This is a translation for your convenience. The German version is authoritative.
1. Controller
The controller for the processing of your data in the GymArc app and on this website is:
[Name or company of the operator][Street and number]
[Postcode, city]
Germany
Email: support@gym-arc.app
2. In short
- GymArc stores what you enter: workouts, nutrition, body metrics. That is health data. We process it to provide the app to you, and anything beyond that only with your explicit consent.
- The database is in the EU (Frankfurt).
- AI features, health sync, usage analytics, news and visibility to training partners are off by default. You switch each one on, and off again at any time: Me → Settings → Privacy & consents.
- You can export everything and delete your account: Me → Account.
- We do not sell data and show no ads.
- This website sets no cookies, uses no analytics and loads no content from third-party servers.
3. This website
gym-arc.app is delivered through the network of Cloudflare (Cloudflare, Inc., USA). When you open a page, Cloudflare processes technically necessary data: your IP address, the requested address, time, browser and system details (user agent) and the referring page. This is needed to deliver the page and protect it against attacks (legitimate interest, Art. 6(1)(f) GDPR). We do not analyse this data ourselves and keep no access logs of our own.
The website sets no cookies, stores nothing in your browser, uses no analytics or advertising services and embeds no fonts, scripts or images from third-party servers. Fonts and graphics are served from our own server.
Email. If you write to us, we process your address and your message to reply (Art. 6(1)(b) or (f) GDPR). Emails to support@gym-arc.app are forwarded by Cloudflare Email Routing to our mailbox at [mailbox provider]. We delete the correspondence once it is settled and no retention obligation applies.
4. What data the app processes
| Category | Data | Source |
|---|---|---|
| Account | Email address, sign-in method (email, Apple, Google), display name, handle, language, registration date | you; for Apple/Google the provider |
| Profile | Year of birth, sex, height, activity level, training location, available equipment, training days, diet, intolerances | you (onboarding, settings) |
| Training | Plans, exercises, sets (weight, reps, time, RPE), notes, timestamps, records, planned sessions | you |
| Nutrition | Diary entries, your own foods and recipes, water, shopping list, calorie and macro targets | you |
| Body metrics | Weight, measurements, body fat | you; with consent Apple Health / Health Connect |
| Photos and videos | Photos of meals and equipment for scanning, a video of one rep for the form check | you (only if you use the feature) |
| Progress photos | Photos of your body. These photos stay on your device and are not uploaded. | you |
| Coach | Your messages, the replies, what the coach remembered about you | you and the AI |
| Training partners | Partnerships with sharing per partner, requests, invite codes, workout invitations, notifications, “respect”, blocks, your own reports, settings; details in section 12 | you |
| Progress | Level, XP, streaks, achievements | calculated from your entries |
| Subscription | Subscription status, receipts, pseudonymous customer ID | Apple / Google via RevenueCat |
| Consents | Purpose, time, policy version, withdrawal | you |
| Technical | Device type, operating system, app version; with consent crash reports and usage events | your device |
Body metrics, nutrition and training data are health data within the meaning of Art. 9 GDPR.
5. Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Providing the app: account, storing and showing your entries, syncing between devices | Account, profile, training, nutrition, body metrics, progress | Contract (Art. 6(1)(b) GDPR); for health data your explicit consent (Art. 9(2)(a) GDPR) |
| Handling the subscription | Subscription | Contract (Art. 6(1)(b) GDPR) |
| Syncing health data (Apple Health, Health Connect) | Weight, steps, active calories | Consent “Sync health data” |
| Personalised AI analysis: coach, photo scan, equipment scan, recipe suggestions and import, summaries | Your message or photo; plus pseudonymised training and nutrition data | Consent “Personalised AI analysis” |
| AI form check | Video of one rep | Consent “AI form check” (a separate purpose because a video of your body leaves the device) |
| Improving the app: crash reports, usage analytics | Technical data, pseudonymous usage events | Consent “App usage analytics” (Art. 6(1)(a) GDPR, § 25(1) TDDDG) |
| News by email | Email address | Consent “News & offers” |
| Training partners: connecting, sharing training days and summaries of finished workouts with confirmed partners, inviting to a workout, “respect” | Handle, display name; with sharing the data from section 12 | Consent “Visibility to training partners” for sharing |
| Handling reports (abuse prevention between training partners) | Report with reason, context, note and a snapshot of name, handle and workout title of the reported person | Legitimate interest (Art. 6(1)(f) GDPR) |
| Security and abuse prevention, proof of consent | Logs, consents | Legitimate interest (Art. 6(1)(f) GDPR), legal obligation (Art. 6(1)(c) GDPR) |
Every consent is voluntary, can be given individually and withdrawn at any time with effect for the future (section 10). Without consent the app keeps working; only the feature in question is off.
