Privacy Policy

Who we are

Gymmie ("we", "us") provides rules-based training and nutrition planning at gymmie.co.uk. This policy explains what personal data we collect, why, and the choices you have. Questions: hello@gymmie.co.uk.

What we collect

• Account data — email address and password (stored as a hash by our authentication provider).
• Profile data you provide — name, age, sex, height, weight, target weight, fitness goal and level, training days and session length, gym equipment, country and cuisine preferences, dietary restrictions, and any injury notes you choose to add.
• Training and nutrition activity — workouts generated and logged (sets, reps, weights, effort), check-ins, streaks, weigh-ins, meal-plan interactions, and coach-chat messages.
• Payment data — handled by Stripe. We never see or store your card number; we receive subscription status only.
• Technical data — device and usage information needed to run and secure the service, and error reports so we can fix failures.

Why we use it

• To build your training and meal plans — that is the product, and it cannot work without your profile and activity data.
• To operate your account, subscription, and support requests.
• To keep the service safe, debug failures, and improve how planning works.

We do not sell your personal data, and we do not use it for third-party advertising.

Health-adjacent data, honestly handled

Weight, injury notes, and training signals are sensitive to you even where the law treats them as ordinary personal data. We use them only to shape your plan and never share them for marketing. Gymmie is non-medical fitness guidance and is not a healthcare service.

Who processes it for us

• Supabase — authentication and database hosting.
• Vercel — application hosting and delivery.
• Stripe — subscription payments.
• OpenAI — powers the coach's explanations and chat. Coach messages and the plan context needed to answer them are processed for this purpose.
• Sentry — error monitoring.

Each provider processes data under its own safeguards and our instructions. Some providers process data outside the UK/EEA under recognised transfer mechanisms.

How long we keep it

For as long as your account is active. Delete your account and we delete or anonymise your personal data within 30 days, except records we must keep for legal or accounting reasons.

Your rights

Under UK GDPR you can request access, correction, deletion, restriction, or a copy of your data, and you can object to certain processing. Email support@gymmie.co.uk and we will respond within one month. You can also complain to the ICO (ico.org.uk).

Cookies

We use strictly necessary cookies to keep you signed in and the service secure. We do not run third-party advertising cookies.

Changes

If this policy changes materially we will note the new effective date here and, where appropriate, tell you in the app.