GymSet AI Privacy Policy
Last updated: 2026-10-21
This policy explains what data GymSet AI ("the App") collects, why, which service providers process it, how long it is kept, and how you can delete it.
- Operator: CHOU TING-RUI (individual developer)
- Contact: support@gymsetai.com
1. Data we collect
You need an account to use the App. After you log in, the following data is stored in our cloud database:
| Data | When it's collected | Who can see it |
|---|---|---|
| Email address | When you sign up, log in, or reset your password | Only you |
| Password (email sign-up accounts only) | When you sign up with email or reset your password. The authentication service (Supabase Auth) stores it hashed, and we never see it in plain text. Accounts that sign in with Apple or Google have no password | No one |
| Account ID | Generated automatically when you sign up | Used internally |
| Apple sign-in data (Sign in with Apple accounts only): your Apple user ID and email address. If you chose to hide your email from Apple, this is a relay address created by Apple, not your real inbox. The App does not ask Apple for your name | When you sign in with Apple; stored by the authentication service (Supabase Auth) | Only you |
| Apple token (Sign in with Apple accounts only): a refresh token Apple issues to the App | After you sign in with Apple, our server obtains it from Apple and stores it on the server | No one. Neither the App nor other users can read it; only our server uses it, when you delete your account |
| Google sign-in data (Google sign-in accounts only): your Google account ID, email address, name, and profile picture URL | When you sign in with Google; stored by the authentication service (Supabase Auth) | Only you. The App does not use your name or picture as your nickname and does not show them to other users |
| Nickname | When you enter it at sign-up or change it later on the Profile tab | You, and anyone you have been in a battle with (or sent a rematch invite to), including users you don't know who were paired with you by random matching. An opponent can use "Share result" to send text containing your nickname outside the App |
| Gender (male or female) | When you first open the Home tab and pick a body figure | You. The App does not show it to other users, but users who have been in a battle or room with you can technically read this field from their account |
| Training plan | Synced automatically when you create or edit it | Only you |
| Workout logs: date, start and end times, exercise names, sets, weights, reps, cardio minutes, and notes you type | Synced automatically when you finish a workout | Only you, except that when a workout is used for a battle check-in, your opponent in that battle can see that workout. The App screen shows only a summary (workout day name and exercises), but technically your opponent's account can read the full record, including notes and start/end times |
| Battle data: invite code, whether it is a friend room or a random match, status, start and end dates, both players' total scores, result, rematch invites; for group rooms, also the battle type (team battle or ranking room), room size, member list and teams, and each member's total score and place | When you start, join, or accept a battle, or tap "Random match" to join the queue | Both players in the battle; in a group room, every room member. A random match that is still in the queue, with no opponent yet, is visible only to you |
| Usage events: which main actions you take in the App, such as opening the App, finishing onboarding, completing a workout, creating / joining / finishing a battle, and seeing / applying / editing an AI next-set suggestion, plus a few attached numbers or codes (for example battle mode). They contain no workout content, photos, Apple Health data, or text you type | When you take these actions | No other user can see them; we use them only for statistics |
| Rank data: your rank, rank points, number of placement matches played, season badges, plus a hidden skill rating the system calculates from your results, your count of consecutive battles with no check-ins, and any random-matching pause end time | When a random-match or random-group-room battle is settled | Rank and rank points: you, and opponents or room-mates who have shared a battle with you. How many rank points you gained or lost in each random group room: only you and your room-mates. Season badges and pause end time: only you. Hidden skill rating: no user can see it (including you); it is used only by the system |
| Check-ins and proof photos: the check-in date, the strength sets and cardio minutes you report for that day, the daily score calculated from them, and the photo | When you check in to a battle by taking a photo or picking one from your library | Only the people in that battle or room. Your battle opponent and your room-mates can see the sets, cardio minutes, daily score, and check-in photo you report each day |
| Rejections: who rejected which day's check-in, and when. In group rooms, rejection is a vote, and every rejection vote is recorded (who cast it, which check-in, and when) | When your opponent taps "Reject"; in a group room, when a member casts a rejection vote | Both players in the battle; in a group room, every room member |
| Reports: who reported, who was reported, the battle, the reason (inappropriate photo or nickname; harassment or other misconduct), and the time | When you report your opponent from the battle screen, or report another member from a group room's room screen | Only us (the operator). The person reported and your opponent cannot see reports, and are not notified |
| Blocks: who you blocked and when | When you block your opponent from the battle screen, or block another member from a group room's room screen | Only you (you can view and undo them under "Blocked users" on the Profile tab). The blocked person cannot see it, but once it is in effect they cannot join your battles or start a rematch with you, and the App does not explain why when that fails. Random matching will not pair the two of you either |
About random matching. There are two ways to start a battle: a "Friend room", which uses an invite code, and a "Random match", where the App pairs two users who are both in the queue. Your opponent in a random match is usually someone you don't know. Once you are paired, they can see exactly what a friend-room opponent can see: your nickname, your rank and rank points (once you have played random matches), your check-ins in that battle (including the sets, cardio minutes, and daily score you report each day) and proof photos, and the workout you use for each check-in. They cannot see your email address, your plan, or your other workouts. Pairing works like this: you are paired with the other user who has been in the queue longest and who meets the conditions. There are four conditions: neither of you has blocked the other, the two of you have no battle in progress, the other player has been queueing for less than 7 days, and your ranks are within one tier of each other (widened to two tiers once either of you has queued for 1 day, and to any rank after 2 days; players whose random matching is paused for skipping every check-in are not matched). Apart from rank data, matching does not use your location, training content or any other personal data. Reporting and blocking work the same way in random matches. A random match can pair you with a user of any age (the minimum age of 13 still applies), and the App does not group players by age. If you are a minor, we suggest using friend rooms only.
