Privacy Policy
Last updated: 19 October 2026
The short version: we only collect what GymPlan needs to work. We don’t sell your data, we don’t show ads, and we don’t use advertising trackers. You can delete your account and all of its data at any time from Profile → Settings → Account.
1. Who we are
GymPlan (gymplan.site) is a workout planning and tracking web app. GymPlan is the data controller for the personal data described here. Contact us about privacy at support@gymplan.site.
This policy is written to meet the Turkish Personal Data Protection Law No. 6698 (KVKK) and the EU General Data Protection Regulation (GDPR).
2. What we collect and why
| Data | Why we use it | Legal basis |
|---|---|---|
| Email address and password (the password is stored only as a secure hash by our login provider) | To create your account, sign you in, and send account emails (confirm your email, reset your password) | Performing our contract with you |
| Workout data you enter: routines, exercises, weights, completed workouts, notes, settings, and exercise photos you upload | To show, save and sync your workouts across your devices | Performing our contract with you |
| Body weight and body-weight goal (only if you choose to enter them) | To show your weight progress | Your explicit consent, given by entering it. You can delete it any time. |
| Technical data: app version, chosen theme, the last time the app saved, and which days your account opened the app | To keep the app working, spot people stuck on an old version, and count daily active users | Our legitimate interest in running and improving GymPlan |
| Anonymous daily totals (for example, how many times the welcome screen was opened that day) | To understand how many visitors create an account. These totals contain no name, email, or device ID. | Our legitimate interest |
| Server logs kept by our host, including IP address and browser type | Security, preventing abuse, and basic visitor statistics | Our legitimate interest |
| Subscription details, if you buy a paid plan (plan, status, renewal date) | To give you the paid features you bought | Performing our contract with you |
If you use GymPlan without an account, your workouts are saved only in your browser on your device and are not sent to us. If you later create an account, they are moved into it.
We do not collect your card or bank details. Payments are handled by our payment provider (see section 4).
3. Storage on your device
GymPlan saves your workouts and settings in your browser’s storage so the app works offline at the gym, and stores your sign-in session there. These are strictly necessary for the app to work. We don’t use advertising or cross-site tracking cookies.
4. Who we share data with
We use these service providers to run GymPlan. They only process data on our instructions and to provide their service:
- Supabase: account login and database. Your account data is stored in the European Union (Frankfurt, Germany).
- Netlify: website hosting and server logs (United States).
- Resend: sending account emails such as confirmation and password reset (United States).
- Polar: if you buy a subscription, Polar processes the payment as the merchant of record and handles payment details, invoices and sales tax.
- Google Fonts, esm.sh / jsDelivr, and GitHub: deliver the app’s fonts, code library and exercise-library photos. Like any website, they receive your IP address when your browser loads these files.
We never sell your personal data or share it for advertising. We may disclose data if the law requires it.
5. International transfers
Some providers above are located outside Turkey and the EU, for example in the United States. Where this happens, we rely on the safeguards the law allows, such as the European Commission’s Standard Contractual Clauses, and, for transfers from Turkey, the safeguards required by Article 9 of the KVKK.
6. How long we keep data
- Account and workout data: until you delete your account. Deleting your account removes it from our live database straight away. Copies may stay in our providers’ backups for a short time before they are overwritten.
- Daily activity records: while your account exists.
- Server logs: for the period our host keeps them, normally no longer than about 30 days.
- Payment records: as long as tax and accounting laws require.
7. Your rights
Under the KVKK (Article 11) and the GDPR you can:
- find out whether we process your data, and get a copy of it;
- have wrong data corrected;
- have your data deleted (you can do this yourself in the app at any time);
- object to or restrict some processing, and withdraw consent you gave (for example, by deleting your body-weight entries);
- receive your data in a portable format;
- learn who your data was shared with, including abroad;
- complain to a data protection authority: in Turkey, the Personal Data Protection Authority (KVKK); in the EU, the authority in your country.
To use any of these rights, email support@gymplan.site from the email address on your account. We reply within 30 days.
8. Security
Connections are encrypted (HTTPS). Database security rules allow each account to read and change only its own data, and passwords are stored only as secure hashes. No system is 100% secure, so please use a strong password that you don’t use anywhere else.
9. Age
GymPlan is for people aged 16 and over. If you believe a child under 16 has given us personal data, contact us and we will delete it.
10. Changes to this policy
If we make important changes, we will update the date at the top and tell you in the app. Using GymPlan after a change means the updated policy applies.
11. Contact
Questions or requests: support@gymplan.site