Privacy Policy

Last updated: July 1, 2026

In short: The GymGPT app keeps your fitness data on your device. We don’t run accounts, we don’t track you across other apps or websites, and we never sell your personal information. The AI coach sends your messages and profile to Google to generate replies. This website’s waitlist stores the email you submit so we can send you an invite. You have full rights over your data under GDPR and the CCPA; see sections 9 and 10.

This Privacy Policy explains how Atharva Parande (“GymGPT,” “we,” “us,” “our”), the sole developer and operator of the GymGPT web app (the “App”) at gymgpt.vercel.app (together with its marketing pages, the “Website”, and together with the App, the “Services”), handles personal information. It also describes your rights under the EU/UK General Data Protection Regulation (“GDPR”) and the California Consumer Privacy Act as amended by the CPRA (“CCPA”), and how to exercise them.

1. Who is responsible for your data (Controller)

The data controller (and, for CCPA purposes, the “business”) responsible for your personal information is Atharva Parande, operating GymGPT as an individual developer. You can reach us at any time at atharvaparandeytl@gmail.com.

The Services are operated from India and made available worldwide, with a primary audience in the United States and Europe.

2. Information the App handles

GymGPT is designed to be private by default. The App has no user accounts and no login, and the information below is stored locally on your device:

Fitness profile you enter: name (optional), age, height, weight, training goal, experience level, available equipment, workout location, weekly schedule, and any injuries or limitations you choose to share.
Activity you log: workouts, sets, reps, weights, completed sessions, streaks, levels, achievements, daily check-ins (energy, sleep, soreness), and nutrition/calorie entries.
Coach messages: the text you send to the in-app AI coach and the “coach memory” it builds from your conversations.

We do not operate a server that stores your fitness profile or training history. If you delete the App, this locally stored data is removed with it.

2a. The AI coach and Google Gemini

The App’s coach is powered by Google’s Gemini API. When you send a message to the coach (or use a feature that asks the coach to adjust your plan, swap an exercise, or log food), your message and the relevant parts of your fitness profile are transmitted securely to Google to generate a response. This data is processed by Google as a service provider under Google’s API terms and Privacy Policy. We transmit only what is needed to answer you, and we do not attach your name, email, or contact details to those requests. If you never use the coach, no fitness data leaves your device through this path.

2b. Subscriptions (Stripe)

GymGPT Pro is an auto-renewable subscription billed through Stripe. Stripe processes the payment, and we never receive or store your full card number. Stripe provides us only with the information needed to activate your subscription (such as plan and status). You can manage or cancel a subscription at any time from your account settings in the app.

2c. Notifications

With your permission, the App schedules local reminders (such as daily training nudges, streak reminders, and comeback prompts) directly on your device. These are generated on-device and are not routed through our servers.

3. Information the Website handles

When you join the early-access waitlist on the Website, you submit your email address. We use it to add you to our mailing list and to send you a welcome message and, later, your invitation and product updates. This is the only personal information the Website asks you to provide.

Your email is stored with our email provider, Resend (see Section 6), so we can contact the waitlist.
Your browser also stores a small entry in local storage on your own device to power the “number in line” counter. This stays on your device and is not transmitted to us.
The Website does not use advertising cookies or third-party tracking pixels.

Our hosting provider, Vercel, may process limited technical data (such as your IP address and request metadata) as part of serving and securing the Website. See Section 6.

4. How and why we use information

To provide the App’s core features: building and adapting your plan, logging workouts and nutrition, tracking progress, and answering your coach messages.
To deliver, secure, and improve the Services and diagnose technical problems.
To process and validate your subscription through Stripe.
To send you waitlist, onboarding, and product-update communications you signed up for (and which you can opt out of at any time).
To comply with legal obligations and to establish, exercise, or defend legal claims.

We do not use your personal information for cross-app advertising, and we do not sell or “share” it for cross-context behavioral advertising.

5. Legal bases for processing (GDPR)

If you are in the EEA or UK, we rely on the following legal bases under Article 6 GDPR:

Processing	Legal basis
Running the App and its features on your device	Performance of a contract (Art. 6(1)(b))
Sending your coach messages to Google to generate replies	Performance of a contract (Art. 6(1)(b))
Processing your subscription via Stripe	Performance of a contract (Art. 6(1)(b))
Waitlist signup and related emails	Consent (Art. 6(1)(a)), withdrawable at any time
Securing the Services, preventing abuse, and improving reliability	Legitimate interests (Art. 6(1)(f))
Meeting legal obligations and defending claims	Legal obligation / legitimate interests (Art. 6(1)(c), (f))

Where we rely on consent, you can withdraw it at any time without affecting processing carried out before withdrawal.

6. Who we share information with (Processors)

We do not sell your personal information. We share it only with the service providers needed to run the Services, each acting on our instructions:

Stripe: processes subscription payments (privacy).
Google (Gemini API): generates AI coach responses from the content you send (privacy).
Resend: stores waitlist emails and delivers our messages (privacy).
Vercel: hosts the Website and processes technical request data (privacy).

We may also disclose information if required by law, to enforce our Terms, or to protect the rights, safety, and security of our users or others. If the Services are ever transferred to a new owner, your information may be transferred as part of that transaction, subject to this Policy.

7. International data transfers

We operate from India and our providers are located in various countries, including the United States. When your information is transferred internationally, we rely on the providers’ safeguards (such as the EU Standard Contractual Clauses and equivalent mechanisms) to protect it consistent with GDPR. By using the Services, you understand your information may be processed in countries other than your own.

8. Data retention

App data lives on your device and is retained until you reset it in the App or delete the App.
Coach messages sent to Google are subject to Google’s retention practices.
Waitlist emails are retained until you unsubscribe or ask us to delete them, or until the waitlist is closed and no longer needed.

9. Your rights in the EEA / UK (GDPR)

If you are in the EEA or UK, you have the right to: access your personal data; request rectification or erasure; restrict or object to processing; receive your data in a portable format (data portability); and withdraw consent at any time. You also have the right to lodge a complaint with your local data protection authority.

Because the App stores your fitness data only on your device, you can exercise access, correction, and erasure directly in the App (edit your profile, reset coach memory, or delete the App). For waitlist data or any other request, email atharvaparandeytl@gmail.com and we will respond within the time required by law (generally one month).

10. Your rights in California (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect and how we use it, to access and delete it, to correct inaccurate information, and to be free from discrimination for exercising these rights.

We do not sell your personal information, and we do not “share” it for cross-context behavioral advertising, as those terms are defined under the CCPA. We have not done so in the preceding 12 months. Categories of personal information we collect are: identifiers (email, optional name), commercial information (subscription status), and health/fitness information you choose to enter, collected and used for the business purposes described in Section 4 and disclosed only to the service providers in Section 6.

To exercise your rights, email atharvaparandeytl@gmail.com with the subject “California Privacy Request.” We will verify your request using the information you provide and respond as required by law. You may use an authorized agent to submit a request on your behalf.

11. Security

Data sent to our providers is transmitted over encrypted connections (HTTPS/TLS). Your App data benefits from your device’s built-in protections. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

12. Children

The Services are not directed to children under 13 (or the minimum age of digital consent in your country), and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, contact us and we will delete it.

13. Changes to this policy

We may update this Policy as the Services evolve. Material changes will be reflected here with a new “Last updated” date; significant changes may also be highlighted in the App or by email.

14. Contact

Questions or requests about privacy? Email atharvaparandeytl@gmail.com.