Social: friends/followers, reactions, comments, blocks, reports, real-time activity status (ongoing workout, shared with your friends — can be disabled in settings).
Content: photos, videos, posts, timestamps.
Training data: sets, reps, weights, records, volumes, durations.
Device & diagnostics: Firebase installation ID, crash logs, IP region.
3) How We Use Your Data
Account creation and secure authentication.
Syncing workouts and posts across your devices (cloud).
Displaying your content and social interactions.
Content moderation to ensure community safety.
Improving stability and fixing bugs (Crashlytics).
4) Data Retention & Deletion
You can delete your posts, media or account at any time in the app.
When you delete your account, personal data and media are permanently erased.
5) Your Rights (GDPR)
As a European user, you can exercise the following rights:
Data processed: Advertising ID, device information, usage signals
Purpose: displaying third-party ads inside the app
No sensitive personal data is used for ads
Legal basis: consent (GDPR Art. 6(1)(a)) where required
Cross-app tracking is disabled unless user opts-in (App Tracking Transparency on iOS)
Stripe (Payments / Coaching Services)
Gymbro does not store payment details
Stripe processes payment information securely (PCI-DSS compliant)
Purpose: processing coaching payments
Legal basis: performance of contract (Art. 6(1)(b) GDPR)
7) Advertising & Tracking
Gymbro displays third-party advertisements using Google AdMob.
We do not sell personal data.
We do not perform cross-app tracking unless you explicitly consent (iOS ATT).
Advertisers may receive anonymized usage signals (e.g., ad performance).
Users may reset their Advertising ID at any time from device settings.
If you refuse consent on iOS or Android, ads remain non-personalized.
8) Data Shared With Third Parties
We may share limited technical data with service providers strictly for the following purposes:
With Google (Firebase / AdMob):
Crash reporting & diagnostics
Displaying ads
Device Advertising ID (for ads frequency capping & fraud prevention)
With Stripe (for payments):
Name, email, purchase metadata
No other third-party receives personal data. We never share health data, workout metrics, photos, or private messages with advertisers.
9) Storage Location & International Transfers
Your data is stored in Google Cloud (Firebase) — europe-west region (EU).
Some third-party services (Google, Stripe) may process data outside the EU. When this occurs, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission.
10) Consent Management (ATT & Android Ads)
iOS users are asked for permission before enabling personalized ads (App Tracking Transparency).
Android users may opt out of personalized ads via system settings ("Reset Advertising ID" / "Opt out of Ads Personalization").
Gymbro continues to work even if you decline.
11) Data Security
All data transmitted is encrypted using TLS 1.2+
Access to data is restricted through Firebase Security Rules
Passwords are hashed and never stored in plain text
Only authorized staff may access backend logs in case of abuse reports
