Privacy Policy & Legal Notice

Summary

• Gym 2.0 is a private project. The server, the database and the AI model run on hardware the developer operates in Switzerland. Your data is not sold, not used for advertising and not used to train AI models.
• The code of the apps and the server is open source (github.com/xcolx/Gym-2.0), so you can check how they handle your data.
• There are no ads, no analytics, no tracking and no third-party SDKs in the apps. The only external services are Cloudflare, which forwards all traffic to the server, Google (Gmail), which delivers the emails for your account, and CrowdSec, which receives the IP addresses of detected attacks.
• You can download all data stored about your account and delete your account at any time in Settings → Account.

1. Who is responsible

This policy covers the Gym 2.0 iOS app, the web app at gym2.app and the server they use (api.gym2.app). The controller responsible for the processing of your data is:

For any question about your data or to exercise your rights, write to this email address. This policy follows the Swiss Federal Act on Data Protection (FADP).

Because the code of Gym 2.0 is open source, others can run their own copies of it. This policy doesn't cover them: if you use a copy run by someone else, that person is responsible for your data, and their own privacy policy applies.

2. Data we process

Account

• Your email address, username and password. The password is only stored as a hash (bcrypt).
• When you sign up, change your email or reset your password: a time-limited token for the link we email you, and the new email address until you confirm it.
• Your profile image, bodyweight, app color, weight and distance units and language, if you set them.
• Technical account data: when the account was created, the last login, the number of failed logins (to protect against password guessing), when the username, profile image, bodyweight or password were last changed and whether you use the iOS app, the web app or both.

Workouts and exercises

Your workouts (name, date, duration, exercises and sets with repetitions, weights, times, intensities and distances), your workout schemes, and the exercises you create (name, description, images, muscles and equipment). Workouts and bodyweight can say something about your health, see section 3.

Friends, chats and moderation

• Your friends, friend requests you sent or received, and users you blocked.
• Your chats: the messages and photos you send, the groups you create or join, their names and images, and which messages you have read.
• When you report a user, a group or a message: what you reported, the reason you enter and when, together with a copy of the reported content at that time (the username and profile image, the group's name and image, or the message's text, photo and sender's username). The copy lets us review the report even if the content is changed or deleted afterwards. Reports and their copies are kept until they are handled, also when the reported account, group or message is deleted.
• Automatic check of images: your profile images, group images and chat photos are checked for nudity when you upload them, by a detection model (NudeNet) that runs on our own server, so the images aren't sent to anyone for it. Images it is sure about are rejected. If it finds nudity in an image, rejected or not, it creates a report like a user would, with a copy of the image, the group's name or the message's text, your username, the body parts it found and how sure it was. These reports are kept like the others above, also when you delete your account, and are part of your data takeout (section 10). Nothing is stored about images without findings. Exercise images aren't checked.

Gym-AI conversations

The messages you write to the Gym-AI, its answers and the titles of the conversations. See section 5 for how they are processed.

Login sessions

For every login: a hash of the session token, whether it is the iOS or the web app, the IP address at the login, when the session was created and when it was last used.

Server and connection data

• Every request to the server passes through Cloudflare (see section 6) and is logged by the server with the IP address, the time, the requested address and the response status. These logs are used to keep the service running, to find errors and to defend against attacks.
• The IP address is used for a short time in memory to limit the number of requests (rate limiting), e.g. against password guessing.
• The server logs are analyzed by CrowdSec, a security software running on the server, which detects attacks such as password guessing or scanning for vulnerabilities and blocks the IP addresses they come from. See section 6 for what it shares.
• Anonymous statistics of the requests per hour (route, response status, response time, API version and platform), without IP addresses or any link to an account.

3. Why we process your data and legal bases

• To provide Gym 2.0 (account, sync between your devices, workouts and stats, friends, chats, Gym-AI, account emails): necessary to perform the contract with you, i.e. to provide the service you signed up for.
• Health-related data (workouts and bodyweight): only processed because you enter it, to show it to you and sync it. By entering it you explicitly consent to this. You can delete individual entries or your account at any time, which withdraws the consent for the future.
• Security and operation (server logs, rate limiting, attack detection with CrowdSec, failed login counter, sessions, backups, anonymous request statistics, handling of reports, the automatic check of uploaded images for nudity): our legitimate interest in a secure, working and abuse free service.
• Legal obligations, e.g. answering requests of authorities where the law requires it.

The only automated decision is the rejection of uploaded images in which the automatic check finds nudity (see section 2). It only affects the upload: the reports it creates are reviewed by a person, and decisions about your account, like a suspension, are always made by a person. If you think an image was rejected wrongly, contact us at [email protected]. We don't create profiles for advertising.

4. Who can see your data

• Every user who finds you by your exact username or meets you in a chat sees your username, profile image and app color.
• Your friends additionally see your language.
• Members of a chat see the messages and photos sent in it and who is a member. Public groups can be found and joined by every user, so everything sent in them is visible to all users.
• Exercises you create are only visible to you. If the developer verifies an exercise, the description and the images get replaced before other users can see it.
• The developer has access to the database to operate the service, answer your requests, fix errors, review exercises and handle reports and abuse. Data is only looked at where this is needed for these purposes.

Your workouts, workout schemes, bodyweight, email address and Gym-AI conversations are never shown to other users.

