Privacy Policy

Last updated: October 6, 2026

This policy explains what data we handle when you use the GymSets app (on iPhone, Apple Watch, Android and Wear OS), our website appgymsets.com and our emails: what we use it for, who we share it with, how long we keep it, and what you can do about it. We've tried to write it in plain English. If anything is unclear, get in touch.

1. Who We Are

The controller of your data is GymSets (GainCircle Labs). For anything privacy-related, or to exercise your rights, email privacy@appgymsets.com. For questions about the app or your account, email support@appgymsets.com.

2. The Short Version

• You can use the app without an account. Without one, your workouts stay on your phone.
• If you sign in, we store your workouts in the cloud so they sync. We also send your session stats (including a calorie estimate) and your onboarding answers to our marketing database, even if you don't sign up for our emails. Section 3.3 explains this.
• We only send you marketing emails if you say yes, and you can unsubscribe at any time.
• What we read from Apple Health or Health Connect, and what your watch measures, stays on your devices.
• Progress photos stay on your phone.
• We don't sell your data.

3. What We Collect, Why, and Our Legal Basis

3.1. Your Account

When you sign in with Apple or Google, we receive your name, your email address and a user ID, plus your profile photo URL if you use Google. If you use Apple's Hide My Email, we get an Apple relay address instead of your real one. Accounts are handled by Firebase Authentication (Google).

Why: to identify your account and sync your data across devices. Legal basis: we need it to provide the service you ask for (performance of a contract).

3.2. Your Workouts and Sync

The app stores your sessions with their exercises, sets, reps, weights and times, the exercises and routines you create, your body weight, and your settings and preferences. If you enter them in Settings › Your details for calories, it also stores your sex, year of birth and height: they're optional, and together with your weight we use them to estimate the calories you burn in your sessions. You can change or delete them at any time.

All of this is stored on your device. If you sign in, it's also stored in Firebase Firestore (Google), so you can restore it and use it on other devices. Progress photos stay on your phone only: we never upload them to any server.

Why: so the app works and you don't lose your data. Legal basis: performance of a contract.

3.3. Your Workout Stats and Onboarding Answers

If you're signed in, every time you finish a session the app sends a summary to our marketing database (hosted on Cloudflare): number of sets and reps, total weight lifted, duration, a calorie estimate, the muscle groups you trained, your best set, whether an exercise has stalled for weeks, your streak and your personal records. It also tells us when you log a progress photo (only that you logged one, never the photo itself). And once you sign in, it sends your onboarding answers: your goals, what's holding you back, the muscle groups you want to prioritise, how many weeks you're committing to, and your weekly sets target.

We do this for everyone who is signed in, including people who don't sign up for our emails. Without an account, none of this leaves your phone. The calorie estimate we send is based only on what you log in GymSets, never on Apple Health, Health Connect or your watch.

Why: to measure how GymSets is used and make it better, for example to learn which features help people train consistently. And, only if you've signed up for our emails, so that what we write to you is about your own training. Legal basis: our legitimate interest in measuring and improving the product. You can object at any time by emailing privacy@appgymsets.com: we'll stop using this data for that purpose and delete what we hold.

3.4. Your Record in Our Marketing Database

Each time you sign in, the app sends that same database your email address, your account name, your language, your time zone, your platform (iPhone or Android), the app version, the prices your store shows you and, if we know it, how you found us: the campaign parameters (UTM) from our website, Apple's campaign token, Google Play's Install Referrer, or the short link (appgymsets.com/s/…) from one of our social posts. If you previously joined our mailing list with the same address, we merge the two records.

Why: to learn which channels bring people in, to keep your record up to date and, if you've signed up for our emails, to send them at a sensible time in your time zone and with your store's prices. Legal basis: our legitimate interest in knowing where our users come from and keeping their details current. Marketing emails themselves are only sent with your consent (section 3.6).

3.5. Purchases and Subscriptions

Purchases are charged by Apple (App Store) or Google (Google Play): we never see your card or payment details. The stores notify us of each purchase, renewal, free trial, cancellation or refund (the product, price and currency, dates and trial status), and we keep those notifications in a purchase record linked to your account.

Why: to unlock Pro on all your devices, sort out problems, and keep our accounts. Legal basis: performance of a contract and our accounting and tax obligations.

3.6. Emails from GymSets

We only send you marketing emails (training tips, progress summaries, product news and offers) if you say yes: when the app asks you, in Settings › GymSets emails, or in a form on our website. We keep a record of every yes and every no — when, where, and which wording you agreed to — so we can show what you decided.

