Privacy policy
Privacy policy
Last updated: 10/09/2026
This Privacy Policy explains how Gymbro AI ("Gymbro", "we", "us", or "our") collects, uses, and protects your information when you use the Gymbro mobile application and the website at gymbro.social (together, the "Service").
We are based in the Republic of Cyprus and act as the data controller for your personal data. Until our company is formally incorporated, the Service is operated by its founders, Dávid Bozsir, Alexandru Vlad-Nicolae Enache, and Stepan Kanin, under the Junior Achievement Cyprus framework. You can contact us at ceo@gymbro.social.
1. Information We Collect
We collect only what we need to run the Service.
Account information. Your email address, username, and login credentials.
Onboarding details. Information you give us during the setup quiz, including your bodyweight, training experience, and target lift goal. We use this to calibrate your analysis and rankings.
Lift videos. The recordings you upload or capture so the Service can analyse your form and performance. See Section 4 for exactly what happens to these.
Performance data. Lifts you log, estimated 1RM, form scores, percentile rankings, and progress over time.
Payment information. If you subscribe, your payment is processed by our payment provider. We never see or store your full card details.
Device and technical data. Device type, operating system, app version, and crash or diagnostic logs.
Usage data. How you interact with the Service, used to improve it.
2. How We Use Your Information
We use your information to provide the core Service by analysing your lifts, generating feedback, ranking you, and tracking your progress. We also use it to create and manage your account and subscription, respond to your requests and provide support, maintain the security and stability of the Service, improve our features, and send you service related messages. We send marketing emails only if you have opted in, and you can opt out at any time.
3. Legal Bases for Processing
If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR.
Contract (Article 6(1)(b)). Creating and managing your account, delivering the analysis and ranking features you signed up for, and processing your subscription. Without this data we cannot provide the Service.
Explicit consent (Articles 6(1)(a) and 9(2)(a)). Processing your lift videos, bodyweight, and training data. Because this information relates to your physical condition, we treat it with the higher standard that applies to health related data and ask for your explicit consent during onboarding. You may withdraw that consent at any time, which will end your ability to use the analysis features.
Consent (Article 6(1)(a)). Marketing emails and any optional analytics you agree to.
Legitimate interests (Article 6(1)(f)). Keeping the Service secure, preventing fraud and abuse, and understanding aggregate usage so we can improve the product. We balance these interests against your rights and you may object at any time.
Legal obligation (Article 6(1)(c)). Retaining payment and accounting records where law requires it.
4. Your Videos and How Analysis Works
This section matters, so we have written it plainly.
When you record or upload a lift, the video is transmitted to our processing server, hosted by Render, where it is analysed using Google's MediaPipe pose estimation technology. The analysis extracts body position data from the footage to calculate your form scores, estimated 1RM, and rankings.
The video file is permanently deleted from our servers within approximately 10 minutes of upload. We do not archive it, we do not keep a backup copy, and there is no way for you or us to retrieve it afterwards. If you want to keep your footage, save it on your own device before uploading.
We do not use your videos to train AI models. We do not sell them. We do not share them with anyone other than the processing infrastructure described above, and no human at Gymbro reviews them as part of normal operation.
What we do keep is the numerical output: your scores, estimated 1RM, percentile, and the written feedback generated for that set. This is what builds your progress history.
5. Publicly Visible Information
Gymbro is a competitive product, so some of your information is visible to other users.
Your username, strength rating, percentile ranking, and top lift figures may appear on global and category leaderboards. Your bodyweight is used to calculate these rankings but is not itself displayed on leaderboards.
If you choose to generate and share a stat card, the image you create will contain your performance figures, and you control where you post it. Once shared outside the Service, we have no control over how it is used or distributed.
You can control your visibility in Settings.
6. How We Share Your Information
We do not sell your personal data. We share it only with service providers who help us operate the Service, and only to the extent needed.
Stripe processes subscription payments.
Firebase (Google) hosts your account, performance data, and database.
Render hosts the server that receives and processes your uploaded videos.
Google MediaPipe provides the pose estimation technology used for form analysis.
Apple and Google handle app delivery and in app purchases.
Each of these providers is bound by a data processing agreement. We may also disclose information where required by law, or to protect our rights and the safety of our users.