About group rooms. Besides 1v1, there are two kinds of group room: team battles (2v2, 3v3, 5v5) and ranking rooms. A friend group room opened with an invite code (team battles 2v2, 3v3 or 5v5, ranking rooms 3 to 10 players) can be joined only by people who have the code, and you can't join if you or anyone in the room has blocked the other. Every room member, including your teammates, can see exactly what an opponent can see as described above; wherever this policy says an opponent can see something, everyone in a group room can see it too. For random team battles (2v2, 3v3, 5v5) and random ranking rooms, the App places queued users in the same room. The people in your room are usually people you don't know. You are placed in a room only if: neither you nor anyone in the room has blocked the other, the room was created less than 7 days ago, and your rank is within one tier of everyone in the room (two tiers once you or the room has waited 1 day, any rank after 2 days), and at least one person in the room isn't paused from random matching. Apart from rank data, this does not use your location, training content or any other personal data.
Data we do not collect
- Location, contacts, or advertising identifiers (IDFA/AAID). The App does not read your device location.
- Third-party analytics, crash reporting, or advertising SDK data. The App includes none of these; the "usage events" above are recorded in our own database and are not shared with analytics or advertising companies.
- Google Health Connect or any sensor data. From Apple Health (HealthKit), the App only reads what is described under "About Apple Health" below.
- Payment information. The App has no paid features.
About Apple Health (iPhone only). The App uses Apple Health only for two features, each of which you turn on yourself. "Sync to Apple Health" (Profile tab) writes each finished workout to the Health app as a strength training session (start and end time) with an estimated active energy value (MET 5 × body weight × duration), so it counts toward your Move ring. For that estimate it uses the body weight you entered in the App; it also asks for permission to read body weight, but reads your latest body weight from the Health app only if you haven't entered one (70 kg if there is none). That weight is used only on your device for this calculation and is not saved or uploaded. "Import cardio from Apple Health" (workout screen) asks for permission to read workouts, then reads the workouts recorded in the Health app since the day your current session started (activity type, whether it was indoors, start time, duration, distance, and which app recorded it) only to list the cardio you can import. Apart from that body weight, it reads nothing else from Health. Only a workout you tap is added to your workout as a cardio entry (activity name, minutes, distance in the note, and that Health workout's ID so it isn't imported twice); like your other workouts, it syncs to our cloud database and its minutes count toward battle scores, so the opponent in that battle can see them. Workouts you don't tap are not saved or uploaded. Data from Apple Health is never used for advertising or marketing and is never sold. You can turn off read or write access anytime in the Health app → Sharing → Apps → GymSet AI.
About information inside photo files. A photo file can carry information written by the camera (EXIF), such as when it was taken and the device model. If location tagging is on in your camera, it may also include where the photo was taken. Before uploading, the App re-encodes the photo you take or pick from your library as a new JPEG image (at most 1600 pixels on the long side) that keeps only the picture itself, so the original file's EXIF information, including location, is not uploaded. If re-encoding fails, the App asks you to try again and never uploads the original file instead. What is visible in the picture itself is a different matter; see the next paragraph.
About check-in photos for cardio. When your workout includes cardio, we suggest photographing a screen that shows the time or distance. Do not photograph a route map. A route map can reveal where you live or the routes you usually run, and your opponent in that battle can see the photo. The App itself does not collect GPS location and does not record your route.