They're sent on our behalf by Brevo (Sendinblue SAS, France). We record whether you open an email and which links you tap, so we can tell which emails are useful. When you tap a link we also store your IP address and browser (the "User-Agent"), and we delete them after 90 days. The footer of every email says the most we'll send you in a week. To measure whether our emails actually help, a small, randomly chosen group of people doesn't get marketing emails.

You can unsubscribe at any time: with the link in every email, in the app's Settings, or by emailing us. Legal basis: your consent. Withdrawing it doesn't affect anything we did with it before.

A few emails don't depend on that setting because they're about your subscription or something you asked for: the welcome to Pro, your receipt, a failed payment notice, and replies to your messages. Legal basis: performance of a contract. And if you turn off your subscription's auto-renewal, we write to you once to ask why. Legal basis: our legitimate interest in understanding why people leave; you can object by emailing privacy@appgymsets.com.

3.7. Our Website Mailing List

If you leave your email in a form on our website, we store your first name, your email address, your language, the form or notice you used to sign up, the page's campaign parameters (UTM), and when you gave your consent. To check that a real person is signing up, we use Cloudflare Turnstile (section 5).

Why: to send you what you asked for and news about GymSets. Legal basis: your consent.

3.8. Notifications

If you're signed in and allow notifications, we register your device with Firebase Cloud Messaging (Google) and store on our server its notification token, your language, your time zone, your platform, the app version and which notifications you want. We delete it when you sign out. You can choose which notifications you get in the app's Settings, or turn them off in your phone's settings.

Why: to tell you about your streak, remind you to train, let you know about your account and, only if you turn it on, tell you about offers. Legal basis: our legitimate interest for alerts and reminders, which are part of the app. Offers only with your consent: they're off by default.

3.9. App Usage Analytics (Ours)

We also collect our own usage statistics, so we can see where people drop off during onboarding and which screens actually get used: the screens you open, the features you use, the app version, your platform, language and country. They're tied to a random installation ID that is generated on your device: it doesn't come from Apple or Google, and it disappears when you delete the app. While you're not signed in, that ID is all we have and it isn't connected to any account. If you sign in, we link it to your account, so we can tell that the person who installed the app and the person who signed up are the same one.

Through this we don't store your IP address, your email, or anything about the content of your workouts. The data goes to our own server (Cloudflare). Events are deleted after 35 days; after that only totals remain, and those can't be traced back to anyone.

You can turn this off at any time in Settings › Privacy › Usage analytics. When you do, the installation ID is discarded, its link to your account is deleted, and the statistics already sent from your device are deleted from our server. Legal basis: our legitimate interest in improving the app.

3.10. Google Analytics (Only If You Agree)

In the iPhone and Android apps we only use Google Analytics for Firebase if you agree to it. It has its own unticked box when we ask you about our emails, and its own switch in Settings › Privacy, which stays off until you turn it on. If you do, Google collects how you use the app (screens and actions), details about your device, and an app installation ID.

Legal basis: your consent. You can turn it off at any time in the same place.

3.11. Crashes and App Performance

To find and fix bugs we use Firebase Crashlytics and Firebase Performance Monitoring (Google). When the app crashes or something is slow, they send a technical report: what went wrong or how long it took, your device model, system and app versions, language, and an installation ID. They don't include your workouts.

Legal basis: our legitimate interest in keeping the app working properly.

3.12. Advertising

On the free plan we show ads from Google AdMob. Before showing them, if you're in the European Economic Area, the UK or Switzerland, we ask for your permission with Google's consent form; on iPhone, Apple also asks whether you allow tracking. With your permission, Google may use your device's advertising ID, your IP address, your approximate location (worked out from your IP), device details and how you interact with ads, to show you personalised ads and measure them. If you don't give permission, the ads aren't personalised.

You can change your mind at any time in Settings › Ad privacy options and, on iPhone, in your phone's settings (Privacy & Security › Tracking). GymSets Pro has no ads. Legal basis: your consent, both for personalised ads and for storing or reading information on your device. Google decides for itself some of what it does with this data, as described in its privacy policy.

3.13. Feedback You Send from the App

If you send us feedback from the app, we store your message, your name and email, your device model, system and app versions, language, country, whether you have Pro, how many sessions you've logged, and your installation ID and, if you're signed in, your account ID. That context helps us understand and answer you: you'll see our reply and your message's status under “My messages”, and we send you a notification when they change (you can turn it off in the app's notification settings, “Replies to your messages”). If someone uses feedback to abuse the service, we can block their account or installation for a while; we keep the block and its reason while it lasts. We delete feedback after 24 months.

