PRIVACY POLICY

MAKINGAPPS LLC operates GYMDONE (also called Gym Done) and is responsible for the personal information described in this policy. In this policy, "we", "us", and "our" refer to MAKINGAPPS LLC. This Privacy Policy explains how we collect, use, store, protect, and share personal information when you use our fitness apps, gymdone.com, and related services. GYMDONE provides workout planning, fitness profiles, and progress tracking. For questions about this policy or your personal data, contact [email protected].

Information You Provide and How We Use It

Account information includes your name, email address, and the sign-in information needed to create and manage your account. We use it to authenticate you, provide account support, and send account, security, and service communications. If you contact support, we also process your message and information you provide to resolve your request.

Depending on the features you use, you may provide your gender, age or age range, country, height, weight, fitness level, training goals, available equipment, exercise or muscle-group exclusions, workout schedule, workout logs, meal logs, and progress. We use this information to personalize training plans and display your fitness history. Some of this information may reveal information about your health. You may choose not to provide optional information, but the related personalization or tracking features may be limited.

When you buy Premium, we process account and transaction information needed to identify your purchase, activate access, manage your subscription, and handle billing questions or refund requests. Payment details are collected by the payment provider handling your purchase, such as Stripe, Apple, or Google, under that provider's terms and privacy policy. Refunds and cancellation are described in our Terms of Use.

Legal Bases for Processing

Where the GDPR or similar laws apply, we rely on the following legal bases according to the purpose of the processing: performing our contract with you to provide your account, requested fitness features, and paid access; our legitimate interests in protecting accounts, preventing fraud, and maintaining and improving the service, where those interests are not overridden by your rights; and legal obligations, such as retaining records required for accounting or responding to lawful requests.

Where consent is required for optional integrations, the processing of health information, or promotional communications, that processing requires your consent, including explicit consent for health information where applicable. You can withdraw consent by changing the relevant permissions or contacting [email protected]. Withdrawal does not affect the lawfulness of processing before withdrawal, but may prevent us from providing the feature that depends on it. Accepting our Terms of Use does not by itself constitute consent to every optional use of your data.

Sign in with Google: Data We Access and Collect

If you choose Sign in with Google, Google sends us a signed identity token so we can verify your identity. This token contains your Google account identifier, email address and email verification status, and basic profile information such as your name and profile picture, when available. We process this information to authenticate you. We save your email and available name and profile picture information in your GYMDONE account when you register, and use your verified email to recognize an existing account when you sign in again.

GYMDONE does not receive your Google password. Sign in with Google does not give us access to your Gmail messages, Google Drive files, contacts, or calendar. Connecting Apple Health or Health Connect is a separate, optional action with its own permissions; signing in with Google does not grant access to health data.

How We Use Google User Data

We use Google account information to create or sign you into your GYMDONE account, display your profile, associate your workouts and preferences with your account, and provide account support and service communications. Your Google identity token is used to verify the sign-in request; GYMDONE then issues its own session token to keep you signed in.

We do not sell, rent, or trade Google user data. We do not use it for personalized advertising, retargeting, or training generalized artificial intelligence or machine learning models. GYMDONE's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Sharing and Disclosure of Information

We do not sell, rent, or trade personal information. We use service providers to operate GYMDONE, including hosting and infrastructure, authentication, payment processing, website analytics, and customer support. These providers receive information needed for their role in providing the service. Our website uses DataFast and Know for website usage analytics, and subscription checkout uses Stripe for payment processing.

For Google user data, sharing is limited to what is necessary to provide or improve the GYMDONE features you use, such as hosting your account information and handling account support, or to meet applicable legal obligations and protect against fraud or security threats. We do not share Google account information with advertising networks or data brokers. Google processes your sign-in under its own Privacy Policy.

If you choose to share a workout or fitness results with other people or through a social platform, the information you include becomes visible to the recipients you select. Sharing is optional; signing in with Google does not publish your profile or workouts to other users.

International Processing

GYMDONE uses third-party services, including the providers described above, that may process information in countries other than the country where you live. Data protection laws can differ between countries. Where applicable law requires a legal transfer mechanism or additional safeguards, those requirements apply to the transfer. To ask where information about your account is processed and which transfer safeguards apply, contact [email protected].

Health Data Usage (Apple Health & Health Connect)

Apple Health (HealthKit): If you choose to connect Gym Done with Apple Health, we may access health-related information such as workout sessions, body metrics, activity levels, and energy data. This data is exclusively used within the app to tailor your training plans and monitor your fitness progress. We strictly follow Apple's developer guidelines for handling HealthKit data and do not use this information for marketing or advertising.

