Legal

Privacy Policy

Last updated: 23 July 2026

1. Controller

The controller of your personal data is Gym Bro, established in Delaware, United States of America, operator of gym-bro.org and app.gym-bro.org. Contact: okhmat.anton@gmail.com.

2. What we collect

On this website

• Contact form data — the name, e-mail address and message you submit.
• Basic technical data — the page you submitted from, the referring page and any UTM parameters in the link you arrived through.
• Your cookie choice — stored in your browser's local storage, not on our servers.

In the application

• Account data — e-mail address and authentication details, or the identifier supplied by Sign in with Apple / Google Sign-In.
• Training data — your goal, interview answers, declared restrictions and injuries, schedule, generated programs and logged workouts.
• Chat and AI logs — messages exchanged with the coach and the corresponding model requests and responses, kept for debugging and cost control.
• Subscription data — trial and subscription status. Card details are handled by the payment provider or app store and never reach our servers.

We do not ask for and do not want data about diagnoses or medical treatment. Anything you volunteer about injuries is used only to adapt your training program.

3. Why we process it, and on what basis

• To provide the service — generating programs, recalculating them, storing logs. Basis: performance of a contract.
• To answer your messages — handling contact-form submissions and e-mail. Basis: legitimate interest in responding to enquiries, or steps taken at your request before entering a contract.
• To bill and prevent abuse — subscriptions, trial limits, fraud prevention. Basis: contract and legitimate interest.
• To improve prompts and control cost — reviewing AI request and response logs. Basis: legitimate interest.
• Non-essential analytics — only if you accept in the cookie banner. Basis: consent, withdrawable at any time.

4. Who else processes your data

We keep the list of processors short and current:

• Hosting provider — stores the website and the application server.
• AI provider (kie.ai) — receives the parts of your interview, program and messages needed to generate a response.
• CRM provider (AKM Advisor) — receives contact-form submissions so that enquiries can be tracked and answered.
• App stores and payment provider — process subscription payments where applicable.

Processors act on our instructions and may not use your data for their own purposes. We do not sell personal data and we do not share it for third-party advertising.

5. International transfers

We operate from the United States and use providers that may process data outside your country. Where data of individuals in the European Economic Area or the United Kingdom is transferred, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

6. How long we keep it

• Contact enquiries — up to 24 months after the last message, then deleted.
• Account, training and AI logs — for as long as your account exists, and up to 90 days after deletion in backups.
• Billing records — as long as tax and accounting law requires.

7. Your rights

Depending on where you live, you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data deleted (“right to be forgotten”);
• restrict or object to certain processing, including processing based on legitimate interest;
• receive your data in a portable, machine-readable format;
• withdraw consent at any time, without affecting processing already carried out;
• complain to your local data protection authority.

To exercise any of these, write to okhmat.anton@gmail.com. We respond within 30 days, usually much sooner.

8. Security

Traffic is encrypted in transit with TLS, access to production data is limited to the operator of the service, and secrets are stored outside the source code. No system is perfectly secure; if a breach affects your data and creates a risk to you, we will notify you and the relevant authority as required by law.

9. Children

The service is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a minor has created an account, write to us and we will remove it.

10. Cookies

Details of what is stored in your browser and how to change your choice are in the Cookie Policy.

11. Changes

If this policy changes materially, we will update the date above and notify registered users before the change takes effect.