Privacy Policy

The data controller (titolare del trattamento) is [Operator legal name], [Registered address, Italy], Italy — VAT / tax code [P. IVA / Codice Fiscale].

For any question about this notice or to exercise your rights, write to privacy@gymly.app. No Data Protection Officer has been appointed, as the conditions of Article 37 GDPR do not apply to this service.

• Account data — your email address, an optional display name, and a cryptographic hash of your password. We never store your password itself.
• Training data — the days and exercises in your plan, the weights, sets and repetitions you record, and the start and end time of each session.
• Preferences — unit of measurement, time zone, appearance, and your notification settings.
• Push subscriptions — if you enable reminders, the endpoint your browser issues plus the two keys required to encrypt a message to your device.
• Technical data — a session cookie, and the browser user agent recorded with each session so you can recognise your own devices. Our hosting provider processes IP addresses and request logs for security and to deliver the service.

Gymly is not a medical service. Please do not record health information, injuries or diagnoses in the free-text fields: we do not intend to process special categories of data under Article 9 GDPR.

• To provide the service — creating your account, storing your plan and your training history, and syncing them across your devices. Legal basis: performance of a contract, Article 6(1)(b) GDPR.
• To keep the service secure — authentication, abuse prevention and troubleshooting. Legal basis: legitimate interest, Article 6(1)(f) GDPR.
• To send training reminders — only if you switch them on. Legal basis: consent, Article 6(1)(a) GDPR, withdrawable at any time in Settings.
• Anonymous usage analytics — off by default and only ever active if you switch it on. Legal basis: consent, Article 6(1)(a) GDPR.
• To comply with the law — where we must respond to a lawful request. Legal basis: legal obligation, Article 6(1)(c) GDPR.

Providing account and training data is necessary to use Gymly; without it the service cannot function. Reminders and analytics are entirely optional.

We do not sell your data and we do not share it for advertising. Your data is processed on our behalf by the following providers, each appointed as a data processor under Article 28 GDPR:

• Vercel Inc. — application hosting and delivery.
• Turso (ChiselStrike Inc.) — the database in which your account and training data are stored.
• Your browser vendor's push service (for example Google, Apple or Mozilla) — only if you enable reminders, and only to deliver an already-encrypted message to your device.

Where a provider processes data outside the European Economic Area, the transfer is covered by the European Commission's Standard Contractual Clauses under Article 46 GDPR, together with supplementary technical measures such as encryption in transit and at rest.

• Account and training data: for as long as your account exists.
• After you request deletion: 14 days, so that signing in again can cancel an accidental request. After that window the data is erased permanently and cannot be restored. You can also choose immediate, permanent deletion.
• Sessions: 60 days from creation, or until you sign out.
• Push subscriptions: until you turn reminders off, or until your browser invalidates them.

Under Articles 15 to 22 GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased — available directly in Settings → Delete my account;
• restrict or object to processing based on our legitimate interest;
• receive your data in a structured, machine-readable format — available directly in Settings → Export my data;
• withdraw consent at any time, without affecting processing carried out beforehand.

To exercise a right that is not already available in the app, email privacy@gymly.app. We answer within one month, extendable by two further months for complex requests (Article 12(3) GDPR).

If you believe your data has been handled unlawfully you may lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, or with the authority of the EU member state where you live (Article 77 GDPR). You may also bring proceedings before the ordinary courts.

Passwords are stored only as salted scrypt hashes. Session tokens are held as SHA-256 digests, so a copy of our database does not let anyone sign in as you. All traffic is served over HTTPS. These measures are appropriate to the risk under Article 32 GDPR, but no online service can promise absolute security.

Gymly is not directed at children under 14, the age of digital consent set by Article 2-quinquies of the Italian Codice Privacy. If you believe a child has created an account, contact us and we will delete it.

Gymly does not carry out automated decision-making or profiling that produces legal effects concerning you, within the meaning of Article 22 GDPR. Statistics shown in the app are simple arithmetic on the data you entered.

If we make a material change we will notify you in the app before it takes effect. The date at the top of this page always reflects the current version.