What we collect, why, and the buttons that control it.

We store what you type and upload so the app can coach you, pass the relevant parts to an AI provider to generate your plans, and give you one-tap export and delete. No ads, no data sales.

Last updated 28 October 2026. Questions: hello@gymcoach.app.

Plain-language summary

We store your profile, logs, measurements, photos and settings so they sync between your devices.
Your profile, today's log and what you send to the coach are sent to our AI provider to generate the answer. Keys and raw data never go to the browser.
Progress photos are stripped of location data, kept private, and shown to trainers only if you allow it.
Export everything as a ZIP or delete your account from Profile. No email, no waiting.
This website uses no tracking cookies. The app stores a login token and a local copy of your data on your device.

1. Who is responsible

GymCoach Technologies, India ("we"), operates Repyra and this website. Contact for privacy matters: hello@gymcoach.app. This policy is written to meet the Digital Personal Data Protection Act, 2023 (India) and, where it applies, the GDPR.

2. What we collect

Data	Examples	Why
Account	Name, email, password (bcrypt hash), role, gym, language, theme, created and last-login dates	To run your account and sync your data
Profile	Age, sex, height, weight, goal, focus, days per week, diet, injuries, notes	To calculate targets and build plans
Daily logs	Food entries, water, sets with weight and reps, feelings, plans, chat messages, saved meals, custom foods, pinned videos, reminder settings	The core of the app: plans, reports, records
Body data	Weight, waist, chest, arm, thigh, hip, neck, body-fat entries; progress photos (date, pose, note, image)	Progress tracking; photos only if you upload them
Technical	IP address and timestamps in security logs (sign-ups, logins, failed logins, password changes, admin actions), AI usage counts, push subscription endpoint	Security, abuse prevention, fair-use limits, reminders
Contact form	Name, email, topic, message	To reply to you

We do not collect precise location, contacts, advertising identifiers or payment card details. Progress photos are re-encoded on upload and EXIF metadata (including GPS and camera data) is removed.

3. How we use it

To provide the Service: building plans, computing targets and reports, syncing between devices, sending reminders you turned on.
AI processing: to generate a plan, food estimate, chat reply, meal plan or report note we send the relevant parts of your profile, recent logs and your message or photo to our AI provider. The provider processes it to return the answer. Which provider is used can change; it is configured on the server, and your API traffic never carries our keys. We do not use your data to train models, and we instruct providers not to.
Security: rate limiting, detecting abuse, auditing admin actions.
Gym staff: if you joined through a gym, its owner and trainers see your training and nutrition summaries, measurements and assigned programmes, and your photos only if you enable sharing.
To reply to you when you contact us.

Legal bases where the GDPR applies: performance of a contract (the Service), legitimate interests (security), and consent (photos, notifications, photo sharing with trainers, which you can withdraw at any time in the app).

AI providers as described above, only the parts needed for each request.
Open Food Facts receives the barcode number when you scan or type one, nothing else.
Hosting and email providers that run our servers and send password-reset emails, under contracts that restrict them to our instructions.
Your gym's staff, as described in section 3.
Authorities when the law requires it.

We do not sell personal data and do not share it with advertisers.

5. Storage, security and retention

Data is stored in a MySQL database and a private file store on our servers. Photos are kept outside the web root and streamed only to the owner (or an allowed trainer) after authentication.
Passwords are bcrypt-hashed. Login tokens are stored hashed and expire after 30 days. Connections use HTTPS with HSTS when hosted.
We keep your data while your account exists. When you delete your account, your personal data, logs, measurements and photos are deleted immediately; security logs tied to your account are deleted or anonymised within 90 days; backups roll over within 30 days.
Contact form messages are kept for up to 24 months.

6. On your device

The app stores a login token and a local copy of your data in your browser's storage so it works offline and syncs later. The service worker caches the app's files and the 3D model. This website sets no cookies and loads no analytics. Fonts are served by Google Fonts and photos on this website by Pexels, whose servers see your IP address when the files load.

7. Your rights and controls

Access and portability: Profile, Data export gives you a ZIP with everything, photos included.
Correction: edit your profile, logs and measurements in the app.
Deletion: Profile, Delete account. A gym owner with other members must transfer ownership first.
Consent: turn notifications, photo sharing with trainers and AI features on or off in Profile.
Complaints: write to us first; you can also contact the Data Protection Board of India or your local supervisory authority.

8. Children

Repyra is not intended for anyone under 16. If you believe a child has created an account, email us and we will delete it.

9. Changes

We will post changes here with a new date and, for material changes, show a notice in the app or email you at least 14 days in advance.