as in the Terms.

The Russian version of this policy is the main one. Versions in other languages are translations; if they differ, the Russian version applies.

2. Who processes your data

Your data is processed by the GymDay service — "the operator", "we" or "us" in the Terms and in this policy. We decide why and how the data is processed and are responsible for it.

• Contact email, including for personal data requests: [email protected]

There are no other contact channels. If the operator changes, we will publish a new version of this policy and ask you to accept it (section 18).

3. What data we process

We collect only what the diary needs to work, and we do not ask for more. Only your email address and password are required; everything else you provide or record if you choose to.

Account.

• Email address — to sign in, send you emails and contact you.
• Password — we store it only as an irreversible hash: neither we nor anyone else can read your password.
• Previous email addresses, if you changed your email, and the new address of an unfinished change — so that you can undo a change you did not make; we notify previous addresses of email changes and of account deletion.
• Language, time zone, units (kg or lb, cm or in), theme, whether coach hints are on.
• When and which version of the Terms and this policy you accepted, and when you gave or withdrew consent to health data.

Diary — what you record yourself:

• workouts and sets: date, title, exercises, weight, reps, time, distance;
• workout plans;
• your own exercises;
• settings and notes for any exercise — both your own and catalog exercises;
• photos for exercises. We save photos without the technical information stored in the file — for example, without the place and time the photo was taken.

About you — optional: sex and year of birth. Right now they are shown only to you and carried between your devices; they do not affect any calculations. If this changes, we will describe it in a new version of this policy first.

Import files — a spreadsheet or export you upload to transfer your records. The file is needed only for the import.

You write notes and titles yourself, and we process them like any other diary records. Do not put health information or other data you do not want to keep in GymDay into them.

4. Health data

Body weight, height, circumferences and other body measurements, as well as measurement types you created yourself, are health data. This is a special category of data, so:

• we store it only with your separate consent. GymDay asks for it the first time you record a measurement or your height. Without consent, measurements are not saved; the rest of the diary works as usual;
• we use it only to show it to you and how it changes, and to share it with an AI assistant you connect, if you separately allowed that assistant to read it (section 7);
• you can withdraw consent at any time in your profile. Your height, all measurements and your measurement types are then deleted permanently — on the server and, when they sync, on your devices.

Sex and year of birth are not health data: withdrawing consent does not delete them; you can clear them in your profile.

5. Technical data

When you use the service, as with any website, we receive technical information about the requests:

• IP address. We need it to protect the service and accounts from abuse, password guessing and automated attacks. We use the country derived from the address once, at sign-up, to suggest familiar units; we do not store it in your account.
• Device type — phone, tablet or computer — on which you started a workout, so that your other devices can show where it is in progress. We do not identify the device model.
• Service logs. The server records events such as sign-ins, password and email changes, and errors. Logs are needed to investigate break-ins and failures. Email addresses in logs are hidden; we do not write passwords, measurements or the content of your records to them.
• App integrity check. The iPhone app uses an Apple service that confirms a request comes from the genuine GymDay app. For this we store a technical key of the app installation. The key itself contains no information about you; we link it to your sign-in to the app so that we can warn you by email about a sign-in from a new device. Apple does not give us information about you for this, and we do not give Apple your data.
• Sign-in sessions — so that you stay signed in on the website and in the app and can log out on all other devices.

6. Cookies and browser storage

The website uses only necessary cookies: to keep you signed in, to protect forms from forgery, and to remember your language, the workout started on this device, and which coach hints you have already applied or postponed in the current workout. Our attack protection provider may set its own technical cookies for the same purpose.

The website keeps in your browser the sets that have not yet reached the server and some interface settings — so that nothing is lost without a connection.

GymDay has no analytics, advertising or tracking cookies or counters. That is why we do not show a cookie choice window: the website cannot work without the necessary cookies, and we have no others.

7. AI assistant

You connect an AI assistant — a program made by another company — to your account yourself, on our screen, and choose what to allow it:

• diary records — workouts, sets, plans, your own exercises, "Progress" and coach hints, plus your language, time zone and units. This permission is given with every connection;
• health data — only if you allowed it separately;
• changes to the diary — only if you allowed it separately.

The assistant does not receive your email address, password, sex, year of birth, exercise notes or photos.

We pass data to the assistant program with your permission and only within the permissions you granted. From then on the assistant and its developer process it under their own rules and their own privacy policy — we have no control over that. Connect only assistants you trust.

We keep information about the connection — the name of the assistant program, the permissions granted, when it was connected and last used — as long as the account exists, and service records of the assistant's actions, so that you can review them and, where possible, undo them. You can disconnect an assistant at any time in your profile, under "Connected assistants"; after that it no longer receives your data.

8. Why we process data and on what basis

We do not send marketing emails. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you: coach hints are suggestions, and the decision is yours.

9. Who we share data with

To run the service, we use contractors. They process data on our behalf and only to provide their service to us:

Besides contractors, data is received by the AI assistant you connected yourself — within the permissions granted (section 7). It is not our contractor: its developer processes the data independently, under its own rules.

We may disclose data to a public authority only if the law requires it, and only to the extent the law requires.

We do not sell your data, do not share it with advertising networks or data brokers, do not use it for advertising and do not train artificial intelligence models on it.

10. Where data is stored

GymDay is available from any country, so your data may be stored and processed outside your country. This is a cross-border transfer of data.

