Last updated 31 August 2026
This policy covers GymNotes Coach — the mobile app (iOS, Android) and the web app at https://gymnotes-coach.com. It does not cover the GymNotes app your clients use; that one has its own policy at https://privacy.gymnotesapp.com.
GymNotes Coach is operated by Mykyta Subotin, an individual entrepreneur registered in Ukraine.
Contact for anything in this policy, including data requests: hello@gymnotesapp.com.
This app handles two kinds of personal data, and we are not in the same position for both.
Your own data — we decide what happens to it. Your account, your profile, your usage of the app. We are the controller.
Your clients' data — you decide what happens to it, and we act on your instructions. The names, contacts, goals and notes you record about the people you train, and the training data they share with you through their own app. For that data you are the controller and we are your processor. We store it, we show it to you, and we do not use it for anything of our own.
That distinction has practical consequences for you. It means you are the person your clients ask about their data, you are responsible for having a lawful reason to hold it, and you are responsible for telling them you hold it. Section 11 of the Terms sets out what that requires of you.
Account. Your email address. If you sign in with Apple or Google, we receive your email and, on first authorization only, the name those services provide. Passwords are handled by our authentication provider and stored only as a hash; we never see them.
Profile. Display name, avatar image, short bio, and one contact handle with its type (for example a Telegram username) if you choose to add one — this is shown to your clients so they can reach you.
Device, for notifications. A token identifying your device, your platform (iOS or Android) and your app language. Only if you allow notifications.
Usage analytics. Which screens and actions you use, as event names with numeric or true/false properties — for example that a plan was published, or how many exercises it contained. No value taken from a client is ever sent: no names, emails, phone numbers, goals or notes. This is enforced in the app's code, not only by policy.
Crash reports. When the app crashes we receive the error, a stack trace, your device model and OS version, and your user id. Personally identifying data is switched off at the SDK level.
Voice dictation, if you use it. See section 5.
We do not collect your location, your contacts, your photo library beyond the images you deliberately pick, advertising identifiers, or anything for advertising purposes. We do not run ads and we do not sell data.
Two separate things, from two separate sources.
What you type in. For each client you may record a name, an email address, a phone number, a training goal, free-text notes and a photo. You choose what to enter. Some of these people are not GymNotes users at all — you may have added them from your own records — and they have no way of knowing the entry exists unless you tell them. That is why section 11 of the Terms exists.
What the client shares. Once a person connects to you by entering your invite code in their own app, and only after they see and confirm a screen listing exactly what you will be able to see, you can view:
Only from the moment they connect. Everything they recorded before that stays private, and their app tells them so on the confirmation screen. They can disconnect at any time, which stops you seeing anything new; what you have already seen remains in your records.
We do not use any of this for our own purposes.
If you dictate a training program, the recording leaves your device: it is sent to our server, and from there to specialist providers that turn speech into text and text into a structured program of days, exercises, sets and repetitions. Those providers are outside Ukraine and the European Economic Area — see section 7 on transfers.
We do not store the audio. It is held in memory for the length of the request and discarded. We do not store the transcript either. What we keep is one row per dictation containing your user id, a timestamp and which app it came from — used to enforce the monthly limit and nothing else.
Under our agreements, these providers do not use this material to train their models. Recordings are limited to three minutes.
If a client's name is dictated, it passes through those providers along with everything else — which is a good reason to leave names out of a dictated program, and there is nothing in the feature that needs them.
Photos of people are private. Your own avatar and the photos you attach to a client are stored in a private bucket. They are not reachable by URL: the app asks the server for a short-lived link each time it needs to display one, and that link is only issued to someone entitled to see the picture. For a photo you took of a client, that is you and no one else — not the client, not another coach. Your avatar is additionally visible to the clients you are connected to, and to someone holding a live invite code from you, who is shown it on the screen where they decide whether to connect.
This is a change from how it previously worked: these photos used to sit in a public bucket, reachable by anyone with the URL.
Custom exercise photos are still public. A photo you add to an exercise you created is stored in a public bucket — the file is reachable by anyone who has its exact URL, without signing in. The URLs are not listed or guessable in practice, but they are not access-controlled either. Exercise photos are pictures of movements and equipment; if you are photographing a person, attach it to the client rather than to an exercise.
We use a small number of specialist companies to run GymNotes Coach. They act on our instructions, may use the data only to provide their service to us, and are bound by written data processing agreements. They are:
| Category | What they do for us |
|---|---|
| Hosting, database, authentication and file storage | Keep your account, clients, plans and exercises |
| Web application hosting | Serve gymnotes-coach.com |
| Push notification delivery | Deliver notifications to your device |
| Speech recognition and text processing | Turn a dictated program into text and then into a plan (§5) |
| Crash reporting | Receive crash reports |
| Product analytics | Receive usage events |
| App distribution and sign-in | Apple and Google |
Nobody else receives this data. There are no advertisers, no marketing partners and no data brokers on this list, because we do not use any.
We will tell you exactly who they are if you ask. Write to hello@gymnotesapp.com and we will name the specific companies behind each category, free of charge. If a client of yours asks you for that list, you may pass it on.
Transfers. Some of these providers are located outside Ukraine and the European Economic Area, mainly in the United States. Those transfers are made under the European Commission's standard contractual clauses; you can ask us for a copy.
For your account, profile and the core features: performance of our contract with you.
For crash reports and analytics: our legitimate interest in a working, improvable app. You can object — write to us and we will exclude your account.
For push notifications: your consent, given through the system prompt and withdrawable in your device settings or in the app.
For your clients' data: your lawful basis as controller, not ours. We hold it because you instruct us to.
While your account exists, we keep your account, profile, clients, plans and exercises.
Disconnecting a client does not delete the record — it is archived, keeps the history of the relationship, and lets the two of you reconnect later. It stops you seeing anything new from that person.
If you delete your account, we delete your profile, your client records and your plans within 30 days. Server logs and crash reports may persist for up to 90 days in our providers' systems. Anything we must keep by law — accounting records for paid subscriptions, for example — we keep for the period the law requires and nothing beyond it.
You can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or object to our using it. You can also ask us to name the specific companies in section 7. Write to hello@gymnotesapp.com; we answer within 30 days.
If a client of yours asks us any of this, we will forward the request to you, because for their data you are the controller and we are not entitled to act on it alone.
If you think we have handled your data wrongly, you can complain to the Ukrainian Parliament Commissioner for Human Rights (Уповноважений Верховної Ради України з прав людини), or to the supervisory authority in your EU country of residence.
Data is encrypted in transit (TLS) and at rest. Access to a coach's data is enforced in the database itself by row-level security, so one coach cannot read another's clients, plans or exercises even if the app misbehaves. Passwords are stored hashed. Our own access to production data is limited to what is needed to run and fix the service.
No system is perfectly secure. If a breach affects your data we will tell you and the supervisory authority as the law requires.
GymNotes Coach is for adults — 18 and over — and we do not knowingly create accounts for anyone younger.
If you train minors, the personal data you record about them carries additional requirements in most jurisdictions, including a parent's or guardian's consent. That obligation is yours as the controller of that data, not ours.
We will post a new version here and update the date at the top. If a change materially affects you, we will tell you in the app before it takes effect.
hello@gymnotesapp.com