Privacy Policy

Effective date: September 21, 2026. Operator: Herculean Labs LLC.

This Privacy Policy explains how Gym Notes (“Gym Notes,” “we,” “us”), operated by Herculean Labs LLC (Twelve Trials Software), handles information when you use the Gym Notes mobile application and related cloud services.

Contact

Questions about privacy: [email protected]

Overview

Gym Notes works offline for core workout planning and logging. An optional account unlocks cloud AI Coach, subscriptions, and cloud backup. We do not use advertising SDKs, third-party product analytics, HealthKit, location, contacts, camera, or photo libraries.

Information we process

Account information

When you create an account: email address, password (handled by our authentication provider), and an account identifier. Session tokens are stored securely on your device.

Workout and app data on your device

Gym Notes stores on your device: workout plans and schedules, exercise templates and progression rules, workout history (including sets, reps, and weights), settings (such as units, appearance, rest-timer alerts, and daily reminder preferences), and—if you use AI Coach—local chat messages, coaching memories (for example equipment or limitations you share), and related local AI state.

Cloud backup

If you use cloud backup, we upload a compressed copy of your on-device database to private cloud storage. That backup can include your workouts, plans, settings, and local AI chats and memories. A small set of cache/meta tables is excluded from the backup file.

AI Coach

When you use AI Coach, your message and relevant workout context (such as current workout details, comparable history, and coaching memories you have stored) are sent through our backend to an AI model provider (OpenAI or a configured compatible provider) to generate a response. We also store usage and cost metadata for allowance limits, and may temporarily retain turn state needed to complete a coaching request. Turn records can retain conversation and workout context until you delete your account. Local chats and memories remain on your device unless included in a cloud backup.

AI Coach is a fitness coaching aid. It is not medical advice, diagnosis, or emergency assistance.

Subscriptions and purchases

Purchases are processed by Apple or Google through RevenueCat. We associate your subscription with your Gym Notes account identifier and store entitlement status (for example whether AI Coach or cloud backup is active, product identifiers, and billing period metadata). Pricing shown in the app comes from the store; we do not invent prices in this policy.

Notifications

Daily reminders and rest-timer alerts use local device notifications only. We do not register remote push notification tokens for Gym Notes reminders.

How we use information

• Provide and improve workout logging, planning, and progression
• Authenticate your optional account and sync entitlements
• Provide AI Coach responses and enforce usage allowances
• Store and restore cloud backups you request
• Process subscriptions and prevent abuse
• Respond to support requests you send us

Processors and service providers

• Supabase — authentication, database, file storage, and backend functions
• OpenAI (or a configured compatible AI provider) — model inference for AI Coach
• RevenueCat — subscription and entitlement management
• Apple App Store and Google Play — billing and subscription management
• Expo / EAS — app build and distribution infrastructure (not used as an end-user analytics product in Gym Notes)

Each provider processes data under its own terms and policies. Exact retention practices of third parties (including whether AI prompts are retained or used for training) are determined by those providers and are not fully controlled by Gym Notes.

Storage and security

Data in transit to our cloud services uses HTTPS/TLS. Cloud data stored with Supabase is encrypted at rest by that provider. This is not end-to-end encryption: our backend must process AI Coach requests and manage backups. No security measure is perfect.

Retention

• On-device data remains until you delete it, clear app data, or wipe the device after a successful in-app account deletion
• Cloud account data, AI turn/usage records, subscription entitlement mirrors, and backups are retained until account deletion (or earlier replacement of superseded backups)
• Provider operational backups and logs may persist for a limited time after deletion according to that provider’s practices; we do not claim immediate removal from every backup copy

Account deletion

You can delete your Gym Notes account in the app or on our Delete account page. Deletion removes your cloud account credentials, profile, subscription entitlement records we store, AI Coach turn and usage records, cloud backups for your account, and your RevenueCat customer record associated with Gym Notes. In-app deletion also wipes user-owned data on that device after the server confirms deletion. The website deletion flow deletes cloud data only; it does not erase workouts stored only on other devices.

Deleting your Gym Notes account does not cancel an Apple or Google subscription and does not delete Apple or Google store transaction records. Cancel subscriptions in your store account separately.

Your choices

• Use Gym Notes without creating an account
• Choose whether to use AI Coach, subscriptions, or cloud backup
• Control notification permission in your device settings
• Delete your account as described above
• Contact us at the email above for privacy questions

Children’s privacy

Gym Notes is not directed at children, and we do not knowingly collect personal information from children for Gym Notes accounts.

International processing

Our service providers may process data in the United States or other countries where they operate. If you use Gym Notes from another region, your information may be transferred to those locations.

Changes

We may update this Privacy Policy. The effective date above will change when we publish updates. Continued use after an update means you accept the revised policy.

What we do not claim

This policy does not claim HIPAA, GDPR, CCPA, SOC 2, or other regulatory certifications unless separately documented. Gym Notes is not a medical device and does not provide medical care.