Privacy Policy — My Gym Tracker

Effective date: November 4, 2026 (updated) · Previous version: August 3, 2026 · Den Digital LLC

This Privacy Policy explains what information My Gym Tracker (the "App") collects, how it is used, and your rights. By using the App you agree to this policy.

1. Information we collect

• Account information — the App no longer requires you to sign up. On first launch it creates an anonymous account for you (a "guest"): a random account ID with no email address, name or password attached. This ID exists so your workouts can be saved to our server and restored, and so you can delete them; it is not shared with advertisers and we cannot link it to you as a person. When you tap "Save your progress", the App links an identity to that same account — your Apple ID, your Google account, or an email address with a password (stored hashed) — and optionally a display name. We then hold that email address (or the one your Apple or Google account provides), which lets you sign in on another device and lets us verify requests from you. A guest account can only ever be used from the phone that created it; nothing is migrated when you save, the same account simply gains a login. We use Supabase as our authentication and database provider.
• Workout data — exercises, sets, reps, weights, durations, notes, templates, custom exercises, and personal records that you create in the App. This is synced to your account — guest or saved — so you can restore it and, once you save your progress, access it across devices.
• Habit check-ins — the habits you set up (name, icon, colour and how often), each day's check-ins, and the "grace" days the App grants to protect a streak. This is synced to your account the same way as workout data, so a check-in made on one phone is not lost or overwritten by another. It contains no health information beyond the fact that you checked a habit off on a given day.
• Body measurements — bodyweight and any other measurements you choose to record (waist, hips, chest, arm, thigh), together with the unit you entered them in. This data is stored only on your device. It is not uploaded to our servers and is not available across devices; use the App's JSON backup export if you want to move it to a new phone. The only exception is the optional AI weekly insight described below, which — only if you turn it on — includes your body-weight trend for the period as numbers (a start value, an end value and a per-week change), never the individual entries.
• Nutrition data — food entries you log (name, calories, protein, carbohydrates, fat, serving text, meal and date) and your daily calorie and protein targets. This data is stored only on your device. It is not uploaded to our servers, is not linked to your account, and is never used for advertising. Two narrow exceptions: the optional AI weekly insight described below, which — only if you turn it on — includes the number of days you logged food and your average calories and protein for the period as numbers, never the foods you ate; and the usage events described below, which record that a food entry was logged or a barcode scanned, never the food itself.
• AI weekly insight (optional, off by default) — the App can write a short weekly check-in from your own training. This feature is opt-in only: it does nothing until you turn it on in Settings, and you can turn it off there at any time. When it is on, once a week the App builds a de-identified summary of your last four weeks on your phone — numbers and exercise names only: workouts, sets, volume, minutes, streak, personal records, exercises that have stalled, sets per muscle group, and, if you log them, the food averages, body-weight trend and run totals described above. It contains no name, email address, account ID, device ID, location, notes or free text. That summary is sent to our server, which passes it to Anthropic (the maker of the Claude models) to write the text. Anthropic processes it in the United States, does not use it to train its models, and deletes it within 30 days. The generated text (a headline, a short body and one suggestion) is saved to your account so it is not regenerated every time you open it, and is deleted with your account. The App only shows a sentence if every number in it appears in your summary; the insight is training feedback, not medical advice.
• Camera (barcode scanning) — if you use the optional barcode scanner to look up a packaged food, the App uses your camera only while the scanner screen is open. Camera images are processed on your device to read the barcode; no photo or video is stored, saved, or transmitted. Only the decoded barcode number leaves your device, and only to the food databases named in Section 4. The rest of the App, including adding food by hand, works without granting camera access.
• Usage events — to see whether the App works for new people, the App records on our server that certain things happened, with the time, your account ID (guest or saved), the app version and platform: the first open, a day on which you opened the App, finishing onboarding, logging a first set, finishing a workout, logging a food entry (with the meal slot only — breakfast, lunch, dinner or snack), a barcode scan succeeding or failing, checking a habit, viewing your weekly recap, starting or finishing a class, linking an account, or importing data. These events never contain what you ate, what you lifted, your measurements, your location, notes or any free text. We use them only to count how many people reach each step; they are not shared with advertisers or anyone else, and they are deleted with your account.
• Optional cycle data — if you use Women's Mode, you may choose to log period start/end dates, cycle length, and notes. This data stays on your device by default. It is uploaded to a separate protected database table only after you explicitly enable Cycle Cloud Sync. It is never placed in ordinary workout-session payloads or advertising data, and it is never included in the AI weekly insight summary.
• Location (GPS) — if you use the optional GPS run tracker, the App reads your device's precise location only while the run-tracking screen is open (in the foreground). It is used to measure your run's distance, pace, and splits and to draw your route on a map. The recorded route is saved with your workout history and synced to your account, the same as your other workout data. The App does not track your location in the background or when the tracker is closed, and location is never used for advertising. The rest of the App works without granting location access.
• Advertising identifiers — the App displays ads via Google AdMob, which may collect the device Advertising ID and limited device information to serve and measure ads and prevent fraud. On iOS, ad personalization follows your App Tracking Transparency choice; if you decline, you receive only non-personalized ads. On Android, the App declares the Advertising ID for AdMob; where required by law or your device settings, ads are non-personalized. No ads are shown in Women's Mode.

