Privacy Policy

Data stored on your device

Workouts, profile details, nutrition entries, habits, supplements, conversations, and app settings are stored locally on your device. The local app database and backup exports are not encrypted by Gym Terminal.

Removing the app or clearing its storage may remove local data. Before doing so, keep an off-device backup or check that your chosen personal-cloud destination confirms a successful sync or recovery backup. Pending changes are not protected by an earlier backup.

Files you choose

Gym Terminal reads an import file only after you select it. A portable file export is created when you request one; you choose where to save or share it. File import restores data once and does not enable personal-cloud sync.

Backup exports are readable files that may contain sensitive fitness, nutrition, supplement, profile, and chat information. Keep them in a location you trust.

Optional personal-cloud sync

You can choose to sync saved data to your own Apple iCloud account using a private CloudKit database on iOS 17 or later, or to your Google account using Google Drive's hidden app data storage on Android. No Gym Terminal account is needed, and this sync feature does not send your saved database through a Gym Terminal sync server. Apple or Google provides the cloud storage and receives the uploaded content and the account and connection information needed to operate it under its own terms and privacy practices.

Sync includes saved workouts, templates, programs and progress, exercise details, weight and body measurements, nutrition and water entries, recipes, habits and completions, supplements and logs, saved conversations, dashboard layouts, profile details, and portable preferences. Exercise photos stay on your device and are excluded from cloud sync and cloud recovery backups. Backup files you choose to save or share include those photos. Built-in exercise illustrations remain available normally. It excludes unfinished workouts, active timers, device permissions, notification registrations, credentials, and API keys. Opaque record, revision, and device identifiers, revision relationships, and timestamps accompany saved content so devices can reconcile changes and deletions.

Google Drive access uses the app-data permission, drive.appdata. The app uses the account email and identifier returned by Drive to display the connected account and prevent accidental account mixing. It does not request access to all files in your Drive.

Installing the app alone does not start a personal-cloud lookup. Choose Restore from a backup and a cloud source to look for a previously completed sync or recovery backup, review the saved data, and confirm Restore and enable sync to restore with ongoing sync. Google may require account selection or authorization. iOS 16.4 supports offline use and file restore; automatic iCloud sync requires iOS 17 or later.

The iCloud and Google Drive datasets are separate. To move between iOS and Android, use a portable backup file. Once enabled, sync transfers saved changes during supported foreground and background activity. Background delivery is best-effort; review the connected account, sync status, and last successful sync before relying on another device's copy.

A cloud account change or loss of access pauses sync and preserves pending local work. Reconnection requires an explicit choice before data is associated with another account. Disconnecting sync stops the connection without deleting existing local or cloud copies.

Cloud recovery and deletion

Sync propagates saved edits and deletions. When personal-cloud access is enabled and available, the app also keeps dated recovery snapshots separately from live sync in that cloud account. Check the last confirmed off-device backup separately from sync status; opening a share sheet does not confirm a saved backup.

Deleted records, superseded content, and older recovery snapshots have a 30-day recovery period. The latest verified recovery copy is retained until a replacement is confirmed; this does not extend retention of expired deleted or superseded content. Expired content is removed on the next successful online maintenance pass, so cleanup may happen later when a device is offline or access fails. Unresolved saved conflict alternatives remain available until you resolve them. Minimal opaque deletion and lineage metadata can remain after content removal to stop older devices from restoring deleted records.

Delete permanently requests removal of the selected content from app-managed sync history, related assets, and recovery snapshots. Delete cloud data removes the app-managed cloud content and recovery backups while keeping this device's current records. Minimal deletion or reset markers may remain. The app tracks cloud deletion until the provider confirms it; connected devices reconcile changes when they next connect. Apple's or Google's own storage and retention practices also apply.

These controls do not remove independently exported files, copies shared with another service, or copies held by disconnected devices before they reconnect. Those copies remain under their respective storage controls. Restoring an explicitly permanently deleted record from a separate backup creates a new record identity.

