Privacy Policy
Last updated: October 25, 20261. Who We Are
Gymrition is developed and operated by Ömer Umutlu, acting as an individual developer and not through a registered company. We are the data controller responsible for your personal data under the EU General Data Protection Regulation (GDPR) and Turkey's Law No. 6698 on the Protection of Personal Data (KVKK).
Ömer UmutluEU contact address: Bismarckstraße 93, 45881 Gelsenkirchen, Germany
Turkey address: Hacıhızır Mah. Kaymaz Sok. No: 43, Kocaeli/İzmit, Türkiye
Email: support@gymrition.com
2. Information We Collect
When you create an account and use Gymrition, we process the following categories of personal data:
- Account & profile — email address, password (hashed, never visible to us), first and last name, date of birth, gender, and an optional profile photo. If you use Sign in with Apple, the name and email you choose to share via Apple's relay service.
- Health & body data — weight, height, body measurements (waist, neck, hip) and calculated body fat percentage, and body progress photos you choose to upload.
- Nutrition & fitness activity — water intake, meal records (including photos submitted for AI analysis and meal descriptions you type or dictate for AI nutrition calculation), nutrition targets, workout records, exercise records, and workout plans.
- Subscription data — your premium status and purchase history, processed through Apple's in-app purchase system and RevenueCat. We never receive your card number.
- Diagnostic data — IP address, device operating system, and crash/error logs, collected automatically to keep the app stable.
- Account identifier — a unique internal user ID used to link your records.
3. What We Do NOT Collect
For full transparency, Gymrition does not collect:
- Your precise or approximate location
- Your contacts or address book
- Microphone or audio recordings — when you dictate a meal using the microphone on your keyboard, the keyboard turns your speech into text and Gymrition only receives that text
- Advertising identifiers (e.g. Apple's IDFA) — we do not track you across other companies' apps or websites, and we show no App Tracking Transparency prompt
- Your payment card number or banking details — these are handled entirely by Apple
- HealthKit data — all health and fitness data is entered manually inside the app
4. How We Use Your Data
We use your data only to: provide the app's core functions (tracking, syncing across your devices, personalised calorie/macro targets); generate AI-written analyses of your progress and calculate the nutrition values of meals you describe (see Section 7); manage your subscription; diagnose crashes and keep the app stable; and respond to your support requests.
We do not sell your personal data, and we do not use it for third-party advertising or for any automated decision that produces a legal or similarly significant effect on you.
5. Legal Bases for Processing (GDPR)
Where GDPR applies, we rely on the following legal bases:
- Performance of a contract — for account creation and core app functionality.
- Your explicit consent — for special category health data (weight, body measurements, and body progress photos), for sending a summary of your health and fitness data to OpenAI to generate AI analyses, and for sending the meal descriptions you submit to OpenAI to calculate their nutrition values.
- Legitimate interest — for diagnostic data used to keep the app stable and secure.
- Legal obligation — for purchase records we must retain for accounting purposes.
6. Your Consent for Health-Related Data
Because weight, body measurements, and body progress photos are special category data, we process them only with your explicit, informed consent, given when you enter this information or upload a photo. You can withdraw this consent at any time by deleting the specific entry or photo, or by deleting your account — see the Account & Data Deletion page.
7. Third-Party Service Providers
We share data with the following service providers, strictly to the extent needed for them to perform services on our behalf:
- Supabase — authentication, database, and file storage (EU region: Frankfurt, eu-central-1).
- OpenAI — generates the AI-written analysis of your progress, calculates the nutrition values of meals you describe by typing or dictation, and, where available, analyses meal photos you submit to the AI food-analysis feature (United States). See "How AI analysis works" and "How AI meal calculation works" below.
- Sentry — crash reporting and diagnostics (EU region: Frankfurt, Germany).
- RevenueCat — Gymrition Pro subscription management (United States).
- Apple — Sign in with Apple and in-app purchase processing.
- USDA FoodData Central — public food database lookups for the terms you search (not linked to your account).
- Expo / EAS — delivers the app binary and over-the-air updates.
How AI analysis works. When you open an AI analysis, the app sends OpenAI a summary of the data that analysis needs: your age, gender, height, current and target weight, weekly goal and daily targets, plus up to 60 days of the related daily records (weight, body fat percentage and waist measurements, calorie and macro totals, water intake, or workouts with exercise names, sets, reps and weights). Your name, email address, account ID and photos are not included. We only send this data after you give your permission in the app; if you decline, nothing is shared with OpenAI and all other features keep working. Under OpenAI's API terms, this data is not used to train OpenAI's models, and OpenAI may retain it for up to 30 days (for example, to monitor for abuse) before deleting it.
