Privacy Policy

GymBro ("we", "us", "our") is an AI fitness coaching app. This page explains what information we collect, how we use it, and — since people regularly ask — exactly what happens with your camera, your location, and your health data.

Who operates GymBro

GymBro is operated by GymBro, established in Nigeria. For the purposes of applicable data protection laws, GymBro is the data controller responsible for the personal data described in this policy. You can reach us at igymbrosupport@gmail.com for any privacy-related request.

What we collect

• Account information: your name, email address, and password (handled securely via our authentication provider).
• Fitness data you choose to enter: age, weight, height, fitness goals, and workout history (rep counts, streaks, exercise selection, food logs).
• Location data during GPS activities: when you start a GPS-based activity (running, walking, cycling, hiking), we collect your device's precise location for the duration of that session to draw your route on a map and calculate distance, pace, and per-kilometer splits. This data is stored with that workout so you can view it later in your history. If you grant background location permission, tracking continues if your screen locks or you switch apps — you can revoke this at any time in your device's Settings, and it only ever applies while a tracked activity is actively running, never passively in the background at other times.
• Heart rate data (optional, via Health Connect): if you have a smartwatch or fitness band that writes heart rate data to Android's Health Connect, and you've granted GymBro permission to read it, we pull heart rate readings during your GPS activities to show live BPM and a post-workout heart rate chart. GymBro has no heart rate sensor of its own and cannot read this data without both a paired wearable and your explicit permission grant. You can revoke this permission at any time in Health Connect's own settings or your device's app permissions.
• AI coach conversations: messages you send to GymBro's AI coach, and the coach's replies, are sent to our AI provider (Groq) to generate a response — see "AI coach data" below for exactly how long that's kept and what it's used for.
• Subscription & payment status: we know whether you're on a free trial or a paid Pro subscription, and your subscription expiry date. On Android, subscriptions are purchased through Google Play Billing — Google acts as the merchant and we never see your card details. On other platforms, payments are processed by Flutterwave. Either way, GymBro never sees or stores your card information directly.
• Profile photo (optional): if you choose to upload a profile picture, it's stored securely and is visible within your own account, and to other members of any group you belong to. You can change or remove it at any time.
• Group data (if you join or create a group): the groups you're a member of, and — only if you explicitly turn them on — your workout summaries and/or live location during outdoor activities may become visible to other members of that specific group. Both are off by default and controlled per-group; see the "Groups" section below.
• Feed content: photos, captions, comments, and reactions you post to the GymBro feed, along with the time you posted them and your profile name and photo as shown on those posts. Anything you post to the feed is visible to other GymBro users (see the "Community feed" section below).
• Referral information: if you refer a friend or are referred by one, we track that relationship and any referral earnings.

What we never collect

• Camera video or images. Pose detection runs locally on your device using on-device processing (MediaPipe) — no video frame is ever uploaded.
• Voice recordings (our AI coach speaks to you; it does not listen to or record you).
• Your location outside of an actively tracked GPS activity, or background location without your explicit, separate permission grant.
• Heart rate or other health data, unless you've paired a wearable with Health Connect and explicitly granted GymBro permission to read it.

AI coach data

GymBro's AI coach is powered by Groq, a third-party AI inference provider. Here's specifically what that means for your messages:

• Groq's own agreement with us prohibits using your messages or the coach's replies to train or fine-tune any AI model.
• Groq does not retain your messages by default. The only exception is a short-term technical one: if Groq is actively troubleshooting a platform reliability issue or investigating suspected abuse, it may temporarily log messages for up to 30 days before deleting them — this is a narrow operational safeguard, not routine storage.
• Groq is not given your name, email, or account identifier alongside your message — it receives the conversation content needed to generate a reply, not your GymBro identity.

Because of this, we ask that you avoid sharing highly sensitive information (like specific medical diagnoses, financial details, or other personal identifiers you wouldn't want logged even temporarily) in your messages to the AI coach — treat it the way you'd treat a message to any third-party service.

Location & GPS tracking

When you start a GPS-based activity, GymBro records your position periodically to build a route, calculate distance and pace, and generate per-kilometer splits after your session. This data is attached to that specific workout and stored with your history, the same way rep counts are.

If you turn on live location sharing for a group you belong to, your position updates roughly every 15 seconds and is visible to other members of that specific group for as long as your session is active — displayed as a colored dot on their map alongside their own position. This is off by default, controlled per-group, and stops immediately when you end the session or turn the toggle off. Members you haven't shared with, and people outside that group, never see this.

Health & heart rate data

GymBro can optionally read heart rate data from Android Health Connect during a GPS activity, if — and only if — you have a paired smartwatch or fitness band whose own app is already writing heart rate into Health Connect, and you've granted GymBro permission to read it. GymBro has no way to measure heart rate on its own. This data is used only to show a live BPM reading during your workout and an average/max heart rate chart afterward. GymBro does not write data back into Health Connect beyond what's needed for this feature, and does not share this data with anyone else, including other group members.

