GymTimer Privacy Policy

Last updated: 28 October 2026

GymTimer is a workout timer for iPhone and Apple Watch with optional AI features. This policy explains what data the app uses, where it goes and the choices you have. In short: your workouts stay on your devices and in your own iCloud, and the AI features only receive a summary of your training when you ask for something and have agreed to it.

Who is responsible

[OPERATOR NAME], [COUNTRY] ("we") is the data controller. Contact: [CONTACT EMAIL].

Data that stays with you

• Workouts, exercises, history, profile and nutrition plans are stored on your device and, if iCloud is on, synced through your private iCloud account (Apple CloudKit). We can't read your iCloud data.
• Apple Watch: workout data is exchanged directly between your iPhone and Watch. If you allow it, the Watch app saves workouts to the Health app; GymTimer never sends Health app data anywhere else.

Cloud AI features

Cloud AI is optional and only used after you agree on the consent screen. You can withdraw consent at any time in Settings → AI & Privacy; the rest of the app keeps working.

When you ask for a workout, weekly plan, adjustment, insight or meal plan, the app sends:

• your Profile: goal, experience, equipment, days per week, session length, injuries or limitations, preferred language and, if you filled them in, height, weight, age, sex, body type, activity level, dietary restrictions, food preferences and nutrition targets;
• your exercise library (names, muscles, equipment) with your last top set per exercise;
• short summaries of recent sessions, recovery and sets per muscle in the last 14 days;
• the saved workouts you chose to adjust, and the note you typed.

Some of these (weight, injuries, for example) are health data. We process them only with your explicit consent (GDPR Art. 6(1)(a) and 9(2)(a)), only to produce the result you asked for.

No name, email, Apple ID, contacts, location or Health app data is sent. Requests are linked to a random identifier derived from your App Store purchase record, so we can count your AI credits without knowing who you are.

Who processes AI requests

• Cloudflare, Inc. runs our server (Cloudflare Workers) that receives the request and stores the job until your app collects the result.
• Scaleway SAS (France, EU) runs the AI model.
• Opper AB (Sweden, EU) is used as a backup when Scaleway is unavailable.

These providers act as processors: they handle requests only to return an answer and under data processing terms. Cloudflare may process data outside the EU under the EU Standard Contractual Clauses.

How long AI data is kept

• The request and its result are deleted from our server as soon as your app has received the result, and after 24 hours at the latest.
• Usage records (which kind of task, when, how many credits and tokens) are kept with your random identifier so credits and limits work. Reset AI data in Settings deletes your request history; the credit counters for the current period stay so they can't be reset for free.
• Server logs contain technical events (task type, timings, errors, your random identifier), never your profile or the AI answer, and are kept for up to 30 days.

Purchases

Subscriptions are sold and billed by Apple. We receive Apple's signed purchase records (product, dates, renewal and refund status) to unlock Pro features. We never see your payment details. Apple's privacy policy applies to purchases.

App integrity

The app uses Apple's App Attest to prove to our server that requests come from the genuine GymTimer app. This creates a device key that can't identify you.

Analytics and tracking

GymTimer doesn't track you across apps or websites and contains no advertising. [If anonymous usage analytics or crash reports are added, describe them here.]

Your rights

You can access, correct, delete or export your data, object to processing, and withdraw consent at any time. Most of your data is in your own iCloud and on your devices, so deleting the app and its iCloud data removes it. For AI data on our server, use Reset AI data or email us with the Support ID shown in Settings. You can also complain to your data protection authority.

Children

GymTimer isn't directed at children under 16, and the AI features shouldn't be used by them.

Changes

If we change what's sent to the AI or who processes it, the app asks for your consent again.