Gainzor
1. Who publishes this policy
The party operating the Gainzor mobile app and gainzor.com — the data controller under the EU General Data Protection Regulation ("GDPR") and the Turkish Personal Data Protection Law No. 6698 ("KVKK") — is set out below. In this policy, "Gainzor", "we" or "us" means that party.
| Legal name | Adem Coşar |
|---|---|
| Address | Hadımköy Hastane Mah. Şehmuz Sok. No: 13, İstanbul / Arnavutköy |
| National ID number | 10889513522 |
| Phone | +90 552 808 62 29 |
| General contact | info@gainzor.com |
| Data protection requests | info@gainzor.com |
Turkish-language versions of our KVKK disclosure and retention policy are available at KVKK Aydınlatma Metni and Veri Saklama ve İmha Politikası. Where the Turkish and English texts differ in meaning, the Turkish text prevails for users in Türkiye.
2. Short summary
This section is not binding and does not replace reading the full document.
- Your training data lives on your phone first. The cloud copy exists so you can sync across devices and not lose everything when you change phone.
- We do not sell your data, and we do not share it with third parties for advertising.
- There is no advertising SDK, no behavioural ad tracker and no cross-app tracking in the app.
- Body measurements and body-fat percentage are processed only with your explicit consent. Declining leaves the rest of the app fully functional.
- Cloud data is hosted in the European Union (Frankfurt).
- You can export your data as a single file and permanently delete your account from inside the app.
3. Data we collect
The list below covers every category the app actually processes. If you don't use a feature — if you never post, for example — no data is created in that category.
3.1 Account and identity
- Email address and password. Your password never reaches us in readable form; our authentication provider stores it as a one-way hash that we cannot view.
- Username, display name, profile photo, bio.
- If you sign in with Google: the email address, name and profile photo on that Google account. Your Google password is never transmitted to us.
3.2 Profile
- Date of birth and gender — to enforce the age limit and to personalise training calculations.
- Height.
3.3 Training data
- Plans, routines, routine exercises and target sets.
- Workout sessions: start and end time, duration, title, notes.
- Sets: weight, reps, RPE, duration, distance, set type (warm-up, drop set, failure), rest time, weight unit.
- Personal records, streaks and earned achievement badges.
- Custom exercises you create and any photo or video you attach to them.
3.4 Health data (special category)
- Body-weight history.
- Body-fat percentage, calorie entries and circumference measurements (neck, chest, shoulder, waist, hips, arm, forearm, thigh, calf) plus any custom measurement type you add.
This category is explained separately in section 4.
3.5 Social content
- Posts, post titles and captions, photos and videos you upload and their cover frames.
- Likes, comments, follow relationships, follow requests and notifications.
- The visibility level you choose for each post and your account privacy setting.
3.6 AI Coach
- Messages you send to the AI Coach and the replies you receive.
- A summary of your long-term preferences (goal, level, equipment access, preferred split).
- The context sent to the model when a plan is generated or reviewed: a recent training summary, muscle distribution, equipment list and — if you gave consent — your current body weight.
3.7 Technical data
- Push notification token (Android only, and only if you allow notifications), device platform and app version.
- Error and crash reports. Personal data reporting is switched off; only technical information such as the stack trace and app/device version is sent.
- IP address and connection logs, kept in our hosting provider's operational logs. These are not content data.
- AI Coach usage counters, so the daily allowance can be enforced.
3.8 Subscription data
- Subscription tier, status, trial period and current period end.
- We never have access to your payment card details. Subscription fees are collected by the Apple App Store or Google Play; card data is processed only by that store and is never passed to us.
4. Health data and consent
Body measurements, body-fat percentage and body-weight history may qualify as special category (health) data under GDPR Art. 9 and KVKK Art. 6. We therefore process them only on the basis of your separate, explicit consent.
Consent is collected on its own screen in the app, independently of any other approval. You are free to decline, and declining does not stop you using the rest of the service:
- If you decline: workout logging, plans, routines, statistics, personal records, achievements and social features all keep working in full. Only the measurement and weigh-in module is disabled.
- If you withdraw consent: withdrawal takes effect going forward. We stop processing new data in this category and delete the measurement and weigh-in records you have saved. Withdraw from the app's settings screen or by writing to info@gainzor.com.
5. Purposes and legal bases
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account and identity | Creating your account, authentication, account security, handling support requests | Art. 6(1)(b) — contract |
| Profile (birth date, gender, height) | Enforcing the age limit; personalising training calculations | Art. 6(1)(c) — legal obligation; Art. 6(1)(b) — contract |
| Training data | Providing the service, statistics and record calculations, cross-device sync, backup | Art. 6(1)(b) — contract |
| Health data | Measurement tracking, charting body change | Art. 9(2)(a) — explicit consent |
| Social content | Posting, feed, interaction and follow features | Art. 6(1)(b) — contract (where you use these features) |
| AI Coach | AI-assisted plan generation, plan review and Q&A | Art. 6(1)(b) — contract; Art. 9(2)(a) for health context |
| Technical data | Debugging, preventing abuse, enforcing usage allowances, delivering notifications | Art. 6(1)(f) — legitimate interests; Art. 6(1)(a) — consent, for notifications |
| Subscription data | Granting premium entitlements and tracking their term | Art. 6(1)(b) — contract |
| Logs | System security and statutory record-keeping | Art. 6(1)(c) — legal obligation; Art. 6(1)(f) — legitimate interests |
Our legitimate interests are keeping the service secure and available, preventing fraud and abuse, and fixing defects. We balance these against your rights and process the minimum data needed; you can object at any time (see section 13).
