GymRot
Privacy Policy
GymRot ("the app", "we", or "our") helps you earn screen time by completing workouts. We designed the app to keep as much data as possible on your device. This policy explains what data the app handles and why.
By using the app, you agree to the collection and use of information in accordance with this policy.
Information collection and use
Signing in is optional. The app's core features (scheduling, app blocking, workouts, streaks, AI plans) run locally on your device. When you sign in with Apple and use the account features, we store the data described below on our servers, only to provide those features. We do not sell your data, use it for advertising, or include any third-party analytics or tracking SDKs.
Account and profile
Sign in with Apple provides an account identifier and email address. You choose a username and display name. If you set a profile photo, it is stored so friends can see it.
Friends and sharing
We store friend requests and accepted friendships. Friends can see your display name, photo, current streak, avatar stage, and avatar customization. When you share a workout plan, a snapshot of that plan is stored so the recipient can import it.
Workout events and schedule backup
If you've made an account, we store the dates on which you completed a workout or took a rest day so your streak stays accurate on the leaderboard. Without an account, all of this stays on your device. We also keep a backup of your setup so you don't lose it if you reinstall or switch phones: your weekly schedule, your workout plans, your saved gym locations and home gym, your bodyweight (if set), your unit preference, and your appearance setting. The set-by-set history of your finished workouts is not part of this backup; see iCloud backup below.
iCloud backup
If you have an account, the app can also keep a fuller backup (set-by-set history, plan library, custom exercises) in your personal iCloud. This backup lives in your own Apple Account's storage; it is never sent to us and we cannot read it. It's on by default; you can turn it off anytime in Profile, which deletes the backup, and deleting your GymRot account deletes it too (if the app is offline at the time, the deletion completes the next time it's online). You can also view or remove the backup yourself anytime in your device's iCloud storage settings.
Crash reports
If the app crashes or misbehaves, Apple's MetricKit produces a diagnostic report (stack traces, app/OS version, device model) that we upload to a write-only table to fix the problem. These reports never contain your location, health data, or content.
Location data
Checking whether you're at one of your saved gyms (geofencing) happens entirely on your device. No location fix, movement, or visit history is ever transmitted. Only the gym places you deliberately save are included in the schedule backup and the optional iCloud backup, as described above.
Screen Time data
The list of apps you choose to block is managed by Apple's Screen Time system entirely on your device, in a form the app cannot read. We never learn which apps you block, and that information can never be sent to us.
Health data
If you turn on "Save workouts to Health" (Profile → You), the app writes your finished workouts (type, duration, calories) into Apple Health on your device. You can revoke access anytime in the Health app. GymRot requests no read access and never receives any data from Health.
AI features
The optional "Generate with AI" feature uses Apple Foundation Models, which run entirely on your device. Prompts and generated plans are not sent to us or any third party.
Service providers
- Apple — Sign in with Apple (authentication). Apple Health, Screen Time, and the on-device AI run on your device and are covered in their own sections above.
- Supabase — database, storage, and authentication hosting (data processor for the data listed above).
Security
The security of your information is important to us, but no method of electronic storage is 100% secure. While we strive to use commercially reasonable means to protect your data, we cannot guarantee its absolute security.
Data retention and deletion
You can delete your account at any time in the app: Home → Profile → Delete account. This permanently deletes your profile, photo, friendships, shared plans, workout-event history, schedule backup, and crash reports from our backend. On-device data is removed when you delete the app; workouts you exported to Apple Health belong to your Health database and can be deleted there.
Your rights (EU, UK, and similar jurisdictions)
Where local law grants them (such as the GDPR), you have the right to access, correct, export, or erase your personal data, to restrict or object to its processing, and to withdraw consent at any time. We process account data because it's needed to provide the features you signed up for (contract), and crash reports to keep the app working (legitimate interest). Most rights you can exercise directly in the app; for example, deleting your account (above) erases all of your server data. For anything else, email us and we'll respond. You can also lodge a complaint with your local data-protection authority. Our backend is hosted in the United States, and our data processor handles international transfers under standard contractual clauses.
Children
GymRot is not directed at children under 13, and we do not knowingly collect data from them.
Changes to this privacy policy
We may update our Privacy Policy. We will notify you of any changes by posting the new Privacy Policy on this page.
You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy will be reflected by a new effective date at the top.
We will not change this agreement to allow the collection of your personal information or make other significant changes without your consent.
Contact us
If you have any questions about this Privacy Policy or your data, please contact us at gymrotsupport@gmail.com.