GymBro Privacy
Last updated: 22 September 2026 · Controller: Henrik Peperkorn, address see legal notice · hello@gymbro3000.com
In short
The GymBro 3000 app does not collect any data about you. There is no account, no server of ours, no advertising and no analytics. Your training data lives on your devices and – if you use iCloud – in your private iCloud. We cannot see it. This website uses no cookies and no tracking. We process personal data in two places only: the server logs when you visit this site, and your email if you write to us. Both are covered below.
The app
Training data
Plans, exercises, sets, weights, reps, notes and, if you enter it, your body weight. You enter it; it is stored on your iPhone, your Apple Watch and, if you use it, your Mac. With iCloud enabled, the app syncs it between your devices through your private iCloud database (Apple CloudKit). Only your Apple Account can access that database; Apple's privacy policy applies to iCloud.
Health data (Apple Health)
During a workout, the app on Apple Watch reads your heart rate and active calories to show them on the watch. When the workout ends, it saves the session to Apple Health as a strength training workout so it counts towards your rings. Heart rate and calories are not stored by the app and never leave your devices; the app keeps only the identifier of the Health workout to avoid duplicates. Access requires your permission, which you can revoke in the Health app at any time. Health data is never used for advertising, never used to evaluate you, and never shared with third parties.
Purchase (GymBro Pro)
Apple handles the purchase through the App Store. We receive neither payment details nor your name – only the anonymous purchase confirmation on your device that unlocks Pro. Apple provides us with aggregated, anonymous figures (downloads, sales), not information about individuals.
Import and export
You create export files yourself and decide where they go. Imported files are read on the device only.
Notifications
The rest timer uses local notifications and a Live Activity on your device. There is no push server.
Crash reports
We receive them only if you have allowed Apple to share them with developers (Settings → Privacy & Security → Analytics & Improvements). They contain no training or health data.
What the app does not do
No tracking, no advertising identifiers, no sharing with third parties, no linking with other services, no AI services, no profiles.
This website
gymbro3000.com is a static site without cookies, tracking tools or embedded third-party content; even the fonts are served from our own host. It is hosted by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus (EU), on servers in the European Union. When you visit, Hostinger processes on our behalf technically necessary access data – IP address, time, requested page, browser – in server logs to deliver the site and protect it from attacks. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR); logs are kept only as long as needed for that and then deleted. In Hostinger's control panel we see these logs and the figures summarised from them – requests, bandwidth, the number of distinct IP addresses and the country they came from. Nothing runs on your device for this either and nothing is stored there; we build no profiles from it and combine it with nothing. The legal basis is the same legitimate interest in secure operation that meets demand (Art. 6(1)(f) GDPR). A data processing agreement under Art. 28 GDPR is in place with Hostinger; Hostinger uses sub-processors (including Cloudflare), and transfers to third countries rely on the EU Standard Contractual Clauses. Details: Hostinger's privacy policy.
Email to us
If you write to hello@gymbro3000.com – for support, a bug report or a privacy request – we process your email address, your name as far as you give it, and the content of your message in order to answer you. The legal basis is our legitimate interest in answering your request (Art. 6(1)(f) GDPR); where the request concerns a contract or steps prior to it, it is Art. 6(1)(b) GDPR. The mailbox is held by Hostinger International Ltd. (address above), acting as a processor under Art. 28 GDPR, on servers in the European Union. Your message goes no further. We delete the correspondence once your matter is settled and no statutory retention period applies – at the latest after two years. You can also reach us by post; the address is in the legal notice.
Retention and deletion
Your data stays until you delete it – individual entries in the app, everything at once by deleting the app (device) and its iCloud data (Settings → [your name] → iCloud → Manage Storage → GymBro 3000). Health entries are deleted in the Health app. Permissions (Health, notifications) can be revoked in the iOS or watchOS settings.
Your rights
You have the right to access the data we hold about you (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to data portability (Art. 20). What sits in the app and in your iCloud is not ours – you see, change and delete it yourself on your devices, at any time and without us. So this concerns the server logs of this website and any email you have sent us. A message to hello@gymbro3000.com is enough; we answer within one month.
Right to object: on grounds relating to your particular situation, you may object at any time to processing we base on a legitimate interest (Art. 21(1) GDPR) – that is the server logs and answering your email. We will then stop processing unless we can demonstrate compelling legitimate grounds. We do no direct marketing.
You may also lodge a complaint with a supervisory authority (Art. 77 GDPR), for example the one responsible for us, the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, Germany.
There is no automated decision-making or profiling under Art. 22 GDPR. You are not required to provide any data; without an email address we simply cannot answer a request.
Changes
If the app or this website changes, this policy changes with it. The current version is always available at this address; the date above shows its status.