This page isn’t available in Polski yet — it’s shown in English.

Polski

Privacy Policy

Draft

This is a draft awaiting review. Text in brackets will be filled in before the app is released.

The translation into your language is waiting for review. Until it’s approved, the text is shown in English.

1. Who we are#

This Privacy Policy explains how we process personal data in the DAR GYM app, on the dargym.app website and when you write to us (the “Service”).

The data controller is A. S. Samokysh, an individual entrepreneur registered in Ukraine (Unified State Register record No. 2 053 000 0000 000850) (“we”, “us”). The app's developer name in the App Store and Google Play is DAR ANDRE. For any question about your data, email support@dargym.app.

Version: [to be filled in].

2. In short#

  • DAR GYM is a fitness and healthy-lifestyle app for adults (18+). It is not a medical device.
  • Your data is stored on your phone in encrypted form and on our server in the EU.
  • We process data about your wellbeing, training limitations and body only with your explicit consent.
  • The AI coach runs on Google's Gemini model. Data goes there only with a separate consent, which you don't have to give: without it, your training program is built by the app's rules without AI.
  • We don't sell your data, show ads or track you across other apps and websites.
  • You can download your data or delete your account in the app at any time.

3. What data we process#

Data you add yourself:

  • Account: email address, password (stored only as a hash) or your Apple or Google sign-in identifier; your name if you entered it or Apple or Google shared it. If you hid your email when signing in with Apple, we only get Apple's relay address.
  • Profile: year of birth, sex, height, goal, experience, starting results in exercises, training days and duration, training locations and equipment, language, country, units, time zone, calorie, protein, fat, carb and weight targets.
  • Workouts: programs, workouts, sets (weight, reps, time, perceived effort), the “How did it go?” rating, notes, personal records.
  • Limitations and discomfort: areas where you avoid load, discomfort marks during exercises (area, side, score), the app's notices about repeated discomfort.
  • Diary and wellbeing: energy, sleep, stress, mood, muscle soreness, alcohol, notes; the “Training readiness” score the app calculates from them.
  • Body: weight and measurements.
  • “Chronic condition” and “regular medication” flags — yes / no only. We don't collect the names of conditions or medications, or pregnancy information.
  • Nutrition: meals, foods and grams, your own foods, barcodes, food described in text and food photos (resized to 1536 pixels, with EXIF metadata removed, including location).
  • Supplements: the supplements you add and when you take them.
  • Conversations with the AI coach: your messages and the replies, Coach memory entries, the “Tip of the day” and weekly summaries, your ratings of replies and your reports.

Wellbeing, limitations, discomfort, body, sleep, supplements and the yes / no flags are data concerning health under GDPR Art. 9, even though the app isn't a medical one. We consider nutrition combined with weight to be in the same category. Anything you write in notes or the chat may also include health information — share only what you want to.

Voice input. Your phone (or Apple's or Google's service, under their terms) recognizes your speech, and only the text reaches us — we don't receive audio.

Data created as you use the Service:

  • Consents: which consents you gave or withdrew, the text version, language and time. This is the record of your consent.
  • Subscription (once subscriptions are available): subscription or trial status, product, store, store country, currency, price and event times. We keep the store's purchase identifier only as a protected hash.
  • AI usage: how many requests you made to AI features (for limits), and the size and cost of requests — without their text.
  • Safety label: the topic of a message to the AI coach when a safeguard was triggered (section 6).
  • Crash reports: data about app crashes and errors (Sentry) — without your name, email or health data.
  • Technical logs: IP address, device type and app version in the logs of our servers, sync service, website and app update service.

What we don't collect: location (you choose your country, or we take it from your phone's language and region settings), contacts, calendar, browsing history, advertising IDs. We don't collect usage analytics now; before we start, we'll ask for your separate consent and name the provider.