Community feed

GymBro has a feed where members can post photos and updates, similar to a social feed. Posts you share there, including your photos, captions, comments, profile name, and profile photo, can be seen by other GymBro users. Only post what you are comfortable sharing, and avoid including personal details such as your home address or other information you would not want public.

We have community rules for what can be posted. Users can report posts or accounts that break those rules, and when a report is made we will review it and act where appropriate, which may include removing content or restricting or removing accounts.

You can delete your own posts at any time. Deleted posts are removed from the feed, and remaining copies are handled as described in "Data retention" below.

Groups

Groups are optional. If you create or join one, other members can see the group's name and membership list. Two additional things are opt-in and controlled per-group, both off by default:

• Share workout data — lets members of that specific group see your completed sessions and stats.
• Share live location — lets members of that specific group see your live position on a map only while you're actively doing a GPS workout (see "Location & GPS tracking" above).

You can turn either off at any time from the group's page, and doing so stops future sharing immediately.

How we use your data

• To operate your account and sync your workout progress across devices.
• To draw your route and calculate distance, pace, and splits after a GPS activity.
• To display heart rate data during and after a workout, if you've connected a wearable via Health Connect.
• To generate AI coach replies to messages you send it.
• To power group features you've explicitly opted into.
• To display your posts on the feed and to review reports and enforce our community rules.
• To process subscription payments through Google Play Billing (Android) or Flutterwave (other platforms).
• To credit referral earnings when someone you refer subscribes.
• To send you notifications you've opted into (streak reminders, offers).

We do not sell your personal data to third parties. More specifically: we do not use your data for advertising or ad targeting, we do not sell or share it with data brokers, we do not use it for cross-app or cross-site tracking, and — beyond what's needed to generate a reply in the moment — we do not use your data to train AI models, ours or anyone else's.

Who we share data with

• Supabase — our database provider, which securely stores your account, fitness, location, and group data.
• Google Play — for Android subscription purchases, Google acts as the payment processor and merchant of record; Google's own privacy policy applies to that transaction. GymBro receives confirmation that a purchase is valid, not your payment details.
• Flutterwave — our payment processor for non-Android subscriptions, which handles those payments directly.
• Android Health Connect — this is a data source on your own device, not a third party we send data to. Heart rate data flows from Health Connect into GymBro, one direction, only with your permission.
• Groq — powers our AI coach's text responses. See "AI coach data" above for specifics on retention and training.
• Other GymBro users — anything you post to the community feed, including your profile name and photo shown on those posts.
• Other members of a group you belong to — only whatever you've explicitly opted to share with that specific group (workout data and/or live location), and only for as long as you keep that sharing turned on.

Security

Your data is stored with Supabase, our database provider, which encrypts data in transit (HTTPS/TLS) and at rest. Access to production data is restricted to what's needed to operate and support the app, and authentication to our systems is protected accordingly. No method of storage or transmission is 100% secure, and we can't guarantee absolute security — but if we become aware of a data breach affecting your personal information, we will notify affected users and relevant authorities as required by applicable law.

Your rights

You can request a copy of your data, ask us to correct it, or request deletion of your account and associated data at any time by contacting us. If you're in a region covered by GDPR or NDPR (Nigeria's data protection law), you have the right to access, correct, or delete your personal data, and to withdraw consent at any time.

Data retention

We retain your account data — including workout history, GPS routes, and heart rate data where applicable — for as long as your account is active. Live location shared with a group is not retained beyond your active session; it reflects your current position only and is not kept as a historical log of everywhere you've been.

If you delete your account, here's specifically what happens:

• Your profile, workout history, GPS routes, heart rate data, and group memberships are deleted from our active systems within 30 days of the deletion request.
• Payment/transaction records are retained separately for 7 years, as required for accounting and tax compliance — this is a legal obligation on us, not a choice.
• Data may persist briefly in encrypted backups after deletion, and is purged from those backups on our normal backup rotation cycle (within 90 days).
• We may retain minimal records (e.g. that an account existed and was deleted) where needed to prevent abuse of the referral system or comply with a legal obligation.

Children's privacy and minimum age

GymBro is for people aged 16 and over. It is not directed at children, and we do not allow anyone under 16 to create an account or use the app, including the community feed. We do not knowingly collect personal data from anyone under 16. If we learn that an account belongs to someone under 16, we will remove the account and delete the associated data. If you believe a child under 16 has provided us with personal data, contact us and we will delete it.

Changes to this policy

We may update this policy as GymBro evolves. We'll update the date at the top of this page when changes are made.

Contact

Questions about your data or this policy? Email us at igymbrosupport@gmail.com, or use Contact Support inside the app (Settings → Support).