Privacy Policy

Who We Are

GainTrack is a fitness tracking application. For questions about this policy, contact us at support@gaintrack.app.

Information We Collect

We collect information you provide and data generated by your use of the app:

• Account information: Name, email address, and profile picture via Google Sign-In
• Password: If you create an email/password account, Firebase stores a salted hash of your password. We never have access to the plaintext.
• Fitness data: Workout logs, exercises, sets, reps, weight, and duration
• Nutrition data: Meal entries, food items, and daily macro totals
• Body measurements: Weight, body fat percentage, and physical measurements you log
• Photos and video you submit for AI analysis (Pro): If you use the Pro meal-photo or workout-video analysis features, the image or short video you capture is sent for AI processing. These may include images of food, your body, your surroundings, and — for video — your likeness. They are processed only to generate your analysis and are not stored after processing (see AI Coach Feature and Data Retention below).
• Goals and preferences: Fitness goals, equipment, calorie and macro targets
• Usage and telemetry data: Feature interactions and app performance metrics used to improve the product
• Push notification token: To deliver reminders (only if you grant permission)

How We Use Your Information

• Authenticate your identity and maintain your account
• Store and sync your workout and nutrition history across devices
• Generate personalized progression suggestions and AI coaching responses
• Send lifecycle notifications and reminders you opt into
• Analyze aggregate, anonymized usage to improve app features
• Process subscription purchases via RevenueCat
• Comply with legal obligations

We do not sell your personal data. We do not use your data for advertising.

AI Coach Feature

GainTrack Pro includes AI-powered features powered by Google Gemini: AI coaching (chat and progression suggestions), meal-photo analysis, and workout-video form analysis. When you use these features, the relevant data — your fitness data, the content of your messages, and, for the photo and video features, the image or short video you capture (which may include food, your body, your surroundings, and your likeness) — is sent to our secure backend and then to Google's Gemini API to generate your result. This data is used solely to produce your personalized response. Photos and videos are processed transiently and are not retained after your analysis is generated. We do not use your data to train AI models, and we operate the Gemini API under terms that prohibit Google from using your content to train its models. For these AI features, Google Cloud (Gemini API) acts as our data sub-processor, processing your content solely on our behalf and under the Google Cloud Data Processing Addendum (DPA), not for Google's own purposes. Separately from Gemini, we test an AI request-routing service (Typesafe, reached through OpenRouter) in shadow mode: it receives the text of your question only — never your fitness data, health data, photos or videos — and its answer is only measured against the response Gemini already produced, so it never changes your result. Typesafe states it does not train on customer data; we do not enable its optional zero-data-retention setting. You can revoke AI data sharing consent at any time from Profile → Privacy, and the photo and video features additionally ask for your consent before capture.

Third-Party Services

GainTrack integrates with the following third-party services, each governed by their own privacy policies:

• Google Firebase & Firestore — authentication and cloud data storage (Privacy Policy)
• RevenueCat — subscription and in-app purchase management (Privacy Policy)
• Google Cloud — Gemini API — AI coaching, meal-photo, and workout-video analysis for Pro users; acts as a data sub-processor under the Google Cloud Data Processing Addendum (Privacy Policy)
• Expo / EAS — app delivery and over-the-air updates (Privacy Policy)
• OpenRouter (Typesafe Jev) — AI request-routing test in shadow mode for Pro coaching chat; receives the text of your question only, never your fitness or health data, photos or videos, and never changes your result (Privacy Policy)
• MongoDB Atlas — backend database infrastructure (Privacy Policy)
• Apple Health / Health Connect — optional health data integration (Pro feature, requires explicit consent)

Health Data

If you enable health integrations (Pro feature), GainTrack may access workout and nutrition data from Apple Health or Health Connect with your explicit consent. Health data is used only to enrich your GainTrack experience and is never shared with third parties or used for advertising. You can revoke consent at any time from Profile → Health Integrations.

Data Storage and Security

Your data is stored on Google Firestore and MongoDB Atlas, both using industry-standard encryption at rest and in transit (TLS 1.2+). We use Firebase Authentication to ensure only you can access your account. Authentication is handled by Firebase Authentication. If you sign in with Google, we receive an OAuth token only — we never see your Google password. If you sign in with email and password, your password is stored exclusively by Firebase using industry-standard salted-hash cryptography (scrypt); we never see or store the plaintext password. API keys and secrets are never stored in the app bundle.

Data Retention

We retain your data for as long as your account is active. If you delete your account, your personal data is removed from our systems within 30 days. Subscription transaction records may be retained for up to 7 years to comply with applicable financial regulations. Anonymized, aggregated analytics data may be retained indefinitely. Photos and videos submitted to the AI analysis features are not retained after your analysis is generated — they are processed transiently and then discarded.

International Data Transfers

GainTrack is operated from the European Union. Your data may be processed in data centers located in the EU and the United States (via Google Firebase and MongoDB Atlas). These transfers are subject to appropriate safeguards including Standard Contractual Clauses where required by applicable law.

Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your account and associated data
• Portability: Export your data via Profile → Export My Data
• Restriction: Request we limit processing of your data
• Objection: Object to processing based on legitimate interests
• Withdraw consent: Revoke push notifications, AI data sharing, or health sync at any time via app settings

To exercise any of these rights, contact us at support@gaintrack.app. We will respond within 30 days. EU/EEA residents may also lodge a complaint with their local data protection authority.

Children's Privacy

GainTrack is intended for users 18 years of age and older. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

Changes to This Policy

We may update this policy as the product evolves. For significant changes we will notify you via the app or email at least 14 days before they take effect. The effective date at the top of this page always reflects the current version. Continued use of GainTrack after changes constitutes acceptance of the updated policy.

Contact