AI Coach and your provider

Before the first message through the default coach service, the app asks you to accept a disclosure of the information sent, recipients, and server archive. This permission is recorded only on your device, and a changed disclosure requires acceptance again. Declining leaves the default coach unavailable while you can continue using the rest of the app. You can revoke permission in Coach settings. Training-data sharing starts off and requires a separate choice after acceptance. Saving a personal provider connection requires an equivalent acknowledgement for that endpoint and model; existing connections require it before their next message. Revoking permission stops future requests but cannot recall information already received by a service.

AI Coach is optional. When you send a message without a saved provider connection, the app sends recent conversation messages, any saved conversation summary, and your language and unit preferences through the Gym Terminal coach server to OpenRouter and its configured hosting providers, Fireworks AI and Z.ai. The default model is Z.ai's GLM-5.3-Flash. The service prefers Fireworks AI and can use Z.ai for the same model when that host is unavailable. The server uses a separate installation identity to authorize requests and enforce usage limits; opening the app does not start a coaching request.

When training-data sharing is enabled, the built-in coach can request the relevant profile (your first name, weekly goal and training days), weekly activity, active program, lift trends, recovery estimates, or latest workout sections according to your coach settings. Newer app versions load these sections when requested rather than attaching every enabled section to every message. Retrieved tool results are used for that response and are excluded from the coach server's private archive and saved conversation context. Information included in your messages, summary, or the coach's answer can still be archived as described below. Older app versions and personal provider connections can include a snapshot of enabled sections with each message.

You can instead add your own OpenAI, Anthropic (Claude), Google (Gemini), OpenRouter, or compatible HTTPS connection in Settings. Text requests then go directly to that endpoint using your provider API key and do not use the default coach allowance. A failed personal connection is not silently replaced with the default service.

Calendar can estimate a meal's calories and nutrients from a description you type or a photo you take or choose. It sends only that description with your language, or that photo, and none of your saved records, along the same route as AI Coach and only after you accept the same disclosure. Without a saved provider connection, the request goes through the Gym Terminal coach server to OpenRouter and its configured hosting provider, Fireworks AI, and counts against a separate daily estimate allowance. The coach server does not archive or log meal descriptions, photos, or the estimates it returns. With a saved provider connection, the description or photo goes directly to that provider. The app does not keep meal photos in your food log or backups.

Voice input uses supported on-device speech recognition. Only the resulting transcript is sent with the conversation context; the microphone recording is not uploaded to the coach server. Spoken replies use supported local speech playback. Voice is unavailable when the required local language support is absent, and microphone capture stops when you leave the app.

The default coach server keeps submitted chat content and full or partial replies in a private archive for troubleshooting and quality review. Its configured retention is seven daily archive periods, with scheduled cleanup while the service operates. The archive includes dictated text but no audio recordings. This cleanup does not automatically delete independently exported server copies, backups, or information held by model providers. Requests sent directly through a personal provider connection bypass this archive.

Training context you enable, including the optional Exercises section's recent and custom exercise names, is included in the same seven-day coach archive when you send through the default service. Exercises starts off and is shared only after you enable it on this device. It shares bounded names from finished workouts in the last 90 days and active custom exercises, without notes or local record identifiers. Turning a section off changes later requests; it cannot recall content already received by a provider or the archive.

When you explicitly share a saved program in a Coach message, the app sends that program's name, routines, exercise names including custom names, set targets, progression rules, rest times, tempo and grouped exercises. Notes and cues are off by default for each share and are included only when you choose Notes before sending. The provider listing uses handles for that message instead of app record identifiers. The captured listing stays with your saved local conversation and is included in the same seven-day coach archive when sent through the default service. Removing an unsent program chip cancels that share; it cannot recall copies already received by a provider or the archive.

The coach service also stores installation credential hashes, conversation ownership identifiers, and usage and request metadata needed to authorize requests and prevent abuse. Installation credential records have no automatic expiry. Conversation ownership metadata expires after 30 days of inactivity, and duplicate-request metadata expires 30 days after its request. Web-server access logs can include IP addresses, requested paths, and request timing.

When you choose to share your latest workout, the app also sends a limited summary of that workout, including exercises, sets, weights, repetitions, distance or time, and totals. This summary excludes workout notes, local record identifiers, and custom exercise names. Anything you type into the conversation is included as message content, so share only information you want that provider to receive.

