Privacy policy

Information accessed and why

• Google Health: With permission, Gym Coach can read sleep and health metrics and measurements. The integration reads recent sleep, daily resting heart rate, and daily heart-rate variability to validate and import daily recovery summaries for the owner's fitness coaching. It does not write to Google Health. The requested permissions cover broader categories than these three metrics; the tool currently requests only these record types.
• Liftosaur: Workout programs, recent training, equipment, and measurements are read to answer training questions and populate the private dashboard.
• Telegram: The bot processes the owner's messages, account identifier, display name, and settings to identify the authorized user and respond to coaching questions. When the owner requests a recovery check, the message can include a brief energy, soreness, and pain-or-illness check-in.

Storage and protection

Application records and mirrored Liftosaur data are stored on the owner's home server. Google authorization credentials are encrypted there and restricted to the server account. When the daily importer runs, it stores sleep minutes, resting heart rate, and average heart-rate variability (RMSSD), with source dates, availability flags, resting-heart-rate calculation method, sleep session count, and refresh timestamps in the home-server database. Missing values are kept as missing. Detailed sleep stages and raw source records are processed temporarily and are not stored by this importer. Operational output contains counts and status, not measurements.

A requested Telegram recovery check reads the owner's stored daily summaries together with the resolved next Liftosaur session. The resulting reply sends the owner summary values, personal baselines, source limitations, and a training recommendation through Telegram. The check-in is used for that request and is not saved as a separate Gym Coach database record. The command, its answers, and the reply still pass through Telegram and may remain in Telegram message history under Telegram's own terms.

The private dashboard requires authentication, and the Telegram bot restricts use to its owner. Database backups are encrypted. These measures reduce risk but do not guarantee protection against every security incident.

Services that process information

Telegram processes messages exchanged with the bot. For AI coaching, the application sends the question and relevant application context, including mirrored Liftosaur information, to OpenAI's API. The application requests that generated responses not be stored using the API's response-storage setting; this is not a guarantee of zero retention by the provider. Google Health records are not currently included in these model requests. The recovery check is calculated by fixed application rules and does not send its Google Health summary or check-in to OpenAI.

Google provides the authorized health records. Cloudflare hosts these public pages and helps protect and route access to the application. Cloudflare may process network information such as IP addresses and request metadata to deliver and secure those services.

Gym Coach does not sell personal information, use Google user data for advertising, or use it to train generalized AI models. Gym Coach's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

Retention, disconnection, and deletion

Authorization credentials remain on the home server until replaced or removed. Application records are retained for the owner's ongoing use until manually deleted; there is currently no automatic expiry for those records. Encrypted database backups rotate through the most recent fourteen backup files, so deleted database records may remain in older backups until those backups rotate out.

You can revoke Gym Coach's Google access from your Google Account's connections page. Revoking access prevents further authorized retrieval; it does not automatically erase existing application records. Contact the operator below to request removal of locally stored credentials or application data. Deletion from Gym Coach does not delete the original records held by Google or Liftosaur, or copies held by other services under their own policies.

This public website

These informational pages contain no forms, application login, advertising, or analytics scripts added by Gym Coach. Visiting them does not connect your Google account or disclose your health records to this website.

Changes and contact

Photo features are under development. This policy will be updated before new data uses are enabled. For privacy questions, access requests, or deletion requests, contact Mayas Knaizeh at mayas.knaizeh@gmail.com.