GymSquire Privacy Policy

Version 2.1

Last updated: 4 August 2026

1. Who We Are

GymSquire (“GymSquire”, “we”, “our” or “us”) respects your privacy and is committed to protecting your personal information. This Privacy Policy explains what personal information we collect, how and why we collect it, how we use, store and protect it, who we share it with, how long we retain it, your legal rights, and how you can contact us regarding your personal information. This Privacy Policy applies whenever you access or use the GymSquire mobile application, website, AI Coach or any related services operated by GymSquire, collectively referred to as the “Services”. GymSquire is operated as a partnership by Will Morse and Joshua Weatherall. Business correspondence address: 82 Claude Road, Caerphilly, CF83 1GN, United Kingdom. Email: team@gymsquire.co.uk. GymSquire is the data controller responsible for the personal information processed through the Services.

2. Scope

This Privacy Policy applies to the GymSquire mobile application, GymSquire website, GymSquire AI Coach, customer-support services, subscription-related services, and any associated online services operated by GymSquire. It does not apply to websites, applications or services operated independently by third parties that may be linked from GymSquire. Those third parties maintain their own privacy policies, and we encourage you to read them before using their services.

3. Information We Collect

The information we collect depends on how you use GymSquire. Some information is required to create an account, verify eligibility, provide requested features or administer a Subscription. Other information is optional and is collected only where you choose to provide it.

3.1 Information You Provide

When creating an account or using GymSquire, you may provide your name or username, email address, password handled using secure authentication and password-hashing methods, date of birth or age, sex, height, weight, activity level, fitness goals, workout preferences, workout history, personal records, custom workout plans, AI chat messages, uploaded food photographs, uploaded objective-verification photographs, customer-support requests, feedback or other information you choose to provide. The application will indicate where information is required. If you do not provide required information, we may be unable to create your account or provide the relevant feature.

3.2 Information Generated Through Your Use of the Services

When you use GymSquire, we may generate or store completed workouts, workout statistics, XP earned, XP progression, objectives completed, achievements earned, exercise history, AI coaching history, nutrition recommendations, meal-analysis results, progress analytics, discount-reward eligibility and redemption status, Subscription status, Subscription platform, account status, and application and account settings. This information is generated through your interaction with the Services.

3.3 Technical, Security and Usage Information

When you use the Services, GymSquire and its service providers may automatically process limited technical, security and usage information such as IP address, approximate country or region, authentication events, sign-in and sign-out activity, password-reset events, email-verification events, dates and times of access, application version, operating-system information, browser, device or user-agent information, API-request information, network-request information, security logs, authentication logs, diagnostic information and error information. This may be used to authenticate users, maintain account security, detect fraudulent or unauthorised activity, prevent misuse, investigate technical problems, improve security, maintain service reliability and protect GymSquire’s systems and users. Technical information is not used by GymSquire to create advertising profiles.

3.4 Subscription and Purchase Information

GymSquire offers paid, auto-renewable Subscriptions. Subscriptions purchased through iOS are processed through Apple In-App Purchase and subscriptions purchased through Android are processed through Google Play Billing. Apple and Google process users’ payment methods and payment-card details under their own terms and privacy policies. GymSquire does not receive or store your complete payment-card number, security code or other complete card credentials. GymSquire may receive limited purchase and Subscription information from Apple or Google, including plan, purchase status, Subscription status, billing period, renewal status, expiration date, trial or promotional-offer status, transaction identifiers, purchase token, refund, revocation or cancellation status, purchase or renewal date, country, region or storefront information, currency, limited pricing information and information needed to validate or restore a purchase. We use this to confirm purchases, provide paid functionality, administer renewals, restore purchases, apply promotional offers, administer XP discount rewards, identify expired, cancelled, refunded or revoked Subscriptions, provide support, prevent fraud and comply with accounting, tax and legal requirements.

4. AI-Powered Features

GymSquire provides AI-powered fitness features including personalised workout planning, exercise guidance, nutrition guidance, meal analysis, supplement information, objective verification, motivation, habit coaching, recovery guidance and general educational fitness information. These features use OpenAI together with GymSquire’s own systems and service providers. When you use AI-powered features, information processed may include workout questions, nutrition questions, uploaded food photographs, uploaded objective-verification photographs, body measurements, workout history, fitness goals, nutrition preferences, activity information, relevant account context and any other information voluntarily included in your request. This information is processed to provide the response, analysis, verification or recommendation requested by you. Users should avoid including unnecessary personal information, particularly information relating to another identifiable individual.

