Privacy Policy

1. Introduction

Welcome to Generation Gym ("GenGym", "we", "our", or "us"). We are committed to protecting your personal information and your right to privacy.

This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you use our mobile application and related services (collectively, the "Service"). Please read this policy carefully. If you disagree with its terms, please discontinue use of the Service.

2. Information We Collect

Account Information

When you create an account, we collect:

• First and last name
• Email address
• Password (stored as a one-way hash — never in plain text)
• If you sign in with Google: your Google account name and email, as provided by Google Sign-In
• If you sign in with Apple: your Apple name and email (Apple may share a private relay address), as provided by Sign in with Apple

Health & Body Metrics

To generate a personalized AI workout plan, we collect information you enter directly:

• Age and biological sex
• Body weight and height
• Health restrictions or physical limitations (e.g. injuries or medical conditions you choose to share)

This data is provided voluntarily by you and is used only to personalize your plan. We do not integrate with Apple HealthKit, Google Fit, or any other health platform API.

Fitness & Workout Data

As you use the app, we collect:

• Workout logs (exercises performed, sets, reps, weights, timestamps)
• AI-generated and custom workout plans
• Exercise progress history
• Calorie goals for workout and rest days

Coach Uploads & Exercise Videos

If you use a coach account, you can create custom exercises and upload a short demonstration video for each one. When you do, we collect:

• The video file itself, including the image, likeness, and voice of any person who appears in it
• The exercise name, description, and any other details you attach to it
• Technical details of the upload — file size, duration, format, upload date, and the account that submitted it
• The outcome of our review, the reason for any rejection, and any appeal you submit

A video you upload may show you or another person. You are responsible for obtaining that person's permission before filming and uploading, and their parent or guardian's permission if they are a minor — see our Terms of Service. Every video is reviewed by a member of our team before clients can see it. Until it is approved, it is visible only to you; if it is rejected, it is never shown to anyone else.

We do not run face recognition on uploaded videos, we do not use them to build biometric identifiers, and we do not use them to train AI models.

Reports, Appeals & Complaints

If you report a video, appeal a moderation decision, or send us a copyright complaint, we keep your message, the content it concerns, our decision, and the correspondence between us.

Nutrition Data

• Food logs and meals you track manually or via the food scanner
• Photos you submit for food analysis (sent to our backend for AI processing and not retained after analysis)
• Calorie and macronutrient information for logged meals

Device & Network Data

• IP address — used to infer your country for default language selection (coarse location only; not stored beyond the request)
• Authentication tokens stored locally on your device

Analytics Data

We use Google Analytics for Firebase to understand how the app is used and to improve it. Firebase Analytics automatically collects:

• App usage events (e.g. screens viewed, features used, session duration)
• Device information (device model, operating system version, app version)
• Coarse, city-level location derived from your IP address
• A randomly generated app instance identifier (not tied to your name or email)

Analytics data is aggregated and used only to understand feature usage and improve the app. It is not used for advertising, and we do not link analytics identifiers to your account profile.

Subscription & Purchase Data

Purchases are processed through the Apple App Store or Google Play. We use RevenueCat to manage subscription status. We receive a RevenueCat customer ID and purchase receipt tokens to verify your entitlements. We do not receive or store your payment card details — those remain with Apple or Google.

3. How We Use Your Information

We use the information we collect to:

• Provide the Service — create and manage your account and deliver app features
• Personalize your experience — generate AI workout plans tailored to your goals, body metrics, and fitness level
• Process food scanning — analyze food photos via our AI service to return nutrition estimates
• Manage subscriptions — verify your purchase entitlements and process renewals via RevenueCat
• Set your default language — use your IP address country code to pre-select the app language on first launch
• Improve the app — analyze aggregated usage data via Firebase Analytics to understand which features are used and where the experience can be improved
• Communicate with you — send transactional emails (account confirmation, password reset)
• Host and deliver coach content — store exercise videos and make approved videos available to the clients a coach shares them with
• Review uploaded content — check exercise videos against our Terms before they are published, and handle reports, appeals, and copyright complaints
• Ensure security — detect and prevent fraud, abuse, and unauthorized access
• Comply with legal obligations — respond to lawful requests and enforce our terms

We do not use your data to serve third-party advertisements or sell personal data to any third party. Analytics data is used solely for app improvement, never for ad targeting.