Data that stays on your device
The following data is stored only on your device and is never uploaded: your language setting, daily reminder time, rest timer and keep-screen-on settings, the training goal, experience level, days per week, weight unit and body weight (if you enter it) from the setup questions, a workout in progress that you haven't finished, which weekly recaps you have dismissed, proof photos waiting to be uploaded, and an invite code opened from a link (it expires after 24 hours). The starter plan built from your setup answers is part of your plan and syncs to the cloud like your other training data; your body weight is never written into the plan. In addition, so the App works offline, your device keeps your sign-in session and a copy of your plan and workouts (including anything not yet uploaded).
Server technical logs
Our cloud provider, Supabase, generates technical logs of connections and requests (for example, IP address, time, and request path) for security and troubleshooting. Supabase keeps these logs for a short period under its service plan and then deletes them automatically. We do not export them or keep them long term. Apart from the "usage events" in the table in section 1, the App does not separately record or upload your usage activity.
2. How we use your data
We use your data only to run the App:
- Email and password (email sign-up accounts only): to log you in and to send 6-digit codes for verifying your sign-up and resetting your password.
- Apple and Google sign-in data: to let you sign in with your Apple or Google account and recognize the same account the next time you sign in.
- Apple token: used only to revoke the App's Sign in with Apple authorization with Apple when you delete your account, and for nothing else.
- Training data: to show your plan, history, and progress charts, and to restore your data when you switch phones. The "AI suggests" weight is calculated on your device from your previous workout. No data is sent to an external AI service.
- Nickname, battle data, check-ins (including the sets and cardio minutes you report), and proof photos: to run one-on-one battles and group rooms (team battles and ranking rooms; friend rooms and random matches). Your opponents and room-mates can verify that you trained, and the App calculates each day's score, the winner, and placings. The scoring formula is in Section 2 of the Terms of Use.
- Gender: to choose the body figure drawn on your Home tab and on share cards.
- Usage events: to see which features are used and where people get stuck, so we can improve the App. They are not used for advertising, marketing, or tracking, and are not sold.
- Rank data: to calculate your rank from random-match and random-group-room results, to match players of similar skill, and to pause random matching after consecutive battles with no check-ins. The method is described in section 2 of the Terms of Use.
- Reports: so we can review inappropriate content and act on violating accounts. Blocks: to make the block work (their proof photos are no longer shown to you, and the two of you cannot join each other's battles, start rematches, or be paired by random matching).
We do not use your data for advertising, sell it, or use it to track you across apps.
3. Service providers
| Provider | What it processes | Location |
|---|---|---|
| Supabase (database, authentication, file storage) | All cloud data listed in Section 1, including proof photos | Asia Pacific, ap-northeast-2 (Seoul) |
| Resend (a US company that sends verification emails for us) | Your email address and the content of verification emails (a 6-digit code) | Data may be processed in the United States |
| Apple (Sign in with Apple, iPhone only) | Only if you choose to sign in with Apple: Apple verifies your identity and provides your Apple user ID and email address. Our server exchanges the authorization code from Apple for an Apple token, and sends that token back to Apple to revoke the authorization when you delete your account | Processed under Apple's privacy policy |
| Google (Google sign-in) | Only if you choose to sign in with Google: Google verifies your identity and provides your Google account ID, email address, name, and profile picture URL | Processed under Google's privacy policy |
Proof photos are stored in private storage. The App displays them through signed links that expire after 10 minutes. All traffic is encrypted with HTTPS.
We exchange data only with the providers in the table above, and only what the table lists. Apple and Google are involved only if you choose to sign in with them, and only the data needed for sign-in is exchanged (for Apple, also revoking the authorization when you delete your account); our server does not send your workouts, battles, check-in photos, or any other data to Apple or Google. Apart from this, we do not share your data with any third party. The only exception: we provide data only when the law requires it or when a competent authority requests it through a lawful process, and only to the extent necessary.
4. How long we keep data
- Account, nickname, plan, workouts, battles, check-ins, and proof photos: kept while your account exists. Nothing is deleted automatically.
- Rank data: kept until you delete your account and deleted together with it.
- Apple and Google sign-in data: part of your account; kept until you delete your account and deleted together with it.
- Apple token: kept until you delete your account. When you delete your account it is used to revoke the authorization with Apple, then deleted together with your account.
- Usage events: there is currently no automatic deletion. When you delete your account, the account field on these events is cleared, so the remaining records can no longer be linked to you.
- Workouts you delete: disappear from your screens. To keep your devices in sync, the server marks the workout as deleted, and its contents stay on the server until your account is deleted. If that workout was used for a battle check-in, your opponent can still see it as check-in evidence (the screen shows a summary; the full record is technically readable).
- Check-ins and proof photos: to keep battles fair, you cannot delete a check-in or photo after you submit it. You can retake today's photo during that day, unless your opponent has rejected it. A rejected photo cannot be replaced.