4.1 AI Conversation Retention

GymSquire temporarily stores AI conversation history to provide continuity during active use. GymSquire’s live copy of AI conversation content is ordinarily retained for no longer than twenty-four hours. After approximately twenty-four hours, the conversation is removed from visible AI chat history and corresponding conversation records are deleted from GymSquire’s live database. Deleted records may remain temporarily within encrypted backups until overwritten or deleted. Service providers involved in AI functionality may process or retain information for different periods according to contractual terms, legal obligations, security requirements and GymSquire’s configuration.

4.2 AI Accuracy

AI-generated information may be incomplete, contain inaccuracies, misunderstand a request or image, not reflect the latest scientific evidence, not account for every relevant personal circumstance, and should not replace advice from an appropriately qualified professional. AI-generated content is provided for general educational and fitness purposes. GymSquire does not provide medical diagnosis or treatment through AI-powered features.

4.3 Automated Processing

GymSquire uses automated systems to generate or assist with workout recommendations, meal recommendations, AI responses, food analysis, calorie and macronutrient estimates, objective verification, progress information and personalised fitness recommendations. GymSquire does not use these systems to make decisions that produce legal or similarly significant effects on users. Objective-verification outcomes and XP rewards are used for engagement, progress and Subscription-reward purposes, not for employment, insurance, credit, legal, medical or similarly significant decisions.

5. Images

GymSquire allows users to upload photographs for meal analysis and objective verification. Uploaded images are processed using artificial intelligence to provide the requested functionality and are not published publicly through GymSquire. Access is limited to authorised technical systems, service providers where necessary, and authorised persons where strictly necessary for security, maintenance, troubleshooting or legal compliance. GymSquire does not sell uploaded photographs, use them for behavioural advertising, display them publicly or intentionally use them to train AI models.

5.1 Image Retention

GymSquire’s copy of an uploaded food photograph or objective-verification photograph is deleted promptly after processing is completed. Uploaded images are not intentionally retained as permanent account records. Temporary copies may remain briefly while upload, analysis or verification is completed. Service providers may process or retain limited information according to contractual terms, legal obligations, security requirements and service configuration. Users should avoid uploading images containing unnecessary personal information and should not upload identifiable images of another person without permission.

6. Health and Fitness Information

GymSquire provides personalised fitness, nutrition and AI-powered features. To provide those features, we process information relating to users’ physical characteristics, fitness activities and goals, including height, weight, age or date of birth, sex, activity level, fitness goals, workout history, exercise performance, personal records, nutrition preferences, meal information, recovery information, information voluntarily provided about injuries, health conditions or physical limitations, and health-related information included in AI conversations. Some of this may constitute special-category personal data, including data concerning health. Where information constitutes special-category personal data, GymSquire will identify an appropriate lawful basis under Article 6 of the UK GDPR and an appropriate condition under Article 9. Where GymSquire relies on explicit consent, consent will be requested separately and clearly before processing begins. You may withdraw consent at any time through available account controls or by contacting team@gymsquire.co.uk. Withdrawal does not affect processing lawfully carried out before withdrawal, but some personalised features may become unavailable. GymSquire aims to process only the health and fitness information reasonably necessary to provide requested features.

7. How We Use Your Information

Depending on how you use GymSquire, we may use personal information to create and manage your account, verify email, authenticate identity, verify age, apply age-appropriate protections, personalise workouts and nutrition, generate AI coaching responses, analyse uploaded food images, verify objectives, calculate XP, achievements and progress, determine eligibility for XP discount rewards, verify and administer claimed discounts, recommend workouts and meals, remember preferences, verify Subscription purchases, activate or remove paid access, restore purchases, administer Subscription status, respond to cancellation, refund or purchase enquiries, provide customer support, communicate about your account or important service information, investigate bugs, maintain security, detect fraud and misuse, prevent unauthorised access, comply with legal, accounting, tax and regulatory obligations, and establish, exercise or defend legal claims. GymSquire does not sell personal information, use it for behavioural advertising or permit other organisations to create advertising profiles using information collected through GymSquire.