The default coach server receives your request and IP address. OpenRouter and its model provider receive the forwarded content; OpenRouter receives the server's connection information. A personally configured provider receives requests directly from your device. Provider retention, training, processing, and deletion practices depend on the provider, model, and account settings. Gym Terminal does not promise that providers keep no logs or never use submitted content for training.

On mobile, your API key is stored in protected device storage separately from app settings and backup exports. On web, the key uses browser session storage by default; choosing Remember on this browser stores it in that browser until you remove the connection or clear its storage. Browser storage is not mobile secure storage.

Saving a connection does not send a chat request. Test connection sends a small test prompt and your key to the configured provider; it does not send your workout history or conversations. Provider charges may apply.

Public content, food lookup, and exercise videos

Barcode lookup and online food search are unavailable in this release, and the app does not send food searches or barcodes to a lookup provider. Food you log in Calendar stays on your device and in supported backups, and is included if you enable personal-cloud sync. Meal estimates you ask for are described under AI Coach and your provider.

Exercise screens may automatically refresh the public exercise catalog from the Gym Terminal content service at most once daily while the app is in the foreground, and load exercise animations from the Gym Terminal content service as GIFs in visible exercise rows and workout cards. These requests use bundled or cached content as a fallback. Requests include catalog-version or exercise identifiers and normal connection information such as your IP address; they do not upload your saved workout database.

The Programs Discover library automatically checks its public catalog at most once daily while visible and when you request a refresh. Loading a program can request its revision. Program covers may load or be prefetched from the program-library service, including uncached covers of saved programs. Requests expose catalog versions, requested program or cover identifiers, and normal connection information such as your IP address; they do not upload your saved workout database.

Exercise videos can open content hosted by third parties such as YouTube. Those services receive the information normally sent when loading their content and apply their own terms and privacy policies.

Diagnostics and app services

This release does not enable Supabase app accounts or database sync, subscriptions, advertising, or automatic analytics or a separate app crash-reporting service. Personal-cloud sync is optional as described above. The app’s own recent technical error summaries stay on your device. You can review, clear, or choose to share them from Diagnostics.

Update-enabled distributed builds contact Expo’s over-the-air update service only after the app fails to start, to look for and download a fix. Normal launches do not contact it. When it is contacted, Expo receives normal connection information such as your IP address, app and runtime version information, a persistent installation identifier (EAS-Client-ID) stored on the device, and up to 1,024 characters of the saved native fatal error text. This native update diagnostic is separate from the app’s local Diagnostics controls. Update requests do not upload your local workout database. Versions released before this notice’s effective date check the update service each time the app launches and send the same information.

Device permissions

The app may ask for access needed for a feature you start, such as microphone access for a voice message, camera access when you choose Take photo for a Calendar meal estimate, notifications, choosing an exercise image, or selecting files for import and export. Voice recording is user initiated and stops when you leave the app. A meal photo is sent only for an estimate you ask for, as described under AI Coach and your provider. Barcode scanning is unavailable and does not request camera access.

You can review or change permissions in your device settings. Features that depend on a denied permission may be unavailable.

Your choices

You can edit or delete records inside the app, create a portable backup from Data & sync, and manage personal-cloud sync, recovery, and deletion from its controls. Keep exported files in a location you trust.

Remove connection clears your personal AI credentials from this device or browser and returns subsequent coaching requests to the default service. It does not delete your local conversations or data already received by a provider. Delete local conversations in the app and use the provider's own controls for copies it holds. Files you save or share outside the app remain wherever you chose to send them.

Delete my coach data in Coach settings requests deletion of this installation's included-Coach credential, conversation ownership and request metadata, and content in the active server archive. It runs only when you confirm the action. If a reply is active, wait for it to finish and retry. A brief content-free revocation marker prevents requests already authenticated before deletion from recreating data. Local conversations stay on this device; sending a later included-Coach message creates a new identity and can send saved conversation content again. This operation does not erase independent server exports or backups, access logs, personal-provider connections, or copies held by model providers; use the contact or provider controls for those copies.

