Privacy Policy

1. Who is responsible for your data

The controller of your personal data is Nikolay, a private individual (“we”, “us”).

For any question about your data, reach us by email at admin@gymassist.space, through Support inside the app, or through the feedback form at the bottom of the home page.

2. What we keep

• Account: email address, the name you entered, a hash of your password (we never store or see the password itself), interface language, sign-up and last-visit dates.
• Sign-in with Telegram: your Telegram ID, name and username. Telegram does not share your phone number with us.
• First-run answers: your goal, experience and how many days a week you plan to train.
• Workouts: dates, exercises, sets, weights, reps, effort rating, notes, your own exercises, templates and programs.
• Body measurements, if you enter them: body weight, body fat, girths (including left and right sides separately) and notes.
• Nutrition, if you use it: your nutrition plan and daily adherence marks.
• Coach mode: the coach profile (bio, experience, achievements, phone, links), clients, invite codes and links, and payment and session records the coach keeps.
• Messages: support conversations and messages from the website form — text, topic and the contact you left for a reply.
• Source tag: which link or website brought you. It tells us which channels bring people in.
• Technical data: sign-in token, IP address and browser details in web server logs, error logs.

We do not collect payment details, location, phone contacts or your phone number — except a phone number a coach chooses to show in their own profile.

3. Why we use it

• To run the log itself: store workouts and measurements, compute stats, muscle load and the recovery forecast, and suggest weights.
• To let you sign in from any device and recover access.
• To run coach mode: a coach sees a client’s data, a client sees the coach’s card.
• To answer your messages and send notifications: workout recaps, support replies, important service news.
• To protect the service from abuse: rate limits, blocking break-ins and spam.
• To understand where people come from and what works — from anonymised aggregate numbers.

There are no ads in GymAssist. We do not sell your data or share it with advertisers.

4. Legal bases

We process your data to perform our agreement with you — the Terms of Use — and on the basis of your consent, which you give with a separate checkbox at sign-up or on first launch: consent text. Server and error logs rely on our legitimate interest in keeping the service secure. Where the GDPR applies, these are Articles 6(1)(b), 6(1)(a) and 6(1)(f).

5. Who else sees your data

• Your coach — only if you joined them yourself with a code or a link. They see your workouts, stats, measurements, nutrition plan and the contacts you shared, read-only. You can leave a coach in Settings at any time, and access ends immediately.
• A coach’s clients see the coach’s card: name, profile, phone and links the coach chose to show.
• Anyone with the link to a workout card you chose to share: the card shows the date, title and numbers of the workout, records and a load map — no name or email. You can take a card down where you shared it.
• Service providers we cannot run without: our hosting provider REG.RU (the database lives on its servers in Russia), the SendPulse email service (receives the address and text of an email, such as a password reset link) and Telegram (delivers bot messages if you use Telegram).
• Authorities — only when the law requires it.

No one else receives your data.

6. Where data is stored

The database and its backups are stored on servers in Russia. If you use GymAssist from another country, your data is transferred to and stored in Russia. Messages between you and our Telegram bot pass through Telegram’s infrastructure, and Telegram’s privacy policy applies to them as well.

7. How long we keep it

• Your account and records — for as long as the account exists. When an account is deleted, its workouts, measurements, plans, nutrition and messages go with it.
• Database backups are made nightly and kept for no more than 14 days, after which deleted data is gone from them too.
• Workout cards you shared — until you take them down or the account is deleted.
• The no-sign-up demo lives for 7 days, then the temporary account is deleted entirely.
• A sign-in token is valid for 60 days or until you sign out.
• Server and error logs are capped in time and size: old entries are deleted automatically.
• Website form messages — as long as needed to reply, or until you ask us to delete them.

8. What your browser stores

We use no cookies. There are no third-party counters, advertising or analytics scripts on the site. Your browser’s local storage holds the sign-in token, chosen language and theme, interface settings, the source tag you arrived with and a coach’s link if you came through one and have not signed up yet. The token is erased when you sign out; the rest, when you clear site data in your browser.

9. Your rights

You can:

• find out what data we hold about you and get a copy;
• correct it — most of it right in the app;
• delete your account with all its data;
• withdraw your consent;
• object to or restrict processing, and take your data elsewhere;
• leave your coach in Settings.

Write to us by email at admin@gymassist.space, through Support inside the app, or through the feedback form at the bottom of the home page — we reply within 10 working days and delete data no later than 30 days after you withdraw consent, usually much sooner. You may also complain to your data protection authority.

10. How we protect it

Connections are encrypted (HTTPS). Passwords are stored only as a strong hash (scrypt). Only the operator can access the server, with keys. Coaches see client data read-only. Internal error details are never shown to the outside.

11. Age

GymAssist is meant for people aged 16 and over. If you are younger, use it only with a parent’s permission.

12. Changes

A new version appears on this page with a new date. We will announce material changes in the app in advance.