7.1 AI Personalisation

GymSquire may use relevant information provided by you to personalise AI-generated responses. This may include fitness goals, previous workouts, body measurements, nutrition preferences, training plan, meal plan, workout history and conversation content retained during the twenty-four-hour conversation period. This information is processed to improve the relevance of the feature requested by you and is not used by GymSquire to create an advertising profile.

7.2 Improving GymSquire

We may use information to investigate bugs, monitor performance, improve system stability, improve prompts and AI-feature configuration, improve objective-verification processes, improve workout and meal recommendations, prevent abuse, protect users, and improve application security and reliability. Where reasonably possible, we use aggregated, de-identified or anonymised information rather than information that directly identifies an individual. We do not intentionally use private AI conversations or uploaded images to train external artificial-intelligence models.

8. Lawful Bases for Processing

Where UK data-protection law applies, GymSquire processes personal information under one or more lawful bases. The applicable basis depends on the purpose and circumstances of the processing.

8.1 Performance of a Contract

We may process personal information where necessary to create and administer your account, provide requested fitness features, provide AI coaching, provide workouts and nutrition features, maintain workout and progress records, determine XP and reward eligibility, confirm Subscription entitlement, provide paid access, restore purchases, administer subscriptions and provide customer support. Without this processing, we may be unable to provide the Services requested by you.

8.2 Legitimate Interests

We may process information where necessary for legitimate interests including securing the Services, preventing fraud and misuse, preventing manipulation of XP or rewards, diagnosing technical issues, maintaining reliability, protecting accounts, investigating complaints, improving functionality, managing our business and establishing, exercising or defending legal claims. Where we rely on legitimate interests, we consider whether those interests are overridden by users’ rights, interests or freedoms.

8.3 Legal Obligation

We may process information where necessary to comply with tax obligations, accounting obligations, consumer-protection requirements, regulatory requirements, court orders, lawful requests from public authorities and other applicable legal obligations.

8.4 Consent

We may rely on consent where we specifically ask for permission to carry out a processing activity. This may include explicit consent for processing certain health information, consent for optional marketing communications introduced in the future, and consent for optional analytics or non-essential cookies introduced in the future. Where we rely on consent, the request will be clear, consent will not be pre-selected, consent will be recorded where appropriate, and consent may be withdrawn at any time. Withdrawing consent does not affect processing already carried out lawfully before withdrawal.

9. Third-Party Service Providers

GymSquire uses third-party providers to operate, secure and distribute the Services. These providers receive only information reasonably relevant to their function. Some process information on GymSquire’s behalf; others may act as independent data controllers for particular activities.

9.1 Apple

Apple distributes the iOS version of GymSquire through the App Store, processes Apple In-App Purchases, manages Apple payment methods, processes Subscription purchases and renewals, administers certain refunds and cancellations, processes App Store account and device information, provides Subscription and transaction information to GymSquire, may provide platform analytics, and may notify GymSquire about purchases, renewals, expirations, billing failures, refunds and revocations. Apple independently processes relevant information under its own privacy policy and platform terms. GymSquire does not receive users’ complete Apple payment-card details.

9.2 Google

Google distributes the Android version through Google Play, processes purchases through Google Play Billing, manages Google payment methods, processes Subscription purchases and renewals, administers certain refunds and cancellations, processes Google Play account and device information, provides Subscription and purchase information to GymSquire, may provide aggregated or platform analytics, and may notify GymSquire about Subscription or purchase changes. Google independently processes relevant information under its own privacy policy and platform terms. GymSquire does not receive users’ complete Google payment-card details.

9.3 OpenAI

OpenAI supplies artificial-intelligence functionality used within GymSquire. Information submitted through AI-powered features may be processed by OpenAI to generate the response, analysis or verification requested by the user. This may include AI conversation content, uploaded food photographs, uploaded objective-verification photographs, fitness information, workout context, nutrition context and other information relevant to the request. GymSquire aims to minimise unnecessary personal information transmitted to OpenAI.

9.4 Supabase

Supabase may provide user authentication, database hosting, data storage, file-storage infrastructure, authentication logging, database backups, security logging and backend functionality. Supabase may process account identifiers, account information, authentication events, IP addresses, request metadata, security logs, stored application data and Subscription-entitlement information.

