Privacy Policy

Who we are (data controller)

The data controller for Go Gym is Go Gym App Limited, a company registered in England and Wales. We are responsible for the personal data processed through the Go Gym website, web app, and mobile apps.

For any privacy question or to exercise your rights, contact us at privacy@go-gym.app.

What data we collect

We collect your account email and profile details, together with the fitness and workout data, food and nutrition logs, body weight and measurements, and any other trackables you choose to record. Some of this - such as body measurements, weight, and health-related habits - is health information, which counts as a special category of personal data and is given extra protection under UK data protection law.

If you connect Apple Health or Health Connect, we also process the health metrics you choose to share. If you use optional AI features, we process the inputs needed to run them (for example a meal photo, or a short-lived voice session). We also collect limited technical data such as device type, app version, and usage events needed to operate and improve the service.

Our legal bases for using your data

We rely on the following legal bases under the UK GDPR:

• Contract - to create your account, sync your data across devices, and provide the core Go Gym service you sign up for.
• Explicit consent - to process the health and fitness information you log (special-category data), including data from Apple Health or Health Connect if you connect them. You give this consent when you sign up and log data, and you can withdraw it at any time by deleting the relevant data or your account.
• Consent - to load optional analytics and advertising cookies on the website and web app, and in-app product analytics on mobile. You control this through the cookie banner, the in-app analytics prompt, and your settings.
• Legitimate interests - to keep the service secure, prevent abuse and bot sign-ups, diagnose faults, and improve the product, balanced against your rights.

How we use it

We use your information to provide the Go Gym service, sync your data across devices, send service messages such as sign-up confirmations and password resets, keep the service secure, and improve the product. We do not sell your personal data, and we do not use your health and fitness data for advertising.

Apple Health and Health Connect

Connecting a health platform is optional. On iOS, Go Gym can read from Apple Health. On Android, Go Gym can read from Health Connect (Google's health data layer on Android 9 and later). We do not connect to Google Fit as a separate product. Other apps, including Google Fit, may write into Health Connect on your phone; if you connect Health Connect, Go Gym only reads the metrics you allow.

Go Gym never writes data back to Apple Health or Health Connect. You choose which metrics to sync. We currently read steps, active calories, weight, resting heart rate, sleep, walking and running distance, and body fat percentage. Synced values are stored as trackable entries in your Go Gym account so they appear alongside the rest of your logs.

This health data is used only to fill in your trackables. It is never used for advertising, never sold, and never shared with third parties for their own purposes. You can disconnect in Go Gym settings, and you can review or withdraw access in the iOS Health app or in Health Connect (on Android 14 and later: Settings → Security & privacy → Health Connect).

Service providers we share data with

We use a small number of trusted providers who process data on our behalf under contract:

• Supabase - hosting, database, and authentication for your account and app data (EU region).
• PostHog - privacy-focused product analytics and error logging on EU cloud infrastructure. You are identified only by an internal ID. Health fields, names, and email addresses are not sent to it. On the authenticated web app this loads only if you accept optional cookies; on mobile it loads only if you accept in-app analytics.
• Vercel - hosting the Go Gym website, web app, and API.
• Resend - sending transactional emails such as confirmations, password resets, and account notifications.
• Cloudflare Turnstile - bot protection on our sign-up form (see below).
• Apple and Google - account sign-in where you choose it, App Store and Play Store billing, and Apple Health / Health Connect if you enable those integrations.
• RevenueCat - managing optional subscriptions and entitlements. Payment card details stay with Apple or Google, not with us.
• Google Gemini - optional AI features such as food-photo estimates and in-app assistance. Only the content needed to run the feature is sent.
• ElevenLabs - optional voice assistant. We store privacy-minimised session records, not audio, transcripts, or health values.
• Google Analytics and Google AdSense - analytics and advertising on the marketing website and, for Analytics, the authenticated web app. Loaded solely if you accept optional cookies. See our Cookie Policy.

In-app advertising (Google AdMob) is not yet active. When ads are introduced, this policy will be updated to describe them.

Bot protection (Cloudflare Turnstile)

When you sign up for Go Gym, we use Cloudflare Turnstile in invisible mode to help distinguish genuine sign-ups from automated bot traffic. Turnstile processes minimal client-side signals such as IP address, browser metadata, and site origin solely for bot detection. We do not use Turnstile to profile or target you for advertising. For more detail on how Cloudflare processes this data, see the Cloudflare Turnstile Privacy Addendum.

Cookies and analytics

On the website and web app we ask for your consent before loading analytics or advertising cookies. Product analytics in the mobile app is a separate, in-app choice and does not use browser cookies. If you decline, optional analytics and advertising tools are not loaded. See our Cookie Policy for what each tool sets and how to change your choice.

Where your data is stored and transferred

Your account and app data is stored with Supabase in the EU region, and PostHog analytics is processed on PostHog's EU cloud. Some providers (for example Google, Apple, Cloudflare, Vercel, RevenueCat, ElevenLabs, and Resend) may process data outside the UK/EU; where data is transferred internationally, it is protected by appropriate safeguards such as UK/EU standard contractual clauses or an adequacy decision.

How long we keep it

We keep your personal data for as long as your account is active. If you request account deletion, we apply a 14-day grace period (during which you can cancel) and then permanently delete your account and associated records, except where we must retain limited information to meet a legal obligation. Data may persist briefly in encrypted backups before those cycle out.

Your rights

Under UK data protection law you have the right to access your data, request a copy or export, have it corrected or deleted, restrict or object to processing, and withdraw consent at any time. You can delete your account and data from within the app, or contact us at privacy@go-gym.app. If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.

Age

Go Gym is intended for people aged 18 and over. We do not knowingly collect data from anyone under 18.

Not medical advice

Fitness data, food logs, and measurements in Go Gym are for informational purposes only. They do not constitute medical, dietary, or professional health advice. Always consult a qualified professional for medical decisions.

Changes to this policy

We may update this policy from time to time. The "Last updated" date below will change when we do. For a material change we will try to notify you in the app or by email.