Privacy policy

Version 1.0Effective September 23, 2026Applies to the Gym+ app and this website

Gym+ is a training log. What you record stays on your device by default and leaves it only with your authorization, as a summary: to your Coach and to the ranking or your teams, according to what you turn on, and, if you turn it on, as an encrypted copy of your history kept in your account (section 4.11). The health data the app reads (heart rate, calories and steps) does not leave the device, except when you authorize it: sending it to your Coach, using it for workout verification and the ranking, where only the verification level is sent, or the copy of your history in your account. This document explains exactly what is read, what for, what leaves the device, who sees what and what you can require of us.

1. Who is responsible

The Gym+ app is published and operated by ALAS TECHNOLOGY LLC, a company registered in the United States under IRS Employer Identification Number (EIN) 93-3927200.

Under the GDPR we are the controller of the data described here. Under Brazil's LGPD we are the controlador.

Data protection officer (LGPD, art. 41): the officer's official channel is privacy@gymplus.life. That address receives any request, question or complaint about personal data, and it is the channel through which we deal with data protection authorities when needed.

2. Health data

This is the part that matters most, so it comes first.

What the app reads

If, and only if, you allow it, Gym+ reads from Apple Health (HealthKit) on iPhone and from Health Connect on Android:

• Heart rate
• Active calories burned
• Total calories burned
• Steps
• Only when you tap to import them during the app’s initial setup: weight, height, date of birth and sex on iPhone; weight and height on Android

And it writes back a single thing: the workout session you have just finished, so it counts toward your activity for the day and shows up in the system health app's history.

What for

To show, inside the workout you logged, what your body did while it was happening, and to display charts and trends of that same data. Those charts and trends are calculated on the device itself. There is no other purpose (not statistical, not commercial, not recommendation) apart from the uses you authorize: sending it to your Coach (section 7), using it for workout verification or the ranking (section 11) and the copy of your history kept in your account, which serves only to give your history back to you (section 4.11).

Importing these profile details serves only to fill in your profile during the app’s initial setup (from the date of birth, the app keeps only your age). The app reads them only when you tap to import them, and they stay on the device, like the rest of your profile (section 3). From the profile, only two things go to our server, and only for the ranking (section 6): the division that matches your sex and, if you confirm it in Ranking settings, your weight.

What never happens to it

• Health data stays on the device: it is read and displayed there and, without your permission, it does not go to any server of ours or of anyone else. It only leaves the device, through our server, for the uses you authorize: sending it to your Coach, described in section 7, or using it for workout verification or the ranking, described in section 11, or the copy of your history kept in your account, described in section 4.11, which serves only to give your history back to you. In the ranking, only the verification level derived from it travels, never the heart-rate series. And only while that permission stands.
• Health data is not sold, rented, lent or traded.
• Health data is not used for advertising, marketing, targeting or profiling, not by us and not by anyone. The Meta SDK described in section 4.10 receives no health data at all.
• Health data does not feed any external automated recommendation system and is not sent to any third-party service for processing.

Anamnesis, assessments and progress photos

We also treat as health data your anamnesis answers, physical assessments, body composition assessments (bioimpedance) and progress photos. They only reach our server when you send or share them with your Coach, with a separate consent for each type, or when you ask for a bioimpedance report to be read automatically, which happens in memory only, on our hosting processor's infrastructure, without the file being stored. All of this is described in section 7.

How to withdraw permission

• iPhone: Settings Privacy & Security Health Gym+, and turn off whatever you want.
• Android: open Health Connect App permissions Gym+.

Withdrawing permission does not erase what is already in your health app. That history is managed by the system itself, and that is where it gets deleted. Gym+ simply stops reading.

3. What stays on the device

The following stays on your device, in the app's private storage, and by default is not sent to us:

• Your training log: exercises, sets, loads, reps, rest, dates.
• Your routines and planned workouts.
• Your profile, if you fill it in: display name, sex, age, height, weight and activity level (the profile photo and cover image, when you publish them, follow section 8; the ranking division that matches your sex and the weight you confirm for the ranking follow section 6).
• Body measurements, if you record them.
• Progress photos, if you take them or pick them from your gallery and do not share them with your Coach (section 7.2).
• Physical assessments and body composition (bioimpedance) assessments you record, until you share them with your Coach (section 7.4).
• Notes you write.
• Preferences: language, theme, units, weekly goal.
• The health data described in section 2.

The training log leaves the device only with your authorization, and then as a summary of each workout, according to what you turn on: the sets, with load and reps, go to your Coach (section 7) and to the ranking (section 6), and the teams you belong to receive a daily summary (workouts, minutes, volume, streak and records and, only with your calories switch on, the calorie estimate Gym+ itself works out from the workout, never a figure read from the health app). If you turn on the history kept in your account, an encrypted copy of the log and of the other items listed in section 4.11 stays on our server, only to come back to you.

If you uninstall the app, this data is removed from the device along with it. We only hold a copy of it to give back if you have turned on the history kept in your account (section 4.11). When you export a backup or share a workout, the file goes wherever you choose, on your own initiative. What you decide to make visible to other people (your @handle in the ranking, what you allow your Coach to see and the photos and videos you publish) is described in sections 5 to 8.

4. What leaves the device

Only what is described below, and each item only when you use the corresponding feature.

4.1 Your account

The account is created with Sign in with Apple, with Sign in with Google or with a code sent to your email. There is no Gym+ password. When you sign in with Apple or Google, the provider hands the app a signed proof of identity, and the app sends it to our server, which checks the signature against the provider's published keys. From that we receive:

• your account identifier at the provider (a stable code, not your name);
• the email address the provider shares. If you chose to hide your email with Apple, we only receive Apple's relay address, and we never ask for the real one.
• your name, when the provider shares it: Apple hands it to the app only on your first sign-in, and the app sends it to our server; Google includes it in the proof of identity itself;
• the @handle (username) you choose right after your first sign-in. It is public: it is how other people find you on Gym+ and how you appear in the ranking.

If you sign in with a code, you give us your email and we send it a 6-digit code, valid for 10 minutes and for at most 5 tries. Of the code, we keep only a cryptographic digest.

The name given at sign-up and the part of your email before the @ are used only to suggest your first @handle. They are stored encrypted only until you choose your @handle, and are deleted at that moment. While they exist, they are shown to nobody (not in the ranking, not to your Coach), included in the export of your data and deleted when the account is deleted. When you change your @handle later, the suggestions come from what the app sends with the request, which is not stored. The session credentials our server returns are kept in memory only and are discarded when you sign out or close the app.

