Privacy Policy

Last updated: 1 October 2026 · Contact: hello@gympets.app

GymPets is made by one person, Lukas Folvarsky. This policy explains exactly what the app stores, what leaves your device, and how to delete it. It describes what the app actually does today — not what it might do later.

What we collect and why

1. Data you create in the app

Workouts and sets, personal records, workout plans and schedules, food and water logs, custom foods, goals, your pet's progress, coins/treats/trophies, streaks, and your app preferences.

Stored: on your device. Also copied to your private cloud area if you are signed in.
Why: it is the app. Without it there is nothing to show you.

Chat and notification read markers. Which messages you have already seen in each of your crews' chats, and how far through your in-app notifications you have looked, are remembered on your device only — lists of league or account identifiers and timestamps, never any message text. Neither is ever uploaded; deleting your account removes the chat markers from the phone, and the notification marker is stored under your account identifier, which is never reused.

Searching packaged foods online, and scanning a barcode, are the only food features that talk to the internet, and only when you ask them to. The built-in food library works entirely offline. If you tap SEARCH MILLIONS OF FOODS ONLINE or MORE FOODS ONLINE on ADD FOOD, the app sends the search text you typed — nothing else — to Open Food Facts, a non-profit open food database, and shows you the matching packaged foods. No account identifier, no name, no health data and no log history goes with it; the request carries only the query and the app's name and version. Nothing is ever sent while you type, and never in the background — one tap, one request. When you add a result to your log, its nutrition numbers are saved into the log entry on your phone, so your past entries never need the internet again. Open Food Facts' data is used under the Open Database License, credited next to the results.

Scanning a barcode works the same way. The SCAN key on ADD FOOD opens your camera; the barcode is read on your phone, and no photo is kept or sent. Only the barcode's digits go to Open Food Facts, to look up that product — the same one request, with nothing else attached. A product you scan is kept on your phone (the latest 200, never uploaded), so scanning it again needs no internet. If a product isn't found and you add it yourself, its barcode is saved with your own foods, so the next scan finds it; like your own foods, that is backed up to your account if you are signed in. The camera asks for your permission the first time, and you can turn it off at any time (Your choices, below).

Talking to your pet happens on your phone. On an iPhone, HOME's SAY SOMETHING TO … opens a page where you can type to your pet: ask about today's workout, your week, your water, calories, steps, weight or runs, tell it what you ate or did, or start and finish a run. The answers are worked out on your phone, from the numbers GymPets already holds — nothing is sent anywhere to answer you. On an iPhone with Apple Intelligence switched on, sentences the app cannot read by itself also go to Apple's built-in AI model, running on your phone, together with the day's numbers the pet answers from; GymPets uses no online AI service. The conversation is not saved: it is gone when you close the page. Nothing is logged from it unless you tap YES. If the pet cannot answer a question about the app, its TELL THE TEAM key opens the feedback form (§8) with your question typed in for you to change; nothing is sent unless you press SEND there. This is being tried out in beta builds and is in no public release.

Timing a run. Tell your pet (or Siri, below) that you are starting a run, a walk or a ride, and GymPets notes the start time on your phone; when you finish, it offers to log the time. For a run, with your permission — iOS asks for Motion & Fitness once — GymPets asks the iPhone's own step counter how far you went between start and finish. The step counter's readings stay on your phone. GymPets uses no location or GPS for this and reads no distance from Health. Only the run you choose to log — its time and distance — is saved, like any other workout set, and backed up with the rest of your log if you are signed in. You can refuse or turn off Motion & Fitness at any time; the pet then asks how far you went.

Siri. You can say “Log food in GymPets”, “Log a workout in GymPets”, “Start a run in GymPets” or “Finish my run in GymPets”. Siri handles your voice under Apple's own privacy policy; GymPets receives only the words Siri heard — or, for a run, only the moment you said start or finish. Words wait on your phone for at most 15 minutes, and a run's start and finish until you answer, until GymPets asks you YES or NO. Nothing is saved to your log unless you tap YES, and none of it is sent to us.

Siri's answers. You can also ask Siri for today's workout, your water today, the calories you have left, your streak, or how you are doing, and it answers out loud without opening GymPets — only once your iPhone is unlocked. So that Siri can answer while GymPets is closed, the app keeps those few sentences, for today and the next day, in a short summary on your phone, rewritten while the app is open; Siri reads them from there to answer you, under Apple's own privacy policy like your voice. The summary is never uploaded or sent to us, and every delete clears it: DELETE ALL MY DATA, DELETE ACCOUNT, or a different account signing in on the phone.