Why: to reply to you and fix what you tell us about. Legal basis: our legitimate interest in helping you and improving the app.

3.14. Email You Send Us

When you write to any @appgymsets.com address, we store your message so we can keep track of it and answer it: your name and email address, the subject, the text of the message, and any attachments. It is stored in Cloudflare D1, the same database and provider as our marketing database. Only the people responsible for that particular address can read it.

Attachments are deleted 30 days after the conversation is closed. The conversation itself is deleted after three years, or earlier if you ask us to.

Data protection requests go to privacy@appgymsets.com, which is read only by GainCircle Labs. Our marketing team has no access to it.

Legal basis: our legitimate interest in answering people who write to us.

3.15. Sharing a Session

When you share a session (for example, to Instagram Stories), you decide where it goes. The image goes straight from your phone to the app you pick (for Instagram, that's Meta), and from then on their privacy policy applies. We don't get anything back.

3.16. Security and Abuse

We use the technical data we can't do without, such as the IP address of each connection, to protect the service, limit abuse and spot bots. We only store it where this policy says so. Legal basis: our legitimate interest in keeping the service secure.

4. Apple Health (HealthKit), Apple Watch and Health Connect

Connecting to the Health app is optional and stays off until you turn it on, when you set up the app, in Settings or when you finish a session. If you turn it on:

• We write to Health each session you finish, as a strength workout with its duration and an estimate of your active calories, plus the body weight you log in the app.
• We read from Health your most recent body weight, only to estimate that workout's calories when you haven't logged your weight in the app; if you allow it, your sex, date of birth and height, only to estimate your sessions' calories inside the app when you haven't entered them yourself; and your workouts, only so we never save the same one twice.
• With the Apple Watch app, your watch measures your heart rate and active calories during the workout and saves the workout to Health. Those calories reach your iPhone, which shows them for that session and uses them to fine-tune the estimate for your other sessions.

What we read from Health and what your watch measures stays on your devices: it is never sent to our servers, never synced to Firebase, never used for advertising or marketing, and never shared with anyone. The sets you log on your watch go straight to your iPhone and, from there, are handled like the rest of your workout data (section 3.2).

You can turn the connection off in the app's Settings, and revoke access at any time in Settings › Health › Data Access & Devices › GymSets. Anything already saved in Health belongs to you and is managed from the Health app; if you delete a session in GymSets, its workout is deleted from Health too.

On Android the same applies to Health Connect: connecting is optional and stays off until you turn it on, when you set up the app, in Settings or when you finish a session. If you turn it on, we write to Health Connect each session you finish, as a strength workout with its duration and an estimate of your active calories, plus the body weight you log in the app; and we read your most recent body weight from Health Connect, only to estimate that workout's calories when you haven't logged your weight in the app, and your height, only to estimate your sessions' calories inside the app when you haven't entered it yourself. With the Wear OS app, your watch measures your heart rate and calories during the workout and passes them to your phone, which uses them the same way as on iPhone. What we read from Health Connect and what your watch measures stays on your devices, with the same guarantees as what we read from Health: it is never sent to our servers, never synced to Firebase, never used for advertising or marketing, and never shared with anyone. You can turn the connection off in the app's Settings, and revoke access at any time in Health Connect › App permissions › GymSets; if you delete a session or a weight entry in GymSets, it is deleted from Health Connect too.

Legal basis: your explicit consent, which you give when you turn the connection on and grant access, and which you can withdraw at any time.

5. Our Website and What It Stores in Your Browser

• Hosting. The site is served by Cloudflare, which needs your IP address to deliver the pages and protect them from attacks.
• Visit statistics. We use Cloudflare Web Analytics, which uses no cookies and doesn't identify you: it counts visits per page, which site you came from, your country, and your browser and device type.
• Forms. When you start filling in a sign-up form, we load Cloudflare Turnstile to check that you're a person and not a bot. Turnstile looks at technical data from your browser and connection (such as your IP address); we don't use it to follow you around or for advertising. Legal basis: our legitimate interest in keeping out fake sign-ups.
• Short links. If you arrive through one of our short links (appgymsets.com/s/…), we count the click in a daily total, without storing who you are.
• Cookies. The site doesn't use cookies. So it doesn't show you the same notice again, it keeps a few markers in your browser's storage that never leave it: gs-promo:… if you close a notice, gs-promo-alta:… if you sign up through one, and gs-promo-c:… so your click is only counted once. All three are written only when you act. There's also gs-promo-s:…, which stops the same notice from showing twice in one visit and disappears when you close the tab. You can clear them at any time in your browser settings.
• The site doesn't use Google Analytics today. If we ever turn it on, it will only run if you accept it in a notice where "Accept" and "No thanks" look the same, and your answer will be kept in your browser (gs-consent).