One device at a time. Your account stays signed in on one device at a time: signing in on another device signs the previous one out. For this, and to protect the account from use by someone else, the app creates a cryptographic key in the device’s security chip (the Secure Enclave on iPhone, the Keystore on Android) that never leaves it, and signs every request to our server with it. We keep, linked to your account: the device identifier the app derives from that key (not a serial number, IMEI, MAC address or advertising identifier), the approximate model (such as “iPhone” or “Pixel 8”) and the date and time of the last access. We use them only for the security of the account: keeping one device signed in at a time, telling you by e-mail when a new device signs in (with an “It was not me” button that signs every device out) and showing the current and recent devices in Settings > Security. They follow the retention period of access records in the retention section and are unlinked from you when the account is deleted.

Usage milestones. We keep, linked to your account, only the type and date of a few usage milestones, with no health data at all (your first completed workout, your first full week with 2 workouts and the first use of each kind of feature: the health app integration, social features, Coach and personal records), to understand how people get started with Gym+ and to improve the product through internal analysis; these milestones are included in your data export and deleted along with the account.

How you use Gym+. At sign-up, the app asks “How do you use Gym+?”: whether you train on your own, train with a personal trainer or are a personal trainer. We keep on our server, linked to your account, the answer and its date, to adapt the app and the messages we send you and to count, in aggregate, how many people use the app each way. The answer never goes to Meta or to any other advertising partner and is not shown to your Coach; it is included in your data export and deleted when the account is deleted.

4.2 Subscription verification

To know whether your subscription is valid, the app sends our server the purchase identifier issued by the store (Apple or Google) and the product identifier. The server checks with the store itself and keeps the result: the plan (Athlete or Coach), the subscription state (free trial, active, grace period, expired, revoked), the expiration date and the date of the last check, linked to your account. The store also notifies our server when the subscription changes state: renewal, cancellation, refund.

We do not receive or store card numbers, bank details, billing address or any means of payment. The store charges you, and the store keeps that.

4.3 The weekly review

When you ask for the weekly review, and only then, the app sends our server:

• the language you want the text in;
• the weekly goal you chose;
• for each of the last 4 complete weeks, three numbers: how many workouts, on how many distinct days and how many sets.

Twelve numbers, a language and a goal. No exercise names, loads, reps, photos, measurements, notes, raw history or any health data. The current week is deliberately left out, because it has not closed yet. The server writes the review text, returns it to the app and does not keep those numbers.

4.4 The referral program

If you use invite-a-friend, the server keeps your invitation code, who invited whom and what stage each invitation is at. To stop a single device from creating several accounts just to collect rewards, the app sends an installation identifier that it generates at random itself. It is neither a hardware nor an advertising identifier, it changes if you reinstall the app, and the server stores it only as a keyed cryptographic digest. When you claim a month you have earned, we use your account email to arrange how it reaches you.

4.5 Messages you send us

If you write to one of our email addresses, we receive the message, your address and whatever you decide to include, such as screenshots. We use that only to reply and resolve the request.

4.6 Emails we send

We use your account email, the app language and the device time zone to send messages from the gymplus.life domain, in the right language and at the right time:

• Service messages: sign-in and confirmation codes, welcome, notices about your subscription (such as the start and end of the free trial, a failed payment and access ending), security notices and moderation decisions about your content. They are always sent, because they are part of how the account works.
• Weekly and monthly reports (section 4.7).
• Subscription and come-back reminders (section 4.8).
• Student activity notices, for people on the Coach plan, and product news: only sent if you turn them on.

Every message that is not a service message carries a one-click unsubscribe link, which turns off that type of message only. We record each of your choices, with the date, the source and the version of the text shown.

4.7 Email reports

The reports are about your own use of Gym+. Each has its own switch, starts on and can be turned off at any time in the app's notification settings, on the email preferences page or with the link at the end of each report.

• Athlete weekly and monthly reports: to build them, the app sends our server only the period's totals: number of workouts, minutes, volume, records, streak or weeks trained, medals and the most-trained muscles. No health data or body measurement is sent. Weekly totals are kept for up to 8 weeks and monthly totals for up to 3 months, only to compare with the previous period.
• Coach weekly and monthly reports: built on our server, they show the number of active students, the average adherence to the training plan, the students, identified by @handle, whose adherence rose or fell by 10 points or more, the programs ending soon and student messages still awaiting a reply. Adherence only counts students who allowed the Coach to see their workouts, and only the count of sessions done and planned.

The Coach report never includes health data: no heart rate, calories, pain, measurements, assessments, bioimpedance, anamnesis or photos. Each read of a student's data to build the report is written to that student's access log, just like a read made in the app.

4.8 Subscription and come-back reminders

If you create an account and do not subscribe, we may send up to 4 email reminders to finish subscribing, within the first 14 days. If your plan ended without renewing, we may send up to 3 come-back reminder emails over the following 60 days; anyone who had a refund or a revocation gets none. These emails are promotional and say so in the footer, only go out between 10:00 and 20:00 in your time zone, stop as soon as you subscribe and carry no price, health data or body measurement.

• Outside Europe, they rely on our legitimate interest in reminding people who already created a Gym+ account and start on, with a one-click unsubscribe in every message, plus the "Subscription reminders" switch in the app and on the preferences page.
• In Europe (when your account's time zone is European), they are only sent if you turn that switch on, that is, with your consent, which you can withdraw the same way.
• Reminders on the device: the app only schedules a subscription reminder notification if you accept a dedicated request, separate from and shown before the system's notification permission, that is, with your explicit consent. There are at most 2, and you can turn them off in the app or system settings.

4.9 Error diagnostics, performance and problem reports

To fix faults, the app sends our server technical data about the errors that happen in it: the error's type and message, the technical trace of the code (obfuscated, with none of your content), the screen where it happened, the app version, the system and the approximate device model, and the last 50 actions in the app before the error (screens opened, main actions and requests to the server, with route, result, duration and request code). We also receive the unexpected app closures that the system itself records (on Android, the exit reason; on iPhone, MetricKit).

• What never goes: what you type, passwords, sign-in codes, tokens, email addresses in the clear, document or phone numbers, coordinates and health data. The app masks this data before sending, and the server masks it again.
• Link to you: with a session open, the error is linked to your account; before you sign in, only to a random identifier of the installation, kept as a cryptographic digest.
• How to turn it off: in Settings > Privacy and data, with the “Send error diagnostics” switch, on by default. Off, the app stops sending everything this section describes, to our server, to Sentry and to PostHog, and whatever was queued for our server is deleted from the device.
• Report a problem: in Settings > Help and about and in Profile, you write what happened and choose whether to attach the diagnostics. The text goes through the same hate and threats filter as the rest of the app, is masked and gets a support code (such as GP-7K3Q9) shown on screen. Support receives the report by email and replies to your account's email address.
• Suggestions, screenshots and the site: in Profile, under “Suggestions”, you send ideas; in “Report a problem”, and with the “Report a problem” button on every page of the gymplus.life site, you can include a screenshot of the screen, shown to you before sending with form fields covered, or attach an image. With it go the screen or page, the app or site version, the system, the language, the screen size, the browser (on the site) and the account, if you are signed in; never passwords or tokens. We use this only to fix faults and to weigh suggestions. It is kept for 180 days, deleted with the account, and reaches the support team by e-mail.