Deleting local conversations or removing the app does not automatically erase server chat archives, cloud backups, or older account data. For requests concerning information held by the Gym Terminal service, email [email protected] with the app version and enough context to identify the request. Do not send passwords, API keys, or a complete backup. We may need additional information to locate records and verify your request.

Why we process information

Records you keep only on your device are not sent to us, so we do not process them. We process personal information only when you use a feature that reaches a service we operate: the default AI Coach and meal estimates, and the public content services. Other services described above, such as Apple, Google and Expo, handle information under their own terms.

We process that information to provide the feature you asked for; with your consent, which you give by accepting the Coach disclosure and by choosing training-data sharing, and which you can withdraw in Coach settings; for our legitimate interests in keeping the services secure, preventing abuse and enforcing usage limits; and where the law requires it. Workout logs, meal descriptions or photos, and any profile details you choose to share, namely your first name, weekly goal and training days, are processed only with the consent you give when you accept that disclosure.

We do not use your information for advertising, sell it, rent it, or use it to build profiles that produce legal or similarly significant decisions about you.

How information is shared

Information you send through a feature reaches only the recipients described in this notice for that feature, such as Apple or Google for personal-cloud sync, or OpenRouter and its model providers for the default AI Coach. We may also disclose information when the law requires it, to protect the rights, safety or property of users or others, or to a successor if the app or its services are transferred, in which case this notice continues to apply to the information transferred.

Retention

We keep information we hold only as long as needed for the purpose it was collected for, including legal, security and abuse-prevention needs, and for the specific periods stated above. When we no longer need it, we delete or anonymize it, or, where it sits in a backup that cannot be edited, isolate it from further use until it can be deleted.

International transfers

The Gym Terminal coach server handles your request in your region. OpenRouter, its model providers, Apple, Google and the other services described above may process information in the United States or other countries, where privacy laws may differ from those where you live. Where European or UK law applies, we rely on adequacy decisions, standard contractual clauses or another lawful transfer mechanism offered by the recipient. Contact us for more information about the safeguards used.

Security

We use technical and organizational safeguards designed to protect information we hold, such as encrypted connections to our services and hashed installation credentials. No service or device is completely secure, and we cannot guarantee the security of information you send or store. Protect your device, backup files and cloud accounts.

Children

Gym Terminal is not directed to children under 13. If you are under the age of digital consent where you live (up to 16 in some European countries), do not use the AI Coach or meal estimates without a parent's or guardian's permission. If you believe a child has sent us personal information in a way the law does not allow, contact us and we will delete it as the law requires.

Your privacy rights

Most of your information is stored only on your device, where you can view, export, correct or delete it yourself at any time. For information we hold, you can ask us to give you access to it, correct it, delete it, or provide a portable copy, and you can withdraw consent you have given. Some requests may be limited where the law allows, for example when we must keep information to comply with a legal obligation.

In Canada, you can also challenge our compliance and contact the Office of the Privacy Commissioner of Canada. In the European Economic Area or the United Kingdom, Harshvir Dhaliwal is the controller of the information we hold; you can also ask us to restrict or stop processing based on our legitimate interests, and you can complain to your local data protection authority or, in the UK, the Information Commissioner's Office. In U.S. states with consumer privacy laws, you have the rights those laws give you; we do not sell or share personal information for targeted advertising and do not use sensitive personal information to infer characteristics about you.

To make a request, email [email protected]. We may ask for information to verify your request, and we will respond within the time the law requires. We will not treat you differently for exercising your rights.

Earlier versions

Earlier releases, including those named Fit Terminal, may use different services. Refer to the notice supplied with your version or contact us. Updating the app does not itself delete information previously sent to a service. This notice does not establish that older Supabase accounts, records, or service logs have been deleted.

Changes to this notice

We may update this notice. The updated copy in the app and on our website shows a new effective date, and we will give more prominent notice of material changes, for example in the app. A change that needs your consent, such as a new use of Coach content, asks for it again before it applies.

How to contact us

Email [email protected] with questions about this notice or to exercise a privacy right.

Parts of this notice are adapted from templates General Legal, PC published under CC0. General Legal has not reviewed this notice.