How AI meal calculation works. When you use “Describe Your Meal”, the app sends OpenAI only the text you type or dictate (for example, “2 eggs and a slice of bread”). Your name, email address, account ID, photos and other records are not included. OpenAI returns estimated calories and macros; your description and the result are saved as a meal record in your account, and you can delete it like any other record. To apply daily usage limits, we keep a count of how many calculations you make each day. We only send your description after you give your permission in the app; if you decline, nothing is shared with OpenAI and manual entry keeps working. Under OpenAI's API terms, this data is not used to train OpenAI's models, and OpenAI may retain it for up to 30 days (for example, to monitor for abuse) before deleting it.
8. International Data Transfers
Some providers above are located outside the European Economic Area, primarily in the United States. Where we transfer personal data outside the EEA, we rely on appropriate safeguards recognised under GDPR, such as Standard Contractual Clauses or a provider's certification under the EU-US Data Privacy Framework.
9. How We Secure Your Data
We take concrete measures to protect your data:
- All communication between the app and our servers is encrypted with HTTPS/TLS.
- Photos are stored in private, access-controlled cloud storage; server-side rules ensure only your own account can read, upload, or delete your body progress and meal photos.
- Photos are served through short-lived, cryptographically signed links rather than permanent public URLs.
- Your password is hashed by our authentication provider and is never visible to us in plain text.
- Access to production systems is restricted to the developer.
10. Who Can See Your Data Inside the App
This differs by data type:
- Your body progress photos, body measurements, weight, and all nutrition/workout records are strictly private — visible only to you, never to other users.
- Your profile photo and first name may be visible to other signed-in users in social/shared contexts within the app (for example, when you share a workout program).
11. Retention & Deletion
Your data is retained for as long as your account is active. When you request account deletion, the process works as described on the Account & Data Deletion page.
Certain records, such as purchase history, may be retained longer where required by law (e.g. for accounting purposes).
12. Your Rights (GDPR)
If you are located in the EU/EEA, you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate or incomplete data
- Erase your data ("right to be forgotten")
- Restrict processing in certain circumstances
- Receive your data in a portable, machine-readable format
- Object to processing based on our legitimate interest
- Withdraw consent at any time, without affecting prior lawful processing
To exercise any of these rights, contact us at support@gymrition.com. You also have the right to lodge a complaint with your local data protection supervisory authority.
13. Children's Privacy
Gymrition is not directed at children, and we do not knowingly collect data from anyone below the age at which they can legally consent to data processing (16 by default under GDPR, unless your country sets a lower age).
14. Automated Decision-Making
AI-generated content, such as your written progress analysis, is for information only and is not medical advice. We do not carry out any automated decision-making that produces a legal or similarly significant effect on you.
15. Cookies & Tracking Technologies
Gymrition does not use advertising cookies or cross-app/cross-site tracking technologies. We use on-device storage only to keep you signed in and to cache your own data for offline use.
16. Changes to This Policy
We may update this policy from time to time. Material changes will be reflected by updating the date at the top of this page.
17. Contact
For any privacy-related question, reach us through our Support page or at support@gymrition.com.
18. Additional Provisions for Users in Turkey (KVKK)
This section supplements the policy above for users located in Turkey, under Law No. 6698 on the Protection of Personal Data ("KVKK").
Health-related data (weight, body measurements, body fat percentage, and body progress photos) is special category personal data under KVKK Article 6, and is processed only with your explicit consent, given when you enter this data or upload a photo. Sharing a summary of this data with OpenAI for AI analysis likewise happens only with your explicit consent, given in the app before your first analysis. You may withdraw this consent at any time by deleting the relevant record or your account.
Your data is processed by service providers located abroad (see "Third-Party Service Providers" above), primarily in the United States and the European Union. These transfers are carried out with appropriate safeguards under KVKK Article 9.
Under KVKK Article 11, you have the right to:
- Learn whether your personal data is being processed
- Request information about it if it has been processed
- Learn the purpose of processing and whether your data is used accordingly
- Know the third parties, domestic or abroad, to whom your data is transferred
- Request correction of incomplete or inaccurate data
- Request deletion or destruction of your data under the conditions set out in KVKK
- Request that any correction or deletion be notified to third parties your data was transferred to
- Object to a result that is to your detriment, arising solely from automated analysis of your data
- Claim compensation for damages arising from unlawful processing
To exercise these rights, contact us at support@gymrition.com. Your request will be concluded as soon as possible and within 30 days at the latest.