Performance and usability, in aggregate. The app measures how long it takes to open and how smooth each screen is (slow and frozen frames), and counts, per screen, the taps, the taps repeated in quick succession on the same spot, the taps that get no response and the area of the screen where they happen (a grid of 12 by 24 parts, never the exact position). These counts are added up on the device and sent to our server with no account, no installation identifier and no time of day, and the server adds them up by day without keeping the IP address (only a cryptographic digest of it, to limit excessive sending). They serve only to find slow screens and buttons that are hard to use. On the health screens (Health data, Body composition, Measurements, Your photos, Timeline and Compare) and while protected content is on screen, no tap is counted; there, only the smoothness of the screen is measured. They are kept 180 days.

Sentry. Errors, unexpected closures, “app not responding” events (on Android) and hangs (on iPhone) also go to Sentry (Functional Software, Inc.), engaged by us as a processor, with the data stored in the European Union (Frankfurt, Germany). Sentry receives the error's type and message, the technical trace of the code, the screen where it happened and the screens opened before it, the app version, the system and the device model, all masked on the device before sending. If you are 18 or older, it also receives performance measurements (the time to open and the duration of screens and operations) and a code derived from your account by a cryptographic digest, which carries neither your email nor your name. It does not receive what you type, the requests to the server, recordings or images of the screen, or health data.

PostHog. To understand which parts of the app are used and where people give up (for example, how many accounts open the plans screen and how many start a trial), we send PostHog, Inc., engaged by us as a processor, with the data stored in the European Union (Frankfurt, Germany), a closed list of events: screens opened (never the health screens), signing in and out, opening the plans screen, purchase confirmation (only the plan and whether it is a free trial, with no amount or currency), workout start and end, and the app's installation, update, opening and move to the background. With them go the same code derived from the account and technical device data (model, system, app version and language). There is no screen recording, no automatic tap capture and no health data, and no information from your profile is sent. People who are 16 or 17, or whose age has not been confirmed yet, send nothing to PostHog.

Neither Sentry nor PostHog uses this data for advertising, to track you across other apps or websites, or for its own purposes, and none of it goes to Meta. Both are configured not to store the IP address the data comes from.

We use this data only to find and fix errors, improve the app and handle your report, never for advertising. Errors are kept 30 days on our server and up to 90 days at Sentry (performance measurements, 30 days), the aggregate performance and usability counts 180 days, usage events at PostHog while the account is in use (deleted after 12 months without use of the app) and reports 180 days. Errors on our server, events at PostHog and reports are deleted when the account is deleted, and the errors and reports on our server are included in the export of your data.

4.10 Meta SDK

We use a Meta SDK only to measure the paid ad campaigns we run outside the app; the app shows no ads. For this, the app and our server send Meta only these events: the app’s install and opening, the completed sign-up and the subscription (the start of the free period and the purchase, with the plan, the price and the currency). With them go device identifiers: a random identifier the SDK creates for the install, the ad click identifier, when there is one, and technical device data such as model, operating system and app version. What never goes: health, workout or location data and your answer to “How do you use Gym+?”. To opt out, ask by email at support@gymplus.life.

On Android, and on iPhone without your permission. The device’s advertising identifier, your email and your account id do not go: nothing that identifies you goes to Meta, and on iPhone the SDK stays in limited mode.

On iPhone, with your permission. The app may ask once, through the iPhone’s own prompt, for permission to track (App Tracking Transparency). If you allow it, Gym+ also shares with Meta, only to measure campaigns: your email and your account id, hashed, the device’s advertising identifier, your purchases (the start of the free period and the subscription) and interaction events (install, opening and sign-up). You can withdraw the permission at any time in the iPhone’s Settings; from then on, the previous paragraph applies again.

When you install Gym+ from a Google ad, we keep the click identifier (gclid) and the campaign source. If you are 18 or older, we share with Google Ads only that identifier and the fact that an account was created or a trial started, to measure our ads. We never send your name, email, phone number, or any workout or health data. You can object at any time through the support email.

4.11 History kept in your account

By default, your history stays only on the device (section 3). If you turn on Keep my history in my account (Settings > Account), Gym+ starts keeping an encrypted copy of it on our server, linked to your account, so that it comes back when you change phones or reinstall the app. The feature is off by default and only turns on after you read and accept a dedicated consent screen. If you do not want it, nothing changes in the app: your history stays only on the device.

What is kept:

• workouts: exercises, sets, loads, reps, rest, effort, workout notes and the watch data linked to the workout, such as heart rate and calories;
• routines, the weekly schedule and exercises you created;
• profile (display name, sex, age, height, weight and activity level), body measurements and weight entries;
• medals earned in the app, notes, training locations (name and equipment, with no address or coordinates) and the app's preferences.

What is not kept: photos and media of any kind (progress photos, profile photo, exercise photos and videos and the media attached to notes). They stay only on the device.

What for: only to give your history back to you, on the same device or on another one, and to keep the copy up to date after each workout. This copy is not used for advertising, marketing, come-back reminders, targeting or usage analysis, does not go to PostHog, Sentry, Meta or any other partner, and is not shown to your Coach, your guardian or anyone else because of this feature. What you share with your Coach still follows section 7, with the consents that apply there.

Legal basis: because the history includes health data, the basis is your explicit, specific and highlighted consent (LGPD, art. 11, I, and GDPR, art. 9(2)(a), together with art. 6(1)(a)), which you can withdraw at any time in the app's settings. We keep a record of the consent, with only the date, the version of the text and your choice, while the feature is on and for 5 more years after it is turned off, as evidence.

Where it is stored and how it is protected: the copy is stored in Cloudflare's object storage (R2), the hosting processor described in section 12, in the European Union jurisdiction. It is stored only in the European Union; on the way between your device and the storage, the already encrypted data may pass through the Cloudflare network outside the EU, protected by Cloudflare's contractual clauses. Each file is encrypted with AES-256-GCM under a key specific to your account, and file names do not carry your account identifier. Our database holds only an index (months, revisions and sizes), never the content of the workout, and our server does not write the content of the history to its logs.

