Gainz Privacy Policy

2: Personal data we collect about you#

The personal data we collect about you depends on which of our services you use. We will collect and use the following personal data about you:

• your account details: your name, email address, password (if you sign up with email) or your Apple or Google sign-in identity, profile photo, language and time zone
• the answers you give when you set up the App: gender, age or date of birth, height, weight, goals, training experience, training days, activity level, health issues and injuries, strength benchmarks and sport
• what you record in the App: workouts, plans, food and nutrition logs, and the barcodes you scan
• Apple Health (iPhone) or Health Connect (Android) data, if you allow it: we read your height and weight, and we write your finished workouts, height and weight back. We read nothing else
• Photos: up to five photos for each body scan, the optional body photo you add during setup for the transformation preview, meal photos, and profile and coach images
• your messages to the Coach, which we store on our servers so that your conversation is restored if you sign in on a new device
• the description, appearance and gender you choose when you design a coach in the App
• your purchases: which subscription you bought, when, its status and your receipts
• identifiers: your Gainz account ID, the IDs our service providers give your device (for example AppsFlyer’s ID), your device’s identifier for vendors, your IP address, and your device’s advertising identifier: on iPhone (the IDFA) only if you allow tracking, and on Android (the Android advertising ID) unless you have deleted it or turned it off
• your device’s push notification token and whether you allowed notifications
• how you use the App: screens you view, features you use, how you signed up and logged in, errors, crash reports and performance data
• if you use the coach line: your phone number, every message between you and the Coach, your answers to the Coach’s questions (your goal, days per week, equipment and injuries), the Coach’s running notes about you, the times of your messages, and, if you pay, your Stripe customer and subscription references and the date you paid (see 5.1)
• if you share your progress to TikTok: the progress card you chose to share, and the login tokens TikTok gives us
• on our website: your sign-in, how you use the website (see 9 Cookies), and the phone number and consent you give on our text-coaching sign-up form
• if you apply to our creator programme on our website: the details in section 5.3
• payment details: when you pay through Stripe you enter your card and billing details on Stripe’s page. We do not see or store your full card number
• details of any information, feedback or other matters you give to us by email or through our website

The App does not record your voice. If you apply to our creator programme on our website you can upload a voice sample (see 5.3). Photos can contain location data that your phone adds to the file. We remove it from new body-scan photos, but older body-scan photos, and other photos you upload, may still contain it.

You must provide your account details to use the App. Most other information is optional, but the Coach cannot personalise its advice without it.

Sometimes you can choose if you want to give us your personal data and let us use it. Where that is the case we will tell you and give you the choice before you give the personal data to us. We will also tell you whether declining to share that personal data will have any effect on the provision of our services.

We collect and use this personal data for the purposes described in the section How and why we use your personal data below.

4.2: How and why we use your personal data—Special category personal data#

Certain personal data we collect is treated as a special category to which additional protections apply under data protection law:

• your Health Data, including what we read from Apple Health or Health Connect and health information you send the Coach in a message
• Photos of you, which may reveal your race, ethnic origin or a health condition

We use this data to provide our services to you, and we rely on your explicit consent to do so (Article 9(2)(a) UK GDPR). You can withdraw your consent at any time by deleting the information, turning off our App’s access in Apple Health or Health Connect, or deleting your account. Without this data the Coach cannot personalise its advice.

We also use your goals, training experience, training days and activity level for product analytics, and send them to PostHog linked to your account ID (see 4.1 and 6.1). PostHog keeps them after you delete your account unless you ask us to have them deleted (see 7.1).

We do not use Health Data, Apple Health data or Photos for advertising, and we do not sell them.

4.3: Artificial intelligence: who receives your data#

The Coach is AI software. It is not a person. To write its replies and plans, analyse your photos and create images, we send your personal data to third-party AI services. This section tells you what we send and who receives it.

