gymal-legal

Gymal Privacy Policy

Last updated: September 2026

Gymal (“Gymal”, “we”, “us”, “the App”) is a fitness and gamification app operated jointly by Igal Mekonen and Yuval Shamis, individuals residing in Israel, who are joint controllers of your personal data under the GDPR (Art. 26) and the equivalent provisions of Israeli law. This Privacy Policy explains what personal data we collect when you use the App, how we use it, how we share it, how long we keep it, and what rights you have over it. If anything is unclear, or to exercise any of the rights below, contact us at gymonzapp@gmail.com.

1. Information We Collect

Information you provide directly:

• Email, display name / Tamer Name, password (hashed by Firebase Authentication — we never see plain-text passwords)
• Fitness profile: gender (male / female / prefer-not-to-say), height (cm), weight (kg), fitness level (beginner / intermediate / professional), and an initial body-fat percentage calculated automatically from those values. You may overwrite the body-fat estimate manually.
• Equipment availability, workout split preferences, custom workout programs
• Language and theme preferences
• Feedback or bug-report text you submit

Information generated through your use of the App:

• Workout history (exercises, sets, reps, weights, dates), cardio sessions, personal records, battle history, monster/Gymal data (names, levels, stats, happiness, inventory), Coins balance, achievement and challenge progress, streaks, friend relationships

Purchase-related information:

• A purchase token (Android) or original transaction identifier (iOS) supplied by Google Play Billing or Apple StoreKit, plus the resulting subscription tier, expiry, and auto-renew status. We do NOT receive your payment card number, billing address, or other payment details — those are handled exclusively by Google Play and Apple.

Health app data (optional, and off unless you turn it on):

• If you connect Health Connect (Android) or Apple Health (iOS), the App reads one value from it: your total step count for the current day. This lets steps recorded by a smartwatch or another fitness app count towards your Steps Expedition. We request no other health data type — no heart rate, workouts, calories, sleep, or body measurements — and we never write anything back to Health Connect or Apple Health. Your resulting daily step total is saved to your account, exactly as it already is when it comes from your phone’s own step sensor, so your Expedition progress and rewards persist; it is retained on the Steps-Expedition schedule in Section 10. The connection is entirely optional, you can revoke it at any time in Health Connect or in Settings › Privacy & Security › Health, and the Steps Expedition keeps working from your phone’s own sensor either way.

App analytics and advertising measurement:

• The App includes the Google Analytics for Firebase SDK, which records technical usage data and sends it to Google: app opens, session starts and length, screens viewed, in-app purchases, app version, device model, operating-system version, language, approximate country, and a Google-generated app-instance identifier. It does not read the contents of your workouts, your messages to other users, or your fitness profile.
• Advertising identifier. Where you permit it, the SDK also reads your device’s advertising identifier — the IDFA on iOS, the AAID on Android. On iOS this happens only if you tap “Allow” on the App Tracking Transparency prompt; if you decline, iOS supplies nothing and the App behaves exactly the same. On Android you can reset or delete the identifier at any time in Settings › Privacy › Ads.
• What it is for. We advertise Gymal on Google. This data tells us which campaigns actually bring people to the App and which of those lead to a subscription, so that we can stop paying for the ones that do not work, and Google uses it to optimise the delivery of those campaigns. We do not show ads inside Gymal.

We do NOT collect: precise or approximate location; any health-app data other than the daily step count described above (no heart rate, workouts, calories, sleep, or body measurements from Health Connect or Apple Health); any device-sensor data other than your step count; photos, microphone audio, or contacts; browsing activity outside the App; cookies or tracking pixels.

Consequences of refusing. Email, password, display name, and the fitness profile are required to register. Other information is generated only as you use the corresponding features.

2. How We Use Your Information & Legal Basis

Each purpose is matched to its lawful basis under the GDPR and the equivalent provisions of Israel’s Privacy Protection Law:

• Create and authenticate your account — performance of the contract.
• Personalize daily workouts and balance your Gymal’s stats using your fitness profile (gender, height, weight, fitness level, body-fat estimate). The body-fat starting value is calculated automatically from height/weight/gender/fitness level — the only automated decision the App makes about you, and one that does not produce any legal or similarly significant effect on you. Because the combination of gender, body-fat estimate, weight, and height may qualify as “special category” health/biometric data under GDPR Article 9, “sensitive personal information” under the CPRA, or “especially sensitive data” under Israeli law (Amendment 13), processing of this fitness profile is carried out exclusively on the basis of your explicit consent, given through the legal-consent screen at registration and reaffirmed each time you update your fitness profile in Settings — legal basis: GDPR Art. 9(2)(a) explicit consent (and equivalent provisions of Israeli and California law). You may withdraw this consent at any time by deleting your account; withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Track your progress (workouts, PRs, streaks, achievements, challenges, battle history) — performance of the contract.
• Enable social features (friends, leaderboards, rivals) — performance of the contract and our legitimate interest in providing a social experience.
• Process in-app purchases and verify subscriptions — performance of the contract.
• Send account-related emails (verification, password reset, security notices) — performance of the contract and our legitimate interest in account security.
• Respond to feedback and bug reports — our legitimate interest in operating and improving the App.
• Maintain platform safety: review and act on moderation reports submitted about other users — our legitimate interest in preventing harassment, abuse, and fraud on the platform.

