Consumer Health Data Privacy Policy
Draft — not in force yet. We wrote this text ourselves from the law as we researched it; it is not legal advice. It describes the app as it works today.
Version 1
1. About this policy and its effective date
This policy is for people who live in Washington State or Nevada. It says what Washington's My Health My Data Act and Nevada's consumer health data law (NRS 603A.400–603A.550) ask us to say about consumer health data, and nothing else. Everything else about your data is in the Privacy Policy.
Gymdeed is made and run by Halil Kaan Karan, an individual in Istanbul, Türkiye ("we", "us"). Contact: [email protected].
It is not settled whether workout numbers are "consumer health data" under these laws. We treat them as if they are.
Effective date: this is version 1, dated 9 October 2026. It applies from the day Gymdeed is first offered on the App Store in the United States.
2. The categories of consumer health data we collect
- Workout numbers. The exercises you did; sets and reps with their timing, depth, form scores and the mistakes counted; corrections to a count; records, streak days, levels, belts and exam results; your training plan; the seconds of each warm-up and cool-down.
- Body measurements. Your height and weight, if you gave them.
- Challenge numbers. If you use challenges: the exercise, the kind of challenge, your number, how long the set took and, in "Beat your best", your earlier best.
Your injury answers, the camera picture and the body points worked out from it stay on your phone. They never reach us.
3. Sources
- You: the answers you enter in the app.
- Your phone: the app works out the workout numbers on the phone, from the camera picture, while you train.
We get consumer health data from no one else: not from other apps or companies, and not from Apple Health.
4. Purposes, and how we use and process it
The numbers are produced on your phone and stay there unless you say yes to one of the four things below. Each has its own yes in the app, and each can be turned off again in Settings.
| Purpose | What is used | How |
|---|---|---|
| The backup, so that a new phone can have your training back | workout numbers; height and weight, if given | sent to our server after you agree to the backup and sign in; stored in the EU |
| Deed's written words: a comment on a set and Deed's notes in your log | the numbers of a set, and the facts of a log entry with those of your last five entries; never height or weight | sent through our server to an AI model provider, which writes the text; we store neither what we send nor what comes back |
| Usage data, to find what is confusing or broken | workout numbers as counts and categories; never height or weight | sent to an analytics provider under a random id that is not linked to your account |
| Challenges: showing one number to another person | challenge numbers | sent to our server when you send or answer a challenge; shown to the people section 5 names |
A crash report, sent when the app breaks, carries the last workout steps so that we can fix the fault. It is the one thing in this policy that is sent without a yes of its own.
Connections are encrypted. We do not sell consumer health data, we do not use it for advertising, and we do not use it to profile you.
5. The categories of consumer health data we share
- With the companies that work for us (section 6): the workout numbers and body measurements in a backup; the numbers Deed's written words are made from; workout numbers as counts in usage data; the last workout steps in a crash report.
- With other people who use Gymdeed, only in a challenge and only after your separate yes to challenges: whoever opens your link in the app sees your handle, the exercise, the kind of challenge and your number, and in "Beat your best" how far over your own best you went; the person whose challenge you answer sees your handle, your number and that percentage. The web page of a link shows your handle and the exercise, never a number.
We sell none of it.
6. Third parties and affiliates
We have no affiliates.
The third parties that receive consumer health data, by category:
| Category | Who | What it receives |
|---|---|---|
| Hosting provider | Railway Corporation | everything in a backup; challenge numbers |
| AI model provider | Anthropic PBC | the numbers Deed's written words are made from |
| Analytics provider | PostHog, Inc. | usage data |
| Crash reporting provider | Functional Software, Inc. (Sentry) | crash reports |
| Other users of Gymdeed | the people in a challenge with you | what section 5 lists |
Each company works for us on our instructions, under its own data processing agreement.
7. Collection across sites by third parties
No third party collects consumer health data about you over time and across different websites or online services through Gymdeed. The app and this website carry no advertising and no tracking tools.
8. Your rights and how to use them
You can:
- ask whether we collect, share or sell consumer health data about you, and get a copy of it;
- get a list of the third parties and affiliates we shared it with, with a way to contact each;
- withdraw your consent to our collecting or sharing it;
- have it deleted.
In the app. Settings turns off the backup (Stop backing up), Deed's written words, usage data and challenges, each where it was turned on. Settings → Delete account and data deletes everything at once.
By email. Write to [email protected] and include the account code shown in Settings → Account, so that we can find your data; we hold no name and no email address for you. We answer within 30 days, and never later than the 45 days these laws allow, free of charge. If a request needs more time we tell you so, and why, within those 45 days.
A deletion is carried out on our server at once. A copy stays inside our host's recovery archive for up to about four weeks, until the archive has moved past it. What the other companies in section 6 hold carries no account id from the app and runs out on their own periods: the AI model provider deletes a request within 30 days, crash reports are kept up to 90 days and usage data one year.
9. Reviewing and changing your data
History in the app shows the workout numbers Gymdeed holds. The "Wrong count?" key after a set puts a count right. Your height, your weight and your other answers can be changed in the app, and a backup follows the change. For anything you cannot review or change there, write to [email protected].
10. Appeals and complaints
If we refuse a request, or do not act on it, you can appeal. Write to [email protected] with the word "Appeal" in the subject and say which request you mean. You get a second, written reply from Halil Kaan Karan within 45 days of your appeal, saying what was done or not done and why. Gymdeed is run by one person, so the same person reads the appeal; it is read again from the start.
If the appeal is refused too, or you are not satisfied, you can complain to the Attorney General of your state:
- Washington: the Washington State Attorney General, atg.wa.gov/file-complaint
- Nevada: the Nevada Attorney General, ag.nv.gov
11. Changes to this policy
When this policy changes in a way that matters, the new version and its date are published on this page before the change applies. When a change touches something you agreed to, the app asks you again before it uses that data.
Gymdeed Consumer Health Data Privacy Policy, version 1.