Privacy Policy

Who We Are & Scope

GymBeat is developed and operated by BND TEAM SOFTWARE SRL, registered office: Str. Lalelelor nr. 61A, camera 1, Giroc, Timiș County, Romania; Trade Register no. J2016001431350; Unique Registration Code (CUI) 36066057; EUID ROONRC.J2016001431350 ("we", "us"). We are the controller of your personal data under the EU General Data Protection Regulation (GDPR). You can contact us about anything in this policy at support@gymbeat.app.

This policy covers:

• The GymBeat mobile app on iOS and Android (the "App")
• The gymbeat.app website (the "Website")
• Any subdomains and supporting services we operate, such as push notifications and links shared from the App

The Website has no user accounts. Visiting it does not give us access to your App account, and we do not combine Website data with your App account.

Cookies & Tracking Technologies (Website)

The Website uses cookies and similar browser storage. The App does not use web cookies — it keeps your session and settings in your device's storage.

2.1 Necessary (Always On)

These are required for the Website to work and cannot be switched off:

• `NEXT_LOCALE` cookie — remembers your language (EN or RO)
• `gymbeat_cookie_consent` browser-storage entry — remembers your cookie choice so we don't ask on every visit

2.2 Analytics & Campaign Measurement (Opt-In)

With your consent, we load the Meta Pixel to measure how visitors find the Website and how well our own ad campaigns work.

• Meta Pixel ID: `1480741470088030`
• Cookies set: `_fbp`, `_fbc` (Meta measurement cookies)
• Events sent: page views, and a click event when you tap an App Store or Google Play button
• Recipient: Meta (Meta Platforms Ireland Ltd. for users in the EU; Meta Platforms, Inc. elsewhere)
• Meta's privacy policy: facebook.com/privacy/policy

The Pixel is loaded only after you consent. If you do not consent, no Meta script runs on the Website. If you withdraw consent, the Pixel is no longer loaded from your next page load; clear your cookies to remove Meta cookies already set.

2.3 Managing Your Cookie Choices

You can change your preferences at any time using the button below.

You can also clear cookies directly from your browser. Note: clearing browser storage resets your stored choice, so the banner will reappear on your next visit.

2.4 Cookie Retention

• `NEXT_LOCALE` — 1 year
• `gymbeat_cookie_consent` — until you clear your browser storage or change your choice
• Meta cookies (`_fbp`, `_fbc`) — up to 90 days (set by Meta)

Data received through the Pixel is retained by Meta under its own policy; our own derived reports are deleted after 13 months.

Information We Collect (App)

3.1 Account Information

When you create an account, we collect:

• Email address and name
• If you sign in with Apple, Google or Facebook: the basic profile details that provider shares with us (name, email address and, where available, profile picture)
• Your password, which is stored only by our authentication provider, Clerk — never by us in readable form
• Technical sign-in data handled by Clerk, such as session and device information

3.2 Profile & Onboarding Information

To set up your plan and personalize your targets, we collect:

• Display name and an optional profile photo
• Gender (including "prefer not to say")
• Date of birth, height and weight
• Fitness goal, optional target weight and pace, experience level, weekly training frequency and daily activity level
• Why you train and how you heard about GymBeat (including any optional details you type)
• Preferences such as language, units, theme, the Coach's training style and your notification settings

3.3 Training, Nutrition & Progress Data

• Workouts: exercises, sets, reps, weights, rest times, cardio, notes, duration, the gym you trained at, and personal records
• Workout templates, folders and custom exercises you create
• Nutrition: food diary entries, custom foods, saved meals and recipes (with optional photos), barcode lookups, and calorie and macro targets (calculated or set by you)
• Weight history, optional progress photos and your Before & After selection
• Coach Plans: your training schedule and the goal snapshot taken when you start a plan

Progress photos are private: they are not shown to other users and are not sent to any AI or moderation provider.