What we send. When you chat with the Coach, in the App or on the coach line after you link your account, each request includes your name, age (worked out from your date of birth), gender, activity level, bio, height and weight (including values read from Apple Health or Health Connect), your latest body-scan summary, your current workout and nutrition plans, your setup answers, your strength benchmarks, what you have eaten today, your conversation with the Coach and any photo you attach. If you connected a wearable before 13 August 2026, each chat request can also include a summary of the wearable data we hold: your average steps, resting heart rate, last night’s sleep and workouts from the past week, where we have any, and the latest weight your device recorded. A body scan sends up to five photos. A meal scan sends your meal photos. On the coach line, before you link an account, we send your thread, your answers to the Coach’s questions and the Coach’s notes about you. None of this is anonymised.

Who receives it.

• OpenRouter, an AI gateway. We send the Coach’s chat, plans, scans, notifications and notes, and the transformation preview, to OpenRouter, which passes each request to the model we ask for. We do not choose which host OpenRouter uses to run that model: it may be the company that made the model or another company that runs the same model. Fal.ai and ElevenLabs receive our requests directly, not through OpenRouter, and if OpenRouter cannot create your transformation preview we may send the same photo and description directly to Google’s Gemini API.
• Anthropic (Claude models): the Coach’s chat, plans, coaching notifications and notes, and every request that includes a photo (chat with a photo, meal scans and body scans).
• DeepSeek: may write the Coach’s chat, in the App and on the coach line, and may answer other requests that contain no photo. OpenRouter can send these requests to any of the hosts that run DeepSeek models, and those hosts include companies based in China.
• OpenAI (GPT-4o models): may answer any request, including one with a photo, if the first model we ask is unavailable.
• Google (Gemini image model): the body photo you add during setup, with a description of the change, to create your transformation preview, through OpenRouter or, if that fails, directly.
• Fal.ai: creates the transformation preview from the same photo if Google’s model fails, and creates coach images from the description, appearance and gender you choose when you design a coach.
• ElevenLabs: reads the Coach’s workout cues aloud. These are fixed phrases and contain no personal data. Where voice notes are switched on for the coach line, ElevenLabs also receives the text of one part of a Coach reply to read it aloud. We never send a voice note to anyone we know to be under 18.

To find exercise videos, an AI model writes a search term from the exercise name and we search YouTube with it. That search contains no personal data.

What they do with it. The AI providers process your data to answer our request and send the answer back to us. We have not switched on OpenRouter’s settings that opt out of provider data collection or require zero data retention, so a provider may keep and use our requests as its own terms allow. We will update this section if we change those settings. We do not train AI models on your personal data.

Your choices. You do not have to upload photos or give us optional information. If you do not want your data sent to AI providers, do not use the Coach: it cannot work without them. We may change the AI providers we use, and we will update this section when we do.

4.4: How and why we use your personal data—sharing#

See Who we share your personal data with for further information on the steps we will take to protect your personal data where we need to share it with others.

5: Marketing#

We may send you news and offers about Gainz by email. We do this only where you have agreed to it, or where you have bought from us or signed up for an account and did not opt out when we gave you the chance (the ‘soft opt-in’ that the Privacy and Electronic Communications Regulations 2003 allow). Every marketing email has an unsubscribe link. We do not send marketing by text message, telephone, post or push notification. The coach line’s messages, including the payment links it sends, are covered in section 5.1.

Where we send marketing email, we also rely on our legitimate interest in promoting our business (see above How and why we use your personal data).

You can object to marketing at any time by using the unsubscribe link or emailing support@gainz.ai.

We may ask you to confirm or update your marketing preferences if you ask us to provide further products or services in the future, or if there are changes in the law, regulation, or the structure of our business.

We will always treat your personal data with the utmost respect and never sell it to other organisations for marketing purposes.

For more information on your right to object at any time to your personal data being used for marketing purposes, see Your rights below.