4. Why we use data and our legal bases#

  • To provide the Service under our contract (GDPR Art. 6(1)(b)): your account and sign-in, sync between devices, the rule-based training program, load progression, the diary, nutrition, data export and deletion, service emails (confirmation codes, password resets). Health data for these purposes is processed only with your explicit consent (Art. 9(2)(a), consent 1 in section 5).
  • The AI coach — only with your consent (Art. 6(1)(a) and Art. 9(2)(a), consents 2 and 3).
  • Safety messages — to protect your vital interests (Art. 6(1)(d) and Art. 9(2)(c), section 7).
  • Our legitimate interests (Art. 6(1)(f)): AI usage limits and preventing free-trial abuse; revenue accounting without personal identifiers; app stability (crash reports); server security (technical logs); reviewing your reports about AI replies; answering your emails.
  • Legal obligations (Art. 6(1)(c)): responding to lawful requests from authorities and keeping records where the law requires.

We don't use your data for advertising, don't sell it, and don't make automated decisions about you with legal or similarly significant effects (GDPR Art. 22).

5. Your consents in the app#

Before you first use the app, it asks for several separate consents. You can change each of them at any time: Profile → Settings → Data and consents.

  • Consent 1 — processing your health-related data (required): weight, training limitations, discomfort marks, sleep, wellbeing and stress, “How did it go?”, workout notes, training readiness, supplements, Coach memory entries and the yes / no flags — to fit exercises and load to you. The app can't work without it; if you withdraw it, the app offers to delete your account.
  • Consent 2 — sending data to Google Gemini (optional): needed for the AI coach (section 6). If you withdraw it, AI features turn off, and your Coach memory entries stay in the app until you delete them.
  • Consent 3 — health-related data for the AI (optional, only together with consent 2): lets the AI coach consider your health-related data. If you withdraw it, the next requests go without this data.

Withdrawing consent doesn't affect processing that happened before. If the text of consent 2 or 3 changes, the app asks you to confirm it again and, until then, works as if the consent were withdrawn.

Before first use you also confirm the Terms of Use (https://dargym.app/pl/terms), that you are 18 or older, and that you've read the “not a medical app” notice. We keep a record of which version you confirmed.

6. The AI coach#

In DAR GYM you talk to an AI coach — an artificial intelligence program, not a person. Chat replies, program explanations, food estimates from photos and text, the “Tip of the day” and weekly summaries are generated by the Gemini model from Google LLC (Gemini API), which only our servers call. Your phone doesn't connect to Google directly for this.

What is sent to Gemini with consent 2: your profile (age, sex, height, weight, goals), workouts, food photos and food descriptions, chat messages (including dictated ones) and Coach memory entries. With consent 3, also: training limitations, discomfort marks, wellbeing, sleep and stress, “How did it go?”, workout notes, training readiness, supplements, “Sleep & recovery” entries from Coach memory and the yes / no flags. We send only what a given request needs, and never your name or email.

The processing region is not guaranteed: Google may process data in any country where it operates, including outside the EU (e.g. the US). Google keeps request logs for abuse monitoring for up to 55 days. Google doesn't use this data to train models.

Without consent 2, AI features are unavailable and your training program is built by the app's rules — nothing is sent to Gemini.

The AI never saves anything on its own. Program structure, sets, reps, weights and progression are calculated by the app's deterministic rules; the AI picks exercises from allowed options and explains the choice. AI suggestions come as cards, and you decide whether to save them.

Workouts from the AI coach. When you ask the AI coach to prepare workouts, the AI uses the conversation to set only their parameters (how many, what type and how hard), while the app builds the workouts using the DAR GYM training method rules and adds them only when you tap “Save”.

Coach memory. Coach memory entries are kept for as long as your account exists (a deleted entry is permanently erased within 30 days), are included in your data export and are deleted with your account.