3.4 Health Platform Data (Optional)

If you connect Apple Health (iOS) or Health Connect (Android), and only for the data types you allow:

• We read: steps, active calories burned, heart rate, and sleep (duration and stages)
• We write: the weight you log and the workouts you complete

Health data is read only while you use the App, never in the background. The values we read are stored in your GymBeat account — as daily summaries and per-workout metrics — so the App can show them and the Coach can take your recovery into account (see Section 3.7). You can change what syncs or disconnect at any time in Settings → Health. Data previously written to Apple Health or Health Connect stays there and is managed in those apps.

We never use health-platform data for advertising, never send it to Meta, and never sell it.

3.5 Camera & Photos

• The camera opens only when you scan a barcode, photograph a meal, or take a photo for your profile, a post, a recipe, a weight entry, or a gym or equipment listing. You can also choose photos from your library
• Barcodes are read on your device; only the barcode number is sent to our servers to look up the product
• Photos you add are resized on your device and uploaded to our servers. Meal photos sent for AI analysis are covered in Section 3.8
• Photos other users can see (profile, post, recipe, gym and equipment photos) are screened automatically for objectionable content (see Section 7)
• You can revoke camera and photo access at any time in your device settings

3.6 Location

We use your location only to show gyms near you on the map and to calculate distances:

• Precise location with the "While Using the App" permission — never in the background
• If precise location is unavailable, an approximate location estimated from your IP address by ipapi.co
• If you search for a city on the map, the city name you type is sent to OpenStreetMap's Nominatim service to locate it
• To find nearby gyms, the App sends your coordinates to our servers with each map request; they are not stored

We do NOT track your location in the background, keep a location history, or attach your coordinates to your profile or workouts.

3.7 AI Coach

The Coach builds workouts, reviews your sessions, plans multi-week blocks and writes a weekly recap. The training decisions — exercises, loads and progressions — are made by our own rules on our servers; an AI language model from OpenAI then writes the explanations you read. To do this, the Coach uses:

• Your profile and goals (age, gender, height, weight, goal, experience, training frequency and activity level)
• Your workout history, personal records, your gym's equipment, and the suggestions you accepted or dismissed
• For the weekly recap: your nutrition logs and targets, your weight trend and — if you connected a health platform — summaries of your sleep, steps and heart rate

The AI model receives only the computed facts it needs to write (for example exercises, loads, weekly averages and short insights) and your language. It does not receive your name, email address or photos. Coach results are saved in your account.

3.8 AI Meal Photo Analysis

When you scan a meal:

• The photo is sent to OpenAI's vision model to identify the foods and estimate portions, calories and macros
• To write the short comment on the result, the model also receives your daily calorie and macro targets and what you have logged so far that day
• No name or email address is attached to the request
• We keep the photo, the AI estimates and any corrections you make, linked to your account. Your corrections help us measure and improve the scanner's accuracy

Retention: meal-scan photos are currently kept for as long as your account exists and are deleted when you delete your account. If we introduce automatic deletion after a shorter period, we will update this policy. The resulting diary entries remain part of your nutrition log until you delete them.

3.9 Community & Social Features

Community features are optional. When you use them, we store the following and show it to other GymBeat users:

• Your public profile: display name, profile photo, follower and following counts, any badge, and your posts
• Posts you share: workouts (exercises, sets, volume, duration, the gym's name and, if available, calories, heart rate and steps from your health platform) and meal logs (foods and macros), with any caption and photos
• Likes and follows, and templates, meals or recipes imported from posts — other users can import the ones you share
• Gym and equipment reviews, ratings, photos, "helpful" votes, equipment details and verifications you contribute
• Messages you send in a gym's chat, shown with your display name to everyone who opens that chat
• Reports and blocks you make (these are not shown to the people involved)

Anything you post or contribute is visible to other GymBeat users. Think twice before sharing health details publicly.

