Last Updated: October 19, 2026
GymR is operated by ZiYing Zhang, an individual based in China. The operator location, hosting locations and App Store distribution territories are distinct; the main database is hosted in Japan (Tokyo). Privacy contact: ryanzhangfor33@gmail.com.
To provide fitness training records and AI analysis services, we collect the following categories of information:
We do NOT collect: precise location, contacts, browsing history.
We use the collected data for the following purposes:
If you are in the European Economic Area (EEA), our legal bases for processing your personal data include:
For health-related data (Art. 9), we process only with your explicit consent. You may withdraw consent at any time; withdrawal does not affect the lawfulness of processing before withdrawal.
Health-platform connections and AI are optional. Open My → System Settings → AI data & consent to withdraw text, image/video or cloud-speech consent for this account on this device. Manage other devices separately. Withdrawal blocks later requests; already-sent requests may still be processed by their recipients and existing content is not automatically deleted. Request deletion using section 13. Revoke system permissions separately in device settings. New purposes or recipients requiring consent must be disclosed and that consent obtained before processing.
Current text and vision AI routes support Xiaomi MiMo, Alibaba Cloud Qwen and configurable Google Gemini. Earlier versions also disclosed or used DeepSeek. Different features may use different models and disclosed primary/backup routes based on availability, quality, cost, safety and compliance requirements.
Login credentials are not sent by default; avoid unrelated identity information in your input. A failed request may be retried with another disclosed provider above. More than one recipient may receive the same content, including recipients that did not return the final result. Dynamic routing alone does not constitute consent to a new recipient.
Each provider may have different rules for retention, model training or improvement, human review, and international transfers. The provider that actually receives data depends on the route used for that request, and its current privacy policy and service terms govern the processing. Free or unpaid services may have different data-use rules from paid services; do not submit sensitive, confidential, or unrelated third-party personal information.
Relevant provider policies: Google Gemini API Additional Terms and Google Privacy Policy; DeepSeek Privacy Policy; Xiaomi MiMo Privacy Policy; and Alibaba Cloud Model Studio Privacy Notice.
We select providers based on performance, privacy practices, availability, and cost, and continuously evaluate alternatives. All AI features are optional — core workout tracking functions work without AI.
With your explicit authorization, GymR can exchange data with Apple Health on iOS or Google Health Connect on Android:
Content you confirm importing and saving may become GymR account profile or workout records. If you choose AI, relevant data may be sent to disclosed providers as described above. GymR does not use health-platform data for advertising or data trading. Declining health access does not prevent basic manual logging. Manage permissions in your health platform; deleting GymR does not automatically remove health-platform, paired-device or exported copies. Manage those separately.
We do not sell your personal data. We share your data only in the following circumstances:
Sharing you initiate: exports, posters, plans and teaching links may be disclosed to recipients you select. Downloaded, forwarded or third-party copies cannot automatically be recalled by deleting GymR. Third-party video platforms such as YouTube process playback connections under their own policies.
We use TLS for service connections, provider-supported server encryption, access controls and authentication. Profile, workout, media and consent caches support offline use on your device; some files may remain after logout. Protect your device and use system app-data clearing or uninstall controls when needed. No internet transmission or electronic storage is completely secure.
Saved profiles, workouts and analysis content are retained to provide account features while your account is active. Logout or uninstall does not delete your cloud account. The current cloud speech endpoint does not separately write recordings to GymR file storage. Temporary device recordings are cleaned up after processing or failure where possible; forced termination or cleanup failures can leave copies. Provider logs follow actual configuration and applicable terms. We do not promise zero retention.
Go to My > System Settings > Permanent Deletion, enter DELETE and confirm, or use our external account deletion page. The service cleans account-associated records and identifiable private uploads in active systems; success cannot be undone. Failed cleanup is reported as a failure: retry or contact support rather than treating it as completed deletion. Requests are handled promptly and no later than 30 days. Deleting GymR does not automatically cancel store subscriptions.
Data that we are legally required to retain, such as limited payment, tax, accounting, security, or fraud-prevention records, is retained only for the period required by applicable law or necessary for the stated legitimate purpose. Such records are access-restricted and are not used to provide your GymR profile. Apple App Store and Google Play transaction records are controlled by those platforms and are subject to their own retention policies.
Restricted disaster-recovery copies expire with actual backup rotation; removal of every record from all backups within 30 days is not guaranteed. Irreversibly anonymized statistics may remain. Store transactions and data received by AI providers follow their retention policies.
Workout records are not retained for an additional 12 months after confirmed permanent deletion. Export workouts before deletion via My > Data Management > Export Workout Data; contact support for other personal-data requests. Manage health-platform, paired-device, shared and exported copies separately.
GDPR (EEA Users):
CCPA (California Users):
To exercise any of these rights, contact us using the information below.
The current production Supabase database is configured in Japan (Tokyo). Media, diagnostics, AI and identity data are not necessarily processed only in Japan. Cloudflare storage/delivery and AI, identity and diagnostic providers may process necessary data in China, the United States or other regions depending on endpoints and arrangements.
Where required, transfers need applicable contractual arrangements (such as DPAs/SCCs) or another lawful mechanism and the required notice/consent. Availability of provider standard terms does not establish completion of every GymR agreement or transfer requirement. Contact section 13 for relevant recipients, regions and safeguards.
GymR is not intended for children under 16. We do not knowingly collect personal data from children under 16. If we become aware that we have inadvertently collected such data, we will delete it immediately.
We may update this policy and communicate material changes in the app or another appropriate channel. New sensitive-data purposes or recipients requiring consent need that consent before processing; continued use alone does not replace explicit consent. The date above identifies this revision.
Email: ryanzhangfor33@gmail.com
Privacy contact: ryanzhangfor33@gmail.com. This does not represent appointment of a statutory Data Protection Officer (DPO). Include the request type and account email for verification, not passwords or full identity credentials.
You also have the right to lodge a complaint with your local data protection authority (DPA).
For EEA users: the DPA in your country of residence.
For UK users: Information Commissioner's Office (ICO)
For California users: California Privacy Protection Agency (CPPA)