🇫🇷 Version française

Privacy Policy

Effective date: 11 September 2026

1. Who we are

GymChad is published by Mathieu Gries-Peroz, an independent developer based in France, who acts as the data controller for the personal data described below. You can reach us at contact@gymchad.app.

2. Data we collect and why

Without an account, GymChad works fully offline: your programs, workouts, sets and personal records are stored only on your device. We collect nothing.

If you sign in (via Google Sign-In or Sign in with Apple), we process:

• Account data — your email address and display name, plus your profile picture when provided by Google. Used to identify your account and let you recover your data on a new device. With Apple, the email may be a private relay address (@privaterelay.appleid.com) and your name is only shared the first time you sign in.
• Profile data — the username and profile picture you choose, and your unit preference (kg/lb).
• Training data — your programs, workout sessions, sets and personal records, backed up to the cloud so you never lose them.
• Group activity — if you join a group, its members can see your username, profile picture and automatic workout events (completed sessions, personal records) and reactions. The feed remains members-only. Private groups require an invitation code; any signed-in user can discover and freely join a public group.
• Group page and background. A PRO owner can publish their group's name and description, a background image and an optional location. These details appear in discovery when the group is public. Private group backgrounds are for members only. Uploaded images are resized and stripped of metadata. When PRO expires, the group becomes private and stops using its custom background, while all members stay. Images, including previous versions, are removed when the owner deletes their account.
• Nearby search. “Around me” lets you authorize a one-time reading of your approximate current location. This location is sent to Supabase to calculate distances; it is not saved in your profile and there is no background tracking. To set a group's location, its owner can request a one-time reading of their current location after granting location permission. It is published only when they save the group's settings.
• Reports. When you report content or a profile, we store your account identifier, the reported account or publication, your chosen reason and any details you provide. We also keep a copy of the relevant profile or publication information, including its username, picture link and published content. These records let support examine the report and take moderation action. Reports are reviewed by a person and are not shown to group members.
• Blocks. We store the identifiers of your account and the account you block. This hides your group publications and social profiles from each other, filters reactions and stops new notifications between the two accounts. You can remove a block later.
• Subscription status — whether you have an active GymChad Pro subscription (see section 4). We never see your payment details.
• Push notifications — if you allow notifications, a device token is stored so we can notify you of activity in your groups. It is deleted when you sign out or delete your account.

Some obviously abusive words are filtered in shared text. Reports and support review cover other concerns, including profile pictures. We do not automatically analyse images. If reporting or blocking controls are not yet available in your version of the app, contact contact@gymchad.app.

3. Where your data lives

Cloud data is stored with Supabase on servers located in Paris, France (AWS region eu-west-3), inside the European Union.

Your uploaded profile picture is stored in Supabase Storage and has a public URL. Anyone with that link can view the picture. Account deletion removes the stored picture.

4. Third-party services

• Supabase — authentication, database, backups and profile picture storage, including report and block records used for moderation (EU servers).
• Google Sign-In — account sign-in. Google's own privacy policy applies to the sign-in step.
• Sign in with Apple — account sign-in on iPhone. Apple's privacy policy applies to the sign-in step.
• Firebase Cloud Messaging (Google) — delivery of push notifications. It receives your device token and the text of each notification, which can include the author's username and a shared session or exercise name. The complete training log is not sent.
• RevenueCat — subscription management. It processes an identifier linked to your GymChad account and store purchase receipts, never your payment details. See the RevenueCat privacy policy.
• Apple App Store / Google Play — payment processing for GymChad Pro, under their own terms.
• jsDelivr — a content delivery network that serves the animated exercise demonstrations. When you open an exercise's animation, jsDelivr technically receives your IP address, as any web server does. No account data is sent.

5. What we don't do

• No advertising, no ad trackers.
• No third-party analytics.
• No selling or renting of personal data — to anyone, ever.

6. Retention and deletion

Your account and cloud training data are kept for as long as your account exists. You can delete your account directly in the app (Profile → account settings). This permanently removes your account, profile and uploaded picture, cloud training backup and its history, group memberships, reactions, groups you own, push notification tokens and subscription status records. Your publications are deleted from all groups, including groups owned by other members.

Deleting your account also removes blocks involving your account, reports you submitted and reports about your account, including their stored content copies. Reports otherwise remain available for support to examine and follow up until support deletes them. They do not expire automatically. A block remains until you remove it or either account is deleted.

Data stored locally on your device stays under your control and is removed by uninstalling the app. Deleting your account does not cancel an active subscription. The stores and RevenueCat retain purchase records under their own retention policies. See how to delete your account, including by email if you no longer have access to the app.

7. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict and port your personal data, and to object to certain processing. Most of this you can do directly in the app; for anything else, email contact@gymchad.app. You may also lodge a complaint with your supervisory authority (in France, the CNIL).

8. Children

GymChad is not directed at children. You must be at least 15 years old to create an account.

9. Changes

If we change this policy, we will update this page and its effective date. Substantial changes will be announced in the app.