7. International Transfers
Some of our providers are located outside the European Economic Area, including in the United States. Where we transfer your data internationally, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses or an applicable adequacy decision.
8. Data Retention
Lift videos. Deleted within approximately 10 minutes of upload, as described in Section 4.
Account and performance data. Kept for as long as your account is active.
Payment and accounting records. Kept for as long as required by Cypriot and EU law.
Inactive accounts. If an account is inactive for 24 months, we may delete or anonymise the associated data after giving you notice by email.
When you delete your account, we delete or anonymise your personal data within 30 days, except where we are legally required to retain certain records.
9. Your Rights
Under the GDPR you have the right to access your data, correct it, delete it, restrict or object to processing, receive a copy in a portable format, and withdraw consent at any time. Withdrawing consent does not affect processing carried out before withdrawal.
To exercise any of these rights, email ceo@gymbro.social. We will respond within one month.
You also have the right to lodge a complaint with your local data protection authority. In Cyprus this is the Office of the Commissioner for Personal Data Protection, at dataprotection.gov.cy.
10. Deleting Your Account
You can delete your account and associated personal data directly in the app via Settings, then Delete Account. You can also email ceo@gymbro.social. We will action your request within 30 days.
11. Age Requirement
The Service is intended for users aged 16 and over. We do not knowingly collect personal data from anyone under this age. If you believe someone under 16 has provided us with personal data, contact us and we will delete it promptly.
12. Automated Processing
Your form scores, rankings, and feedback are generated automatically by our analysis system. These outputs are informational and do not produce legal effects or similarly significant effects for you. Gymbro provides training feedback, not medical advice. If you have an injury or a health condition, consult a qualified professional before acting on anything the Service tells you.
13. Data Security
We use reasonable technical and organisational measures to protect your data, including encryption in transit and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
14. Third Party Links
The Service may link to third party sites or services. We are not responsible for their privacy practices, and we encourage you to read their policies.
15. Changes to This Policy
We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you in the app.
16. Contact Us
Gymbro AI
Email: ceo@gymbro.social
Website: gymbro.social
Last updated: 10/09/2026
This Privacy Policy explains how Gymbro AI ("Gymbro", "we", "us", or "our") collects, uses, and protects your information when you use the Gymbro mobile application and the website at gymbro.social (together, the "Service").
We are based in the Republic of Cyprus and act as the data controller for your personal data. Until our company is formally incorporated, the Service is operated by its founders, Dávid Bozsir, Alexandru Vlad-Nicolae Enache, and Stepan Kanin, under the Junior Achievement Cyprus framework. You can contact us at ceo@gymbro.social.
1. Information We Collect
We collect only what we need to run the Service.
Account information. Your email address, username, and login credentials.
Onboarding details. Information you give us during the setup quiz, including your bodyweight, training experience, and target lift goal. We use this to calibrate your analysis and rankings.
Lift videos. The recordings you upload or capture so the Service can analyse your form and performance. See Section 4 for exactly what happens to these.
Performance data. Lifts you log, estimated 1RM, form scores, percentile rankings, and progress over time.
Payment information. If you subscribe, your payment is processed by our payment provider. We never see or store your full card details.
Device and technical data. Device type, operating system, app version, and crash or diagnostic logs.
Usage data. How you interact with the Service, used to improve it.
2. How We Use Your Information
We use your information to provide the core Service by analysing your lifts, generating feedback, ranking you, and tracking your progress. We also use it to create and manage your account and subscription, respond to your requests and provide support, maintain the security and stability of the Service, improve our features, and send you service related messages. We send marketing emails only if you have opted in, and you can opt out at any time.
3. Legal Bases for Processing
If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR.
Contract (Article 6(1)(b)). Creating and managing your account, delivering the analysis and ranking features you signed up for, and processing your subscription. Without this data we cannot provide the Service.
Explicit consent (Articles 6(1)(a) and 9(2)(a)). Processing your lift videos, bodyweight, and training data. Because this information relates to your physical condition, we treat it with the higher standard that applies to health related data and ask for your explicit consent during onboarding. You may withdraw that consent at any time, which will end your ability to use the analysis features.