5.1: The coach line and your phone number#

The coach line is a coaching service on iMessage. You can start it by texting a Gainz number, without a Gainz account, or you can link it to your Gainz account from the App. By texting the line, you agree to receive messages from Gainz at the number you text from. Message and data rates may apply, depending on your mobile plan.

The Coach on the line is an AI. Where the coach on the line is modelled on a real person, for example an athlete, it is an AI persona. That person does not read or write your messages. If you sincerely ask whether you are talking to a real person, the Coach will tell you that it is an AI.

Who carries the messages. Messages on the coach line are carried by Photon (its Spectrum service) and by Apple’s iMessage. Our own sender service, which runs on Amazon Web Services, passes our replies to Photon, and Photon passes your messages to us. Photon and Apple receive your phone number, every message in both directions, typing and read indicators, reactions and replies, the Coach’s contact card (its name and photo) and any voice notes.

What we keep. Your phone number, which we encrypt when we store it, and a keyed fingerprint of it (a one-way code that lets us recognise the number without reading it); every message between you and the Coach; your answers to the Coach’s questions (your goal, days per week, equipment and injuries); the Coach’s running notes about you; the times of your messages, follow-ups and sessions; and, if you pay, your Stripe customer and subscription references and the date you paid.

We do not open photos, files or voice memos you send to the line; the Coach replies that it cannot open them. If you text a card number, we remove it before we store your message.

AI. Your messages, your answers and the Coach’s notes are sent to our AI providers to write the Coach’s replies (see 4.3). If you link your Gainz account, the Coach also uses your App profile, plans and history on the line, and your thread moves into your account.

Adults only. The coach line is only for people aged 18 or over. It does not ask your age, but if you tell it you are under 18 (for example by giving your age or school year, or by mentioning a parent), or your linked account shows you are, it will not coach you, send you follow-ups or voice notes, or offer you a subscription. We keep the messages you have sent under the rules in section 7, with a record that you are under 18.

Paying. If you ask to subscribe, the Coach sends you a Stripe payment link. If you have linked your account and have not subscribed, it may also send you the link once, about two days before the 7 days of free access you get by linking end. It never sends a payment link in its first message or to anyone it knows to be under 18. Stripe receives your card and billing details and keeps a customer record with our reference for you. See our Terms for how coaching subscriptions work.

Linking your account. When you link the line to your Gainz account, we store your phone number (encrypted), a link code that is valid for 15 minutes, and the dates you gave your consent. A link that is not used for 30 days expires.

Stopping messages. Text STOP at any time and the coach line stops messaging you. The Coach’s first message tells you this. A message that says only “stop” or “cancel” stops messages but does not cancel a subscription (see our Terms). If your number is not linked to a Gainz account, then unless you have paid, or started to pay, for a subscription on the line, we delete your coach-line thread and record within 7 days. If it is linked, STOP unlinks your number, and your messages stay in your account until you delete your account (see 7.1). We keep a fingerprint of your number so that we never message it again, unless you later link that number from the App.

Deleting your data. You can ask us to delete your coach-line thread and everything we hold about your number at any time by emailing support@gainz.ai with the number you text from. We will do it within one month. For how long we keep coach-line data otherwise, see 7.

Our website’s sign-up form. If you give us your number through the text-coaching form on our website, we record the number, your consent and the time, and email that record to our support inbox through Resend.

We do not sell your mobile number, and we do not share it with third parties for their own marketing. We share it only with the providers named in this section and in section 6.1, to deliver your messages and payments. For how we handle sharing generally, see Who we share your personal data with.