2. Account data

If you use GymPets without signing in, you get an anonymous account identifier and nothing else. If you choose Continue with Google, we receive your email address, display name and Google account identifier from Google.

Why: so your progress survives a lost or replaced phone, and so friends can find you.

3. Health and fitness data (steps)

With your permission, GymPets reads your step count from Health Connect (Android) or HealthKit (iOS).

• The raw samples stay on your device. They are never uploaded.
• Only the daily step total is stored and synced, so your step history survives a device change.
• Health data is never used for advertising or analytics, and is never shared with third parties.
• You can revoke this permission at any time in your system health settings. The rest of the app keeps working.

4. Data other players can see

If you use friends or leagues, GymPets publishes a small public profile that any signed-in GymPets user can read: your display name, your invite code, your pet's species, level, stats, power and the cosmetic gear it wears, your trophy count, your streak, and your step totals for the walk-off leaderboard. Those are today's and this week's totals plus a short history, so everyone in a league can check the same finished races: your daily step total for roughly the last twelve days and your weekly total for roughly the last six weeks. Older totals are deleted from the profile as new ones are added. That profile also carries a last-active timestamp, updated whenever the app publishes the profile — opening or returning to the app when it syncs your steps, saving a name or a look, picking your pet, finishing a friend battle, pulling to refresh — which is what lets your buddies' screens show ACTIVE TODAY or ACTIVE 3 DAYS AGO next to your name. It is a date-level signal: nothing tells other players whether you have the app open right now, and only the timestamp is shared — never your location or what you are doing in the app.

Delete all my data (ME → ACCOUNT) removes that step history from your public profile straight away, along with everything else it deletes. The profile is then rebuilt from your fresh start and carries only step totals the app reads from your phone after that — today's and this week's, building back up day by day while step reading stays on.

Your food logs, workout logs, weight, personal records and preferences are never part of this. Other players see a record or a workout only if you share it in a league chat yourself: it is then a chat message everyone in that league can read, deleted like any of your messages. A crewmate who saves a workout you shared keeps their own copy.

Friend requests and battle results are delivered to a private inbox in your own account area; a battle result from someone in one of your leagues may also name the league you share, so the notification can say which crew it happened in. Only you can read your inbox.

Removing a buddy removes it both ways. When you remove someone, you come off their buddy list as they come off yours — neither of you keeps a copy of the other. They are not sent a notification about it. If your phone has no signal at the time, the removal is saved and finishes the moment you are back online. This is the only thing the app lets you change in another player's account, and it is deliberately the narrowest possible one: you can delete the entry that is about you, and nothing else — you cannot read their buddy list, add yourself to it, or alter anything in it.

A pet-house neighborhood is being tried out in beta builds of the app and is not yet in any public release. If you use it, the friends you added or accepted can view your published house layout — the furniture you have placed, your floor size and style. Nobody else can, and nobody can search or list houses. Visiting a friend's house lets them know you dropped by — one notification per day at most — unless you turn KNOCK WHEN I VISIT off in ME › PREFERENCES, in which case nothing at all is sent or saved about the visit and there is nothing for them to find. It is on to begin with. Your purchases, coins and everything else stay private; only what is on the floor is visible. Removing a friend closes your house to them immediately and takes your house off their neighborhood field — and because removal is mutual, it closes their house to you at the same moment. Blocking someone does the same thing: it hides them from your chat and your inbox, and it also ends the friendship in both directions. Unblocking does not undo that — one of you would have to add the other by invite code again.

The same feature lets friends be inside a house at the same time. While you are in one, the other people in that house can see your pet, its name and gear, and the tiles you send it walking to — for as long as you are in there, and nowhere else. Leaving the house, closing the app or losing signal for a couple of minutes ends it; no history of any of it is kept — there is no movement trail, no visit log, and the record of your being there is deleted when you leave (or disappears on its own shortly afterwards if your phone never got the chance to). A house holds four people at a time, and the owner can send anybody home. This is the one thing turning the knock off does not hide: it stops the notification, not your pet — an owner who happens to be standing in their own house while you are in it can see you there, because that is what being in a room together is.

5. Purchases

Purchases (GymPets+ subscription and one-off tips) are processed by Google Play and managed through RevenueCat. We never see or store your card number. RevenueCat receives your GymPets account identifier and your purchase status so the app knows what you own. Deleting your account detaches your phone from that record but does not erase it at RevenueCat — see the account deletion page.