One device at a time: the copy follows the rule of one signed-in device at a time (section 4.1). When you sign in on a new device, the app downloads the copy and merges it with whatever is already on the device, without duplicating workouts.

Plan: keeping new workouts requires an active plan. Without a plan, nothing new is kept, and what is already in your account remains available to download, turn off or delete.

How to turn it off and delete it: turn off the switch in Settings > Account. When you turn it off, the copy is deleted from the server within 24 hours, and what is on the device stays there. The index of the copy (months, revisions and sizes, never the content) may remain in the database backups for up to 30 days. Withdrawing consent does not affect what was done before or the rest of the app. A workout you delete in the app leaves on the server only a deletion marker, with no content, for 90 days, so that another device knows it was deleted.

How long: while the account exists and the feature is on. If you go 24 months without using the app and without an active plan, the copy is deleted, with notice 30 days in advance: by email, if you agreed to receive that notice by email, or in the app, when you open it again. Using the app during that period cancels the deletion.

Account deletion and export: once the account is deleted, the copy is deleted with it. The export of your data includes the kept history.

If you are 16 or 17: the feature is off and locked, and can only be turned on after your guardian allows it in the guardian panel (section 17). If your guardian withdraws that permission, the cloud copy is turned off and deleted within 30 days; the history stays only on the device. The guardian does not see the kept history: the guardian panel still shows only what section 17 describes.

iCloud backup on iPhone: while the feature is on, the app excludes the history on the device from the iCloud backup, so that health data is not stored in two places. When you turn it off, the history goes back into the iCloud backup, as before.

5. Location and gym recognition

If you allow it, Gym+ uses the device's location only while the app is in use, for a single purpose: recognizing the gym you are at, so that your workouts count toward that gym's ranking.

• Your exact position never reaches our server and we do not store it: at most, the server receives an approximate cell, as described below.
• To find gyms nearby, the app sends the server a geohash cell of about 1 km, a square of the map that indicates the area; it is used for the search and not stored.
• At check-in, the app sends the identifier of the gym and the cell of about 150 m you are in, to confirm you are at the gym. That cell is checked against the gym's and not stored.
• If you register a new gym, the app sends as its position only the cell of about 150 m you are in, never your exact position; the server refuses any position more precise than the cell. The center of that cell becomes the gym's position and is shown to people looking for gyms. We keep no record tying you to that position and to the time you registered it: only the note that you registered the gym remains, and it is erased when you delete your account.
• To name the city and, on iPhone, to suggest gyms nearby, the app uses the system's own location services: Apple's on iPhone and Google's on Android. For those requests, the coordinate may go from the device to Apple or Google, which handle it under their own privacy policies; Gym+ only gets the place name back.
• The app does not use location in the background, does not build a history of your movements and does not use location for advertising.

The permission is optional. You can refuse it when the system asks or revoke it later, at any time, in the device settings (iPhone: Settings Privacy & Security Location Services Gym+; Android: Settings Apps Gym+ Permissions Location). Without it the app keeps working; it simply stops recognizing the gym automatically.

6. Public ranking

The gym ranking is public within Gym+: anyone who opens it sees the standing of the people in it, each identified by their @handle. The ranking shows your @handle, not your email or the name on your Apple or Google account.

You can leave the ranking or hide yourself from it at any time, from within the app. You can also ask us to do it at privacy@gymplus.life. Once you leave, your @handle no longer appears in the list; your workouts remain on your device.

Division. If you have an account and answered the sex question in the app’s profile (during the initial setup, in the settings or by importing from the health app), the app sends our server only the ranking division that matches your answer: male, female or open (for those who prefer not to say). The division decides which boards you enter and the table used for strength levels and weight classes. On boards split by division, anyone who views them knows the division of the people on them. You can change your division in Ranking settings.

Weight. Your weight goes to our server only if you tap “Confirm weight” in Ranking settings. It is used to divide strength and volume by your weight and to set your weight class on the strength boards. Nobody sees the number: it is stored encrypted, and the boards show only the weight class. Without it, you stay off the strength and volume boards, and 90 days after the last confirmation it stops being used until you confirm it again.

How to stop taking part. “Leave the ranking”, in Ranking settings, takes you off every board; turning off “Medals, levels and competitions” in the settings also takes you off them. The division and the weight stay stored, linked to your account, are included in the export of your data and are erased when the account is deleted.

7. Sharing with your Coach

7.1 What you choose to share

If you train with someone on the Coach plan, Gym+ lets that person follow your progress. Nothing is shared without your consent, and consent is given per category: you choose each one separately:

• Performance: workouts, sets with load and reps, and adherence to the training plan.
• Health summary: for each workout, the average and maximum heart rate, the active calories and the time in each heart-rate zone, never the heart-rate series. Because it is health data, it is only shared with your specific consent for this category.
• Watch verification: confirmation, from the watch, that your workout sessions took place.
• Progress photos, anamnesis, physical assessment and body composition: each with its own consent, as described in sections 7.2 to 7.4.

Anything you do not allow is not sent to your Coach. You can withdraw your consent at any time, in full or per category; from then on, sharing of that category stops. The Coach can also end the link with you, for example when you stop being their student, and in that case sharing stops as well.

Shared data passes through our server to reach the Coach and is kept for as long as the link and your consent exist. The Coach uses what they see to follow your training and may not use this data for any other purpose.

7.2 Progress photos

Progress photos stay on your device. You can share them with your Coach, one photo at a time, if you give the dedicated consent for photos. They serve only to let the Coach follow your progress.

• Who sees them: only the Coach of the link you shared with, and only while the link is active and your consent stands. They see the photo in the app, with their own @handle marked over the image, through temporary links that last a few minutes, and have no way to download the file.
• Moderation: before it becomes available, the photo goes through the same safety analysis as every other image sent to Gym+ (section 8), which takes the gym context into account.
• Storage: the photo, the pose and the date are encrypted on our server. Nothing about the photo goes into notifications or the inbox.
• Deletion: when you delete the photo or withdraw your consent, when the link ends or is blocked, or when either account is deleted, the photo and every stored copy are deleted at once.

7.3 Anamnesis

The anamnesis is the health questionnaire your Coach can send you: the PAR-Q, the Gym+ standard questionnaire or questions written by the Coach. It lets the Coach learn your history before building or adjusting your training.

• The answers are health data. They are only sent with your specific consent for the anamnesis, and each submission is kept as a version that never changes.
• They are encrypted on our server. The Coach can only read them while the link is active and your consent stands, and each read is logged.
• When you withdraw consent, the Coach's copies are deleted at once. When the link ends, they are deleted as well, and the anamnesis requests of the ended link are deleted 30 days after it ended.