Data protection laws in other countries may differ from the laws of your country. We transfer data only to the recipients in section 9 and only to the extent needed to run the service. By creating an account and accepting this policy, you agree to this transfer.

11. How long we keep data

• Account and diary — as long as the account exists. We do not delete an account or records because you have not signed in for a long time.
• Deleted records. A record you deleted in the diary is no longer shown, but is kept hidden until the account is deleted: this is how the deletion reaches all your devices when they sync.
• Health data — as long as your consent is in force. After withdrawal it is deleted (section 4).
• Import files — as long as they are needed for the import; deleted after it is finished or cancelled.
• Previous email addresses — as long as the account exists: we use them to notify you of email changes and account deletion.
• Information about assistant connections — as long as the account exists (section 7).
• Service logs and security records — as long as needed to protect the service and investigate failures, then deleted.
• After you delete your account, the account and diary are deleted at once, with no grace period, and cannot be restored. Photos and other files are deleted from storage after the account. After deletion, only the following remains:
  • your email address — until we send the email confirming the account was deleted;
  • service logs with the email address hidden — until they are routinely deleted;
  • technical marks with no information about you — so that the app on your phone learns the account was deleted instead of asking you to sign in again;
  • backups, if they contain your data — until they are routinely replaced, within a reasonable time.

  We keep information longer only if the law requires it — and only that information.

Deleting the account does not erase data saved in the app on your phone: delete it in the app or delete the app itself (Terms, section 7).

12. Your rights

Wherever you live, you can:

• Know what data about you we process and how: the rules are in this policy, the data itself is in your profile and the export; we answer questions about processing on request (section 13).
• Get and take your data with you. Export is in your profile on the website, at any time and free of charge (Terms, section 9): workouts, plans, your own exercises, notes, measurements and profile data as tables that open in any spreadsheet program and can be moved to other services. Exercise photos are not included in the export: you can open them on the exercise card and save them one by one.
• Correct your data — in the diary and the profile.
• Delete your data — specific records in the diary, health data by withdrawing consent, everything by deleting your account in your profile on the website or in the app.
• Withdraw consent. Consent to health data — in your profile. Consent to the processing of personal data as a whole — by deleting your account: the service cannot work without this data. Withdrawal does not make processing before it unlawful.
• Object to processing or ask us to restrict it — by email under the rules of section 13.
• Disconnect an AI assistant — in your profile (section 7).
• Complain to the data protection authority of the country where you live. We would appreciate it if you wrote to us first: many questions are resolved faster that way.

Exercising your rights is free. We do not make the service worse because you used them.

13. How to make a data request

Almost everything can be done yourself in your profile — this is faster and more reliable than any email. If you need something else:

• write to [email protected] from your account email;
• we reply only with a new email to the account email, not to the reply address of your message;
• by email we do not say whether an account exists, do not disclose its data and do not take any action on it: everything about a specific account is done in the profile. If the action you need is not in the profile, we will reply with how to do it. This protects your data from people pretending to be you (Terms, sections 5 and 6).

We reply within the time limits set by law. We may refuse clearly unfounded or excessive requests, including repetitive ones — to the extent the law allows — and will explain why.

14. Children

You can use GymDay from the age of 13. If you are under 18, you need the consent of a parent or other legal guardian — to the Terms and to the processing of your data, including health data (Terms, section 4).

We do not verify age and do not knowingly collect data of children under 13. If we are told that a child under 13 is using an account, we will write to the account email and ask the account owner to delete it in the profile. We do not delete an account ourselves on the basis of an email (Terms, section 5).

15. How we protect data

• The website, the app and the assistant connect to the service only over a secure connection.
• Passwords are stored as an irreversible hash. Photos and import files are kept in private storage with no public access.
• Access to data is restricted and used only to run the service. Contractors receive only what their service needs.
• The service limits request rates and notifies you by email of a sign-in to the app on a new device.

No system is completely secure. If a breach occurs that puts your rights at risk, we will inform you and the data protection authorities as the law requires. If you have found a vulnerability, see the Terms, section 21.

16. The app without an account

You can use the iPhone app without an account. Your records are then stored only on the phone: we do not receive or see them and cannot restore or export them. If the app contacts the server, for example for the exercise catalog, we receive only technical request data (section 5).

If you later sign in, the records from the phone are moved to your account, and from then on this whole policy applies to them. Measurements and height are moved only if you have given consent to health data (section 4).

Phone backups are made and kept by the device maker under its own rules.

17. What we do not do

• We do not sell or rent out your data.
• We do not show ads or share data with advertising networks.
• We do not use analytics or tracking counters.
• We do not train artificial intelligence models on your data.
• We do not compare you with other people or build rankings.
• We do not pretend to be someone else in emails. GymDay emails come only from addresses on the gymday.fit domain — service emails from [email protected], support replies from [email protected]. We never ask for your password and never send sign-in links you did not request.

18. Changes to this policy

• This policy and the Terms are released as one version: they share a number and a date. We publish a new version on this page; earlier versions remain in the archive here.
• When the policy is updated, the website shows the new version and asks you to accept it; in the app such a screen will appear in the version that includes it. Until you accept the new version, you can export your data or delete your account.
• We start any new processing of health data only with your new consent.
• If you use the app without an account, a new version applies from the date it is published.