Gym Rat privacy policy
Last updated: 27 October 2026
Gym Rat is a workout planner and training log. This policy explains what information Gym Rat collects, why, where it is kept, how long for, and how you can see, change or delete it. We wrote it in plain English. If anything is unclear, contact us at ai.wise.au@gmail.com.
Who we are
Gym Rat is provided by Ihab Hassan (independent developer). We are responsible for your information (the "controller" under data-protection laws such as the GDPR).
The short version
- We collect what the app needs to build your plan and keep your training log: your email, your training preferences, your workouts, and any body stats you choose to enter.
- No ads, no selling, no tracking. We don't sell or rent your information. We don't show ads. We don't use analytics or advertising SDKs, and the app doesn't read your advertising ID, location, contacts or photos.
- Your data lives on your phone first and is backed up to our database so you can use it on another phone.
- You can delete your account in the app at any time. After a 30-day period in which you can change your mind, everything is permanently deleted.
What we collect and why
| What | Examples | Required? | Why we need it |
|---|---|---|---|
| Account details | Email address, password (stored only as a secure hash by our auth provider), a random account ID | Yes | To create your account, sign you in, reset your password and keep your data separate from everyone else's |
| Google account details | Email address, name and profile picture link from Google | Only if you choose "Continue with Google" | To sign you in with Google. The app itself only uses your email; your name and picture link are kept by our auth provider |
| Training preferences | Goal, equipment, experience level, days per week, session length, units (kg or lb), exercises you've hidden | Yes (you can skip level and some other answers) | To generate your training plan and adjust it |
| Body stats | Body weight, height, age, sex | No. Every field is optional | To tailor suggestions and to count bodyweight exercises in your training volume |
| Weigh-ins | Date, body weight, optional note | No | To show your body-weight trend |
| Plans | The plans generated for you and your edits (swaps, day changes), including earlier versions | Yes | To show today's session and let you go back to a previous plan |
| Workouts | Exercises, sets, weights, reps, warm-up and skipped sets, start and end times, effort rating, optional notes | Yes, this is the app's core | To keep your training log, suggest your next weights and reps, detect personal records and show your progress |
| Training state | Deload weeks you started or postponed, automatic plan changes you haven't seen yet | Yes | To time deload weeks and tell you when an exercise moved to a harder variation |
| A random device ID | A random code created when the app is first installed. It isn't your phone's serial number or advertising ID | Yes | To know which phone is running an unfinished workout, so two phones don't both resume it |
Health-related information. Body stats, weigh-ins and workouts describe your body and physical activity, and the law may treat them as health data. We use them only to provide the app's features to you. Body stats and weigh-ins are optional; you can leave them blank or clear them in Profile.
What we don't collect. No location (GPS or approximate), contacts, photos, microphone, camera, advertising ID, phone number, payment details or data from other apps. We don't use Google Fit or Health Connect. We have no crash-reporting or analytics tools.
How the app works with your data
- On your phone first. Everything you do is saved in a database on your phone, so the app works without an internet connection. Your plan is generated on your phone.
- Backed up to our database. When you're online, the app copies your changes to our database and fetches changes made on your other phones. Only your own account can read or change your data; our database enforces this for every row.
- Personal records are calculated on your phone from your workouts and are not uploaded.
- Settings that stay on your phone: theme, rest-timer behaviour, reminder settings and the random device ID.
- Reminders (workout reminders, weekly summary, rest timer) are scheduled by the app on your phone. We don't send push notifications from a server, and no notification token is created or sent anywhere.
- Exercise demos and fonts are built into the app. Watching a demo doesn't contact any server.
Who else handles your data
We don't sell, rent or share your information with anyone for their own purposes. We don't share it for advertising. These service providers process it for us, under contract, only to run the app:
| Provider | What they do for us | What they handle | Where |
|---|---|---|---|
| Supabase, Inc. | Hosts our database and account sign-in | Everything listed above except settings kept only on your phone | Our database is hosted in Sydney, Australia (AWS ap-southeast-2) |
| Signs you in, only if you choose "Continue with Google" | Google tells us your email, name and profile-picture link | Google's own locations; Google's privacy policy applies to your Google account | |
| Google Play | Distributes the app | Google Play's own data about your download, under Google's policies | Google's own locations |
We may also disclose information if the law requires it, or to protect the rights and safety of our users or the public.
How long we keep it
| Data | How long |
|---|---|
| Your account and training data | For as long as you have an account |
| Sets and weigh-ins you delete | Removed from the app straight away. A deletion marker (a "tombstone") stays in our database for up to 90 days so your other phones also remove the item, then it is erased |
| Workouts you discard, and earlier plan versions | Kept with your account (hidden from your history) until you delete your account |
| After you ask to delete your account | Kept for 30 days so you can change your mind, then permanently deleted (see below) |
| Data on your phone | Until you sign out (signing out erases your data from the phone) or the app next opens after your account was deleted. Settings stay on the phone until you uninstall the app |
| Server logs and backups kept by Supabase | For Supabase's retention period for our plan: daily backups are kept for up to 7 days on paid plans (the free plan keeps none), and API and sign-in logs are kept for a short period set by Supabase |
Deleting your account
- In the app: Profile > Account > Delete account, type DELETE, and confirm.
- Without the app: see <https://ihabhassan84.github.io/delete-account/> (the page in
docs/launch/account-deletion-page.md).
What happens:
- You're signed out on every phone straight away, and your data is hidden. Nobody can use the account.
- For 30 days you can change your mind: sign in again and the deletion is cancelled. Everything is as you left it.
- After 30 days, your account and everything in it (profile, body stats, weigh-ins, plans, workouts and sets) are permanently deleted from our database, including your Google sign-in link if you used one. This can't be undone.
- Copies in Supabase's backups and logs disappear when those expire (see "How long we keep it").
Deleting the app from your phone doesn't delete your account.
Your rights and choices
- See and correct: your profile, preferences, body stats, weigh-ins, plans and workouts are all visible and editable in the app.
- Delete: individual sets in the app, or your whole account (above).
- Clear optional data: you can clear any body stat at any time in Profile > Units and body stats.
Security
- All traffic between the app and our database is encrypted (HTTPS).
- Our database lets each account read and write only its own rows.
- Your sign-in session is stored in your phone's secure, hardware-backed storage (Android Keystore).
- The app's data on your phone is excluded from Android cloud backups, so it isn't copied to other services.
- Passwords are handled by our auth provider and stored only as a secure hash. We never see them.
No system is perfectly secure. If we learn of a breach that affects you, we will tell you as the law requires.
Children
Gym Rat is for people aged 16 and over. We don't knowingly collect information from anyone younger. If you believe a child under 16 has an account, contact us and we will delete it.
Changes to this policy
If we change this policy, we will update the date at the top and, for important changes, tell you in the app before the change takes effect.
Contact
Questions, requests or complaints: ai.wise.au@gmail.com.