Privacy Policy

Last updated: November 2026

Draft template — must be reviewed by a qualified privacy professional before public launch.

GymBro ("we") is the data controller for personal data processed through the app, under EU Regulation 2016/679 (GDPR).

Data we collect

• Account data: email, username, date of birth, password (stored hashed).
• Profile data: name, bio, photos, sports, goals, fitness level.
• Content: posts, comments, messages, challenges, battles, leagues.
• Training data: workouts, goals, journal entries. These may relate to your health and are always private to you.
• Location: only when you tap "Near me" — used once in your browser, never stored.

Legal bases

• Contract (Art. 6(1)(b)): providing the social network you sign up for.
• Consent (Art. 6(1)(a), 9(2)(a)): marketing emails and any health-related data you choose to log. Withdraw anytime in Settings.
• Legitimate interest (Art. 6(1)(f)): security, abuse prevention and moderation of reports.

Visibility

Training logs, goals and journal entries are never public. You can make your profile private so only followers see your posts, and block any user.

Retention

We keep your data while your account is active. Deleting your account permanently erases your profile, content, messages and uploaded media. Reports are kept up to 12 months for moderation.

Your rights

Access, rectification, portability, erasure, restriction, objection and withdrawal of consent. Use Settings → "Export my data" and "Delete account", or edit your profile. You may also complain to your national data protection authority.

Processors

Hosting and database are provided by our cloud infrastructure provider within appropriate GDPR safeguards. Maps use OpenStreetMap.

Security

All traffic uses HTTPS; access is enforced by row-level security in the database; media is stored privately and served through short-lived signed links.