Privacy and
Data Protection.
Absolute technical transparency about how we handle your biometric and athletic performance information.
Last updated: July 14, 2026
1. Data We Collect
We collect the data you give us while using GymRat+: account information (name, email, profile photo, and Google or Apple sign-in), physical and performance data (body weight, measurements, estimated body fat, training history, perceived exertion), nutrition and hydration logs, and your device tokens for push notifications.
2. Photos and Camera
With your permission, the app uses your camera and photo library for two things: progress photos (front, side, and back) stored privately in encrypted cloud storage and visible only to you (and your coach if you linked one), and food photos for nutritional scanning. You can delete any photo at any time from the app; deleting it also removes it from storage.
3. AI Processing
Your conversations with Kyro and the photos you scan (meals and progress analysis) are processed by third-party AI providers (such as OpenAI, through a secure gateway) for the sole purpose of generating your analysis or plan. We do not authorize these providers to use your data or photos to train their models, and we never sell your biometric profile.
4. Third-Party Integrations
Google and Apple: sign-in. Strava: if you connect it, we read your cardio activities (you can unlink anytime). Polar: processes payments for GymRat+ subscriptions on the web; financial data is handled by Polar and we never store card numbers on our servers. Apple and Google: if you subscribed earlier through their stores, we validate that subscription with them. Payments between a student and their coach happen outside the app: we neither process them nor see your financial data.
5. Sharing with Your Coach
If you accept a link with a coach, they can see your workouts, nutrition plans, progress, and progress photos in order to coach you. You can end the link at any time and access is revoked. Public workout share links only exist if you generate them, and they show the routine only — never your personal data.
6. Notifications, Cookies, and Telemetry
We send push notifications (web and native iOS) that you can disable from your device or profile. We use analytics tools (Google Analytics, Vercel Analytics) and error monitoring (Sentry) to keep the app fast and stable. Non-essential cookies are managed through the consent banner.
7. Information Security
All communications are encrypted in transit with TLS. Photos and files are stored in encrypted services with restricted-access URLs, passwords are hashed, and production access is limited and audited.
8. Your Rights (Colombian Law 1581 of 2012 / GDPR)
As the data subject you may access, update, correct and delete your data, request proof of the authorization you granted us, and revoke it at any time. To delete your account with all associated data — including your photos — write to security@gymratplus.com: deletion is complete and permanent across our servers and file storage, and we handle it within the timeframes the law requires. If you believe we did not handle your request properly, you may file a complaint with Colombia's Superintendency of Industry and Commerce.
9. Data Controller and Sensitive Data
The controller of your data is GymRat+, domiciled in Colombia, and you can reach us at security@gymratplus.com for any request about your information. This policy is governed by Colombian Law 1581 of 2012 and its implementing decrees. Note that your weight, body measurements, progress photos and any health data you record are sensitive data: we process them only with your prior, express and informed consent, you are not obliged to provide them, and their sole purpose is to deliver the training and nutrition service you requested.
Technical Security Contact
Data inquiries: security@gymratplus.com