Safeguards in replies. The AI coach doesn't assess your health, give advice about medication or provide medical advice. Our server checks messages and replies against safety rules; for questions outside training, the app shows a fixed message instead of a model reply. When such a safeguard is triggered, we keep a service label with the message topic for up to 90 days (only if you gave consent 2) to check that the AI coach stays within these limits. Automatic checks can make mistakes, so don't rely on them in an emergency — call your emergency number.

Reports. You can tap “Report” under coach replies in the chat, the “Tip of the day” and the weekly review. We keep the rating, reason and your comment; to review the report, we look at that reply and a few messages before it. This is how we improve our safeguards (retention — section 11).

AI can make mistakes — for example, misjudge the calories in a photo (the app shows a range). Double-check anything important.

7. Safety messages#

Safety messages without AI consent. If a message to the AI coach shows signs of an emergency (for example, chest pain or thoughts of self-harm), the app shows the emergency number or helpline for your country, even if you haven't given consent to AI processing or have withdrawn it. To do this, our server automatically checks the message text for such signs. The legal basis is protecting your vital interests (GDPR Art. 6(1)(d) and Art. 9(2)(c)), not consent, so withdrawing consent doesn't turn this check off. In this case the message isn't sent to the AI model or any other third party and isn't stored: neither the text itself nor a record that the check was triggered.

8. Who else receives data#

We use providers that process data on our behalf and only on our instructions (processors), and must protect it at least as well as we do:

  • Supabase — database, sign-in, photo storage and server functions; servers in the EU.
  • PowerSync (JourneyApps) — syncing data between your phone and our server; servers in the EU.
  • Google LLC (Gemini API) — the AI coach, only with consent 2 (section 6).
  • Functional Software (Sentry) — crash reports without your name, email or health data; servers in the EU.
  • Resend — service emails (confirmation codes, password resets) from mail.dargym.app.
  • Cloudflare — hosting of the dargym.app website, DNS and forwarding of emails to support@dargym.app.
  • Google (Gmail) — the mailbox that receives emails sent to support@dargym.app.
  • Expo (650 Industries) — app update delivery; sees your IP address, platform and app version when the app checks for updates.

Apple and Google process data independently, under their own terms and policies, when you sign in with their account, buy a subscription in the App Store or Google Play (they are the sellers of the subscription), or dictate text using their speech recognition service.

Open Food Facts is an open food database. When you scan a barcode, our server asks it only for that barcode — without your ID or IP address.

We may disclose data if the law or a lawful request from a public authority requires it, or to protect people's rights and safety. If the Service passes to another party (for example, if we set up a company), the data will pass with it on the same terms, and we'll let you know.

9. International transfers#

We are based in Ukraine, and we store the Service's data on servers in the EU. Some providers are US companies or run infrastructure outside the EU: Google (Gemini, Gmail), Cloudflare, Expo, and Supabase and Sentry where their support staff access data from outside the EU. For Gemini, the processing region is not guaranteed (section 6).

When data from the EU or UK is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum for UK data) or on the EU-U.S. Data Privacy Framework where the provider is certified under it. You can get a copy of the relevant safeguards by emailing support@dargym.app.

10. How we protect data#

  • On your phone, data is stored in an encrypted database. Photos on the phone are protected by the operating system.
  • Data travels between your phone, the website and our server only over encrypted connections (TLS).
  • On the server, each person can see only their own data: access rules in the database enforce this. Photos are kept in private storage.
  • Only we have access to production data, and only to support the Service.

No protection is absolute. If a breach puts you at risk, we'll notify the supervisory authority and you within the time the law requires.

