Privacy Policy

Effective: 23 October 2026

1. Who we are

The controller of your personal data is Kamil Dziadczyk, operator of GymCoin (gymcoin.pl) ("we"). Contact: kontakt@gymcoin.pl.

2. Data we collect

• Profile: sex, age, height, weight, activity level and goal.
• Health and activity data: meals and nutrition, weigh-ins, body measurements, workouts, cardio, steps, water, fasting. This is health data under Art. 9 GDPR.
• Photos you add: meal and label photos (for reading nutrition values) and progress photos.
• Messages to the Leafy coach and text you enter.
• Account data: user ID and, if you create an account, e-mail or Google/Apple sign-in details.
• Leaderboard data: workout count, volume, coins, streak and level, if you use the friends leaderboard.
• Technical data: device type, OS and app version, error logs.

3. Why we use it and legal basis

• Running the app (calorie tracking, workout log, goals, stats) – performance of contract (Art. 6(1)(b) GDPR) and your explicit consent for health data (Art. 9(2)(a) GDPR).
• AI features (Leafy, label and meal photo reading, weekly plan, summaries) – your consent. AI features are optional.
• Leaderboard and friends – your consent; results are visible only to people you share the app with.
• Security and bug fixing – our legitimate interest (Art. 6(1)(f) GDPR).

We do not sell your data and do not use it for personalised advertising.

4. Who we share data with

• Cloud and database provider (e.g. Supabase or Firebase) – account storage and sync.
• AI provider – Anthropic (Claude model) – when you use AI features we send your question, meal description or photo and the data needed for the answer (e.g. calorie goal).
• Open Food Facts – product searches and barcode lookups send the product name or barcode only.
• Apple and Google – if you sign in with them or connect Apple Health / Health Connect.

Some providers may process data outside the European Economic Area (e.g. in the USA) under the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework.

5. Apple Health and Health Connect

With your permission the app reads steps, activity and active energy from Apple Health or Health Connect and may write workouts and weight. This data is never used for advertising and never sold. You can revoke access in your phone settings.

6. Retention

For as long as you use the app. After account deletion we delete your data within 30 days; backups expire within 90 days. Data stored only on your device is removed when you uninstall the app.

7. Your rights

You may access, correct, delete, restrict or export your data (Profile → Export data), object to processing, and withdraw consent at any time. You may lodge a complaint with your data protection authority (in Poland: uodo.gov.pl). To delete your account, use the in-app option or e-mail kontakt@gymcoin.pl.

8. Children

The app is intended for users aged 16 and over.

9. Changes

We will announce material changes in the app. The current version is always at gymcoin.pl/privacy.