6. Crash reports

GymPets uses Firebase Crashlytics. If the app crashes, we receive a crash report containing the error, a stack trace, your device model, OS version and an app-install identifier. It does not contain your food logs, workouts, or health data.

7. Notifications

Workout, streak, meal and water reminders, and the weekly walk-off reminder (which names your league), are generated and scheduled on your phone. No server sends them and no notification content leaves your device.

8. Feedback you send us

If you use ME → FEEDBACK — or the pet's TELL THE TEAM, which opens the same form — to send a bug report or an idea, we receive:

• the message you typed, and whether you tagged it a bug or an idea;
• your account identifier and display name, so we can reply if you are signed in;
• your app version and build, platform and OS version, device model, and language setting, so we can find the problem.

The app shows you this list before you send, and again behind the ? in the feedback box.

We do not receive your food logs, workouts, weight, steps, personal records, goals or plans, and we do not copy your email address into the feedback record. Nobody else using GymPets can read your feedback — the collection is write-only from the app, and only we can open it.

Feedback is kept until we have acted on it. Because it is a message addressed to us, it is not deleted when you delete your account — the same way deleting an account does not unsend an email you wrote us. It stays as correspondence and is not linked to any other data we hold about you.

Who processes data for us

• Google Firebase (Authentication, Firestore database, Crashlytics) — stores your account and synced data.
• Google Play / RevenueCat — process purchases and subscription status.

These providers act as processors for GymPets. We do not share your data with anyone else. One service is queried without acting as a processor: Open Food Facts receives the food search text you type, only when you tap ADD FOOD's online search, and the digits of a barcode you scan — it never receives your identity, a photo, or anything you have logged.

Where data is stored

On your device, and on Google Firebase servers (currently in the United States).

How long we keep it

Your synced data is kept while your account exists. When you delete your account, everything we hold under your account identifier is removed from the database immediately: your backup, your public profile, your invite code, your friends list, your inbox, your league memberships, and the messages you posted in the league chats you are still in. A short list of things is not removed by this — see the account deletion page, which names each one and why. Crash reports are kept for up to 90 days by Firebase Crashlytics. Local data on your phone is removed when you delete the app or use Delete all my data.

Your choices and rights

• Delete everything: ME → ACCOUNT → DELETE ACCOUNT. This erases everything held under your account — backup, public profile, invite code, friends, inbox, league memberships and your league chat messages — then your sign-in account, and wipes the app on your phone. There is no undo. If any step cannot be completed, it stops before deleting your sign-in account and says so, so that nothing is left behind that you can no longer reach. See the account deletion page.
• Delete your data but keep your account: ME → ACCOUNT → DELETE ALL MY DATA. This erases your workouts, food, pet and coins from this phone and from the backup, and the step history on your public profile. Your account, name and buddies stay. There is no undo.
• Rebuild this phone from your backup: ME → ACCOUNT → REFRESH FROM CLOUD. Nothing is deleted anywhere; your data is downloaded again.
• Stop step reading: revoke the GymPets permission in Health Connect (Android) or Health → Sources (iOS).
• Stop run distance: turn GymPets off in Settings → Privacy & Security → Motion & Fitness (iOS). The run timer keeps working; the pet asks how far you went.
• Stop the camera: turn GymPets off in Settings → Privacy & Security → Camera (iOS), or in the app's permissions (Android). Scanning then stops; everything else keeps working.
• Stop reminders: turn them off in ME → REMINDERS, or in system notification settings.
• Play without an account: just don't sign in. Everything except friends and leagues works, and nothing leaves your phone at all — there is no account to upload to, and the app does not create one for you. Signing in with Google or Apple is what starts a backup, and what lets a new phone find it. (Older installs may still hold a guest account made automatically by a previous version; those keep working and can be closed with DELETE ACCOUNT like any other.)
• Send feedback or report a problem: ME → FEEDBACK, or email hello@gympets.app.
• Access or correction: email hello@gympets.app and we'll help.

If you are in a region with additional rights (for example the EU/UK, or a US state with a consumer-health-data law such as Washington's My Health My Data Act), you may request access to, correction of, or deletion of your data using the same email. We do not sell health data or share it for targeted advertising, so there is nothing to opt out of.

Children

GymPets is not intended for children under 13, and we do not knowingly collect data from them. If you believe a child has created an account, email us and we will delete it.

Changes

If this policy changes materially we will update the date at the top and note the change in the app's release notes.