5.2: Advertising measurement and tracking#

We advertise our App, and we use AppsFlyer to measure which adverts lead to installs and subscriptions. This is how it works:

• When you open the App, AppsFlyer receives install and open events, an ID it gives your device, and, on iPhone, the Apple Search Ads token for your install. It also receives a copy of Apple’s SKAdNetwork install report.
• The App tells AppsFlyer when you sign up (and how), finish setup, start a trial or subscribe.
• RevenueCat, which manages App subscriptions, may send AppsFlyer your purchases, with your Gainz account ID, so that AppsFlyer can match a purchase to the advert that led to it.
• AppsFlyer links this information with the advertising networks’ click data to work out which campaign to credit.
• On iPhone, your advertising identifier (IDFA) is used only if you allow tracking when the App asks; iOS enforces this, and you can change your choice in iOS Settings, under Privacy & Security, then Tracking. On Android, AppsFlyer receives your Android advertising ID; you can delete or reset it in your device’s settings, under Google or Privacy, then Ads.

The App sends AppsFlyer the events described above, and RevenueCat may send it your purchases, whether or not you allow tracking. Allowing tracking decides only whether your iPhone’s advertising identifier is included.

Apple treats this as “tracking”. It involves your purchases, how you use the App and your user ID. We do not sell this data. We do not send AppsFlyer your Health Data, Photos or messages.

On our website, the Tolt affiliate script records the referral link you arrived from, and passes a referral ID to Stripe if you buy (see 9 Cookies).

5.3: Applying to our creator programme#

If you apply on our website to have an AI coach made in your likeness, we collect:

• your full name, email address and country
• your TikTok and Instagram handles and follower counts
• your sport, your coaching credentials and the personality description you write
• the face photos you upload
• a voice sample, if you choose to give one, and your consent to its use for voice cloning
• the consents you tick and the licence you sign, which we keep as a PDF
• if you set up payouts, the payout account reference that Stripe or Tolt gives us. You set up payouts on their site, and we do not see your bank or card details
• as the record of your signature: your IP address, your browser details, the time you submitted and the version of the terms you agreed to

Your photos, voice sample and signed licence go directly from your browser to our file storage on Amazon Web Services. The rest of your application passes through our website’s host, Vercel, to our servers. Our team reviews every application.

We use this data to take steps at your request before entering into the creator licence and to perform it. For your voice sample we rely on your consent, and we keep the record of your signature for our legitimate interest in being able to show what you agreed to. We have not yet built the step that turns an approved application into a coach. We will update this section before we do.

We keep your application, with its photos, voice sample and signed licence, whether or not we accept it, until you ask us to delete it at support@gainz.ai.

6: Who we share your personal data with#

We use other companies to run our App, our website and the coach line. Section 6.1 lists them, what they do for us and what they receive. Most of them act as our processors. We rely on each provider’s standard data-processing terms, where the provider offers them, to limit how it uses your personal data, and some providers may also keep and use our requests as their own terms allow (see section 4.3). Some, such as Apple, Google, Stripe and TikTok, also use your personal data as independent controllers under their own privacy policies when you sign in with them, pay through them or share to them. Sharing with these companies will involve the transfer of your personal data outside of the UK (see section 8).

We routinely share personal data with:

• the service providers listed in section 6.1, including our AI providers and payment service providers
• our banks

We only allow those organisations to handle your personal data if we are satisfied they take appropriate measures to protect your personal data.

We or the third parties mentioned above occasionally also share personal data with:

• our and their external auditors, eg in relation to the audit of our or their accounts, in which case the recipient of the information will be bound by confidentiality obligations
• our and their professional advisors (such as lawyers and other advisors), in which case the recipient of the information will be bound by confidentiality obligations
• law enforcement agencies, courts, tribunals and regulatory bodies to comply with our legal and regulatory obligations
• other parties that have or may acquire control or ownership of our business (and our or their professional advisers) in connection with a significant corporate transaction or restructuring, including a merger, acquisition, asset sale, initial public offering or in the event of our insolvency—usually, information will be anonymised but this may not always be possible. The recipient of any of your personal data will be bound by confidentiality obligations

7: How long your personal data will be kept#

We will not keep your personal data for longer than we need it for the purpose for which it is used. Different retention periods apply for different types of personal data:

7.1: Deleting your account#

You can delete your account in the App, at Settings → Account Management → Delete Account. Deletion is immediate and cannot be undone. We delete your account from our database straight away, together with your profile, Health Data, plans, logs, messages, Photos, any coach-line records linked to your account, your TikTok connection and share images, and our records of your subscriptions. We then delete your files from our storage, and retry every hour any that fail.