7.4 Physical assessment and bioimpedance

You can record physical assessments (skinfolds, circumferences and physical tests) and body composition assessments (bioimpedance). They stay on your device and serve to track your progress.

• Sharing with the Coach: an assessment only reaches our server when you share it with your Coach or when the Coach records an assessment of you, and both depend on a dedicated consent (one for physical assessment, another for body composition). The measurements are encrypted on the server. The Coach only sees the assessments you shared and the ones they recorded, and each read is logged. When your next assessment is nearly due, you and the Coach get a reminder.
• Withdrawal and deletion: you can delete the assessments you recorded and hide the ones the Coach recorded. Once no active link holds your consent, the copies you shared are deleted; only a marker with no measurement remains, to sync your other devices, and it is deleted 30 days later. What the Coach recorded remains yours. If your account is deleted, all of this is deleted; if the Coach's account is deleted, what they recorded remains yours, without their name.
• Automatic report reading: instead of typing the numbers, you can send the device's PDF or a photo of the bioimpedance report to be read automatically. This requires a separate consent, which you can withdraw on the app's privacy screen. The file is read on our server by an automated document-reading system (artificial intelligence) that runs on our hosting processor's infrastructure (section 12), which does not keep the content or use it to train models. The file exists in memory only while it is read: it is not written anywhere, and the usage log keeps only technical data, such as the file type, the number of pages and the outcome, never the text, the image or the values. When the report is a PDF, the name and the report number are swapped for markers before the text is read by the automated system. When it is a photo, the whole image, including the name and identification printed on it, is analyzed automatically to extract the data. The name goes back to the app only so you can check, on the device, that the report is yours, and it is not stored. A photo goes through the same safety analysis as other images. The values read are only saved after you review and confirm them.

7.5 Archiving by the Coach

The Coach can archive the link with you, for example when you take a break, and the link can also be archived when the Coach has more students than seats, as described in the Terms of use. Archiving disconnects the link without ending it:

• What stops being shared: the Coach stops seeing any of your data (workouts, metrics, health, assessments, photos, anamnesis and adherence) and receives nothing new; workouts you log during that time stay on your device only. You stop receiving the Coach's programs, videos and program conversations, and the copy of that content on your device is deleted.
• What the Coach still sees: only your name and @handle, when the link was archived and by whom, the date the archive ends and the list of programs they sent. Their private notes are kept and come back if they unarchive.
• Consent suspended: your consents stay on record but authorize no sharing while the link is archived. If the Coach unarchives, they apply again as they were. You can withdraw them or end the link for good at any time.
• Notice: you are told in the app when the link is archived, with no reason given, and when it is unarchived.
• 12-month retention and ending: an archived link is kept for up to 12 months, and the Coach is told 30 days before it ends. If nobody unarchives it, the link ends after the 12 months, the consents are closed with a record and both sides are told. Deleting your account or the Coach's account ends an archived link like any other.

7.6 The Coach's public page and contact requests

People on the Coach plan can publish a public page at gymplus.life/p/ followed by their @handle. The page shows the Coach profile (name, bio, city, specialties, whether they coach in person or online and the CREF number, only once it is verified) and the photo and cover approved by moderation. The Coach turns the page on and off and chooses whether search engines may list it. The page stops appearing if the Coach plan lapses.

Anyone who wants to train with the Coach can send a contact request, from the page or from the app, with a name, a contact (email or @handle) and a message. This data serves a single purpose, the Coach's reply:

• it is encrypted on our server and only the Coach reads it; for a request made from the app, the Coach's reply is available to the sender;
• it is deleted 180 days after it was sent, or earlier, when the Coach or the sender removes it; whoever sends from the page gets a link to delete their own request;
• to keep robots and abuse out, the page form uses a Cloudflare robot check, loaded only when you start filling it in, and sending limits per IP address, kept only as a cryptographic digest and only for the length of the limit; the same contact sent again to the same Coach updates the earlier request instead of creating another.

Deleting the Coach's account deletes the page and the requests received; deleting the account of someone who sent from the app deletes the requests they made.

8. Photos and videos you publish

Some media exist to be seen by other people: your profile photo, your cover image, photos you decide to publish and, for people on the Coach plan, the exercise videos they record for their students. When you upload one of these, we store it on our server in order to show it to the people it is shared with.

These media are moderated (automated analysis and human review) to enforce the Community Guidelines. Content that breaches the guidelines may be removed; removed content is kept for 30 days so the decision can be appealed, and is then deleted. Moderation only covers published media; progress photos you keep on the device are neither uploaded nor analyzed.

You can ask for any media you have published to be removed by writing to privacy@gymplus.life. When you delete your account, the media you published are deleted.

Reports

You can report other people's profiles, photos, videos, messages, comments, programs and other content. With a report we keep who reported, what was reported and who its author is, the reason chosen, the detail you write, if any (up to 1,000 characters), and the date. Once sent, the content disappears from your view, and the app offers to block the author.

The moderation team sees the report with the context needed to decide: the reported excerpt and the author's moderation history. We tell the person who reported a generic outcome. When a report involves a child or a teenager, it goes straight to the child safety team and the outcome is not disclosed to the person who reported; confirmed cases are reported to the authorities, as described in Child safety. How long reports are kept is in section 13.

9. Screenshots and screen recording

Some Gym+ content is protected, for example the paid workouts prepared by a Coach. On those screens the app notices when a screenshot or a screen recording is made, in order to protect that content.

• What the app records is only the fact that the event occurred on a piece of protected content.
• That record goes to our server for moderation and to protect the content, and it is not sent to the Coach.
• No image of the screen is taken, stored or sent by Gym+, and this does not give the app access to the capture the system produced or to your gallery.
• Detection only runs on protected-content screens; it is not used anywhere else in the app.

10. Bluetooth and sensors

Gym+ uses Bluetooth only to connect heart-rate straps and sensors that you choose. Scanning for devices happens when you ask to connect a sensor, and is used for nothing else. The app does not use Bluetooth to locate you, does not look for other devices around you for any other purpose and does not send the list of devices found to our server. The heart rate read from the sensor is handled like the rest of the health data in section 2. You can revoke the Bluetooth permission in the device settings whenever you like.

11. Watches and sensors

Gym+ works with the watches and sensors you choose to connect:

• Apple Watch;
• Wear OS watches;
• Garmin watches, through the Gym+ app for Connect IQ;
• Bluetooth heart-rate straps.

What is collected

During a workout, these devices record your sets, reps, load, heart rate as 15-second averages and the workout summary.

How the data reaches your phone

The data travels from the watch to the phone through each manufacturer's official channel:

• Garmin: the Garmin Connect IQ Mobile SDK and the Garmin Connect app;
• Apple Watch: Apple's pairing;
• Wear OS: the Wear OS data layer;
• Straps: standard Bluetooth, as described in section 10.

