Privacy Policy
Last updated 25 August 2026
GymTracker ("we", "us") is operated by Dev Moves (devmoves.co.uk), the data controller for the information described below. This policy explains what we collect, why, and the choices you have — in plain English, because that's how we do everything.
What we collect
- Account details — your name, email address and password (stored hashed, never readable by us).
- Profile & goals — date of birth, gender, activity level, training goal, target weight and dates, injuries or ailments you tell us about, and food preferences including allergies you choose to record.
- Health and fitness data — body weight, body-fat percentage and measurements you log; your workouts, sets, weights and ratings; food and hydration diary entries; and, where you enable it on a connected device, heart-rate data from Apple Watch or Health Connect. This is special category data under UK GDPR, which we process with your explicit consent — given when you enter it — solely to provide the service.
What we use it for
- Running the product: building your training plan, pre-filling weights, tracking progression, calculating calorie and macro targets, and showing your own history and reports back to you.
- AI features — when you use the AI day builder, session debriefs or AI meal plans, relevant data (such as your targets, preferences and recent training) is sent to Anthropic's Claude API to generate the result. Anthropic does not use API data to train its models. We never sell your data or use it for advertising.
- Keeping the service secure and fixing problems.
Who can see your data
- Coaches — only if you explicitly accept a coach's invitation. A coach sees the data relevant to the discipline you agreed (training coaches see training history and body metrics; nutrition coaches see nutrition data and body metrics). Ending the relationship ends their access.
- Clubs — if you join a club, other members see your name and leaderboard statistics (sessions, volume, PRs) for that club.
- Strava — only if you connect it. Completed sessions are posted to your Strava account; you can disconnect at any time in your profile.
- Service providers — our hosting provider (UK/EU-based servers), Anthropic (AI processing, as above), and Open Food Facts (barcode lookups send only the barcode number, never personal data).
That's the whole list. No advertising networks, no analytics trackers, no data brokers.
Cookies
We use essential cookies only: a session cookie to keep you logged in and a CSRF token to keep forms secure. No advertising or third-party tracking cookies — which is why you don't see a cookie banner.
How long we keep it
Your data is kept while your account is active so your history and progress keep working. If you ask us to delete your account, we delete your personal data within 30 days, except where we're legally required to keep something.
Your rights
Under UK GDPR you can ask us to access, correct, export or delete your data, or object to or restrict our processing of it. Email support@gym-tracker.co.uk and we'll act on it promptly. You also have the right to complain to the ICO, the UK's data-protection regulator.
Changes
If we change this policy in a way that matters, we'll update the date above and flag it in the app before the change takes effect.