• Comply with legal obligations and retain proof of consent — legal obligation.

• Measure and optimise our advertising — working out which Google Ads campaigns lead to installs and subscriptions, using the analytics and advertising-identifier data described in Section 1 — your consent. On iOS that consent is the App Tracking Transparency prompt; on Android it is your device-level advertising-ID setting. You may withdraw it at any time — on iOS in Settings › Privacy & Security › Tracking, on Android in Settings › Privacy › Ads — and withdrawal does not affect the lawfulness of processing carried out beforehand.

• Count steps from Health Connect or Apple Health towards your Steps Expedition, where you have connected one — your explicit consent, given in that platform’s own permission prompt and revocable there at any time without deleting your account. Step counts are health data under GDPR Article 9 — legal basis: GDPR Art. 9(2)(a) explicit consent (and equivalent provisions of Israeli and California law). Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

The analytics and advertising-identifier data described in Section 1 is used only to measure and optimise our own advertising for Gymal. Everything else we hold about you is excluded from advertising entirely: your fitness profile, workout and cardio history, body measurements, personal records, social activity, and any data read from Health Connect or Apple Health are never used for advertising or marketing, never sold, never shared with third parties, and never used to train machine-learning models. We do not sell your information, and we show no ads inside the App.

3. How We Share Your Information

Service providers (processors) acting on our behalf:

• Google Cloud / Firebase (Google LLC) — hosts Firestore (database) and Firebase Authentication.
• Cloudflare Workers (Cloudflare, Inc.) — runs our purchase-verification backend. Your device sends your account ID and the purchase token / original transaction identifier; the backend verifies with Google Play or Apple and writes the resulting subscription state to Firestore. It does not store data outside Firestore.
• Google Play Billing (Android) and Apple App Store / StoreKit (iOS) — process payments and provide purchase confirmations. They are the controllers of your payment data.
• Google Sign-In — if you sign in with Google, handles authentication; we receive only the basic profile (email, display name).
• Google Analytics for Firebase / Google Ads (Google LLC) — receives the analytics and advertising-identifier data described in Section 1, and reports back in aggregate how our advertising performed. Google acts as our processor for the analytics measurement itself, and as an independent controller when it uses that data to optimise ad delivery across its own network.
• Sign in with Apple (Apple Inc.) — if you sign in with Apple on iOS, handles authentication; we receive your Apple user identifier and the email address you authorize. If you use Apple’s “Hide My Email” feature, the address we receive is an anonymized Apple private-relay address (ending in @privaterelay.appleid.com) that forwards to your real inbox — we never see your real email address.
• Resend (Resend, Inc.) — our transactional email provider. It delivers our account emails (address verification, password reset, security notices) from noreply@gymalapp.com, and for that purpose receives your email address and the contents of those messages. It does not use your address for any other purpose.

Other users of the App:

• Friends you add can see your display name, avatar, monster roster, simple progress indicators (e.g., win streak), and aggregate stats. We never expose your email, password, workout details, settings, body measurements, or fitness profile to other users.
• Leaderboards may show your display name alongside an aggregate stat such as total power, level, or streak length.

Legal disclosure. We may disclose information if required by a binding legal request from a competent authority, or if necessary to protect rights and safety, in each case to the minimum extent legally required.

We do NOT sell, rent, or trade your personal information, and we do NOT share it with data brokers. The App contains no crash-reporting SDK. It does contain one analytics SDK — Google Analytics for Firebase — used solely for the advertising measurement described in Section 1. Because that measurement involves passing an advertising identifier to Google, it may count as “sharing” for cross-context behavioral advertising under California law; see Section 8.

4. Data Storage, Security & International Transfers

Your data is stored on Google Cloud Firestore. Google Cloud operates data centers worldwide. If you use the App from the EEA, UK, or Israel, your data may be transferred to and stored on Google Cloud servers outside your country of residence, including in the United States. Transfers are protected by:

• the European Commission’s Standard Contractual Clauses (SCCs) and/or the EU-U.S. Data Privacy Framework, as contracted between us and Google Cloud;
• equivalent transfer safeguards under the UK International Data Transfer Agreement (IDTA) and Israeli law.