Garmin processes the data that passes through it under Garmin's own privacy policy. The same applies to Apple and Google for their own systems.

Where the data stays

On your device. It only leaves the device when you authorize sending it to your Coach (section 7) or using it for workout verification or the ranking (section 6), or when you turn on the history kept in your account (section 4.11), which keeps an encrypted copy of your workouts, with the watch data, only to give it back to you. In the ranking, only the verification level derived from this data travels, never the heart-rate series.

Legal basis

Because this is health data, the processing is based on your consent: specific and highlighted consent under the LGPD (art. 11, I) and explicit consent under the GDPR (art. 9(2)(a)). The full table is in section 14.

How to withdraw permission

• disconnect the watch or strap in the app;
• revoke the permissions in the system settings or in the Garmin Connect app;
• withdraw, in the app, the permission you gave to the Coach, to workout verification or to the ranking;
• turn off the history kept in your account in Settings > Account.

Withdrawal does not affect processing already carried out before it.

12. Who we share with

We do not sell personal data for money and do not trade it for services, discounts or any other return. The third parties involved are the ones that make the app possible:

Cloudflare, Google (Google Workspace), Sentry and PostHog act as processors: they process data only on our instructions, under a contract that requires confidentiality and security measures, and may not use it for their own purposes. The international transfer of this data is described in section 16.

We may also share data when there is a court order, a request from a competent authority or a legal obligation, and, where the law allows us to tell you, we do.

13. How long we keep it

The purchase marker exists for one specific reason: to stop a subscription that has already been used from being transferred or reused on another account after the first one is deleted. It cannot be used to re-identify you or to recover anything that was yours.

Archived moderation records

Every decision of our media delivery system (granting, denying, holding or revoking access, and the screenshot events in section 9) creates an audit record. It is how we investigate abuse of paid content, and it is an application access record, which art. 15 of Brazil's Marco Civil da Internet requires us to keep for 6 months. The records stay in the database for 90 days and then move to a separate, private archive with restricted access:

• in the archive, a record does not carry your account identifier, only a pseudonymized identifier, computed with a secret key and a random value of each person's own, kept apart from each other;
• while that value exists, your archived records are included in the export of your data, without the pseudonym;
• when the account is deleted, the random value is destroyed and the archived records are unlinked from you for good: nobody, not even we, can tie them to you again. They remain as an anonymous audit trail until their 6 months end, and are then deleted;
• database backups are kept for up to 30 days, are only read to restore the service and, after a restore, every account deletion made after the backup's date is applied again before the service runs again.

14. Legal basis for each processing activity

Each purpose has a legal basis under Brazil's LGPD (Law No. 13,709/2018) and, for people in the European Economic Area, the United Kingdom or Switzerland, under the GDPR. Where the basis is consent, you can withdraw it at any time, without affecting what was done before or the rest of the app.

Where we rely on legitimate interest, the interest is concrete and the impact on you is small: against fraud, we keep only cryptographic digests, with no email and no name; in moderation, we only handle what you chose to publish, to keep the community safe; in screenshot detection, we only record that the event occurred, to protect the work of whoever created the content; in subscription reminders outside Europe, we only write to people who already created an account, a few times, with no health data and with a one-click unsubscribe; in the robot check and sending limits, we only use technical data from the request, to protect the Coach from spam; in campaign measurement through the Meta SDK, we send only the events in section 4.10, with no health data and, without the iPhone’s permission to track, without the device’s advertising identifier and without your email; in diagnostics, at Sentry and at PostHog, we use only technical data and a code derived from the account, with no health data and never anything from people who are 16 or 17 at PostHog, and you can turn it all off with the “Send error diagnostics” switch. You can object to this processing by writing to privacy@gymplus.life.

15. LGPD: your rights in Brazil

The legal basis for each processing activity is in section 14.

What you can require

At any time, free of charge, you can request (LGPD art. 18):

• confirmation that we process your data, and access to it;
• correction of incomplete, inaccurate or out-of-date data;
• anonymization, blocking or deletion of data that is unnecessary, excessive or processed in breach of the law;
• portability to another provider;
• deletion of data processed on the basis of your consent;
• information about whom we share your data with;
• information about what happens if you do not consent;
• withdrawal of consent;
• review of a decision taken solely on the basis of automated processing, such as a content removal made by automated moderation (art. 20).

Some choices you can make yourself, without writing to us: withdrawing the consent given to your Coach (including those for progress photos, anamnesis and assessments), withdrawing the consent for automatic report reading, ending a link, even an archived one, turning off the email reports and reminders, deleting a contact request you sent, turning off and deleting the history kept in your account, leaving the ranking and revoking the location, Bluetooth, notification and health permissions in the device settings. You can also download, in Profile > Account & subscription > Export account data, a file with the data we keep about your account, even without an active plan.

To exercise any of them, write to privacy@gymplus.life. We reply within 15 calendar days. There is a direct path inside the app to delete your account, described in Delete account.

If you believe we have mishandled your data, you can complain to Brazil's National Data Protection Authority (ANPD).

International transfers

Data that leaves the device is processed in the United States and in other countries where our processors run infrastructure. That transfer relies on standard contractual clauses entered into with each processor (LGPD art. 33, II, b) and on the other safeguards described in section 16. You can ask us for a copy of the applicable safeguards. The copy of the history kept in your account (section 4.11) it is stored only in the European Union; on the way between your device and the storage, the already encrypted data may pass through the Cloudflare network outside the EU, protected by Cloudflare's contractual clauses.

16. GDPR: your rights in Europe

Gym+ has an interface in 16 languages and is sold on the Apple and Google stores in countries of the European Economic Area. If you are in the EEA, the United Kingdom or Switzerland, the rules below also apply.

Legal bases (art. 6 and art. 9)

The basis for each processing activity is in the table in section 14. In short: performance of the contract (art. 6(1)(b)) for running the app and the account; consent (art. 6(1)(a)) for location, for sharing with Meta on iPhone with the permission to track, for sharing performance with the Coach and for subscription reminders, by email and on the device; explicit consent (art. 9(2)(a)) for everything involving health data, which is special-category data: reading from the health app and sensors, the health summary and watch verification shared with the Coach, progress photos, anamnesis, assessments, the automatic reading of the bioimpedance report and the history kept in your account; legal obligation (art. 6(1)(c)) for the tax record and the record of consent to the history kept in the account; and legitimate interest (art. 6(1)(f)) for fraud prevention, moderation, reports, screenshot detection, the robot check, access records, error, performance and usage diagnostics (including through Sentry and PostHog) and campaign measurement through the Meta SDK in the app. That is why health data is only read after you allow it in the system, and why each consent can be withdrawn without affecting the rest of the app.