Android Health Connect: If you enable Health Connect integration on Android, Gym Done may read health data like exercise sessions, calories burned, weight, height, and similar metrics. This data is used only to power personalized training features and fitness insights. We do not share this data with third parties or use it for marketing. Our integration is compliant with Google's Health Connect Permissions Policy and adheres to its Limited Use policy.

You control these permissions in Apple Health or Android Health Connect settings and can revoke them at any time. Revoking permission stops future access through that integration. To request deletion of health information already held by GYMDONE, contact [email protected].

Data Storage and Security

Account information, including the Google profile information described above, is stored in GYMDONE's backend systems so you can access your account and saved fitness information across sessions. The website stores a GYMDONE session token in your browser's local storage to keep you signed in; signing out removes that token from the browser.

We use HTTPS to encrypt information in transit and authentication checks to protect account access. We verify Google identity tokens before accepting a Google sign-in. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Data Retention

We retain personal information, including information received through Google sign-in, for as long as needed to provide your account and the services described in this policy. Retention depends on the type of information and its purpose, including account operation, support, security, and any applicable legal or accounting requirements. When information is no longer needed for those purposes, we delete it or anonymize it.

Account and fitness records support your saved profile and history; support correspondence is retained as needed to handle and document requests; and transaction records may need to be kept for applicable accounting requirements or payment disputes even after an account is deleted. Retention is assessed by the purpose of each category, rather than a single period for all data. You can contact us for information about retention applicable to your account, including any residual backup copies and exceptions to deletion.

Request Account or Data Deletion

You can request deletion of your GYMDONE account and associated personal information, including Google profile information, by emailing [email protected] from the email address associated with your account. Please state that you want to delete your account. We may need to verify your identity before acting on a request. Any information retained to meet legal obligations or resolve disputes is limited to what is necessary for that purpose.

You may also request deletion of specific personal information without requesting deletion of the entire account. Tell us which information your request concerns. We will respond within the period required by applicable law and explain any applicable exception or permitted extension. If you no longer have access to your account email, contact us to discuss another way to verify your request. Please do not send your password or full payment-card details with a request.

Account deletion, subscription cancellation, and a refund are separate requests. To stop future charges, cancel a website subscription through Profile → Manage Subscription, or manage an Apple or Google subscription in the store where you purchased it. If you cannot access these controls, contact [email protected] for help. Tell us about an active subscription when requesting account deletion so we can explain how billing and deletion will be handled. See our subscription terms.

Revoking Google Access

You can review and remove GYMDONE's connection in your Google Account connections settings. Removing the connection does not automatically delete your GYMDONE account or information already stored by GYMDONE. To delete that information, use the deletion request process above. Signing out of GYMDONE or uninstalling the app also does not delete your account.

Cookies and Browser Storage

When you visit Gymdone.com or related services, we may send one or more cookies to your browser to help recognize you, improve navigation, and enhance your experience. You can manage or disable cookies through your browser settings, but some site features may not function properly if cookies are disabled.

Log File Information

When you access the website or app, our servers may automatically log standard information sent by your browser, such as IP address, browser type, pages visited, timestamps, and device data. This helps us improve performance and troubleshoot issues.

User Rights (GDPR / CCPA)

Depending on your location and the applicable law, you may have rights to know about and access your personal information, correct inaccuracies, request deletion, receive a portable copy, restrict processing, or object to processing based on legitimate interests. You may withdraw consent where processing is based on consent, and object to direct marketing. These rights are subject to applicable conditions and exceptions. To make a request, email [email protected].

We may ask for information needed to verify your identity or an authorized representative's authority, where applicable. We will not discriminate against you for exercising applicable privacy rights. You may also complain to your local data protection authority. If you are in the European Economic Area, you may contact the authority in your country of residence, work, or the place of an alleged infringement; in the United Kingdom, you may contact the Information Commissioner's Office. You do not have to contact us before making a complaint to an authority.

Children's Privacy

Gym Done is not intended for individuals under 13 years of age. We do not knowingly collect data from children under 13. If we learn that personal data has been collected from a child under 13, we will promptly delete it.

Users aged 13 to 17 may use the Services only with a parent or legal guardian's involvement as described in our Terms of Use. Where local law requires parental consent to process a minor's information, the relevant processing requires that consent. A parent or guardian can contact [email protected] about a child's information or to request its deletion.

Updating or Editing Information

Users can update their personal data by logging into their account and accessing profile settings. You can unsubscribe from promotional messages via the link in those messages. We may still send necessary account, security, or service communications.

Links to Other Sites

Gym Done may contain links to third-party websites. We are not responsible for the privacy practices or content of those third parties. Please review their policies separately.

Privacy Policy Changes

We may update this Privacy Policy as our services or data practices change. We will publish updates on this page. If we materially change how we use personal information, including Google user data, we will notify affected users through the app or email and request consent where required before using their data for a new purpose. You may contact us with questions at [email protected].