2. Information we do NOT collect

• We do not require an email address, a name or any other personal detail to use the App. A guest account carries none of them.
• We do not collect your location in the background, or at any time while the GPS run tracker is closed. Location is read only during an active run-tracking session (see Section 1).
• We do not collect your contacts, photos, calendar, or other personal media.
• We do not record audio or use your microphone.
• We do not store or transmit camera images. The barcode scanner reads frames on your device and keeps none of them.
• We do not send any personal identifier to Anthropic. The AI weekly insight, when you have turned it on, receives numbers and exercise names only (see Section 1).
• We do not use third-party analytics or crash-reporting SDKs. If the App closes unexpectedly, a short technical record (error type, message and stack trace — no food, workout or account data) is kept on your device. Nothing is sent anywhere unless you tap to share it yourself, and you can clear these records in Settings.
• We do not sell or rent your data to anyone.

3. How we use your information

• To provide the core features of the App (logging workouts and habits, syncing across devices, viewing history).
• When you use the GPS run tracker, to calculate your run's distance, pace, and splits and to display your route on a map — only while the tracking screen is open.
• To keep your account — guest or saved — secure, and to let you sign in on another device once you have saved your progress.
• To look up the nutrition facts for a barcode you scan or a food you search for, and to show your daily calorie and protein totals against the targets you set.
• If you turn on the AI weekly insight, to write a short weekly check-in from the de-identified summary described in Section 1.
• To serve advertisements that support the free version of the App.
• When you choose to log cycle data, to provide estimated phase labels and optional training suggestions. These estimates are informational fitness guidance, not medical advice, diagnosis, contraception, or fertility prediction.

4. Service providers and hosting

The App's server — the database, authentication and the small functions that run the weekly insight and account deletion — is operated by Den Digital LLC, a Wyoming company, using the service providers below. Each receives only the data needed for its function:

• Supabase — authentication, database, and storage of your account, workout and habit data on our behalf. supabase.com/privacy
• Anthropic — only if you turn on the AI weekly insight: receives the de-identified weekly summary (numbers and exercise names, no identifiers) and returns the written check-in. Processed in the United States; not used to train Anthropic's models; deleted by Anthropic within 30 days. anthropic.com/privacy
• Google AdMob — advertising. AdMob may collect device identifiers and limited device data to serve ads. policies.google.com/technologies/ads
• Apple (Sign in with Apple) / Google (Google Sign-In) — only if you choose one of them in "Save your progress": used to confirm who you are and to give us the email address (or Apple's private relay address) attached to that account. Apple Privacy · policies.google.com/privacy
• Google Maps (Android) / Apple Maps (iOS) — used to display your run route on a map. The map provider processes map-tile and rendering requests to show the map on your device. Google Maps Platform terms · Apple Privacy
• Open Food Facts — when you scan a barcode, the App sends the decoded barcode number to Open Food Facts to retrieve that product's name and nutrition facts. No account identifier, device identifier or other personal data is sent with it. world.openfoodfacts.org/privacy
• Cloudflare Workers — when you search for a food by name, the App sends your search text to a small proxy we operate on Cloudflare, which forwards it to the USDA database below and caches the result. The proxy exists so that a database API key is not embedded in the App. Search text is not linked to your account, and we do not build a profile from it. cloudflare.com/privacypolicy
• USDA FoodData Central — a public food-composition database operated by the U.S. Department of Agriculture, queried through the proxy above to return nutrition data for your search. fdc.nal.usda.gov
• Apple App Store / Google Play — distribution.

Barcode and food-search lookups are the only network requests the nutrition features make. The food you log is not sent to any of these services — only the barcode number or the words you type into the search box.

5. Data security

All data is transmitted over HTTPS/TLS. Account data is stored in encrypted Supabase Postgres with row-level security so each user — including a guest — can only access their own records. Passwords are hashed using industry-standard algorithms; we never see your plaintext password. The AI weekly insight can only run for an account that has turned it on; a modified copy of the App cannot bypass that check because it is enforced on our server.

6. Your rights

• You can request a copy of your data by emailing the address below, or export it yourself at any time from Settings (CSV or JSON).
• You can delete your account and all associated data from Settings — this works for guests too — or by emailing the address below. See Delete your account. A guest account has no email address we can verify a request against, so if you have not saved your progress, use the in-app option.
• GPS run routes are part of your workout data: deleting a run in the App removes its route, and deleting your account removes all synced routes along with your other data.
• Habit check-ins are deleted with your account.
• You can turn the AI weekly insight off at any time in Settings. Turning it off stops any further summary from being sent; insights already written are deleted with your account.
• You can disable future cycle-data sync or delete local cycle logs in the App at any time. Deleting your account deletes synced cycle records along with other account data.
• Nutrition entries and body measurements never leave your device, so there is nothing on our servers to request or delete. You can remove individual entries in the App, and uninstalling the App removes all of them. Because they are not backed up to your account, export a JSON backup from Settings before switching phones if you want to keep them.
• EU/UK users have rights under GDPR and may contact us to exercise them.
• California users have rights under the CCPA/CPRA and may contact us to exercise them.

7. Children

My Gym Tracker is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

8. Changes to this policy

We may update this Privacy Policy from time to time. The "Effective date" at the top of this page reflects the most recent revision. Continued use of the App after changes means you accept the updated policy.

9. Contact

Questions, requests, or concerns: support@mygymtrackerapp.com (or support@dendigital.us — both reach the same people).

Den Digital LLC
(physical address available on request)