Privacy policy

What this document is about

This is GymHouse's personal data processing policy. It complies with Colombia's data protection law (Law 1581 of 2012 and its regulations, compiled in Decree 1074 of 2015) and with the app stores' rules.

It explains, in plain language, who is responsible for your data, what data GymHouse keeps, what it uses it for, who it is shared with, how long it is kept and how you exercise your rights. It applies to the phone app, the web app and the gymhouse.app pages.

Who is responsible for your data

The controller of your data is Miguel Angel Perez Clavijo, an individual who develops and runs GymHouse, domiciled in Manizales, Caldas (Colombia).

Address: Calle 47 A # 35 A 22, Manizales, Caldas, Colombia. Phone: +57 304 674 2211. Email: soporte@gymhouse.app.

For anything to do with your data —questions, requests, complaints and exercising your rights— the channel is that email, handled by the controller himself.

Your authorization and sensitive data

When you create your account you tick two separate boxes: one accepts the terms of use and the other authorizes the processing of your data under this policy. We keep which version you accepted and when, as proof of that authorization, and if the policy changes in an important way the app asks you to accept it again.

Some of the data you can record is sensitive under the law because it is about your health: your body measurements and their photos, what you eat and drink, your sleep and your fitness. You are not required to provide it: the app works without it, and each item is only stored if you decide to record it. If you do, it is used only for what is described here and never for advertising.

You can withdraw your authorization whenever you want: by deleting that data from the app, deleting your account or writing to us at soporte@gymhouse.app.

What data we keep

· About your account: email, name, username, date of birth and gender. If you add them: phone, photo, bio and link. Also when you created the account and the last time you signed in (the latter is only seen by the GymHouse administration).

· About your training: sessions, sets, weights, reps, RPE, routines, personal records, body measurements (with their photo if you upload one) and your physical activity level, which by default is calculated from what you train in the app.

· About your nutrition, if you use it: what you log that you eat and drink, the foods, dishes and recipes you create (with their photo if you upload one), your meal plans, your daily goal —calculated from your weight, height, age, gender and physical activity— and, in the market, the prices you set and the purchases you log. What you eat is health data: you see it and, while you're a member of a gym, so does its staff (as explained below); what you choose to share (a recipe, a plan, your prices or a published meal) is also seen by the people you choose. Only the number of days on which you log something adds a few points in competitive mode, without anyone else seeing where they come from.

· About your sleep, if you record it: when you went to bed and got up, how long and how well you slept, your naps and your target schedule. This is also health data and only you see it; the app uses it to estimate your muscle recovery better, and the number of nights you record adds a few points in competitive mode, without anyone else seeing where they come from.

· About what you post: photos and videos, texts, comments, likes, who you follow and the messages you exchange with a gym.

· About artificial intelligence, if you use it: what you asked for your training plan and the result (the plan, or the foods and amounts recognized in a photo), without the photo. It is explained in its own section.

· About your coins: your balance and each movement (the ones you earned watching ads, the ones you bought and what you spent them on).

· About your location, only if you grant the permission and use the nearby gym search: your phone's position at the moment of searching, which is not stored linked to you; the only thing kept is an approximate area of about 5 km, with no owner, so searches aren't repeated.

· Technical: your signed-in session, a copy on your phone of the data you've already seen so the app works offline, your phone's notification identifier (if you allow them) and the device language.

· About ads: if you use the app without Premium, how many ads of each type you see each day, to measure what they earn and pay for the service. Only the GymHouse administration sees it, and it is deleted with your account.

We don't ask for or store card details: payments are processed by your phone's app store.

What we use it for

So the app does what it promises: show you your progress, calculate your estimates and your nutrition goal, build plans, recognize what you eat in a photo if you ask, show your posts to whoever you decide and let your gym manage you as a member.

Also to send you the emails and notices the app itself needs: the verification email when you sign up, the password reset one and the notifications you turn on.

To protect the app and the people who use it: slow down repeated attempts to sign in or request codes, prevent cheating with coins and ads, and handle reports from the community.

And to show ads to people who use the app without Premium: they fund the free version. With Premium you don't see ads.

We don't sell your personal data or use your health data for advertising.

Who it is shared with

· With other people on GymHouse, according to YOUR settings: a private account is only seen by its accepted followers, and each workout is posted with the visibility you give it.

· What you share from your nutrition, with whoever you choose: your dishes and your plans start out private; your recipes and your market prices start out visible to whoever can see your profile, and you can change that on each recipe and in “Who sees my prices”; a meal you post is seen by whoever you choose. What you log in your diary is shared with no one except the staff of the gyms you're a member of.

