Privacy Policy

Last updated 14 August 2026.

This policy explains what GYMMER does with your personal data, why, and what you can require of us. It is written to satisfy Articles 13 and 14 of the General Data Protection Regulation (GDPR). If anything here is unclear, ask us — an explanation you cannot follow is not transparency.

Who is responsible

The controller of your personal data is IHAR FINCHUK, trading as GYMMER (VAT/tax no. PL5223211274), a sole trader registered in Poland, at ul. Floriańska 6/02, 03-707 Warszawa, Poland. You can reach us about anything in this policy at mail@gymmer.com — that is the fastest route, and it reaches a person.

We have not appointed a Data Protection Officer. Our processing does not meet the thresholds in Article 37 that require one — we do not carry out large-scale systematic monitoring, and health-related data is processed only for the individual user who supplied it, not at scale for other purposes. Write to the address above and a person will answer.

What we collect

Account data. Your email address, and your name if you give one. If you sign in with Google or Apple we receive your email address, your name where you allow it to be shared, and a stable identifier for your account with that provider. We never receive your password for those services.

Body and training data. Your age, sex, height and body weight, the workouts you record, the exercises in them, and the sets, repetitions and loads you log. You supply all of this; none of it is inferred or bought.

Goals and progress. Targets you set and the progress calculated against them from your training data.

Coach conversations. The messages you send to the AI coach and its replies.

Technical data. Your IP address, device and browser type, and timestamps, recorded when your app talks to our servers. This is ordinary server logging, kept short, and used to keep the service running and secure.

This includes health data, and that matters

Your body weight, age, sex and training history are, taken together, data concerning health under Article 9 GDPR. That is a special category: the law prohibits processing it unless a specific exception applies.

Our exception is your explicit consent under Article 9(2)(a). We do not rely on legitimate interest for it, because legitimate interest is not available for special-category data. Concretely, this means:

• You choose whether to enter body metrics. The app works without them — you can log workouts and never state your weight.
• You can withdraw that consent at any time by deleting the data in your preferences, or by deleting your account. Withdrawal does not affect processing that already happened.
• We do not use this data for advertising, and we do not sell it. There is no version of GYMMER in which your weight is a product.

Why we process it, and on what legal basis

To provide the service you asked for — creating your account, storing your workouts, showing your history and statistics. Legal basis: performance of a contract, Article 6(1)(b).

To calculate progress and personalise coaching — computing statistics from your training data and giving the AI coach the context it needs to answer usefully. Legal basis: contract for the calculation, plus your explicit consent under Article 9(2)(a) for the health-related parts.

To send you service email — confirming your address, resetting your password, and account notices. Legal basis: contract. These are not marketing and you cannot unsubscribe from the security-relevant ones while holding an account.

To send optional summaries and reminders — workout summaries and goal progress. Legal basis: consent. Turn them off in your preferences and they stop.

To keep the service secure and working — rate limiting, abuse prevention, diagnosing faults. Legal basis: legitimate interest, Article 6(1)(f), in running a service that stays up and is not abused. We have weighed this against your interests; the data involved is technical, short-lived, and not used to build any profile of you.

The AI coach

GYMMER includes an AI coach you can chat with. You are interacting with an AI system, not a human. We state this here and in the app itself, as Article 50 of the EU AI Act requires — those obligations have applied since 2 August 2026. Our full AI transparency notice explains what the system does, what it cannot do, and how its output is marked.

To answer you, your messages and relevant training context are sent to Ollama, which runs the language model on our behalf as a processor under a data processing agreement. Your conversations are not used to train anyone's model.

The coach produces suggestions. It does not make any decision that produces legal effects for you or similarly significantly affects you, so Article 22 GDPR — automated individual decision-making — does not apply. Nothing about your account, access or billing is decided by the model.

Who else sees your data

We disclose personal data only to processors acting on our instructions under Article 28 contracts, and only as much as each needs:

• Our hosting and database providers, which store the data.
• Ollama, for AI coach replies, as described above.
• Our email provider, to deliver service messages.
• Google and Apple, if you choose to sign in with them — and only to authenticate you.

We do not sell personal data, we do not share it with data brokers, and we run no advertising trackers. We may disclose data where the law compels us to, and will tell you unless legally forbidden.

Transfers outside the EEA

We keep data in the European Economic Area wherever we can. Where a processor operates outside it, the transfer is covered by the European Commission's Standard Contractual Clauses together with an assessment of the destination country's law, or by an adequacy decision. Ask us at mail@gymmer.com for the current list of processors and the safeguard each one relies on.

How long we keep it

• Account, training and body data — while your account exists. Delete your account and we delete it.
• Coach conversations — expired automatically after a limited period; they are a working context, not an archive.
• Server logs — a short operational window, then discarded.
• Records we must keep by law — for the period the law specifies, and no longer.

Deleting your account removes your data from our live systems immediately. Encrypted backups roll over on their own schedule, after which the data is gone from those too.

Your rights

Under the GDPR you may:

• Access your data and get a copy of it.
• Correct anything inaccurate.
• Delete your data — the "right to be forgotten".
• Restrict or object to processing, including any based on legitimate interest.
• Port your data — receive it in a structured, machine-readable format, or have it sent directly to another controller.
• Withdraw consent at any time, without affecting what was lawful before you withdrew it.

Write to mail@gymmer.com. We answer within one month, as Article 12(3) requires. Exercising these rights is free; we will not degrade your service for using them.

If you think we have got this wrong, you can complain to your national data protection authority. You have that right regardless of anything else in this policy, and you do not need to contact us first — though we would rather you did, because we can usually fix it faster.

Children

GYMMER is not for children under 16. We do not knowingly collect their data. If you believe a child has given us data, tell us at mail@gymmer.com and we will delete it.

Security

Data is encrypted in transit. Passwords are stored hashed, never in a form we could read. Access to production systems is limited to the people who need it. No system is perfectly secure, and we will not claim otherwise — if a breach puts your rights at risk we will notify you and the supervisory authority as Articles 33 and 34 require.

Changes

If we change this policy in a way that materially affects you, we will tell you in the app or by email before it takes effect — not by quietly editing this page and moving the date.