6. Who We Share Your Data With

We don't sell your data or give it to anyone for their own marketing. We work with these providers, who handle data on our behalf and follow our instructions:

• Google (United States): Firebase Authentication, Firestore, Cloud Messaging, Crashlytics, Performance Monitoring and, if you agree, Google Analytics; plus AdMob for ads — Firebase privacy · Google privacy
• Cloudflare (United States): our server (Workers), our database (D1), file storage (R2), incoming email (Email Routing), the website (Pages), visit statistics (Web Analytics) and bot protection (Turnstile) — Privacy
• Brevo (Sendinblue SAS, France): sending our emails — Privacy

Apple and Google are also involved as app stores (App Store and Google Play), for sign-in and, on iPhone, through the Health app; they handle your data under their own policies (Apple, Google). Meta receives the image you share to Instagram, only when you share it. And we'll only hand data to an authority if the law requires us to.

Inside GymSets, team members reach the marketing database through an internal dashboard, each with their own login and access only to what their job needs.

7. Data Outside the European Economic Area

Google and Cloudflare are US companies, so some of your data may be processed outside the European Economic Area. Both take part in the EU-US Data Privacy Framework, and their data processing agreements also include the Standard Contractual Clauses approved by the European Commission. Brevo processes data in the European Union.

8. How Long We Keep Your Data

• Your account and workouts in the cloud: until you delete your account.
• When you delete your account in the app (Settings › Account › Delete account), we immediately delete your account, your Firestore data and all your data in our marketing database. The only thing we keep is the purchase record, without your name or email, for as long as accounting law requires. Deleting your account doesn't cancel your subscription: you cancel it in your store. If you no longer have the app, email privacy@appgymsets.com and we'll delete it for you.
• Data on your phone: until you delete it or uninstall the app.
• Marketing database: if 24 months go by without you using the app, opening or tapping any of our emails, and without an active subscription, we delete your marketing data automatically.
• Website mailing list: if you never created an account and there's been no activity for 24 months, we delete your sign-up.
• The record of your yes and no to our emails: as long as we keep your marketing data, so we can show what you decided.
• Email opens and clicks: one year. The IP address and browser of each click: 90 days.
• App usage analytics: events, 35 days; the installation record, up to 400 days after you last open the app.
• Notifications: until you sign out or delete your account.
• Feedback: 24 months.
• Email you send us: attachments, 30 days after the conversation is closed; the conversation, three years.
• Crash reports (Crashlytics): Google keeps them for 90 days.
• Google Analytics (if you agree to it): Google keeps what you do in the app for 2 months, and your installation data for 2 months after the last time you use it.

9. Your Rights

You can exercise these rights at any time, free of charge:

• Access: find out what data we hold about you and get a copy.
• Rectification: correct anything that's wrong.
• Erasure: have your data deleted.
• Restriction: have us stop using it while a complaint is being sorted out.
• Objection: have us stop using it where our legal basis is legitimate interest, such as your workout stats (section 3.3).
• Portability: get your data in a machine-readable format.
• Withdraw your consent at any time: with the unsubscribe link in any email, with the switches in Settings, or by emailing us.

You can do a lot of this yourself in the app: delete sessions, weight entries or your details for calories, turn off usage analytics or emails, and delete your account. For anything else, email privacy@appgymsets.com, ideally from the address on your account. We'll reply within one month (if the request is very complex we may need up to two more months, and we'll tell you). If we can't tell it's really you, we'll ask for the minimum needed to check.

We don't make decisions about you that significantly affect you based solely on automated processing.

If you think we haven't handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es) or to the data protection authority where you live. We'd appreciate the chance to put things right first, so please write to us.

10. Children

GymSets isn't meant for anyone under 16, and we don't knowingly collect data from anyone under 16. If you think a child has given us their data, let us know and we'll delete it.

11. Changes to This Policy

If we change this policy, we'll post the new version here with its date. If the change is significant, we'll let you know beforehand in the app or by email, if we have yours.

12. Contact Us

For questions about the app or your account: support@appgymsets.com
For questions about this privacy policy, or to exercise any of the rights in section 9: privacy@appgymsets.com