3.10 Subscriptions, Trials & Partner Codes

• Subscription status, plan (monthly, yearly, or a legacy lifetime purchase), trial status, renewal and expiry dates, and store transaction identifiers — received from Apple or Google through RevenueCat
• Which subscription screens you saw and whether a purchase or trial started from them, so we can measure how our offers perform
• If you redeem a partner trial code: the code, when you claimed it, when the trial ends, and whether you later subscribe — used to pay the partner's commission. Partners only see how many times their codes were used, never who used them

We do NOT collect or store your payment card details, billing address, or any financial account information. Apple and Google process all payments.

3.11 Notifications

• If you allow push notifications, we store your device's push token and your notification preferences, and keep an in-app history of the notifications we send you
• Push notifications include Coach and plan reminders, weight, workout and meal-logging reminders, and social activity (likes, follows, imports, chat messages, "helpful" votes)
• Some notifications are scheduled only on your device: the rest-timer alert and, when a free trial starts, a reminder two days before it converts into a paid subscription

3.12 Diagnostics & Usage Information

• Crash reports, errors and performance traces (device model, operating-system and app version, the screen you were on, and technical logs), sent to Sentry together with your internal user ID and display name. We remove your email address and IP address before sending
• Logs of requests to our backend (including internal user IDs and error details), stored in Axiom for troubleshooting
• Feedback you send us, together with your app version, platform and operating-system version
• When we last asked you to rate the App and your answer, so we don't ask too often
• Basic account activity, such as when you were last active and when you completed onboarding

3.13 Advertising Measurement (Meta SDK)

GymBeat does not show third-party ads. To measure which of our own ad campaigns bring people to the App, the App includes Meta's Facebook SDK:

• The SDK automatically sends Meta app events such as installs, app launches and in-app purchases, together with device information
• iOS: on first launch we ask for permission to track (App Tracking Transparency). Your device's advertising identifier (IDFA) is shared with Meta only if you allow it. If you decline, app events are reported without the IDFA and our campaigns are measured in aggregate through Apple's SKAdNetwork
• Android: the SDK may collect your device's advertising ID. You can reset or delete it at any time in your device's settings (usually under Privacy → Ads, or Google → Ads)
• We do not send Meta your health, fitness, nutrition or profile data
• If you choose to sign in with Facebook, Meta also learns that you used Facebook Login for GymBeat

3.14 Widgets & Live Activity

If you add GymBeat widgets or allow the workout Live Activity, your latest weight, today's calories and macros, or your current workout are shown on your Home Screen, Lock Screen and — on iOS — in the Dynamic Island and on Apple Watch. This data is stored on your device for the widget and can be seen by anyone who can see your screen. Remove the widget or turn off Live Activities in your device settings to stop it.

Information We Collect (Website)

When you visit gymbeat.app, the following may be collected:

• Standard request logs processed by our hosting provider, Vercel (IP address, browser, operating system, referring page, pages requested) — kept for a short period, no longer than 30 days, for security and debugging
• Your language and cookie choices (Section 2)
• With your analytics consent only: Meta Pixel page views and app-store button clicks

The Website has no accounts, contact forms or newsletter signup. Links shared from the App (to a post, profile or recipe) open a Website page that invites you to download the App; these pages do not display the shared content or any account details.

How We Use Your Information & Legal Bases

We use personal data only for the purposes below, each with a legal basis under the GDPR:

• Providing the App — your account, logging, targets, the Coach, meal scans, community features, the gym map, subscriptions and the notifications you ask for: performance of our contract with you (Art. 6(1)(b) GDPR)
• Health-related data — weight, nutrition, sleep, heart rate, steps and other health-platform data: your explicit consent (Art. 9(2)(a) GDPR), given when you enter the data or connect a health platform. You can withdraw it at any time by deleting the data, disconnecting the platform or deleting your account; this does not affect processing that already took place
• Optional permissions and tracking — location, camera and photos, push notifications, iOS tracking and Website analytics cookies: your consent, which you can withdraw in your device or browser settings
• Keeping GymBeat safe and working — content moderation, abuse and fraud prevention, crash and error monitoring, and security: our legitimate interests
• Improving GymBeat and measuring our marketing — aggregated usage statistics, subscription-screen measurement, meal-scan accuracy and campaign measurement: our legitimate interests. You can object at any time (Section 11)
• Partner commissions for trial codes: our legitimate interest in running the partner program
• Legal obligations — for example, responding to lawful requests from authorities: compliance with a legal obligation (Art. 6(1)(c) GDPR)

We do NOT sell your personal data, and we do not use it to show you third-party ads.