International transfers

The controller is a company registered in the United States, and our server, the database, this website and email forwarding run on Cloudflare's infrastructure, which may process data in data centers outside your country, including in the United States. Account, subscription, referral program, ranking, Coach-sharing, email and report and contact request data, and published media, may therefore be transferred outside the EEA.

Cloudflare is certified under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) and incorporates the Standard Contractual Clauses approved by the European Commission (art. 46(2)(c)) into its data processing agreement. Google, which hosts our mailbox, offers the same safeguards. You can ask us for a copy of the applicable safeguards.

The data sent to Sentry and PostHog (section 4.9) is stored in the European Union (Frankfurt, Germany), under those companies' data processing agreements, with the Standard Contractual Clauses that apply to access by those companies from the United States.

The copy of the history kept in your account (section 4.11) uses Cloudflare's object storage (R2), in the European Union jurisdiction, and it is stored only in the European Union; on the way between your device and the storage, the already encrypted data may pass through the Cloudflare network outside the EU, protected by Cloudflare's contractual clauses.

Health data read from the health app, from watches and from sensors only leaves the device when you authorize it: sending it to your Coach (the health summary and watch verification), using it for workout verification or the ranking, or the copy of the history kept in your account, which stays in the European Union. In the ranking, only the verification level derived from it travels, never the heart-rate series. The same applies to the progress photos, anamnesis and assessments you share with the Coach and to the report you ask to be read automatically. This special-category data is transferred on the basis of your explicit consent and with the same safeguards as above.

Your rights

• Access (art. 15), rectification (art. 16) and erasure (art. 17).
• Restriction of processing (art. 18) and objection (art. 21).
• Notification of any rectification, erasure or restriction to the recipients of your data (art. 19).
• Not to be subject to a decision based solely on automated processing with a significant effect (art. 22), as explained below.
• Portability (art. 20). In practice: what is truly yours (the training log) is on the device, and the app itself exports that history to a file, with no need for us. You download the data we keep about your account yourself, in Profile > Account & subscription > Export account data, which produces a file, even without an active plan: account, subscription, ranking and Coach-sharing data and, if you turned on the history kept in your account, that copy. The media you published and the archived moderation records, while they can still be linked to you, can be sent to you in a machine-readable format on request.
• Withdraw consent at any time (art. 7(3)), without affecting what was processed before.
• Complain to the data protection authority in your country (art. 77).

Requests: privacy@gymplus.life. We reply within one month, as the GDPR requires, and usually much sooner.

Automated decision-making

The weekly review is an arithmetic comparison across four weeks, not a profile of you. Moderation of published media combines automated analysis and human review; if a decision about your content was made solely by automated means, you can ask for a person to review it at privacy@gymplus.life. The automatic reading of the bioimpedance report only proposes values: nothing is saved until you review and confirm them. We make no solely automated decision that produces legal effects or similarly significantly affects you, within the meaning of art. 22.

17. Children and teenagers

Minimum age: 16. Gym+ may not be used by anyone under 16. The account of anyone under 16 is closed and, when we learn that an account belongs to someone below that age, we delete it; anyone can ask us to do so at privacy@gymplus.life. Gym+ is not intended for children under 13 and we do not knowingly collect their data, as COPPA requires in the United States. If the law of your country sets an age higher than 16 to consent to the processing of data (in the EEA, article 8 of the GDPR), the local age applies and, below it, use requires permission from the guardian.

How the app knows your age

• Store or system signal: first, the app checks the device's age signal: on iPhone, Apple's Declared Age Range (iOS 26 or later); on Android, Google Play's Play Age Signals. The app receives only an age range (for example, 16 to 17, or 18 and over) and where it came from (declared by the person, declared by the guardian, or verified), never the date of birth.
• Date of birth: without that signal (an older device, a refusal or the service being unavailable), the app asks for the date of birth, which stays on the device only.
• When they disagree: if the two sources do not match, the more protective one applies.
• What reaches the server: only whether the person is over or under 18 and the day this was confirmed.
• Purpose: the age signal is used only to fit the app to the user's age, never for ads, marketing, profiling or analytics.

Teen mode (16 and 17)

Anyone aged 16 or 17 uses Gym+ in teen mode, with maximum privacy by default:

• No social features: no ranking, duels, teams, league, friends, public @handle, public page or search for other people.
• Coach only with the guardian's consent: a teen can train with a Coach, but the link only starts after the guardian confirms it, as explained below.
• No ad measurement: the Meta SDK (section 4.10) and the Conversions API receive nothing from that account, and whatever already existed for that measurement is deleted.
• No usage analytics: PostHog (section 4.9) receives nothing from that account, and Sentry receives only the technical error, with no account identifier and no performance measurements. The aggregate performance and usability counts, which identify no one, continue.
• No marketing emails: subscription and come-back reminders (section 4.8) and product news are not sent, even if the person turned them on. The workout reports they ask for (section 4.7) keep arriving.
• Health data: only with the specific consent, as for everyone (section 2), and never for advertising.
• History kept in the account: it is off and locked, and only turns on after the guardian allows it in the guardian panel. If the guardian withdraws that permission, the cloud copy is turned off and deleted within 30 days; the history stays only on the device. It is never used for advertising, marketing or analytics, and the guardian does not see it (section 4.11).
• Purchases: follow the store's controls: on the App Store, Ask to Buy in Family Sharing; on Google Play, approval through Family Link.

Guardian consent for a Coach

Anyone aged 16 or 17 can train with a Coach, but the link only starts after the guardian confirms it.

• Confirmation request: when the teen requests or accepts a link, the app asks for the guardian's email address. The guardian receives an email with the Coach's name and @handle and a confirmation link that expires in 7 days. Without that confirmation, nothing is shared with the Coach.
• Consent record: we record the guardian's email address (stored encrypted, together with a cryptographic digest, the hash, used to find the record), the date, the IP address of whoever confirmed and the version of the text that was accepted. This record is deleted together with the teen's account.
• Withdrawal: the guardian can withdraw consent at any time through the link included in the emails. Withdrawal ends the link with that Coach immediately.
• Notices to the guardian: they receive a notice for every new Coach link and a summary when a link ends, with the Coach's name and the start and end dates.
• What the Coach sees: only that the student is under 18, never the exact age or the student's plan. The Coach follows specific conduct rules for minors. Photos, videos and messages go through the same moderation as always, and reports involving a minor are handled with priority.
• Photos and age: a person aged 16 or 17 does not share progress photos with the Coach. In the physical assessments the teen shares, the Coach sees 17 instead of the exact age.

