Draft (last updated 15 November 2026). This text describes how the app actually works and must be reviewed by a legal professional before public launch.
Who we are
ZeroClueGym ("we") is operated by Iulia Andra Diamandescu. Contact: privacy@zerocluegym.com.
What we collect and why
Account: a random user ID (guest) or, if you choose, your email address, to keep your workouts across devices.
Profile and preferences: language, units, experience, goal, time per visit, training days, equipment type, and optional "go easy on" areas (e.g. knees), used only to choose suitable exercises. The "go easy on" areas may be considered health data; we process them only with your explicit consent and you can remove them at any time.
Workouts: exercises, sets, repetitions, weights, how a set felt, dates. This is the core of the app.
Coach conversation: your typed/transcribed messages and the coach's replies, kept 90 days to show your recent conversation.
Voice clips: sent to our speech-to-text provider only to transcribe them; we do not store audio.
Photos of equipment: location metadata is removed, the photo is sent to our AI provider only to identify the machine, and we do not store it. We keep the identified machine name for 180 days.
Usage and security: counts of AI requests and estimated cost (to enforce fair-use limits), technical logs, consent records.
Purchases: if you subscribe, your subscription status from Apple/Google via our billing provider; we never see your payment details.
We do not sell your data and do not use it for advertising. Analytics and crash reporting are off unless you opt in.
Legal bases (GDPR)
Contract (providing the app), consent (AI processing of voice, photos and free-text messages; optional health-related limitations), legitimate interest (security, abuse prevention), legal obligation (records we must keep).
Service providers
Supabase (database and sign-in), EU region (Ireland)
Hetzner (API server), EU (Finland)
Anthropic (AI: message understanding, answers, photo recognition), USA
OpenAI (speech-to-text), USA
RevenueCat and Apple/Google (subscriptions), when enabled
Transfers to the USA rely on the EU-US Data Privacy Framework and/or Standard Contractual Clauses. Providers process data only on our instructions.
Retention
Workouts and profile: until you delete them or your account. Conversation: 90 days. Equipment scan results: 180 days. AI usage records are de-identified after about 13 months.
Your rights
Access and export (Profile → Download my data), correction (edit any logged set), deletion (Profile → Delete account deletes your data and sign-in immediately), withdrawal of consent (Profile → Privacy), objection and complaint to your data protection authority (in Romania: ANSPDCP).
Children
ZeroClueGym is not intended for children under 16.
Changes
We will update this page and, for material changes, ask for your consent again in the app.