4. Third-Party Services

We integrate with the following third-party services. Each has its own privacy policy:

We choose partners who are committed to data privacy and security. We require them to protect your data and prohibit them from using it for their own marketing purposes.

5. Information Shared With Other Users

Most of the information described in this policy is visible only to you. There are two exceptions.

Coach and client accounts

If you are a client linked to a coach, that coach can see the plans they assign you and the workout data you log against those plans. If you are a coach, the clients you are linked to can see the plans and exercises you assign them, including any demonstration videos you have uploaded.

Exercise videos

A demonstration video that passes review becomes available to the clients you share the exercise with, and they can play it inside the app. Videos are delivered through a content delivery network, which means the file is served to your client's device from a server near them. A video that has not been approved, or that has been rejected, is not shown to any other user.

6. Health & Fitness Data

Generation Gym collects health and body metrics directly from you when you create an AI workout plan. This includes age, biological sex, weight, height, and any health restrictions or injuries you choose to disclose.

• User-provided only: We do not integrate with Apple HealthKit, Google Fit, or any other health platform API. All health data comes from what you type into the app.
• Purpose-limited: This data is used solely to generate and personalize your workout plan.
• No third-party sharing: Your health data is never shared with third parties for advertising, marketing, or any purpose unrelated to providing the Service.
• No selling: We do not sell health data under any circumstances.

Food Scanning

When you use the food scanner, photos are sent to our backend AI service for nutritional analysis and are not retained after the analysis is complete. Food photos are not linked to your identity and are not used to train AI models.

7. Location Data

Generation Gym does not request GPS or precise location access. On first launch, we use your IP address to detect your country (via a Cloudflare CDN endpoint) for the sole purpose of setting the app's default language. The country code is used in memory only and is not stored on our servers.

8. Data Storage & Security

Your data is stored on secure servers. We implement industry-standard safeguards including:

• Encryption in transit (TLS/HTTPS for all API communication)
• Encryption at rest for sensitive data fields
• Access controls limiting which employees can access personal data
• Uploaded video files held in access-controlled cloud storage, not publicly listable or browsable
• Regular security reviews

While we take reasonable precautions, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security of your data.

Data Retention

We retain your personal data for as long as your account is active, or as necessary to provide the Service. If you delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required by law or for legitimate business purposes (e.g., fraud prevention records).

Uploaded exercise videos are retained on the following basis:

• Approved videos — kept for as long as the coach's account is active and the exercise exists. Deleting the exercise or the account removes the video from the Service.
• Rejected or removed videos — the file and the record of the decision are kept for 90 days, so that we can handle an appeal or a complaint, and the file is then deleted.
• Reports, appeals, and copyright complaints — the correspondence and our decision are kept for 12 months, or longer where a legal claim is outstanding.

9. Children's Privacy

Generation Gym is not directed to children under the age of 13 (or 16 in the European Economic Area). We do not knowingly collect personal information from children under these ages.

If we learn that we have collected personal data from a child under the applicable minimum age without verifiable parental consent, we will delete that data promptly. If you believe we may have any information from or about a child, please contact us at the address below.

Coach accounts are available to adults only. If a person under the applicable minimum age appears in a video uploaded by a coach, that coach must have the permission of the person's parent or legal guardian before filming and uploading. If you believe a video shows a child without that permission, contact us and we will remove it.

10. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Ask us to correct inaccurate or incomplete data.
• Deletion: Request that we delete your personal data ("right to be forgotten").
• Portability: Receive your data in a structured, machine-readable format.
• Restriction: Ask us to limit how we process your data in certain circumstances.
• Objection: Object to processing based on legitimate interests.
• Withdraw consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

If you delete an exercise video, it is removed from the Service and your clients can no longer view it. We cannot recover or recall a copy that someone has separately recorded or captured from their own screen.

How to Exercise Your Rights

You can manage most data directly within the app (edit profile, delete workout logs, update body metrics). To submit a formal data request or account deletion, email us at gengym@app.com.

We will respond to all requests within 30 days.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by updating the "Effective Date" at the top of this page and, where appropriate, through an in-app notification or email.

Your continued use of the Service after the effective date of the revised policy constitutes your acceptance of the changes.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: gengym@app.com
• App: Generation Gym

We take privacy concerns seriously and will respond promptly.