Consent (Article 6(1)(a)). Marketing emails and any optional analytics you agree to.
Legitimate interests (Article 6(1)(f)). Keeping the Service secure, preventing fraud and abuse, and understanding aggregate usage so we can improve the product. We balance these interests against your rights and you may object at any time.
Legal obligation (Article 6(1)(c)). Retaining payment and accounting records where law requires it.
4. Your Videos and How Analysis Works
This section matters, so we have written it plainly.
When you record or upload a lift, the video is transmitted to our processing server, hosted by Render, where it is analysed using Google's MediaPipe pose estimation technology. The analysis extracts body position data from the footage to calculate your form scores, estimated 1RM, and rankings.
The video file is permanently deleted from our servers within approximately 10 minutes of upload. We do not archive it, we do not keep a backup copy, and there is no way for you or us to retrieve it afterwards. If you want to keep your footage, save it on your own device before uploading.
We do not use your videos to train AI models. We do not sell them. We do not share them with anyone other than the processing infrastructure described above, and no human at Gymbro reviews them as part of normal operation.
What we do keep is the numerical output: your scores, estimated 1RM, percentile, and the written feedback generated for that set. This is what builds your progress history.
5. Publicly Visible Information
Gymbro is a competitive product, so some of your information is visible to other users.
Your username, strength rating, percentile ranking, and top lift figures may appear on global and category leaderboards. Your bodyweight is used to calculate these rankings but is not itself displayed on leaderboards.
If you choose to generate and share a stat card, the image you create will contain your performance figures, and you control where you post it. Once shared outside the Service, we have no control over how it is used or distributed.
You can control your visibility in Settings.
6. How We Share Your Information
We do not sell your personal data. We share it only with service providers who help us operate the Service, and only to the extent needed.
Stripe processes subscription payments.
Firebase (Google) hosts your account, performance data, and database.
Render hosts the server that receives and processes your uploaded videos.
Google MediaPipe provides the pose estimation technology used for form analysis.
Apple and Google handle app delivery and in app purchases.
Each of these providers is bound by a data processing agreement. We may also disclose information where required by law, or to protect our rights and the safety of our users.
7. International Transfers
Some of our providers are located outside the European Economic Area, including in the United States. Where we transfer your data internationally, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses or an applicable adequacy decision.
8. Data Retention
Lift videos. Deleted within approximately 10 minutes of upload, as described in Section 4.
Account and performance data. Kept for as long as your account is active.
Payment and accounting records. Kept for as long as required by Cypriot and EU law.
Inactive accounts. If an account is inactive for 24 months, we may delete or anonymise the associated data after giving you notice by email.
When you delete your account, we delete or anonymise your personal data within 30 days, except where we are legally required to retain certain records.
9. Your Rights
Under the GDPR you have the right to access your data, correct it, delete it, restrict or object to processing, receive a copy in a portable format, and withdraw consent at any time. Withdrawing consent does not affect processing carried out before withdrawal.
To exercise any of these rights, email ceo@gymbro.social. We will respond within one month.
You also have the right to lodge a complaint with your local data protection authority. In Cyprus this is the Office of the Commissioner for Personal Data Protection, at dataprotection.gov.cy.
10. Deleting Your Account
You can delete your account and associated personal data directly in the app via Settings, then Delete Account. You can also email ceo@gymbro.social. We will action your request within 30 days.
11. Age Requirement
The Service is intended for users aged 16 and over. We do not knowingly collect personal data from anyone under this age. If you believe someone under 16 has provided us with personal data, contact us and we will delete it promptly.
12. Automated Processing
Your form scores, rankings, and feedback are generated automatically by our analysis system. These outputs are informational and do not produce legal effects or similarly significant effects for you. Gymbro provides training feedback, not medical advice. If you have an injury or a health condition, consult a qualified professional before acting on anything the Service tells you.
13. Data Security
We use reasonable technical and organisational measures to protect your data, including encryption in transit and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.
14. Third Party Links
The Service may link to third party sites or services. We are not responsible for their privacy practices, and we encourage you to read their policies.
15. Changes to This Policy
We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you in the app.
16. Contact Us
Gymbro AI
Email: ceo@gymbro.social
Website: gymbro.social