GymFlow — Privacy policy
GymFlow is a workout tracker. This policy describes what the app collects, why, who else sees it, and how to get rid of it. It covers the GymFlow apps for iOS and Android and the backend they talk to; it does not cover anything else you might reach from them.
Support: star.hieu.99@gmail.com
The short version
- GymFlow collects your account identity, the workouts you log, any body weight you record, and anonymous usage and crash statistics.
- It shows no advertising, uses no advertising identifier, and does not track you across other companies' apps or websites.
- Nothing is sold, and nothing is shared with anyone beyond the service providers listed below.
- You can delete your account, and everything attached to it, from inside the app: Profile → Account → Delete account.
What is collected, and why
Account identity
When you sign in with Google or with Apple, GymFlow receives from that provider and stores:
| Data | Why |
|---|---|
| A user ID | Identifies your account and scopes every row of your data to you |
| Email address | Identifies the account across devices and re-sign-ins |
| Display name and profile picture URL | Shown on the Profile screen |
GymFlow never sees or stores your Google or Apple password. Sign-in happens inside the provider's own sheet; the app only receives the result.
If you sign in with Apple and choose Hide My Email, GymFlow stores the relay address Apple gives it and never learns your real one.
Your training data
Everything you create in the app: plans, the exercises in them, target and logged sets, weights, repetitions, rest timers, workout sessions, personal records, and the exercises you mark as favourites.
This is stored on your device and synchronised to your account so it survives a reinstall and follows you to a new phone. It is used only to run the app for you. It is not analysed, profiled, or shared.
Your body weight
If you use Profile → Body weight, each weigh-in you record — the weight, the day, and any note you add to it — is stored and synchronised to your account, the same way your training data is. You choose whether to record it at all; the feature does nothing until you do, and any single reading can be deleted from the list on that screen.
It is used only to draw your own chart back to you. It is never analysed, profiled, sold, or shared, and it is never sent to analytics: the app records that a weigh-in happened so it can tell whether the feature is used, and nothing about the number itself.
Your goal weight, if you set one, stays on the device and is not uploaded.
Settings
Your weight unit, theme, and default logging increments stay on the device. They are not uploaded.
Onboarding answers
The questionnaire shown after your first sign-in asks for gender, age, weight, and height. Gender, age and height are not stored — not on the device, and not on the server. The weight you enter becomes your first entry in Profile → Body weight, so the chart there has a starting point; you can delete it from that screen like any other weigh-in. Of the answers themselves, only the fact that you finished onboarding and how many goals you selected is recorded (see below).
Usage statistics
GymFlow records anonymous events through Google Firebase Analytics: which screens are opened, when a workout is started or finished, when a plan is created, and when an operation fails and for what class of reason.
These events are not linked to your account. The app deliberately does not tell Firebase Analytics who you are. Numeric values attached to them — workout duration, total volume, how many workouts you have logged — are recorded as ranges rather than exact figures, so a record cannot be matched back to a specific session.
Four properties describe your setup rather than you: your weight unit, your theme, whether you have an active plan, and a bucketed count of workouts logged.
Crash reports
When the app crashes or hits a handled error, Google Firebase Crashlytics receives the stack trace, the device model, the OS version, the app version, and a short breadcrumb trail of recent actions.
Unlike the usage statistics above, crash reports do carry your account ID, so that a report can be tied back to the account that hit the problem when we are diagnosing it. They carry no other identifying detail: no email, no name, and none of your training data.
Messages you send us from this website
If you use the feedback form on the GymFlow website, the email address and message you type are passed to Formspree, which delivers them to our support inbox. That form is part of the website, not the app: nothing about your account or your training data is attached to it, and the app itself never sends anything to Formspree.
What is never collected
- Your location.
- Your contacts, photos, calendar, microphone, or camera. The app requests none of these permissions.
- Health or fitness data from Apple Health or Google Fit. GymFlow does not connect to either.
- An advertising identifier. The app shows no advertising and never asks for App Tracking Transparency permission, without which the analytics SDK cannot read the identifier at all. On Android the advertising-ID permission is removed from the build outright.
Who else sees your data
These providers process data on GymFlow's behalf. None of them is permitted to use it for their own purposes.
| Provider | What it receives | Role |
|---|---|---|
| Supabase | Your account identity, all of your training data, and any body weight you record | Database and authentication |
| Google Firebase (Analytics, Crashlytics) | Anonymous usage events; crash reports carrying your account ID | Diagnostics and product analytics |
| Google / Apple | The sign-in itself | Identity provider, only at the moment you sign in |
| Formspree | Only what you type into the feedback form on this website — your email address and message | Delivers website feedback to our support inbox |
Data is not sold, rented, or disclosed to anyone else, except where the law requires it.
Where it is stored, and for how long
Your account and training data live in Supabase's hosted infrastructure. Analytics and crash data live in Google Firebase, which retains them on Google's own published schedules.
Your training data and your body weight history are kept for as long as your account exists. Delete the account and they go with it, immediately and permanently.
Deleting your account
In the app: Profile → Account → Delete account.
This deletes your account and, with it, every plan, session, set, and personal record attached to it — on the server and on the device you deleted it from. It is immediate and cannot be undone. There is no recovery period and no support ticket to file.
Anonymous analytics events already recorded cannot be tied to you and are not affected. Crash reports carrying your account ID are removed from Firebase on request to the support address at the top of this page.
Children
GymFlow is not directed at children under 13, and accounts are not knowingly created for them. If you believe a child has created an account, write to the support address above and it will be deleted.
Your rights
Depending on where you live, you may have the right to access, correct, export, or erase the data held about you, and to object to some of its processing.
Deleting your account exercises the erasure right in full and needs no request. For anything else, write to the support address at the top of this page.
Changes
If this policy changes in a way that affects what is collected or who sees it, the app will ship an update carrying the new version and the date above will change. Continuing to use GymFlow after that means the new version applies.