Privacy Policy

Last updated: 8 October 2026

This Policy describes how the GymPR app collects, uses, shares and protects the data of the people who use it. By using GymPR, you agree to the practices described here. We handle personal data under Brazil's General Data Protection Law (LGPD, Law 13.709/2018) and, where they apply, the EU and UK GDPR and United States state privacy laws.

1. Who the controller is

GymPR is operated by CHIMBILAS LTDA, a Brazilian company registered under CNPJ 62.626.897/0001-10, with its registered office at Av. Paulista, 777, Andar 15, Conj. 15, Sala 1925, Bela Vista, São Paulo/SP, 01311-914, Brazil, which is the controller of the personal data processed in the app. For any privacy matter, write to suporte@gympr.app.

2. Data we collect

• Account: name, email and login identifier (email/password or Google sign-in).
• Training profile: goal, experience level, weekly frequency, biological sex (used to calibrate training), injuries and restrictions you report, and notes you write.
• Activity: workouts, exercises, loads, sets, reps, personal records and progression history.
• Subscription: purchase status and plan, processed by Apple, Google and RevenueCat. We never receive or store card details.
• Technical data: device model, operating system, app version, push notification identifiers and usage data for diagnostics.
• Imported files: the workout plan PDF you upload to import. We keep the file for up to 30 days to diagnose failures and improve importing.

3. How we use data

• Create and manage your account and authentication.
• Build, adjust and personalise training routines, including AI-assisted generation.
• Record progress, personal records and reports.
• Process and validate subscriptions.
• Send notifications related to your use of the app.
• Maintain security, prevent fraud and improve the product.

4. Sharing with third parties

We do not sell personal data, and we do not share it for cross-context behavioural advertising. We share only what is necessary with the providers that operate the service:

• Google Firebase for authentication, notifications, and storage of media and imported files.
• MongoDB Atlas as the database where your data is hosted.
• RevenueCat, Apple and Google for processing and validating subscriptions.
• AI providers (OpenAI and Anthropic) receive the necessary content from your training profile and, when you import, the file you upload, in order to generate and personalise routines and reports. This data is not used to train third-party models.
• PostHog as a product analytics tool, on aggregated usage metrics, in the app and on the website.
• Sentry for error monitoring, to identify and fix failures in the app and on our servers.

5. Legal bases

We process data to perform our contract with you (delivering the service), on consent where applicable, to comply with legal obligations, and on legitimate interests for security and product improvement. Where the GDPR applies and we rely on consent, you may withdraw it at any time without affecting processing already carried out.

6. International transfers

GymPR is operated from Brazil, and the providers listed above may process data in other countries, including the United States and the European Union. When data is transferred out of its country of origin, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses, and on the equivalent mechanisms recognised by the LGPD.

7. Retention

We keep your data for as long as your account is active. After account deletion, personal data is removed or anonymised, except what we must retain to meet a legal obligation, for example tax and payment records. Imported files are deleted automatically within 30 days of upload, or sooner if you delete your account.

8. Your rights

Wherever you live, you may ask us to give access to, correct, export or delete your personal data, and to withdraw consent. To exercise any of these, write to suporte@gympr.app. We answer within the period the applicable law sets, and we never charge for a first request or treat you differently for making one.

• Under the LGPD you may also request anonymisation, portability, information about data sharing, and review of automated decisions.
• Under the EU and UK GDPR you may also object to processing, request restriction, and lodge a complaint with your national supervisory authority.
• Under United States state privacy laws, including the California Consumer Privacy Act as amended, you may request the categories and specific pieces of data we hold, request deletion or correction, and opt out of sale or sharing. We do not sell or share personal data as those laws define it.

9. Account deletion

You may delete your account and the associated data at any time. The account deletion page explains how.

10. Security

We apply technical and organisational measures to protect your data, including encryption in transit and access control. No system is completely secure, but we work to reduce the risk.

11. Children

GymPR is not directed to children under 13, and we do not knowingly collect their data. Where local law sets a higher age of digital consent, that higher age applies. If a parent or guardian believes a child has given us data, write to suporte@gympr.app and we will delete it.

12. Changes

We may update this Policy. Material changes will be flagged in the app or on this page, with the update date revised.

13. Cookies and website analytics (gympr.app)

Our website uses analytics cookies to understand how people browse it and to improve the page. These cookies are set only after you accept them in the privacy notice shown on the first visit. Before that, no analytics cookie is written and no information is sent. You may decline, and the site keeps working normally, or withdraw consent later.

With your consent we collect: pages visited, visit origin such as campaign parameters (UTM and gclid), page performance metrics (Core Web Vitals) and clicks on the download button. We do not use session recording or cross-site tracking. This data is processed by PostHog as a product analytics tool.

14. Contact

Privacy questions: suporte@gympr.app.