Privacy Policy
Last updated 31 August 2026
This policy covers the GymNotes app for iOS and Android. GymNotes Coach, the separate app trainers use, has its own policy at https://privacy.gymnotes-coach.com.
We wrote this to be read. It is short on purpose.
In short
| What | What happens to it |
|---|---|
| Your account | Email, optional name, password (stored only as a hash) |
| Your training data | Workouts, exercises, sets, body measurements — kept on our servers so you can reach them from any device |
| Sharing with your coach | Only what you confirm, only from the day you connect, ended by you at any time |
| Voice logging (Pro) | The recording leaves your device to be turned into text, then discarded — see §6 |
| Notifications | A token identifying your device, your platform and language |
| Pro subscriptions | Whether you are subscribed. Never your card details |
| Crash reports | The error, your device model, your user id |
| Usage analytics | Which features get used. No screen recording — see §7 |
We do not run ads. We do not sell data. We do not read your contacts, your location, or your photo library beyond images you pick yourself.
1. Who we are
GymNotes is operated by Mykyta Subotin, an individual entrepreneur registered in Ukraine. We are the data controller.
Contact for anything here, including data requests: hello@gymnotesapp.com.
2. Your account
Your email address, and a name if you choose to give one. Sign in with Apple or Google sends us your email and, on the very first authorization only, the name that service provides — Apple never sends it again. Passwords are handled by our authentication provider and stored only as a hash. We never see them.
3. Your training data
This is the part of the app that matters, and it is all data you type in yourself:
- workouts and their dates, the exercises in them, sets, repetitions, weight, duration and distance, and any notes you add;
- routines and programs you build;
- exercises you create yourself, including a photo if you add one;
- body measurements — body weight, body fat, lean mass, waist, hips, chest, neck, shoulders, arms, forearms, abdomen, thighs, calves — and the units you record them in.
Some of this is health-related. We treat it that way: it is never used for advertising, never sold, and never shared with anyone except the coach you deliberately connect to.
4. Your coach, if you have one
You can connect a trainer by entering a six-character invite code. Before the connection is made you are shown a screen listing exactly what that person will be able to see, and nothing happens until you confirm it.
Once connected, your coach can see your workouts and their dates, your exercises, sets, weights and repetitions, and the body measurements you record.
Only from the day you connect. Everything recorded before that stays private.
You can disconnect at any time, from the app. From that moment your coach sees nothing new. What they already saw stays with them — we cannot reach into their records — and any programs they sent you remain in your library, because they are yours.
You can also report a coach. The report goes to us and not to them: the coach is never told. Filing one does not disconnect anyone; that is a separate action you take yourself.
5. Photos
If you add a photo to an exercise you created, it is stored in a public storage bucket. In plain terms: the file is reachable by anyone who has its exact URL, without signing in. The URLs are not listed anywhere and are not guessable in practice, but they are not access-controlled either. So it is worth a second thought before uploading anything you would not want a stranger to open.
6. Voice logging
Pro subscribers can dictate a workout instead of typing it. When you do, the recording leaves your device: it is sent to our server, and from there to specialist providers that turn speech into text and text into a structured workout. You then see the result and correct it before anything is saved.
Those providers are outside Ukraine and the European Economic Area — see §9 on transfers.
We do not store the audio. It exists for the length of the request and is discarded. We do not store the transcript either. What we keep is one row per dictation — your user id and a timestamp — used to enforce the monthly limit and nothing else.
Under our agreements, these providers do not use your recording or its text to train their models. Recordings are capped at three minutes. Voice logging is optional; if you never use it, no audio ever leaves your phone.
7. Analytics and crash reports
Crash reports. When the app crashes, a crash-reporting service receives the error, a stack trace, your device model and OS version, and your user id. Personally identifying data is switched off at the SDK level.
Usage analytics. A product-analytics service receives events describing which features get used, with numeric or true/false properties.
We do not record your screen. GymNotes does not use session replay, and no recording of what you see or type is made or sent anywhere.
You can ask us to exclude your account from analytics entirely — write to us and we will.
8. Pro subscriptions
Payments are handled by the App Store or Google Play under their own terms. We never receive, see or store your card details. A subscription-management service tells our app whether your subscription is active, using an identifier tied to your account.
Refunds are granted by Apple or Google under their own rules, not by us.
9. Who else is involved
We use a small number of specialist companies to run GymNotes. They act on our instructions, may use your data only to provide their service to us, and are bound by written data processing agreements. They are:
| Category | What they do for us |
|---|---|
| Hosting, database, authentication and file storage | Keep your account and training data and serve it to your devices |
| Push notification delivery | Deliver notifications to your device |
| Speech recognition and text processing | Turn a dictated workout into text and then into exercises (§6) |
| Crash reporting | Receive crash reports |
| Product analytics | Receive usage events |
| Subscription management | Tell the app whether Pro is active |
| Email delivery | Notify us when someone reports a coach |
| App distribution and payments | Apple and Google |
Nobody else receives your data. There are no advertisers, no marketing partners and no data brokers on this list, because we do not use any.
We will tell you exactly who they are if you ask. Write to hello@gymnotesapp.com and we will name the specific companies behind each category, free of charge.
Transfers. Some of these providers are located outside Ukraine and the European Economic Area, mainly in the United States. Those transfers are made under the European Commission's standard contractual clauses; you can ask us for a copy.
10. Why we are allowed to hold it
| What | Basis |
|---|---|
| Account, training data, coach connection, voice logging | Performance of our contract with you |
| Subscription records | Contract, and legal obligations for accounting |
| Crash reports and usage analytics | Our legitimate interest in a working, improvable app — you can object |
| Push notifications | Your consent, withdrawable in device settings |
| Coach reports | Our legitimate interest in keeping people safe on the service |
11. How long we keep it
While your account exists, we keep your account, workouts, measurements, routines and exercises. That is the point of the app — a training log you delete after a year is not a training log.
If you delete your account, from Account → Delete account in the app, we delete all of it within 30 days. Crash reports and server logs may persist up to 90 days in our providers' systems. Subscription and accounting records we keep for the period Ukrainian tax law requires.
Disconnecting a coach does not delete anything of yours; it stops the sharing.
Reports you file about a coach are kept even if you disconnect from them, because a report that vanishes when the relationship ends is a report that cannot be investigated.
12. Your rights
You can ask us for a copy of your data, to correct it, to delete it, to restrict how we use it, or to object to our using it. You can also ask us to name the specific companies in §9. Write to hello@gymnotesapp.com and we answer within 30 days. Deleting your account you can do yourself, in the app, without asking us.
If you think we have handled your data wrongly you can complain to the Ukrainian Parliament Commissioner for Human Rights, or to the supervisory authority in your EU country of residence.
13. Security
Data is encrypted in transit and at rest. Access is enforced in the database itself by row-level security, so one account cannot read another's data even if the app misbehaves. Passwords are stored hashed. Our own access to production data is limited to running and fixing the service.
No system is perfectly secure. If a breach affects your data we will tell you and the supervisory authority as the law requires.
14. Children
GymNotes is for people aged 16 and over, and we do not knowingly create accounts for anyone younger. If you are under 16 and have an account, ask a parent or guardian to write to us and we will delete it.
15. Changes
We post the new version here and change the date at the top. If a change materially affects you we will tell you in the app before it takes effect, and ask again for consent where consent is what the change relies on.
16. Contact
hello@gymnotesapp.com