· The data of a product with a barcode, only if you turn on “Share this product's data with the GymHouse community” (it's off by default): the name, brand, size, nutrients and servings are shared, never who contributed them or anything from your diary.

· Your body measurements: the DATA is always seen by the staff of the gyms you're a member of, and you choose in Settings → Privacy who else sees it (your gymbros, your circle or anyone on GymHouse). Only you see the PHOTOS of your measurements, unless you choose to share them with your gyms' staff, your gymbros, your circle or anyone on GymHouse.

· Outside GymHouse, only what is PUBLIC and only when someone shares its link: if someone —you or another person— shares the link to a post, a profile, a training plan, a routine, a gym or an exercise that anyone can see, its page and the preview other apps and social networks show may display, also to people without an account, its title or name, the @username, the main photo or profile photo, the description and a summary (for example, the duration and volume of a workout). Anything private, anything only your followers, your gym or your circle can see, anything from a private account and anything deleted is never shown: its link shows only a generic GymHouse card.

· With your gym, if you're a member and while you are: your member record (with your email), your visits, the notes and goals of your follow-up, the notices it sends you and, if you're Premium, the meal plan it writes for you; and, even if you keep them private or only for your circle, the people in charge of your follow-up see your training plans and routines, your training data (statistics, progress, history and records), the data of your measurements, the foods, dishes and recipes you create, your meal plans and your food diary with your daily goal. They see it, they never change it. They don't see the photos of your measurements (unless you choose so), your sleep or your market prices, and as soon as you stop being a member they stop seeing it.

· If you used the invitation code of a GymHouse collaborator: that collaborator sees your name, your @username and your email while you are their client, and nothing about your training or your nutrition.

· With the providers that make the app work, who process the data on our behalf and only for that: Railway (the server and the database), Cloudflare (photo and video storage and the web pages), Resend (sending emails), Expo, Google Firebase and Apple (notifications), Google Maps Platform (the nearby gym search, which receives what you search for and the area), RevenueCat (the status of your subscriptions and your coin purchases, with your email as identifier), Anthropic and OpenAI (artificial intelligence; see its section) and Google and Apple when you sign in with their account. We require them to protect your data at least as well as this policy does and we don't let them use it for their own purposes.

· With Open Food Facts, an open food database, when you look up a product by its barcode: only the code is sent, never any of your data.

· With Google AdMob, which serves ads to people without Premium: technical data about the device and, if the system allows it and you consent in the ads privacy notice (you can change it in Settings), your phone's advertising identifier. Google processes them under its own privacy policy. When you watch a rewarded ad to earn coins, AdMob confirms to our server that you watched it in full with a single-use identifier that GymHouse generates for that ad: it doesn't carry your email or your name.

· In competitive mode: you join automatically, without asking, as soon as you meet its requirements (among them, a workout done with the app, a measurement with your weight and height, and a public account: a private account never joins). From then on your name, photo, @username, league and points appear in its rankings, visible to anyone on GymHouse; never your weights or your body weight, nor where your points come from. You can leave whenever you want from the competitive mode screen: you stop appearing right away and don't rejoin automatically.

· When the law requires it.

Your email address is not shown to other people in the app, except to the team of a gym you're a member of and to the collaborator whose code you used, as stated above.

Artificial intelligence

Two features use artificial intelligence from two external providers based in the United States, Anthropic (Claude) and OpenAI (GPT): recognizing what's on a plate or on a nutrition label from a photo, and building a training plan from what you write. Which of the two handles each request is decided by GymHouse depending on how you pay for it (with your Premium allowance or with coins); in both cases the same is sent.

Something is only sent when you ask for it. Before the first time, the app asks for your permission and tells you what is sent and to whom; you can withdraw that permission anytime in Settings → Privacy, and from then on nothing is sent.

For the plate, what's sent is the photo you choose, whatever you add before choosing it if you want —the total weight of the plate, the foods you know it has and a note— and, if you adjust the proposal, your answers, the foods and amounts you correct and your note. For the plan, what's sent is the text you write and what you choose for it —your goal, days per week, the length of each session, where you train, the equipment you don't have, your level and what you want to avoid— and, if the app has them, your age, your sex, your weight and your height, so the plan fits you; if you adjust the proposal, also what you write to adjust it. Don't include other people's data or anything you don't want to share.

Unless you choose otherwise, the photo is not stored at GymHouse: it is processed and discarded. We only keep a fingerprint of the photo, which can't be used to rebuild it, and the result: the foods and amounts recognized, or the plan. If you save the result as your own dish, that photo becomes the dish's photo, like any photo you upload to it.

