Privacy Policy

Effective: 28 October 2026

1. Who we are

The controller of your personal data is Kamil Dziadczyk, operator of GymCoin (gymcoin.pl) ("we"). Contact: kontaktgymcoin@gmail.com.

2. Data we collect

• Profile: sex, age, height, weight, activity level and goal.
• Health and activity data: meals and nutrition, weigh-ins, body measurements, workouts, cardio, steps, water, sleep, supplements, fasting and – if you turn on cycle mode – period dates and cycle phases. This is health data under Art. 9 GDPR.
• Photos you add: meal and label photos (sent only to read nutrition values, not stored) and progress photos (kept only on your phone).
• Messages to the Leafy coach and text you enter.
• Account data: a random user ID and a recovery code. If you choose to sign in with Google, we store your Google account ID and e-mail address only to restore your data on a new phone. We never ask for your phone number.
• Health Connect / Apple Health data (only if you connect it): steps, calories burned, weight and workouts recorded by your phone or watch.
• Friends activity: summaries of your workouts (name, duration, volume, records) and 💪 reactions, visible only to people who added your friend code. You can turn sharing off in the Progress tab.
• Referrals: whose referral code you used (to award coins to both of you).
• Purchases: GymCoin Premium is billed by Google Play or the App Store. We never see your card details, only the subscription status.
• Leaderboard data: the name you choose, workout count, volume, coins, streak and level. Only people who added your friend code can see it.
• Sign-ups on gymcoin.pl: if you leave your email in the form, we use it only to tell you when the app launches or to invite you to testing. We delete it on request (kontaktgymcoin@gmail.com) and no later than 6 months after launch. If you sign up via a friend's link, we also store that link's short code to count their referral reward.
• Tips from Leafy (newsletter, optional): if you tick a separate box in the form, we also send you recipes and diet and training tips, at most one email a week. You can withdraw consent at any time via the link in the email or by writing to kontaktgymcoin@gmail.com.
• Technical data: device type, OS and app version, error logs (error text only, no health data).
• Usage statistics: once a day we record that a feature was used (e.g. app opened, meal added, workout, Premium screen opened) with a hashed ID, platform and app version. No meal content, weight or other health data. Kept for up to 180 days.

3. Why we use it and legal basis

• Running the app (calorie tracking, workout log, goals, stats) – performance of contract (Art. 6(1)(b) GDPR) and your explicit consent for health data (Art. 9(2)(a) GDPR).
• AI features (Leafy, label and meal photo reading, weekly plan, summaries) – your consent. AI features are optional.
• Leaderboard, friends and referrals – your consent; visible only to people who added your friend code.
• Security, bug fixing and usage statistics (to know which features work and what to improve) – our legitimate interest (Art. 6(1)(f) GDPR).

We do not sell your data. We never use health data for advertising.

4. Who we share data with

• Cloudflare, Inc. (Cloudflare Workers and D1) – app server, backup storage and sync.
• AI provider – Anthropic (Claude model) – when you use AI features we send your question, meal description or photo and the data needed for the answer (e.g. calorie goal).
• Open Food Facts – product searches and barcode lookups send the product name or barcode only.
• Google and Apple – as app stores, Premium payment processors, notification providers and Health Connect / Apple Health.

Some providers may process data outside the European Economic Area (e.g. in the USA) under the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework.

5. Health Connect and Apple Health

Connecting is optional and is turned on in Profile → “Watch & health”. The app only reads steps, calories burned, weight and workouts to show them in your diary and tune your goal. We never write data to Health Connect or Apple Health.

Data from Health Connect and Apple Health is not sold, not used for advertising or credit decisions, not shared with third parties (other than our server provider to sync your own data) and not used to train AI models. You can revoke access at any time in Health Connect or Apple Health settings, or with “Disconnect” in the app. Our use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements.

6. Retention

For as long as you use the app. When you delete your account in the app, your data is removed from the server immediately (for e-mail requests, within 30 days at the latest). Backups expire within 90 days. Data stored only on your device is removed when you uninstall the app.

7. Your rights

You may access, correct, delete, restrict or export your data (Profile → Export data), object to processing, and withdraw consent at any time. You may lodge a complaint with your data protection authority (in Poland: uodo.gov.pl). To delete your account and all data, use Profile → Delete account and all data; data is removed from the server immediately. You can also e-mail kontaktgymcoin@gmail.com. Foods you added to the shared database stay there without any link to you.

8. Children

The app is intended for users aged 16 and over.

9. Changes

We will announce material changes in the app. The current version is always at gymcoin.pl/privacy.