Automated Processing & AI

Some features rely on automated processing:

• Coach and targets: workouts, loads, calorie and macro targets, goal dates, projections and recaps are generated automatically. They are suggestions — you decide what to do with them
• Content moderation: text and images you post are screened automatically before they appear, and content flagged as harmful is rejected. If you think something was rejected by mistake, contact us
• Usage limits: free accounts have limits on some AI features, which are applied automatically

We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you.

Service Providers & Third Parties

7.1 Service Providers (Processors)

These providers run parts of GymBeat on our behalf. They process data under contract with us, only to provide their service:

• Clerk (USA) — sign-in and account security: email, name, password, sign-in provider details. clerk.com/legal/privacy
• Convex (USA) — our database, file storage and backend, holding the App data described in Section 3. convex.dev/legal/privacy
• OpenAI (USA) — AI Coach explanations, meal-photo analysis and text moderation. Receives the data described in Sections 3.7 and 3.8 and the text you post, without your name or email. Under OpenAI's API terms, this data is not used to train its models. openai.com/policies/privacy-policy
• Sightengine (France) — automatic moderation of profile, post, recipe, gym and equipment photos. sightengine.com/privacy
• RevenueCat (USA) — subscription management: your internal user ID and App Store or Google Play purchase records; no name, email or health data. revenuecat.com/privacy
• Sentry (USA) — crash and error reporting (Section 3.12). sentry.io/privacy
• Axiom (USA) — storage and search of our server logs (Section 3.12). axiom.co/privacy
• Expo (USA) — push-notification delivery (push token and notification text) and App updates. expo.dev/privacy
• Vercel (USA) — Website hosting. vercel.com/legal/privacy-policy

7.2 Independent Third Parties

These services receive data when you use the related feature, under their own privacy policies:

• Apple and Google — app stores and payments, push delivery (Apple Push Notification service and Firebase Cloud Messaging), Sign in with Apple and Google Sign-In, Apple Health and Health Connect (where your data stays under your control), and the in-app rating prompt
• Meta — Facebook Login (if you use it), the Facebook SDK in the App (Section 3.13) and, with your consent, the Meta Pixel on the Website (Section 2.2)
• Map providers — map display by Apple Maps (iOS) or Google Maps (Android). If you ask for directions, the gym's location opens in the maps app you choose
• ipapi.co — receives your IP address to estimate your location when precise location is unavailable
• OpenStreetMap Nominatim — receives the name of a city you search for on the map
• Open Food Facts — the open food database behind barcode and food search. Our servers query it with product barcodes only, never with your personal data

Data Sharing and Disclosure

We do NOT sell your personal information. We share it only:

• With the providers and third parties listed in Section 7, as described there
• With other users, for what you choose to post or contribute (Section 3.9)
• With referral partners, as aggregate counts only (Section 3.10)
• With sponsors shown in the App, as aggregate statistics only (such as the number of taps on their card). We record when you tap a sponsor's card to compute these statistics
• If required by law, or to protect the rights, safety and security of our users and GymBeat
• In connection with a merger, acquisition or sale of assets (you will be notified)

We do NOT share your fitness, nutrition, weight or health data with gyms, sponsors or partners.