For users in Türkiye the corresponding KVKK bases are Art. 5/2(c) (contract), 5/2(ç) (legal obligation), 5/2(f) (legitimate interest) and Art. 6/2 (explicit consent) for health data.
7. International transfers
Your cloud data is hosted in the European Union (Frankfurt). The AI Coach, Android push notifications, Sign in with Google and crash reporting are by their nature operated through providers established outside the EU/Türkiye.
Those transfers are made under appropriate safeguards — primarily the European Commission's Standard Contractual Clauses, or an adequacy decision where one applies — and, where such safeguards are unavailable, on the basis of your explicit consent. You may request a copy of the relevant safeguards by writing to info@gainzor.com.
You are free to withhold consent for transfers. In that case only the features requiring a transfer (the AI Coach and push notifications) become unavailable; the rest of the service continues to work.
8. What you share
Your training data is never shared by default, and you can use the app without ever touching the social features. When you create a post, you choose its visibility:
- Everyone — appears in the explore feed and can be seen by anyone using Gainzor.
- Followers — only followers you have approved; unfollowing removes access.
- Only me — nobody else can see it.
Making your account private puts your whole profile and every post behind follow-request approval. Please also note:
- Your username, display name and profile photo are always visible in user search and to people who follow you.
- Anything you post as "Everyone" can be seen, screenshotted or saved by others. Deleting a post removes it from our systems, but we have no technical control over copies other people have already saved.
- You are responsible for the content of photos and videos you upload. The app collects no location data, but a photo's own metadata may contain a location — check before you post.
9. How long we keep it
| Data | Retention |
|---|---|
| Account, profile, training, social and achievement data | For as long as your account is open |
| Health data (measurements, weigh-ins) | For as long as your consent stands; deleted on withdrawal |
| AI Coach chat history | Until you delete it or close your account (chats can be deleted individually in the app) |
| Push notification token | Until notification permission is withdrawn, the app is uninstalled, or the token expires |
| Error and crash reports | Up to 90 days |
| System and connection logs | For the period required by applicable law |
| Copies in backups after account deletion | Up to 30 days, after which they disappear with the backup cycle |
Full detail: Data Retention and Destruction Policy.
10. Deleting your account and data
You can permanently delete your account from the app's Settings screen. Deletion covers:
- Your account and profile,
- Training, plan, routine, measurement, record and achievement data held in the cloud,
- Your posts, comments, likes and follow relationships,
- Your AI Coach chat history,
- Photos and videos you uploaded.
The local database on your phone is cleared when you sign out or uninstall the app.
Deletion cannot be undone. If you want a copy first, use Settings → Export data to save your entire training history as a single file.
If you have a subscription: deleting your account does not cancel it. Cancel separately in the subscription settings of the store you bought it from.
11. Security
- All traffic between the device and our servers is encrypted with TLS.
- The database enforces row-level security: every record is protected by policies so that only its owner, or a user with access rights, can read it.
- Passwords are stored as one-way hashes and cannot be viewed by us.
- Secrets are held server-side and are not embedded in the app package.
- Access to data is limited to people who need it for their role.
- Media on privately visible posts is served through signed, time-limited links.
No system is perfectly secure. If you find a vulnerability, please report it to info@gainzor.com. Where a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours and inform affected users without undue delay.
12. Age limit
Gainzor is not designed for anyone under 16 and may not be used by them. Users who are 16 or older but under 18 need the consent of a parent or guardian to use the app and to buy a subscription.
If we learn that we are processing data belonging to someone under 16, we delete the account and the data without delay. If you believe your child has provided us with data, contact info@gainzor.com.
13. Your rights
Under GDPR you have the right to:
- Access the personal data we hold about you,
- Have inaccurate or incomplete data rectified,
- Have your data erased,
- Restrict processing in certain circumstances,
- Receive your data in a portable format and have it transmitted to another controller,
- Object to processing based on legitimate interests,
- Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal,
- Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. We do not make such decisions.
You can exercise the right to portability directly using the export feature in the app. For everything else, write to info@gainzor.com from the email address registered to your account. We respond within 30 days, free of charge.
If you are not satisfied, you may lodge a complaint with the data protection supervisory authority of your country of residence, or — for users in Türkiye — with the Personal Data Protection Authority (KVKK).
15. Changes
We may update this policy. The current version is always published at this address with its effective date and version number at the top.
If we make a material change — particularly starting to process a new category of data, using data for a new purpose, or transferring it to a new recipient — we will announce it in the app or by email before it takes effect. Where a change requires consent, we will ask for it again.
16. Contact
Data protection questions and requests:
info@gainzor.com
Everything else and technical support:
info@gainzor.com
Postal address: Adem Coşar, Hadımköy Hastane Mah. Şehmuz Sok. No: 13, İstanbul / Arnavutköy
Last updated: 20 August 2026 · Version 1.0