Security relies on Firebase Authentication and Firestore: encryption in transit (TLS/HTTPS), encryption at rest, hashed and salted passwords, and Firestore security rules that limit each user to their own data.

No system is perfectly secure. We make a good-faith effort to safeguard your information but cannot guarantee absolute security. If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authorities and you in accordance with applicable law.

5. Your Rights

Wherever you live, you have the rights to:

• Access — request a copy of your personal data.
• Correction / rectification — change inaccurate data. You can change display name, email, fitness profile, and preferences directly in the App; contact us for other corrections.
• Deletion / erasure — delete your account and all associated data from Settings → Account → Delete account.
• Portability — request your data in a structured, machine-readable format.
• Restriction of processing — ask us to pause processing while we investigate a request.
• Objection — object to processing based on our legitimate interest (e.g., leaderboards).
• Withdraw consent — where processing is based on consent, you may withdraw it at any time.
• Lodge a complaint with your local supervisory authority (see Sections 6, 7, 8).

To exercise any right, email gymonzapp@gmail.com from the address on your account. We will respond within the time required by law — generally 30 days under GDPR and Israeli law, 45 days under CCPA.

6. EEA / UK / GDPR Rights

If you are in the EEA, UK, or Switzerland, GDPR / UK GDPR gives you the rights in Section 5, plus:

• The right to lodge a complaint with your local Data Protection Authority. EU authorities are listed at edpb.europa.eu. UK users may contact the ICO at ico.org.uk.
• The right to be informed of the lawful basis for each purpose (Section 2) and of international transfers and their safeguards (Section 4).

EU Representative (GDPR Art. 27): [EU REPRESENTATIVE TBD — appointment in progress. Until completed, EEA/UK users may direct questions to gymonzapp@gmail.com.]

7. Israeli Privacy Rights

If you are located in Israel, your data is processed in accordance with the Protection of Privacy Law, 5741-1981, as amended (including Amendment 13, in force from August 14, 2025). You have the rights in Section 5. In addition:

• You may lodge a complaint with the Israeli Privacy Protection Authority (PPA), Ministry of Justice — gov.il/en/departments/the_privacy_protection_authority.
• You have the right to be informed of collection purposes, data recipients, and consequences of refusal — set out in Sections 1, 2, and 3.

Data Protection Officer (DPO): [DPO TBD — appointment in progress under Amendment 13. Until completed, Israeli users may direct questions to gymonzapp@gmail.com.]

8. California Privacy Rights

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) gives you these additional rights.

Categories of personal information we collect (using CCPA’s defined categories). The categories below describe the personal information we have collected, used, and disclosed for a business purpose in the preceding 12 months. We have never sold personal information, and we do not sell it now (CCPA §1798.115).

Sharing for cross-context behavioral advertising. From September 2026 the App passes your device’s advertising identifier, together with the app-usage data described in Section 1, to Google so that we can measure our advertising campaigns. Under the CPRA’s broad definition this may qualify as “sharing” — not as a sale, since we receive no money for it, but it is a disclosure for cross-context behavioral advertising and we describe it as sharing rather than argue the point. It applies only to that advertising identifier and the technical usage data in Section 1; no other category below is ever shared for advertising.

• Identifiers — email (if you use Sign in with Apple’s “Hide My Email”, this is an anonymized Apple private-relay address ending in @privaterelay.appleid.com), account ID, display name, and — if you sign in with Apple — the Apple user identifier linked to your account. Where you have permitted it, also your device’s advertising identifier (IDFA / AAID) and the Google app-instance identifier — the only identifiers in this list that are ever shared for advertising
• Customer records — password (hashed), fitness profile
• Commercial information — purchase history, subscription tier, Apple original transaction identifier (iOS) or Google Play purchase token (Android)
• Internet activity — your in-App activity, including the technical app-usage data (app opens, session length, screens viewed, app version, device model) that Google Analytics for Firebase records as described in Section 1 (we do NOT collect external browsing)
• Inferences — the body-fat starting estimate computed from your fitness profile

Sources: directly from you; generated by your use of the App.

Business purposes: as set out in Section 2.

Sensitive Personal Information. Your gender and the body-fat estimate may qualify as Sensitive Personal Information under CPRA. We use this information solely to provide the App’s core service (personalizing workouts and balancing Gymal stats) and for no other purpose. Because we only use SPI for permitted business-service purposes, we are not required to offer a “Limit the Use of My Sensitive Personal Information” link.