Following by the guardian

The guardian of a person aged 16 or 17 can follow their activity on Gym+, read only and without creating an account.

• How it starts: the teen enters the guardian's email in the app, or the guardian has already confirmed a Coach. The guardian confirms through the link in the email, which expires in 7 days.
• What the guardian sees: the time in the app and the workouts by day (number and minutes) for the last 90 days and, for each Coach they confirmed, the messages between the Coach and the teen. They never see photos, measurements, health data, location or the messages with Coaches they did not confirm.
• Access: each time, the guardian asks for a reading link, which we send only to their email and which works for 24 hours. Withdrawing consent ends access immediately.
• Access log and transparency: we record each access with the date and the IP address, and the teen sees in the app when the guardian accessed it and what they can see.
• Minimum data and retention: for this we keep only, per day, the minutes in the app, the number of workouts and the minutes of workout, for 90 days and only while a guardian is confirmed. None of it is used for advertising or shown to the Coach, and all of it is deleted with the account.

The rest of teen mode does not change: still no ranking, duels, teams, league, friends, public @handle or people search, no ad measurement and no marketing emails.

Guardians and legal basis

The guardian can ask for access to, correction or deletion of the teenager's data at privacy@gymplus.life. We follow Brazil's Digital Statute of Children and Adolescents (ECA Digital, Law 15.211/2025, in force since March 17, 2026), Decree 12.880/2026 and article 14 of the LGPD, which requires the processing of children's and teenagers' data to be in their best interest. Reports involving a child or a teenager follow what is described in Reports, in section 8.

Legal representative in Brazil (ECA Digital, Law 15,211/2025, art. 40): ALAS TECNOLOGIA LTDA, CNPJ 27.272.134/0001-18. Contact: privacy@gymplus.life.

18. Security and governance

Certifications

ALAS TECHNOLOGY LLC holds the ISO/IEC 27001 and ISO/IEC 27701 certifications and runs an information security and privacy management system under those standards. The system assigns responsibilities, assesses risks at regular intervals and documents the controls applied to Gym+, described below.

ISO/IEC certifications: Information Security Management 27001:2022 (Certificate Q7LUQTCU20251113BRAIS1Z1), Privacy Information Management 27701:2025 (Certificate Q7LUQTCU20251113BRAPI15R) and Compliance Management System 37301:2021 (Certificate Q7LUQTCC20251113BRACM1X7). Check the certificates (opens in a new tab)

Controls

• Encryption in transit: all communication between the app, this website and our server must use HTTPS. The app refuses any redirect that would carry a credential.
• Encryption at rest: data stored on the server is encrypted at rest; what we store about subscriptions is additionally encrypted with AES-256-GCM, progress photos, anamnesis answers, assessments and contact requests are additionally encrypted with AES-GCM, the copy of the history kept in your account is additionally encrypted with AES-256-GCM, under a key specific to each account, and account and installation identifiers are stored as cryptographic digests.
• Data minimization: we process only what each purpose in this policy needs. Your exact position never reaches our server, only approximate cells, and the check-in cell is not stored. The training log stays on the device by default and leaves it only with your authorization, as a summary, to your Coach and to the ranking or your teams, according to what you turn on, or as an encrypted copy in your account, if you turn on the kept history, and health data only leaves it when you authorize sending it to your Coach, using it for workout verification and the ranking or the copy of the history in your account (section 2, section 3, section 4.11 and section 5).
• Access control: access to production systems is limited to the people who need it to run the service, with strong authentication and periodic review of permissions. In the app, session credentials live in memory only and are discarded when you sign out, and no marker stored on the device grants paid access: the entitlement always comes from a fresh check with the store.
• Logging and audit: access to production systems and administrative actions are logged, and those logs are reviewed to detect misuse. The retention period is in section 13, and the archived part is pseudonymized (Archived moderation records).

Incident response

No system is unbreakable. We maintain an incident response procedure to detect, contain, assess and remedy any security incident. If an incident may result in relevant risk or harm to data subjects, we notify Brazil's National Data Protection Authority (ANPD) and the affected data subjects within the deadline set by the ANPD's regulations. For people in the European Economic Area, the United Kingdom or Switzerland, we notify the competent supervisory authority within 72 hours of becoming aware of the incident and, where the risk is high, we inform the affected data subjects without undue delay, as the GDPR requires (arts. 33 and 34).

Data protection officer

Our data protection officer (the encarregado under the LGPD) oversees this management system and is the point of contact for data subjects and authorities: privacy@gymplus.life. To report a vulnerability, see the Security page or write to security@gymplus.life.

19. This website

What follows applies while you have not accepted ad measurement. If you accept it in the cookie notice, this website loads the Meta Pixel (from connect.facebook.net) on the home pages and on the referral, support and community pages, never on the calculators, the policies or the security page, and uses Meta's _fbp (browser identifier, 90 days) and _fbc (ad click identifier, 90 days) cookies and the site's own gp_utm cookie, which keeps the ad source during the visit (item 4.10). Besides the two cookies described below, your answer to the notice, accept or decline, is kept in the functional gp_consent cookie for up to 12 months. You change your answer through the Cookie preferences link in the footer; declining or withdrawing deletes _fbp, _fbc and gp_utm.

This website uses no advertising or analytics cookies, loads no font, script or image from another domain and builds no profile of visitors. It uses only two cookies, both set by the site itself and both purely functional. The first, gp_lang, is created only when you pick a language in the selector, and it keeps that choice for up to one year so the site opens in the same language next time. The second, gp_invite, is created only when you open an invitation link at gymplus.life/i: it holds nothing but the invitation code, is limited to the /i path and lasts up to 30 days, so the code stays at hand until you enter it in the app. It does not identify you or your device. Cloudflare, which hosts the site, logs the IP address and technical request data for as long as needed to deliver the page and protect the infrastructure.

The only exception is the Coach public pages (gymplus.life/p/): when you start filling in the contact form, the page loads Cloudflare's robot check, which uses technical data from the browser only to tell people from robots (section 7.6).

20. Changes to this policy

Once published, this policy may change. If the change materially affects what we do with your data, we will tell you inside the app and by email, with the date of the update, before it takes effect.

21. How to reach us

• Privacy, data subject rights and data protection officer: privacy@gymplus.life
• Support: support@gymplus.life or the support page
• Security and vulnerabilities: security@gymplus.life or the security page
• Anything else: contact@gymplus.life

ALAS TECHNOLOGY LLC, EIN 93-3927200

Legal representative in Brazil (ECA Digital, Law 15,211/2025, art. 40): ALAS TECNOLOGIA LTDA, CNPJ 27.272.134/0001-18. Contact: privacy@gymplus.life.