Deleting your account does not cancel a subscription. A subscription bought in the App is managed by Apple, and a subscription bought through Stripe (on our website or on the coach line) keeps renewing until it is cancelled. Cancel your subscription before you delete your account. If you have already deleted your account and Stripe is still charging you, email support@gainz.ai straight away so that we can cancel it.

When you delete your account in the App we also delete your user record with Google’s Firebase Authentication and, if you signed in with Apple on an iPhone or iPad, stop Gainz’s use of Sign in with Apple. If either step does not complete, you can remove Gainz in your Apple Account settings, or email us and we will remove the record. Deleting your account does not remove the records held by RevenueCat, Stripe, PostHog, AppsFlyer, Superwall and Sentry, or request records kept by OpenRouter or the AI providers. If you want these deleted too, email us and we will ask those providers to delete what they hold about you, where they allow it.

If you cannot use the App, email support@gainz.ai from the address registered to your account and we will delete it for you. If you use only the coach line, see 5.1.

8: Transferring your personal data out of the UK and EEA#

The EEA, UK and other countries outside the EEA and the UK have differing data protection laws, some of which may provide lower levels of protection of privacy.

It will be necessary for us to transfer your personal data to countries outside the UK and EEA. We will comply with applicable UK and EEA laws designed to ensure the privacy of your personal data.

We will transfer your personal data to third party service providers located in the USA, and to other countries where our service providers operate. We do not choose which host OpenRouter uses to run an AI model, so an AI request may be processed in the USA or in another country where that host operates. Some of the hosts that run DeepSeek models are companies based in China.

As we are based in the UK we will also transfer your personal data from the EEA to the UK.

Under data protection laws, we can only transfer your personal data to a country outside the UK/EEA where:

• in the case of transfers subject to UK data protection law, the UK government has decided the particular country ensures an adequate level of protection of personal data (known as an ‘adequacy regulation’) further to Article 45 of the UK GDPR.
• in the case of transfers subject to EEA data protection laws, the European Commission has decided that the particular country ensures an adequate level of protection of personal data (known as an ‘adequacy decision’) further to Article 45 of the EU GDPR.
• there are appropriate safeguards in place, together with enforceable rights and effective legal remedies for you, or
• a specific exception applies under relevant data protection law

Where we transfer your personal data outside the UK, we rely on an adequacy regulation where one applies. Where none applies, we rely on the provider’s standard data-processing terms and the transfer mechanisms they include, such as standard data protection clauses recognised or issued further to Article 46(2) of the UK GDPR, where the provider offers them.

Where we transfer your personal data outside the EEA, we rely on an adequacy decision where one applies. Where none applies, we rely on the provider’s standard data-processing terms and the transfer mechanisms they include, such as standard data protection clauses issued further to Article 46(2) of the EU GDPR, where the provider offers them.

Any changes to the destinations to which we send personal data or in the transfer mechanisms we rely on to transfer personal data internationally will be notified to you in accordance with the section on Changes to this privacy policy below.

9: Cookies and other tracking technologies#

A cookie is a small text file which is placed onto your device (eg computer, smartphone or other electronic device) when you use our website. We use cookies on our website. These help us recognise you and your device and store some information about your preferences or past actions.

On our website:

• essential cookies keep you signed in and remember your cookie choices
• Google Analytics measures how people use our website, including when someone taps the button to text the coach line. It starts with analytics and advertising storage switched off, and uses cookies only if you accept them in our cookie banner. You can change your choice at any time from the cookie icon on the page
• the Metricool tracker (website analytics) and the Tolt affiliate script (which records the referral link you arrived from, and passes a referral ID to Stripe if you buy) currently load for every visitor, whatever you choose in the cookie banner

In our App, the SDKs described in sections 5.2 and 6.1 use similar technologies: they store identifiers on your device.