Subscription and purchase data linked to your account. When you purchase a subscription, your purchase history, subscription tier, expiry, auto-renew status, and the Apple original transaction identifier (iOS) or Google Play purchase token (Android) are linked to your account ID in our database. Apple App Store guideline 5.1.1(i) and the CPRA require us to make this linkage explicit so that you understand subscription and transaction data are not anonymous in our system, even though we never see your payment card or billing address (those remain with Apple or Google). Purchase data is treated as “Commercial information” under the CCPA and is subject to all rights described in this Section 8.

Your rights: to know, delete, correct, opt out of sharing, and non-discrimination. You will not be denied service or charged differently for exercising any right — the App is fully functional whether or not you allow advertising measurement.

How to opt out of sharing. You control this on the device, and the control is absolute — if you decline, no advertising identifier reaches Google at all:

• iOS — decline the App Tracking Transparency prompt, or turn Gymal off at any time in Settings › Privacy & Security › Tracking.
• Android — Settings › Privacy › Ads › Delete advertising ID.

You may also email gymonzapp@gmail.com and we will action the request for your account.

To submit a request: email gymonzapp@gmail.com. We verify identity by confirming you can receive mail at the account email. Authorized agents may submit requests with proof of authorization.

9. Children’s Privacy

Gymal is not intended for and is not directed to children under 13. We do not knowingly collect personal information from anyone under 13. During registration, users confirm they are at least 13.

Notice for EEA / UK users. Under GDPR Article 8, the digital age of consent for online services varies by member state (13 to 16). In Germany, the Netherlands, and Luxembourg the age is 16; in France, 15; in Austria, 14. If you are below the digital age of consent in your member state, do not use the App without the consent of the holder of parental responsibility. We encourage parents to review this policy with their child.

If you believe a child under the applicable age has provided us data, contact gymonzapp@gmail.com and we will delete it promptly.

10. Data Retention

We retain most of your data for as long as your account is active. As an exception, four kinds of history are deleted automatically on a rolling schedule based on your subscription tier, even while your account stays active: your workout logs, your cardio-session logs, your rivals (battle) history, and your Steps-Expedition logs. Each such record is stamped with an expiry date when it is created, and is then pruned automatically by our database once that date passes. On the Free tier, all four are kept for about 1 week; on the Pro tier, all four are kept for 1 year; on the Max tier they are kept for as long as your account exists. This automatic clean-up removes only old history entries — it does not affect your account, your Gymals, their stats, your personal records, streaks, or lifetime totals.

When you delete your account from within the App:

• Account profile, monsters, workouts, cardio, achievements, inventory, friends, battle history, personal records, custom programs — deleted from our database immediately on request. Backups and replicas may retain copies for up to 30 days before being overwritten.
• Subscription state — deleted with your account. Cancellation behavior is platform-specific (see our Terms of Service Section 3): on Android, we send a best-effort server-side cancellation request to Google Play on account deletion; on iOS we have no ability to cancel and you must cancel through Apple’s subscription settings yourself.
• Legal-consent records (proof you accepted our Terms and Privacy Policy at registration: email, display name, consent type and version, timestamp) — retained up to seven (7) years after account deletion, for the purpose of defending legal claims and complying with legal obligations. After seven years they are deleted, unless we are subject to a litigation hold. Legal basis: our legitimate interest in defending legal claims and our legal obligation under Israeli and EU/UK law.
• Feedback and bug reports you submitted — retained indefinitely after account deletion, in anonymized form where reasonably possible, for the purposes of reviewing reported issues, identifying abuse patterns, and improving the App. Legal basis: our legitimate interest in operating a safe and functional service.
• Moderation reports submitted about other users (Settings → Report user) — retained indefinitely after account deletion. These records are write-only from the user side and cannot be retrieved or deleted by clients, so that bad-faith deletions cannot erase a history of misconduct. Legal basis: our legitimate interest in maintaining platform safety and preventing harassment / abuse, and our legal obligation to maintain records of moderation decisions.
• Purchase ledger entries (in the purchaseLedger collection, written by our purchase-verification backend on each transaction: purchase token / original transaction identifier, product, timestamp) — retained for seven (7) years after the corresponding subscription ends or account is deleted, for tax, audit, anti-fraud, and refund-dispute purposes. Legal basis: our legal obligation under tax and consumer-protection law and our legitimate interest in fraud prevention.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last Updated” date at the top. Material changes will be announced in the App or by email at your account address before the change takes effect. Continued use after the effective date constitutes acceptance.

12. Contact

Email: gymonzapp@gmail.com

Joint Controllers: Igal Mekonen and Yuval Shamis, Israel (individuals / joint developers). A Data Protection Officer (for Israeli law) and an EU Representative (for the GDPR) are being appointed. Until appointments are complete, please use the email above and we will respond within the time required by applicable law.