5. Gym-AI

The Gym-AI is Qwen3.5 4B, an open-weight language model by the Qwen team of Alibaba Cloud, which runs on a server the developer operates (with Ollama). Only the model itself comes from Alibaba, no data is sent there. Your messages are not sent to any AI provider or other third party. To answer, the model receives the current conversation (up to its last 50 messages) and nothing else: no workouts, stats or profile data. The conversations are stored so you can open them again, until you delete them or your account. They are not used to train or improve the model.

The answers are generated automatically and can be wrong. They are no medical advice. Don't enter information about yourself or others that you don't want to have stored.

6. Service providers and transfers abroad

Everything is hosted on hardware the developer operates in Switzerland, except for these providers:

• Cloudflare, Inc. (USA) protects gym2.app and api.gym2.app and forwards all traffic to the server (reverse proxy). For this, Cloudflare processes your IP address, technical data of your device and browser, and the content of the requests, which it decrypts and encrypts again on the way. See the Cloudflare privacy policy.
• Google LLC / Google Ireland Ltd. (Gmail) delivers the emails to verify your account, confirm a new email address and reset your password. Google receives your email address and the content of these emails. See the Google privacy policy.
• Apple distributes the iOS app through the App Store. Downloads, purchases and the optional analytics and crash reports you can share with app developers in the iOS settings are handled by Apple under its own privacy policy. We don't receive any personal data from Apple that identifies you.
• CrowdSec SAS (France): when CrowdSec on the server detects an attack, it reports the IP address it came from, the time and the type of attack to CrowdSec's central service, which uses these reports to create a shared blocklist of known attackers. Normal use of Gym 2.0 is not reported. See the CrowdSec privacy policy.

Cloudflare and Google may process data in the USA and other countries. These transfers are based on the Swiss-U.S. and EU-U.S. Data Privacy Framework, under which both companies are certified, or on the standard contractual clauses of the European Commission recognized by Switzerland.

The nightly backups (see section 8) are encrypted on the server before they are sent to a backup server the developer operates, so it only stores encrypted data. We don't sell or rent your data to anyone.

7. Data stored on your device

Web app

• A cookie with your session (session_token). It is technically necessary for staying logged in, HTTP-only (not readable by scripts) and only sent to gym2.app. There are no tracking or advertising cookies, so there is no cookie banner.
• A copy of your data in the browser's database (IndexedDB) and cached images and app files (service worker), so the app works offline. The local storage keeps the logged-in user, the app color, the appearance and when the update notice was last shown.

iOS app

• The session token in the iOS Keychain. Keychain items can remain on the device after the app is deleted, a reinstalled app removes it when it is first started.
• A copy of your data in the app's database, cached images and settings, so the app works offline.
• Photos are only accessed when you pick one (profile image, group image, chat photo, exercise image). Files you import or export stay on your device until you share them.

Logging out or deleting your account removes your data from the device. In the browser you can also remove it by deleting the site data of gym2.app.

8. How long we keep data

• Account and its content: as long as your account exists. Things you delete (workouts, schemes, exercises, chats, messages, Gym-AI conversations) are kept for 30 days, so the deletion reaches all your devices, and then removed permanently.
• Deleted account: you are logged out everywhere, your profile images are removed and the messages and photos you sent in chats are deleted immediately, as if you had deleted each of them yourself. Your direct chats are deleted and you leave your groups (a group without members is deleted). The account and all its data are removed permanently 30 days later. Exercises that were verified for all users stay available, without your name.
• Unconfirmed sign ups: removed after 3 days. Email links expire after 24 hours (verification) or 60 minutes (password reset).
• Sessions: until you log out on that device, change your password (which ends all other sessions), delete your account or the session expires, after 30 days to 2 years depending on how often it is used. Expired sessions, with their IP address, are deleted within a day.
• Server logs: deleted automatically after 15 days at the latest.
• CrowdSec: blocks of an IP address usually last a few hours, the detected attacks are deleted from the server after a short time (7 days by default).
• Anonymous request statistics: 90 days.
• Backups: an encrypted backup of the database and images is made every night and kept for up to about 6 months. Deleted data stays in older backups until they are removed; backups are only used to restore the service after a failure.

9. Security

All connections are encrypted (HTTPS). Passwords are stored as bcrypt hashes and session tokens only as hashes. Uploaded images are re-encoded on the server, which removes metadata such as the location where a photo was taken. Backups are encrypted, and the server can only add new backups, not change or delete existing ones. No system is perfectly secure, but we take reasonable measures to protect your data.

10. Your rights

Depending on the applicable law, you have the right to:

• Access your data and receive it in a portable format: Settings → Account → Data Takeout downloads a ZIP file with all data stored about your account in a JSON file, including the reports the automatic check of images created of your uploads, and the images themselves. Reports that other users sent about you are not included, to protect the people who reported.
• Correct your data: your profile, workouts, schemes and exercises can be edited in the app.
• Delete your data: Settings → Account → Delete Account, or individual entries in the app.
• Object to processing based on our legitimate interest, ask for it to be restricted, and withdraw your consent at any time with effect for the future.

For anything you can't do in the app, email [email protected] from the email address of your account. We answer within 30 days.

11. Children

Gym 2.0 is not intended for children under 16. If you are under 16, don't create an account. If we learn that a child under 16 has an account, we delete it.

12. Changes to this policy

We update this policy when Gym 2.0 changes the way it processes data. The current version is always available at gym2.app/privacy, with the date of the last update at the top. If a change matters for you, we tell you in the app or by email.