6. Service providers and recipients
We use the following services. We conclude data processing agreements under Art. 28 GDPR with processors.
| Service | Purpose | Data | Location | When |
|---|---|---|---|---|
| Supabase (Supabase, Inc.) | Database, sign-in, file storage, server functions | All account and content data; scan photos and form check videos in file storage | EU (Frankfurt) | always (running the app) |
| Google Gemini API (Google) | AI analysis: coach, meal photo scan, equipment scan, recipe suggestions, recipe import, summaries, form check | Your message or the photo or video; plus pseudonymised training and nutrition data. No email, no name. | Google, worldwide (including USA) | only with consent “Personalised AI analysis” or “AI form check” |
| Open Food Facts (association, France) | Product data for barcodes and search terms | The barcode or search term. Our server makes the request, not your device: Open Food Facts sees neither your IP address nor your account. | France | when you scan or search |
| Recipe websites (each operator) | Importing a recipe from a web address | The address you enter. Our server fetches the page, not your device. | depends on the site | only when you import a recipe (part of AI analysis) |
| RevenueCat (RevenueCat, Inc.) | Checking subscription status, matching purchases with the App Store | Pseudonymous user ID (a random identifier, no email), receipts, subscription status | USA | once you are signed in |
| Apple | Sign in with Apple, billing of the subscription through the App Store | Apple ID, email or relay address, name on first sign-in; purchases | Apple, worldwide | when you sign in with Apple or buy a subscription |
| Continue with Google | Google ID, email, name | Google, worldwide | when you sign in with Google | |
| Apple Health / Health Connect | Syncing weight, steps and active calories with your device's health app | Weight, steps, active calories. The sync runs on your device; Apple or Google receive no data from us through it. | on your device | only with consent “Sync health data” and after the system permission |
| Sentry (Functional Software, Inc.) | Crash reports | Crash report, device type, operating system, app version. No health data. | EU (Frankfurt) | only with consent “App usage analytics” |
| PostHog (PostHog, Inc.) | Usage analytics | Pseudonymous usage events; screen recordings in which text input and images are masked | EU (Frankfurt) | only with consent “App usage analytics” |
| Cloudflare (Cloudflare, Inc.) | Delivering this website, forwarding emails to our address | Technical access data (section 3); for emails sender, recipient and content | worldwide (including USA) | when you visit the website or write to us |
Notifications (reminders, end of rest) are created by the app locally on your device. We run no push service and store no push token.
The exercise catalogue comes from open collections (wger, Everkinetic); no data is sent to these projects when an exercise is shown.
7. Transfers outside the EU
Google (Gemini API, sign-in), RevenueCat, Apple and Cloudflare may process data in the USA and other countries outside the EU. Basis of the transfer: [per provider adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses under Art. 46(2)(c) GDPR].
8. How long we keep data
- As long as your account exists. Your entries stay until you delete them or delete the account.
- Deleting your account (Me → Account → Delete account) removes immediately and permanently: the account, all tables with your data and all uploaded files. With Sign in with Apple we also revoke GymArc's access to your Apple ID.
- What is not deleted with it: progress photos on your device (they only live there; delete the app to remove them). Reports you made about others stay for moderation, without any link to you (section 12). Notifications your account triggered for others disappear with it.
- Scan photos and form check videos stay in file storage until the account is deleted.
- Billing data is kept by Apple or Google under their own rules.
- Device storage: the app keeps a cache of your data on the device so it starts quickly and works offline. It is cleared when you sign out.
9. Your rights
You have the right to
- access (Art. 15 GDPR) and data portability (Art. 20 GDPR): Me → Account → Export data gives you everything as a JSON file.
- rectification (Art. 16 GDPR): you change name, handle, email and all entries in the app.
- erasure (Art. 17 GDPR): Me → Account → Delete account.
- restriction of processing (Art. 18 GDPR) and objection (Art. 21 GDPR): write to us at support@gym-arc.app.
- withdraw consent (Art. 7(3) GDPR): see section 10.