9.5 Cloudflare

Cloudflare may assist with network security, API security, website or service delivery, performance optimisation, malicious-traffic detection and denial-of-service protection. Cloudflare may process limited network and technical information necessary to provide those services.

9.6 OnSpace

GymSquire is developed and operated using technology provided through OnSpace. Depending on the technical configuration of the deployed application, OnSpace may provide application-development infrastructure, deployment services, hosting or runtime services, workflow functionality, API connectivity and technical support. Where OnSpace processes personal information belonging to GymSquire users, it may process only the information needed to provide the relevant technical service, subject to its applicable contractual terms and privacy documentation.

9.7 Google Workspace

GymSquire uses Google Workspace to receive and manage correspondence sent to team@gymsquire.co.uk. Google may process email addresses, sender and recipient information, email content, attachments and related email metadata.

9.8 Framer

The GymSquire website is hosted using Framer. Framer may provide website hosting, content delivery, website security, protection against malicious traffic and privacy-focused aggregated website analytics.

9.9 Other Providers

GymSquire may use additional providers where reasonably necessary to deliver requested features, maintain security, manage infrastructure, comply with legal obligations or provide customer support. Where a new provider materially affects how users’ personal information is processed, this Privacy Policy will be updated where appropriate.

10. International Transfers

Some GymSquire service providers operate internationally. Personal information may therefore be processed or stored outside the United Kingdom. Where personal information is transferred to a country that is not covered by applicable UK adequacy regulations, GymSquire will take reasonable steps to ensure that an appropriate transfer mechanism is used where required. Such mechanisms may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the European Commission’s Standard Contractual Clauses or another legally recognised safeguard. You may contact us for further information concerning safeguards relevant to your personal information.

10.1 Data Minimisation

When information is provided to a service provider, GymSquire aims to provide only the information reasonably necessary for that provider’s function. Apple and Google process payment and Subscription information but do not need users’ complete workout histories to process a purchase; OpenAI receives information relevant to the AI request but does not need complete payment-card details; customer-support providers receive information relevant to the user’s enquiry; and security providers process technical information needed to protect the Services.

11. Data Security

GymSquire implements reasonable technical and organisational measures designed to protect personal information against unauthorised access, accidental loss, misuse, alteration, disclosure, destruction and unlawful processing. Measures may include HTTPS/TLS, secure password hashing and authentication, encrypted database connections, secure cloud infrastructure, database access controls, restricted administrative access, role-based access controls, authentication logging, API security, network protections, denial-of-service protection, software updates, security monitoring, access reviews, row-level database security and encrypted backup procedures. Access is restricted to authorised persons and service providers who require it for legitimate operational, technical, support, security or legal purposes. No internet transmission or storage system can be guaranteed completely secure, so GymSquire cannot guarantee absolute security. Users are responsible for keeping passwords confidential, using strong unique passwords, protecting devices, logging out from shared devices and notifying GymSquire if they believe their account has been compromised.

11.1 Security Incidents

If GymSquire becomes aware of a personal-data breach, we will investigate it promptly. Where required by law, we will record the incident, notify the relevant supervisory authority, notify affected individuals, take reasonable steps to reduce potential harm and review relevant controls to reduce the likelihood of recurrence.

12. Data Retention

GymSquire retains personal information only for as long as reasonably necessary for the purposes for which it was collected, including providing the Services and complying with legal, accounting, tax, security and regulatory obligations.

12.1 Account Information

Account information is ordinarily retained while your account remains active or inactive. An inactive Subscription does not automatically cause deletion of the GymSquire account, allowing users to renew, restore purchases, regain saved progress or exercise privacy rights. Account information is deleted or anonymised following account deletion, subject to legal and backup-retention requirements.

12.2 Workout, Progress and Reward Information

Workout history, completed exercises, XP, achievements, objectives, personal records, reward eligibility and progress information are ordinarily retained while your account exists. This information is deleted or anonymised following account deletion, subject to legal and backup-retention requirements.

