GymSet AI Privacy Policy
Last updated: 2026-10-01
This policy explains what data GymSet AI ("the App") collects, why, which service providers process it, how long it is kept, and how you can delete it.
- Operator: CHOU TING-RUI (individual developer)
- Contact: support@gymsetai.com
1. Data we collect
You need an account to use the App. After you log in, the following data is stored in our cloud database:
| Data | When it's collected | Who can see it |
|---|---|---|
| Email address | When you sign up, log in, or reset your password | Only you |
| Password | When you sign up or reset your password. The authentication service (Supabase Auth) stores it hashed, and we never see it in plain text | No one |
| Account ID | Generated automatically when you sign up | Used internally |
| Nickname | When you enter it at sign-up or change it later on the Profile tab | You, and anyone you have been in a battle with (or sent a rematch invite to). An opponent can use "Share result" to send text containing your nickname outside the App |
| Training plan | Synced automatically when you create or edit it | Only you |
| Workout logs: date, start and end times, exercise names, sets, weights, reps, cardio minutes, and notes you type | Synced automatically when you finish a workout | Only you, except that when a workout is used for a battle check-in, your opponent in that battle can see that workout. The App screen shows only a summary (workout day name and exercises), but technically your opponent's account can read the full record, including notes and start/end times |
| Battle data: invite code, status, start and end dates, result, rematch invites | When you start, join, or accept a battle | Both players in the battle |
| Check-ins and proof photos | When you check in to a battle by taking a photo or picking one from your library | Only the two players in that battle |
| Rejections: who rejected which day's check-in, and when | When your opponent taps "Reject" | Both players in the battle |
| Reports: who reported, who was reported, the battle, the reason (inappropriate photo or nickname; harassment or other misconduct), and the time | When you report your opponent from the battle screen | Only us (the operator). The person reported and your opponent cannot see reports, and are not notified |
| Blocks: who you blocked and when | When you block your opponent from the battle screen | Only you (you can view and undo them under "Blocked users" on the Profile tab). The blocked person cannot see it, but once it is in effect they cannot join your battles or start a rematch with you, and the App does not explain why when that fails |
Data we do not collect
- Location, contacts, or advertising identifiers (IDFA/AAID). The App does not read your device location.
- Analytics, crash reporting, or advertising SDK data. The App includes none of these.
- Apple Health (HealthKit), Google Health Connect, or any sensor data.
- Payment information. The App has no paid features.
About information inside photo files. A proof photo you upload may carry information written by the camera, such as when it was taken and the device model. If location tagging is on in your camera, it may also include where the photo was taken. The App does not read or use this information, but it does not strip it from the file either, so your opponent in that battle could technically read it. If this matters to you, turn off location tagging in your camera before taking the photo.
Data that stays on your device
The following data is stored only on your device and is never uploaded: your language setting, daily reminder time, rest timer settings, a workout in progress that you haven't finished, which weekly recaps you have dismissed, proof photos waiting to be uploaded, and an invite code opened from a link (it expires after 24 hours). In addition, so the App works offline, your device keeps your sign-in session and a copy of your plan and workouts (including anything not yet uploaded).
"Import GymLog backup" reads the file you pick on your device. After import, the plan and workouts sync to the cloud like your other training data.
Server technical logs
Our cloud provider, Supabase, generates technical logs of connections and requests (for example, IP address, time, and request path) for security and troubleshooting. Supabase keeps these logs for a short period under its service plan and then deletes them automatically. We do not export them or keep them long term. The App itself does not separately record or upload your usage activity.
2. How we use your data
We use your data only to run the App:
- Email and password: to log you in and to send 6-digit codes for verifying your sign-up and resetting your password.
- Training data: to show your plan, history, and progress charts, and to restore your data when you switch phones. The "AI suggests" weight is calculated on your device from your previous workout. No data is sent to an external AI service.
- Nickname, battle data, and proof photos: to run one-on-one battles. Your opponent can verify that you trained, and the App calculates HP and the winner.
- Reports: so we can review inappropriate content and act on violating accounts. Blocks: to make the block work (their proof photos are no longer shown to you, and the two of you cannot join each other's battles or start rematches).
We do not use your data for advertising, sell it, or use it to track you across apps.
3. Service providers
| Provider | What it processes | Location |
|---|---|---|
| Supabase (database, authentication, file storage) | All cloud data listed in Section 1, including proof photos | Asia Pacific, ap-northeast-2 (Seoul) |
| Resend (a US company that sends verification emails for us) | Your email address and the content of verification emails (a 6-digit code) | Data may be processed in the United States |
Proof photos are stored in private storage. The App displays them through signed links that expire after 10 minutes. All traffic is encrypted with HTTPS.