- lodge a complaint with a supervisory authority (Art. 77 GDPR), for example [competent supervisory authority for the operator's seat].
10. Changing and withdrawing consent
Under Me → Settings → Privacy & consents every purpose is a switch:
| Switch | What happens when it is on |
|---|---|
| Sync health data | Weight, steps and active calories are synced with Apple Health or Health Connect. |
| Personalised AI analysis | Coach, scans and recipe features send your input and pseudonymised data to the AI. |
| AI form check | A video of your exercise goes to the AI for technique analysis, only when you start a form check yourself. |
| App usage analytics | Crash reports and usage events are recorded. |
| News & offers | We may occasionally email you about new features. |
| Visibility to training partners | Partners you switched sharing on for see your training days and summaries of your workouts (section 12). Switching it off ends sharing for everyone immediately. |
Switching off is the withdrawal. It applies immediately and is as easy as giving consent. Processing up to that point remains lawful. Every grant and withdrawal is logged with time and policy version.
11. AI features: what you should know
- Coach replies, scan results and form check hints are generated by an AI model. They can be wrong and do not replace medical, dietetic or physiotherapy advice.
- There is no automated decision with legal effect within the meaning of Art. 22 GDPR.
12. Training partners
Purpose. Training and staying on track with people you know. You connect in pairs with training partners (at most 12, both sides confirm), see whether and when they train, invite them to a workout and react to a finished workout with “respect”. There is no leaderboard, no ranking of people, no open feed and no messages between users.
What a partner sees of you, only if you gave the consent “Visibility to training partners” and switched sharing on for exactly this partner, and as long as neither of you blocks the other:
- which days you trained: the current week and the seven weeks before; from that your weekly streak (at most 52 weeks back) and the number of weeks in which you both trained;
- your weekly goal as a number;
- whether you trained today and when you last trained (only within 30 days);
- your finished workouts of the last 30 days as a summary: title, end, duration, number of work sets, number of personal bests; you can exclude single workouts (“Visible to partners”);
- “training now” only if you switch it on separately.
Never: weights, exercises, body metrics, nutrition, photos, level, XP, email, date of birth.
Regardless of sharing, a confirmed partner sees your display name, your handle and whether you share with them. Anyone who knows your handle can find you; they only see your name if you show it in search. People you send a request to and people who redeem your invite code see your name.
Recipients. Only partners you confirmed yourself. Data is stored at Supabase (section 6) like all other data; your partners get no copy, they read what you currently share on each request.
Legal basis. Your consent (Art. 6(1)(a) and, because training data is close to health data, Art. 9(2)(a) GDPR). You give it when accepting or sending a request, with two equal buttons and no pre-ticked switch, or per partner under “Visibility & safety”. The server writes the proof (time, version of this section) in the same transaction as the sharing; it cannot be changed afterwards, only withdrawn.
Withdrawal. Per partner under Training partners → Visibility & safety or in the partner's profile; for everyone at once under Me → Settings → Privacy & consents → “Visibility to training partners”. The withdrawal takes effect on the next request. After a withdrawal sharing is off for all partners; to share again you decide per partner.
Retention. Partnerships, requests, invitations, notifications and reactions stay until withdrawal, until you remove or block the partner, or until the account is deleted. You can withdraw open requests; invite codes expire after seven days. For rate limiting the server remembers the times of searches and requests for at most 48 hours.
Minimum age. Partner features are available from age 16. The server locks them based on the stored year of birth; beyond that your confirmation on the rules screen applies.
Blocking and reporting. You can block and report anyone. Blocked people are not told; they can no longer find you and see nothing more of you. A report stores the reason, context, an optional note and a snapshot of the reported person's name, handle and, if applicable, workout title. The purpose is abuse prevention; only the operator can read it, and the reported person does not learn who reported them. After several reports from different people, the reported person's partner features are locked until review. If you delete your account, the report stays for moderation but without any link to you. Retention of reports: [period].
Access and export. Me → Account → Export data contains your partnerships, sent and received requests, workout invitations, notifications, partner settings, invite codes, blocks, your own reports and the “respect” you gave and received.
13. Security
The connection between app and server is encrypted (TLS), and so is this website. Every table is secured so that an account can only read and write its own rows. Sign-in data is kept on the device in the protected keychain. We do not store passwords in plain text.
14. Version and changes
As of 19 October 2026, version 1.0.0.
We update this policy when the app or the law changes. For material changes that affect a consent, we ask you again.