11. How long we keep data#

  • Profile, workouts, diary, nutrition, supplements, limitations, training locations, the “Tip of the day” and weekly summaries, Coach memory entries, consents — for as long as your account exists or until you delete them (section 12).
  • Food photos — for as long as your account exists.
  • Chat messages with the AI coach — 12 months from each message. A short summary of the conversation lives with the conversation: we delete it when no messages are left and the conversation has been inactive for 12 months.
  • Safety label (section 6) — 90 days.
  • Technical AI request data (the request context, intermediate model data, the result of a background job) — 30 days.
  • AI usage records without text (status, size, cost) — up to 13 months; daily and weekly limit counters — 90 days; trial and free-plan counters — for as long as your account exists.
  • Reports about AI replies: your comment — 12 months; the rating and reason — for as long as your account exists.
  • Subscription events (once subscriptions are available): the full event data from the store — 90 days; the record without it (product, store, store country, currency, price, time) — up to 24 months, and the link to you is removed when your account is deleted.
  • Crash reports (Sentry) — 90 days. Technical logs — up to 30 days.
  • Emails with support — 24 months from the last email.
  • Google Gemini request logs — up to 55 days at Google (section 6); we don't control them.
  • Server backups — deleted data disappears from them within 30 days.

What remains after account deletion. After your account is deleted (section 12), only the following remains:

  • once subscriptions are available, a protected hash of the store purchase identifier with the AI usage counters for that purchase — 90 days, so the same free trial can't be claimed again with a new account. Without our secret key, the hash can't be linked to the purchase;
  • subscription event records without your identifiers — up to 24 months from the event, for revenue accounting;
  • a technical log entry about the fact of deletion and its reason, without your identifiers — for the log retention period;
  • data in backups and logs — until the end of their periods above.

12. Deleting your account#

You can delete your account:

  • in the app: Profile → Settings → Data and consents → Delete account;
  • by emailing support@dargym.app from the address linked to your account.

Step-by-step instructions, including for when the app is no longer on your phone, are on the page https://dargym.app/pl/delete-account.

Deletion in the app is immediate and permanent: we delete your photos from storage, your account and all data linked to it on our server. Deletion can't be undone. We reply to and complete email requests within 30 days.

Deleting your account doesn't cancel your subscription — cancel it separately in the App Store or Google Play.

You can delete some data without deleting your account. In the app: food entries and supplements, your chat history (“Clear chat history”) and Coach memory entries (“Forget all”). Other records (workouts, diary, body measurements): by email to support@dargym.app.

13. Your rights#

Depending on where you live (including under the GDPR, UK GDPR and Ukraine's Law on Personal Data Protection), you have the right to:

  • access your data and get a copy — in the app (Profile → Settings → Data and consents → Download my data) you get a JSON file with everything DAR GYM keeps about you;
  • data portability — the same file in a machine-readable format;
  • correct your data — in the app or by email;
  • delete your data — section 12;
  • withdraw consent at any time — Profile → Settings → Data and consents;
  • restrict processing and object to processing based on our legitimate interests — by email.

Email support@dargym.app. We reply within one month (in complex cases this can be extended by two more months — we'll tell you), and we may ask you to confirm that the account is yours.

You can also complain to a supervisory authority: in the EU, the data protection authority of the country where you live or work; in the UK, the ICO; in Ukraine, the Ukrainian Parliament Commissioner for Human Rights. We'd appreciate the chance to help first.

14. Age#

The Service is only for people aged 18 or older. We don't knowingly collect data from anyone under 18. If the age in your profile shows that you are under 18, the app asks you to confirm your year of birth; once confirmed, the account and its data are deleted as described in section 12. If you know that an account was created by someone under 18, email support@dargym.app.

15. The dargym.app website#

The dargym.app website is hosted by Cloudflare. When you visit, Cloudflare processes your IP address and technical request data to deliver the page and protect the site from attacks. The website doesn't use advertising or analytics cookies and doesn't load fonts or scripts from third-party sites.

16. Changes to this Policy#

We update this Policy when features, providers or laws change. Each new version has a new date. We'll tell you about significant changes in the app before they take effect. If a change affects a consent (for example, a new recipient of data for AI), the app asks you to confirm the consent again, and until then that processing doesn't happen. Previous versions are available on request.

17. Contact#

A. S. Samokysh, individual entrepreneur · support@dargym.app · dargym.app