12.3 Subscription and Transaction Information

GymSquire may retain limited Subscription and transaction information after cancellation, expiration, refund or account deletion where necessary to administer purchase restoration, identify previous trials or offers, prevent fraud or repeated abuse, resolve payment disputes, support users, comply with tax or accounting obligations, maintain business records, or establish, exercise or defend legal claims. Apple and Google retain their own purchase and transaction records according to their respective obligations and policies.

12.4 AI Conversations

Visible AI conversation history and corresponding conversation records stored in GymSquire’s live database are ordinarily deleted within twenty-four hours. Deleted information may remain temporarily in encrypted backup copies until the applicable backup expires or is overwritten.

12.5 Uploaded Images

GymSquire’s copy of uploaded food photographs and objective-verification photographs is deleted promptly after processing has completed. Uploaded images are not intentionally retained as permanent account records.

12.6 Customer-Support Correspondence

Customer-support correspondence is ordinarily retained for up to two years after the relevant enquiry has been closed. It may be retained longer where necessary to resolve an ongoing dispute, investigate fraud or misuse, comply with legal obligations, or establish, exercise or defend legal claims.

12.7 Technical and Security Logs

Technical, authentication and security logs are retained only as long as reasonably necessary to protect accounts, maintain system security, diagnose technical issues, investigate incidents, prevent fraud and operate the Services. Where the applicable Supabase plan provides seven-day log retention, relevant logs are ordinarily retained for up to seven days unless longer retention is required for a security investigation or legal obligation.

12.8 Backup Copies

Where database backups are enabled, deleted personal information may remain temporarily within encrypted backup copies. Under GymSquire’s intended configuration, database backups are ordinarily retained for up to seven days before being automatically overwritten or deleted. Backups are used only for disaster recovery, business continuity, system restoration and security purposes. GymSquire does not ordinarily restore an individual user’s deleted account information from backup unless restoration is required to recover the wider service from a significant technical or security incident.

13. Your Rights

Depending on applicable law and circumstances, you may have the right to request access, correction, deletion, restriction, object to processing based on legitimate interests, receive certain information in a structured commonly used and machine-readable format where portability applies, withdraw consent, and lodge a complaint with the Information Commissioner’s Office or another competent supervisory authority. These rights are not absolute, and legal exceptions may apply.

13.1 Exercising Your Rights

To exercise a privacy right, contact team@gymsquire.co.uk. We may ask you to verify your identity before responding, such as through the email address associated with your GymSquire account or another proportionate verification method. We will respond within the time required by applicable law.

13.2 Withdrawing Consent

Where GymSquire relies on consent, you may withdraw that consent at any time. Withdrawal does not affect processing carried out lawfully before consent was withdrawn. Some features may become unavailable where they depend on information that GymSquire is no longer permitted to process.

13.3 Subscription Rights

Privacy requests do not automatically cancel an Apple or Google Subscription. Where you wish to stop future billing, you should separately cancel the Subscription through your Apple or Google subscription-management settings. Deleting your GymSquire account does not necessarily cancel a Subscription managed by Apple or Google.

14. Children’s Privacy

GymSquire is intended for users aged 13 years and above. Users are required to provide age or date of birth during registration so GymSquire can enforce the minimum age requirement, apply age-appropriate protections, provide appropriate explanations and comply with law. GymSquire does not knowingly permit children under 13 to create an account. If we become aware that a user under 13 has created an account, we will take reasonable steps to suspend or close the account, remove access, delete associated information where appropriate and comply with legal requirements.

14.1 Protecting Younger Users

Because GymSquire may be accessed by users under 18, we aim to consider their best interests when designing and operating the Services. Where appropriate, we seek to use clear age-appropriate privacy explanations, collect only information reasonably necessary for requested features, use privacy-protective settings, avoid unnecessary sharing, explain why sensitive information is requested, provide accessible deletion and privacy controls, avoid advertising profiling, avoid encouraging unnecessary disclosures, use appropriate safety controls for AI-generated content, and consider the potential effect of fitness, nutrition, calorie and weight-related recommendations on younger users. Children’s personal information receives additional protection under UK data-protection law and the Children’s Code.

14.2 AI and Younger Users

The GymSquire AI Coach provides educational fitness and nutrition information. It does not provide medical diagnosis, emergency advice, professional healthcare, prescriptions or personalised medical treatment. Users under 18 should involve a parent, guardian or appropriately qualified professional before making significant changes to exercise, calorie intake, diet, supplement use or injury and recovery management. Users should avoid sharing unnecessary personal information through AI conversations and image uploads.