10.1: If you live in the United States#

If you live in a US state with a consumer privacy law, you may have the right to know what personal data we hold about you and get a copy of it, to correct it, to delete it, and to opt out of its sale, its “sharing” for cross-context behavioural advertising, and targeted advertising.

• We do not sell personal data.
• The advertising measurement described in section 5.2 may count as “sharing” for cross-context behavioural advertising, or as targeted advertising, under some state laws. We share personal data for these purposes only in that measurement. The App sends AppsFlyer the install, sign-up, setup, trial and subscription events described there, and RevenueCat may send it your purchases with your Gainz account ID, whether or not you allow tracking. Your advertising identifier is included only if you allow tracking when iOS asks you or, on Android, unless you have deleted or turned off your advertising ID. You can turn off tracking for our App in iOS Settings, under Privacy & Security, then Tracking. To opt out of the rest of this sharing, email support@gainz.ai.
• We use sensitive personal data (your Health Data and Photos) only to provide the services you ask for, except that we use your goals, training experience, training days and activity level for product analytics (see section 4.2).
• To use your rights, email support@gainz.ai. We will check your request against your account details. You can ask someone to act for you as your authorised agent. If we refuse your request, you can appeal by replying to our decision, and if we refuse your appeal you can complain to your state’s attorney general.
• We will not treat you differently for using these rights.

The categories of personal data we collect, where it comes from, why we use it and who receives it are set out in sections 2, 3, 4 and 6.

11: Children#

Our App is not for children under 13. You must be at least 13 to create an account, and if you are under 18 you need the permission of a parent or guardian (see our Terms). We ask for your age when you set up the App, but we do not verify it. If we learn that we hold personal data of a child under 13, we will delete it. If you are aware that any personal data of anyone under 13 years old has been shared with us please let us know at support@gainz.ai so that we can delete that data.

The coach line is only for adults aged 18 or over. It will not coach anyone it knows to be under 18, never offers them a subscription, and does not send them follow-ups or voice notes. We do not ask for proof of age. A parent or guardian can ask us to delete a child’s coach-line messages by emailing us with the phone number.

12: Keeping your personal data secure#

We have appropriate security measures to prevent personal data from being accidentally lost, or used or accessed unlawfully. We limit access to your personal data to those who have a genuine need to access it. For example, we encrypt coach-line phone numbers when we store them, remove card numbers from coach-line messages, and remove location data from new body-scan photos.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

If you want detailed information from Get Safe Online on how to protect your personal data and other information and your computers and devices against fraud, identity theft, viruses and many other online problems, please visit www.getsafeonline.org. Get Safe Online is supported by HM Government and leading businesses.

13: How to complain#

Please contact us if you have any queries or concerns about our use of your personal data (see below How to contact us). We hope we will be able to resolve any issues you may have.

You also have the right to lodge a complaint with:

• the Information Commissioner in the UK
• a relevant data protection supervisory authority in the EEA state of your habitual residence, place of work or of an alleged infringement of data protection laws in the EEA

The UK’s Information Commissioner may be contacted using the details at https://ico.org.uk/make-a-complaint or by telephone: 0303 123 1113.

14: Changes to this privacy policy#

We may change this privacy policy from time to time—when we make significant changes we will take steps to inform you, for example by including a link to a description of those changes on our website for a reasonable period or by other means, such as email. The policy version at the top of this page shows when it last changed.

15: How to contact us#

You can contact us by post or email if you have any questions about this privacy policy or the information we hold about you, to exercise a right under data protection law or to make a complaint.

Our contact details are shown below:

Address: Optimum Fitness AI Ltd, 124-128 City Road, London, England, EC1V 2NX

Email: support@gainz.ai