We do not share your data with anyone other than these providers. The only exception: we provide data only when the law requires it or when a competent authority requests it through a lawful process, and only to the extent necessary.
4. How long we keep data
- Account, nickname, plan, workouts, battles, check-ins, and proof photos: kept while your account exists. Nothing is deleted automatically.
- Workouts you delete: disappear from your screens. To keep your devices in sync, the server marks the workout as deleted, and its contents stay on the server until your account is deleted. If that workout was used for a battle check-in, your opponent can still see it as check-in evidence (the screen shows a summary; the full record is technically readable).
- Check-ins and proof photos: to keep battles fair, you cannot delete a check-in or photo after you submit it. You can retake today's photo during that day, unless your opponent has rejected it. A rejected photo cannot be replaced.
- Reports: nothing is deleted automatically; we keep them so we can act on them. Blocks: kept until you unblock, or until you or the blocked person deletes their account.
- Battles nobody has joined yet: you can take back a battle you started at any time, and its data is deleted.
- Server technical logs: kept by Supabase for a short period under its service plan and then deleted automatically (see Section 1).
- Backups: deleted data may remain in our provider's backups (if any) for a while, until those backups are overwritten on their normal cycle.
5. Deleting your data
In-app account deletion. Open the Profile tab, scroll to the bottom, and tap Delete account (the red text below Log out). In the confirmation dialog, tap Delete forever. Deletion happens right away and can't be undone. Deleting your account also deletes your nickname, plan, workouts, and check-ins.
Deletion by email. If you can't use the App, email support@gymsetai.com from the email address of your account and tell us you want your account deleted. After we confirm you are the account holder, we will complete the request within 30 days. These requests are handled manually, and the same data is deleted as with in-app deletion.
Battle results are kept, but anonymized. So your opponents don't lose their records, battles you took part in stay on their side. Your nickname, check-ins, and workouts are deleted, and your opponent only sees "Deleted user", the result, and both players' final HP (the score). Rejections you made of your opponent's check-ins still stand, but no longer record who made them. A battle in progress ends when you delete your account: if it was already decided, the actual result stands; if not, your opponent wins it. Battles that haven't started yet and rematch invites are deleted. Your opponent can't send you a rematch. If your opponent later deletes their account too, the battle is deleted completely.
Reports and blocks. When you delete your account, blocks involving you (ones you made and ones against you) are deleted. Reports are not deleted; we keep them so we can act on them. The fields that point to your account (as reporter or as the person reported) are cleared, leaving only the reason, the time, the battle it belongs to, and the other person's account ID. If you were the person reported, the report is kept but can no longer be linked back to your account.
Proof photos. When you delete your account, the App attempts to delete the proof photos you uploaded as well. Whether or not that deletion succeeds, your opponent can no longer get new links to those photos once your account is deleted. Photos your opponent already opened before you deleted your account may remain viewable for a short time through cached links. If the photo deletion fails (for example, because the network dropped at that moment), the files may remain in our storage, but other users can no longer read them. You can email us to have them removed manually.
To remove the data stored on your device, uninstall the App.
- You can also find the account deletion steps on the web, without installing the App: https://gymsetai.com/delete-account/
6. Children and minors
The minimum age to use the App is 13. The App is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child under 13 has given us data, email us and we will delete it.
If you are under 18 (or under the age of majority where you live), get your parent's or guardian's consent before using the App.
7. Your rights
You can:
- View and change your nickname on the Profile tab.
- View, edit, and delete your workouts in the App.
- Email us to request a copy of your data or to have it deleted.
Users in Taiwan
Under the Personal Data Protection Act, you may ask us to let you inquire about or review your personal data, to give you a copy, to supplement or correct it, to stop collecting, processing, or using it, and to delete it. Email support@gymsetai.com to exercise these rights.
Users in the European Economic Area and the United Kingdom
We process your data on these bases: it is necessary to provide the service to you (creating your account, syncing your training data, and running battles), and your consent (for example, when you choose to upload a proof photo or allow camera, photo library, and notification access). You have the right to access, correct, and delete your data, to receive it in a portable format, and to lodge a complaint with your local data protection authority. Email support@gymsetai.com to exercise these rights.
8. Changes to this policy
If we make significant changes, we'll announce them on our website and update the "Last updated" date at the top of this page.
9. Contact
support@gymsetai.com