Saving your food photos to improve GymHouse is optional and is a separate permission: it is off and only turns on if you choose it, when you give the AI permission or in Settings → Privacy. With it, we keep in our cloud storage, without posting or sharing it, the photo already resized and without location or phone data, together with what the artificial intelligence recognized, what you added before the photo and the foods and amounts you confirmed at the end. We use it only to measure and improve GymHouse's food recognition and, later on, to train GymHouse's own models; we don't give it to other companies to train theirs. It is kept while you have the permission on and the account: if you turn it off, we delete the photos and data already kept, and when you delete your account they are deleted with it. If a model has already been trained with them, that training can't be undone, but the model doesn't contain your photos or say who you are.

Anthropic and OpenAI process this data on our behalf and don't use it to train their models. Anthropic deletes it from its systems within 30 days; we ask OpenAI not to store the responses, and it keeps what is sent for at most 30 days to monitor misuse. In both cases, unless they must keep it longer by law or to investigate misuse.

What the artificial intelligence proposes is an estimate and can be wrong: review it before saving or following it.

Photos and videos

The app asks for access to the camera or the gallery only when you're about to upload a photo, and uses only the one you choose.

The photos and videos you upload are stored in cloud storage and served through a link. When you delete a post, its content is no longer accessible from the app.

The photo of a barcode is read on our server to get the number and then discarded: it isn't stored.

Cookies and storage

GymHouse doesn't use tracking or advertising cookies on the web, and the gymhouse.app pages don't use cookies.

The web app stores in your browser, using its local storage, only what it needs to work: your signed-in session, your preferences (such as language and theme) and a copy of what you've already seen. The web doesn't work without it, so no separate consent is requested. The session is deleted when you sign out, and everything else when you clear your browser data.

If you sign in with Google or Apple on the web, their window may use their own cookies under their policies. On the phone, ads for people without Premium are governed by the ads privacy notice (see “Who it is shared with”).

Where it is stored

On our providers' servers, which are outside Colombia, mainly in the United States. By authorizing the processing of your data you also authorize that international transfer, which is only made to providers that commit to protecting it.

Your signed-in session and a copy of the data you've already seen stay on your phone, so the app works offline. Both are deleted when you sign out, and on Android they aren't included in the phone's backups.

How we protect your data

Everything travels encrypted (HTTPS). Passwords are stored with one-way encryption: nobody, not even us, can read them. Sessions expire, and changing your password closes all the ones you have open.

Each person only accesses what belongs to them, and we slow down repeated attempts to sign in or request codes. If an incident ever put your data at risk, we would tell you and report it to the authorities, as the law requires.

For how long

For as long as you have the account and GymHouse keeps running: that is how long our database is in force.

Some things expire earlier by their nature: the notices in your activity inbox are deleted automatically after 30 days, and the photo you send to the artificial intelligence isn't stored, unless you turn on saving your food photos to improve GymHouse: then it is kept while you have it on.

When you delete your account your data is deleted, right away or after 30 days as you choose, except what the law requires us to keep. If you want us to delete something specific, write to us at soporte@gymhouse.app.

Your rights

As the owner of your data you have the right to know, update and correct it; to ask for proof of the authorization you gave us; to know how we use it; to withdraw that authorization and ask us to delete it when there is no legal duty to keep it; to access it free of charge; and to file complaints with Colombia's Superintendence of Industry and Commerce (SIC).

You can do much of this yourself from the app: you see and correct your data in Profile, in Settings → Account and in Settings → Privacy, and from there you decide who sees your workouts, can make your account private, block anyone, leave a gym and delete your account.

For everything else —a copy of your data, a correction, a deletion or a complaint— write to us at soporte@gymhouse.app from your account's email address, saying what you're asking for. A request is answered within 10 business days at most and a complaint within 15 business days at most; if we need more time we'll tell you why, and it won't exceed 5 more business days for a request or 8 for a complaint. If you're not satisfied with the answer, you can go to the SIC (www.sic.gov.co).

Minors

GymHouse is not aimed at people under 16 and we don't knowingly collect their data. The app doesn't let anyone create an account with a date of birth under 16.

If you are 16 or 17, in Colombia the authorization to process your data is given by your mother, father or legal guardian: create the account only with their permission. If you believe someone under 16 created an account, or that one was created without that permission, write to us and we'll remove it.

Changes to this policy

This version is in force from the date of its last revision, shown at the end of this document.

If we change something important, the app will ask you to accept it again before you keep using it.

Contact

For any question about your data, write to us at soporte@gymhouse.app.