Privacy Policy

Last updated: 25 August 2026

GymXP ("we", "us", "our") is operated by NicHallSoftware (Nicholas Hall, a sole trader based in the United Kingdom, trading as NicHallSoftware). This policy explains what personal data we collect, how we use it, and your rights under UK GDPR. Contact: nichallsoftware@gmail.com.

1. Data We Collect

When you use GymXP we may collect:

• Account data — name or display name, email address, and profile information you provide when signing in with Apple, Google or email.
• Guest use — you can log workouts without an account. Those workouts stay on your device until you sign in; signing in uploads them to your account.
• Fitness data — workout logs, exercise history, sets, reps, weights, and personal records you record in the app.
• Nutrition data — food logs, macro targets, water and meal information you enter manually or via barcode scan.
• Game and social data — your display name, level, XP totals, streak, equipped gear, achievements, and boss-raid or duel results. These are stored on our servers and shown to friends you add, raid partners and duel opponents. The sets you log are sent to our servers so raid damage and duel results can be scored.
• Health data (Android only) — if you turn on Health Connect in Settings → Integrations and grant permission, GymXP writes each completed workout to Google Health Connect and reads heart-rate samples for that workout and your previous night's sleep duration. Heart rate is shown on your workout summary; sleep duration may be included in AI coach requests so advice can account for recovery. Health data is processed on your device and inside the AI request only; it is not stored on our servers. GymXP does not currently read from or write to Apple Health on iOS. You can revoke access at any time in Health Connect or in Settings → Integrations → Health Connect.
• Progress photos — photos you take or pick to track your physique are stored only on your device and are never uploaded.
• Subscription data — purchase receipts and subscription status, processed by RevenueCat on our behalf. Payment itself is handled by Apple (App Store) or Google (Google Play); we never see your card details.
• Crash and error reports — anonymised diagnostic data collected via Sentry to help us fix bugs. No identifiable fitness or health data is included. You can turn this off in Settings → Privacy & Data → "Send crash reports".
• Usage analytics — anonymised data about how the app is used (for example, screens viewed and actions such as signing up or completing onboarding), collected via Amplitude. This does not include your fitness, nutrition or health content. You can turn it off at any time in Settings → Privacy & Data → "Send usage analytics".
• Device data — operating system version and device type, used solely for compatibility and support.

2. How We Use Your Data

• To provide and improve the GymXP app and its features.
• To manage your subscription.
• To power the AI coach, which uses your workout history, personal bests, nutrition data, streak and (on Android, if enabled) sleep duration to give personalised advice. This data is sent to Anthropic's API for the duration of the request only and is not stored or used for training by Anthropic.
• To score boss raids and duels on our servers from the sets you log, and to show your results to the friends, partners and opponents involved.
• To back up your data and sync it across your devices via Firebase.
• To diagnose and fix crashes and bugs.
• To understand how the app is used and improve it, using anonymised product analytics. You can opt out at any time in Settings → Privacy & Data.

3. Third-Party Services

GymXP uses the following third-party services, each with their own privacy policies:

• Firebase (Google) — authentication, cloud data storage and cloud functions.
• Firebase App Check (Google Play Integrity on Android, Apple App Attest on iOS) — used to check that requests come from a genuine copy of the app. No personal data is involved.
• Google Sign-In / Sign in with Apple — optional sign-in providers.
• RevenueCat — subscription management.
• Anthropic — AI coach functionality (Claude API). Data sent to Anthropic is used only to generate a response, for the duration of the request, and is not used for training.
• Sentry — anonymised crash reporting. Opt out in Settings → Privacy & Data → "Send crash reports".
• Amplitude — anonymised product analytics. Opt out in Settings → Privacy & Data → "Send usage analytics".
• Open Food Facts / USDA FoodData Central — public food databases used for nutrition lookups. Only your search terms or scanned barcodes are sent; no personal data.

4. Data Storage and Security

Your account, workout and game data is stored in Google Cloud's London region (Firebase Firestore, europe-west2), so it stays in the UK. AI coach requests are processed on Google servers in the United States for the duration of the request only; that transfer is covered by Google's standard contractual clauses and the UK International Data Transfer Addendum. We take reasonable technical measures to protect your data.

The app also keeps a local copy of your data in a database on your device. That local copy is not backed up to any external server beyond Firebase.

5. Data Retention

We retain your data for as long as your account is active. You can delete your account and all associated data at any time from within the app (Profile → Settings → Delete Account). Deletion is permanent and irreversible.

6. Your Rights (UK GDPR)

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request erasure of your data.
• Object to or restrict certain processing.
• Data portability.

To exercise any of these rights, contact us at nichallsoftware@gmail.com. You can also complain to the Information Commissioner's Office (ico.org.uk).

7. Website and Cookies

gymxp.co.uk uses Google Analytics 4 to count visits and clicks on the App Store and Google Play links. Analytics cookies are only set if you accept them in the banner shown on your first visit. You can change your choice at any time using the "Cookie settings" link in the footer of every page.

The site stores one item in your browser's local storage to remember your choice. If you decline, store-link clicks are still counted, but without cookies and without identifying you.

8. Children

GymXP is not directed at children under 13. We do not knowingly collect data from children under 13.

9. Changes to This Policy

We may update this policy from time to time. We will notify you of significant changes within the app. Continued use of the app after changes constitutes acceptance of the updated policy.

10. Contact

If you have any questions about this policy, please contact us at nichallsoftware@gmail.com.