Data Security

We implement industry-standard security measures to protect your data:

• Encrypted transmission (HTTPS/TLS) between the App, the Website and our servers
• Authentication through Clerk, with session tokens kept in your device's secure storage
• Access to production data limited to the people who operate GymBeat
• Automatic moderation, reporting and blocking tools to limit abuse

However, no method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

Data Retention

We keep personal data only as long as we need it for the purposes in Section 5:

• Account and App data: while your account exists, or until you delete the specific item
• Meal-scan photos: until you delete your account (Section 3.8)
• Health-platform data synced to GymBeat: until you delete your account. Disconnecting stops new syncing
• Location: not stored — used only for the request that needs it
• Crash reports and server logs: for a limited period set in our providers' retention settings, then deleted automatically
• Website request logs: no longer than 30 days
• Website cookies: see Section 2.4
• After you delete your account: removed from our live systems right away, and any residual copies in backups and logs within 30 days
• Anonymous deletion feedback: when you delete your account, we keep the reason you select, any comment you add, how long the account existed and how many workouts and weight entries it had — without your name, email or account ID

Your Privacy Rights

Depending on where you live — and always if you are in the EU/EEA — you have the right to:

• Access your personal data and receive a copy
• Correct inaccurate data (most of it directly in the App, for example via Edit Profile or by editing entries)
• Delete your data and your account
• Restrict processing, or object to processing based on our legitimate interests, including measurement and product improvement
• Data portability — receive the data you provided in a structured, machine-readable format (email us; there is no in-app export yet)
• Withdraw your consent at any time (health platforms, device permissions, iOS tracking, Website cookies — see Section 2.3) without affecting earlier processing
• Lodge a complaint with a data protection authority — in Romania, the National Supervisory Authority for Personal Data Processing (ANSPDCP, dataprotection.ro) — or with the authority where you live or work

To exercise these rights, email support@gymbeat.app. We respond within one month (extendable by two further months for complex requests, as the GDPR allows) and may ask you to confirm your identity.

11.1 How to Delete Your Account

• In the App: Settings → Delete Account
• By Email: send a deletion request from your account's email address to support@gymbeat.app
• Active paid subscription: cancel it first in your App Store or Google Play settings. The App blocks deletion until the paid subscription has ended, so you are not billed for an account that no longer exists. If you need your data deleted sooner, email us

When you delete your account:

• Deletion starts immediately: your profile, workouts, templates, nutrition logs, foods, meals, recipes, weight history and progress photos, meal-scan photos, Coach data, posts, likes, follows, reviews, chat messages, notifications, health data synced to GymBeat and subscription records are permanently deleted
• Your sign-in account at Clerk is also deleted
• Gym and equipment details you added to shared listings (for example, a machine on a gym's equipment list) may remain available to other users, without your name
• Deleting your account does not cancel a store subscription — subscriptions are managed by Apple or Google
• Data previously written to Apple Health or Google Health Connect remains on your device and must be managed through those platforms
• This action cannot be undone

For California users (CCPA/CPRA): you have the right to know what personal information we collect, and to request its correction or deletion, without discrimination for exercising these rights.

Children's Privacy

GymBeat is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has an account, please contact us and we will delete it.

In some countries, people under a certain age (16 in Romania) need permission from a parent or guardian for processing that relies on consent, such as health data and health-platform sync. If this applies to you, use those features only with that permission. Users aged 13–17 should use the App with parental guidance, especially before sharing anything publicly.

International Data Transfers

We operate from Romania, but several of our providers (Section 7) are located in, or access data from, the United States and other countries outside the EU/EEA. When personal data is transferred outside the EEA, we rely on safeguards recognized by the GDPR: an adequacy decision (such as the EU–U.S. Data Privacy Framework, for certified providers) or the European Commission's Standard Contractual Clauses. Contact us for more information about these safeguards.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Updating the "Last Updated" date
• Sending a notification through the App
• Sending an email to your registered address

Where a change requires your consent, we will ask for it before the change applies to you.

Contact Us

If you have questions about this Privacy Policy or want to exercise your privacy rights, contact us:

You can also contact the Romanian data protection authority, ANSPDCP, or the authority in your country (Section 11).