Privacy Policy

1. Data controller

The GymProgress website and app are published by the GymProgress Editorial Team. GymProgress is a workout tracking application, available as a website and an Android mobile app. Data is processed solely to operate the service. For any question about your data, contact us at the address shown at the bottom of this page.

2. Data collected

• Email address and full name
• Training data (workouts, exercises, sets, weights)
• Login timestamps
• Anonymized IP fingerprint (SHA-256) for GDPR consent
• Android advertising identifier and device technical data — only in the mobile app, collected by the Google AdMob SDK to serve ads

3. Purposes

• Account authentication and security
• Displaying your training data
• Computing statistics and personal records
• Serving and measuring advertisements

4. Advertising

On the web, GymProgress may display ads served by Google AdSense. In the Android mobile app, ads are served by Google AdMob. Google and its partners may use cookies (web) and your device advertising identifier (mobile) to serve and measure ads, including personalized ones. You can reset or delete your advertising identifier, and turn off personalization, in Android settings (Settings → Google → Ads), or manage your preferences through Google Ads settings. On the web, we also measure traffic with Google Analytics 4. For visitors in the European Economic Area, the United Kingdom and Switzerland, ads and audience measurement rely on cookies only after your consent, collected through a consent message shown on your first visit; you can refuse it or change your choice at any time.

5. Notifications

The mobile app may send you reminders as local notifications (for example, for your planned workouts). These notifications are generated and handled locally on your device; their content is not transmitted to our servers. You can disable them at any time in your phone settings.

6. Retention

Data is kept as long as your account is active. You can request deletion at any time from the settings.

7. Your rights (GDPR)

• Access — you can view all your data directly in the app
• Rectification — edit your profile from the settings
• Erasure — immediate cascading deletion from the settings
• Portability — export your data as JSON on request

8. Hosting

Data is hosted on servers located in the European Union (Frankfurt, Germany): API on Render, PostgreSQL database on Supabase.

9. Security

• Passwords hashed with Argon2id (OWASP standard)
• Encrypted connections over HTTPS/TLS
• Short-lived JWT tokens (15 min)
• Compromised-password checks (HaveIBeenPwned)

10. Audience

GymProgress is intended for a general audience and is not directed at children under 13.