- Reports: nothing is deleted automatically; we keep them so we can act on them. Blocks: kept until you unblock, or until you or the blocked person deletes their account.
- Battles nobody has joined yet: you can take back a battle you started at any time, and its data is deleted. The same goes for a random match that is still in the queue: leave the queue and it is deleted.
- Server technical logs: kept by Supabase for a short period under its service plan and then deleted automatically (see Section 1).
- Backups: deleted data may remain in our provider's backups (if any) for a while, until those backups are overwritten on their normal cycle.
5. Deleting your data
In-app account deletion. Open the Profile tab, scroll to the bottom, and tap Delete account (the red text below Log out). In the confirmation dialog, tap Delete forever. Deletion happens right away and can't be undone. Deleting your account also deletes your nickname, plan, workouts, and check-ins. If you signed in with Apple, before deleting, the App asks our server to revoke the App's Sign in with Apple authorization with Apple; whether or not that succeeds, the Apple token on our server is deleted together with your account. If you use Apple or Google to sign in, you can delete your account this way just by signing in the same way in the App; you don't need to know the account's email address.
Deletion by email. If you can't use the App, email support@gymsetai.com from the email address of your account and tell us you want your account deleted. After we confirm you are the account holder, we will complete the request within 30 days. These requests are handled manually, and the same data is deleted as with in-app deletion. If you signed in with Apple and chose to hide your email, your account's email address is an Apple relay address that you may not be able to send from. In that case, please use in-app deletion above instead: signing in with Apple in the App is the most direct way to confirm you are the account holder.
Battle results are kept, but anonymized. So your opponents don't lose their records, battles you took part in stay on their side. Your nickname, check-ins, and workouts are deleted, and your opponent only sees "Deleted user", the result, and both players' final total scores. Rejections you made of your opponent's check-ins still stand, but no longer record who made them. A battle in progress ends when you delete your account: if it was already decided, the actual result stands; if not, your opponent wins it. Battles that don't have an opponent yet (including a random match still in the queue) and rematch invites are deleted. A battle that already has an opponent but only starts the next day counts as in progress. Group rooms work differently: a group room in progress does not end when you delete your account. Your total is frozen on the day you delete it (today counts as −10 if you haven't checked in yet), each remaining day then counts as −10, and the other members see "Deleted" with that score. In a group room that hasn't started, you leave, and if you were the host, hosting passes to the remaining member who joined earliest and hasn't been kicked; the room is deleted only if nobody else is left in it. Your opponent can't send you a rematch. If your opponent later deletes their account too, the battle is deleted completely.
Reports and blocks. When you delete your account, blocks involving you (ones you made and ones against you) are deleted. Reports are not deleted; we keep them so we can act on them. The fields that point to your account (as reporter or as the person reported) are cleared, leaving only the reason, the time, the battle it belongs to, and the other person's account ID. If you were the person reported, the report is kept but can no longer be linked back to your account.
Proof photos. When you delete your account, the App attempts to delete the proof photos you uploaded as well. Whether or not that deletion succeeds, your opponent can no longer get new links to those photos once your account is deleted. Photos your opponent already opened before you deleted your account may remain viewable for a short time through cached links. If the photo deletion fails (for example, because the network dropped at that moment), the files may remain in our storage, but other users can no longer read them. You can email us to have them removed manually.
To remove the data stored on your device, uninstall the App.
- You can also find the account deletion steps on the web, without installing the App: https://gymsetai.com/delete-account/
6. Children and minors
The minimum age to use the App is 13. The App is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child under 13 has given us data, email us and we will delete it.
If you are under 18 (or under the age of majority where you live), get your parent's or guardian's consent before using the App.
7. Your rights
You can:
- View and change your nickname on the Profile tab.
- View, edit, and delete your workouts in the App.
- Email us to request a copy of your data or to have it deleted.
Users in Taiwan
Under the Personal Data Protection Act, you may ask us to let you inquire about or review your personal data, to give you a copy, to supplement or correct it, to stop collecting, processing, or using it, and to delete it. Email support@gymsetai.com to exercise these rights.
Users in the European Economic Area and the United Kingdom
We process your data on these bases: it is necessary to provide the service to you (creating your account, syncing your training data, and running battles), and your consent (for example, when you choose to upload a proof photo or allow camera, photo library, and notification access). You have the right to access, correct, and delete your data, to receive it in a portable format, and to lodge a complaint with your local data protection authority. Email support@gymsetai.com to exercise these rights.
8. Changes to this policy
If we make significant changes, we'll announce them on our website and update the "Last updated" date at the top of this page.
9. Contact
support@gymsetai.com