14.3 Age Accuracy

Users must provide accurate age information. Providing false age information may result in account suspension or termination.

15. Marketing and Service Communications

GymSquire does not currently send promotional marketing emails or newsletters. GymSquire may send service-related communications where necessary to verify your email address, manage your account, provide security notifications, communicate important service changes, respond to support enquiries, communicate about subscriptions, communicate about purchases, refunds or restored purchases, or provide legally required notices. If GymSquire introduces promotional marketing communications in the future, we will provide any consent mechanisms and withdrawal options required by law.

16. Cookies and Website Technologies

The GymSquire website is hosted using Framer. GymSquire does not currently use advertising cookies, behavioural-tracking cookies, Google Analytics, Meta Pixel or third-party advertising technologies. Framer may process limited information or use technologies necessary for website delivery, website security, fraud prevention, protection against malicious traffic, maintaining website functionality and producing aggregated website statistics. Where strictly necessary security technologies are used, they may operate without optional marketing or advertising tracking. If GymSquire introduces optional analytics, advertising cookies or other non-essential technologies in the future, we will update this Privacy Policy and provide any consent controls required by law.

17. Account Deletion

GymSquire allows users to permanently delete their GymSquire account through the application. When an account is deleted, access ends, profile information is deleted from the live system, workout history is deleted from the live system, XP, achievements and objectives are deleted from the live system, saved preferences are deleted from the live system, remaining AI conversation records are deleted, remaining uploaded images are deleted where applicable, and the account cannot ordinarily be recovered. Limited information may be retained where necessary to comply with legal obligations, maintain accounting or tax records, prevent fraud, resolve disputes, enforce legal rights or establish, exercise or defend legal claims. Deleted information may remain temporarily in encrypted backups until those backups expire or are overwritten.

17.1 Account Deletion Does Not Cancel App Store Billing

Deleting your GymSquire account does not necessarily cancel a Subscription processed by Apple or Google. Before deleting your account, you should cancel your Subscription through the relevant Apple or Google subscription-management settings to prevent future renewal charges. GymSquire may provide instructions or links to assist with cancellation, but Apple and Google control their respective billing systems.

18. Changes to This Privacy Policy

GymSquire may update this Privacy Policy to reflect changes to the Services, new features, changes to Subscription systems, changes to providers, legal or regulatory developments, changes in technology, or improvements to privacy and security practices. The version number and last-updated date will be revised when the policy changes. Where a change materially affects users’ rights or how personal information is processed, we will take reasonable steps to notify users through the application, email or another appropriate method. The updated Privacy Policy will apply from the effective date shown in the revised version. Where required by law, we will obtain fresh consent before beginning new processing that depends on consent.

19. Contact Us

If you have questions about this Privacy Policy, how GymSquire processes personal information or your privacy rights, contact GymSquire, partnership operated by Will Morse and Joshua Weatherall. Business correspondence address: 82 Claude Road, Caerphilly, CF83 1GN, United Kingdom. Email: team@gymsquire.co.uk. We aim to respond to privacy enquiries promptly and within applicable legal time limits.

20. Complaints

If you believe GymSquire has handled your personal information improperly, you may contact us so that we can investigate your concern. You also have the right to complain directly to the relevant supervisory authority. For users in the United Kingdom, the supervisory authority is the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom. Telephone: 0303 123 1113. Contacting GymSquire first is not a requirement and does not affect your right to complain to the ICO. Submitting a privacy complaint does not affect any other legal rights or remedies available to you.

21. Summary of Our Privacy Commitments

GymSquire aims to collect only personal information reasonably necessary to provide and protect the Services, explain why personal information is collected, use appropriate security measures, avoid selling personal information, avoid behavioural advertising, process Subscription payments through Apple or Google without receiving complete card details, delete uploaded food and objective-verification photographs promptly after processing, delete GymSquire’s live AI conversation records after approximately twenty-four hours, provide accessible privacy controls, permit users to delete their GymSquire accounts, respect applicable data-protection rights, consider the interests of younger users, and review and improve privacy and security practices over time.