Gymnasia Privacy Policy

Summary

Gymnasia runs primarily on your device. There is no account or sign-up. Your workouts, diet, weight, measurements and conversations with the assistant are stored inside the app itself.

There is one important exception, and it is entirely yours: if you enable the artificial intelligence assistant, you supply an API key from OpenAI, Anthropic, Google or an OpenAI-compatible server whose HTTPS URL you choose. The app talks directly to that destination from your device. Whatever you send when a question needs the model goes to the company you chose, under your own account with them. Explicit requests for a catalogue food's calories per 100 g may be answered using data on your device without sending that question to the AI provider. We do not see or store the chat unless you choose Report on a response and expressly approve the preview of the content that will be sent.

This policy explains in detail what is stored, what leaves your device, and what control you have over it.

Who is responsible

Data controller: Máximo Fernández Núñez.

Contact for anything related to privacy, including exercising your rights and reporting an assistant response: maximofn@maximofn.com.

Gymnasia is a personal project. There is no support department and no designated data protection officer.

There is no account and no server

Gymnasia does not ask for an email address, a password or a username in order to work. No account system exists.

Gymnasia does not sync your data to a server, make cloud backups or use it for analytics. The only exception is the optional feedback backend: it receives suggestions and reports only after an express action and confirmation (see [Third parties](#terceros)). A report contains the preceding question and the selected response, so it may include personal or health data found in those two messages. There is no analytics, no telemetry and no automatic crash reporting: the app bundles no SDK of that kind.

What the app stores

All of the following is stored on your device only:

• Training activity: routines, exercises, sets, repetitions, loads in kilograms, session duration, rest periods, and estimated volume and calories.
• Nutrition: what you log each day, with grams, calories, protein, carbohydrates and fat; the foods you create yourself; and the recipes and products you save.
• Weight and body composition: weight, body fat percentage, neck, chest, waist, hip, biceps, quadriceps and calf measurements, and any progress photograph you attach to a measurement, each with its date.
• Personal data used for calculations: sex, height, date of birth, goal (cutting, bulking or maintenance) and activity level. Used to estimate your calories and macronutrients.
• Conversations with the assistant: the complete history of your chat threads, including the model's messages. New Google turns also retain response steps, thought summaries, technical signatures, tool calls, arguments and results needed to continue the dialogue. These data follow chat deletion and manual backups; they do not contain the API key.
• Assistant memory: free-text notes that you or the assistant save in order to remember things between conversations. It may contain anything you have mentioned in the chat, including health data.
• Legacy credentials from removed features: if an earlier version stored credentials in the secure keystore, a normal update may keep them encrypted so they can be reused if the feature returns. The current version neither reads nor transmits them. “Delete all my data” deletes them.
• Preferences: interface and notification settings, and your consent for the optional additional health-safety evaluation.
• AI provider configuration: the selected model, the HTTPS base URL if you set up an OpenAI-compatible server and, when Anthropic requires it for an identity-linked key, the workspace identifier (wrkspc_…). The app also stores which provider, model and URL combination explicitly rejected a photo, so it can show a notice until you change the configuration.
• Debug log: a technical record of up to 1000 entries covering delivered rest-timer alerts, which include the exercise name and set number; technical policy-selection events; and counters for context prepared for Google, such as exchange count, bytes and the number of old images omitted. Those Google diagnostics contain no messages, images, tool arguments or keys. The log is never sent over the network; you can view and clear it from Settings.
• Local recovery copies: the app keeps one verified copy of its main state. If it finds data that it cannot read safely, it quarantines the original payload instead of overwriting it. Both copies remain on the device and are replaced or removed when the recovery is completed.
• Assistant operation control: before a write, the app leaves a local technical mark. For data on the device, it stores another mark with the data when the write finishes; for a suggestion, it queries the issue service with the technical identifier described below. This lets it check an interruption before deciding whether a retry is safe. The each local record is limited to 256 operations. Confirmed ones expire after seven days; an operation whose result cannot be verified is kept until it can be resolved or you delete activity. Local marks contain technical fingerprints, the action name and timestamps; only a confirmed operation's record also keeps the result returned to the model. They store no arguments, messages, instructions or API keys, never leave the device and are excluded from exported backups.

Where it is stored

In the app's private storage on your device. On Android, other apps cannot read it.

API keys and, when left by an earlier version, legacy credentials from removed features are treated differently: they are stored in the operating system's secure keystore, separate from everything else. The optional Anthropic workspace identifier is not a secret key and is stored with the app's private configuration.

If your device has Android backup enabled, the operating system may include the app's data in your Google account backup. That is governed by your device settings and Google's privacy policy, not by this app.

Your API key

The assistant works on a bring-your-own-key basis: no key ships with the app, and you enter one from your own account with OpenAI, Anthropic, Google or the compatible server you configure.

• The key is stored in your device's secure keystore and is never sent to any developer server, because no such server exists.
• The key is sent only to the configured destination with each request. If you choose a compatible server, you decide its HTTPS URL and are responsible for trusting it. The app rejects redirects from that server.
• If an identity-linked Anthropic key requires a workspace identifier, that identifier is stored locally and sent only to Anthropic to route requests to the selected workspace.
• The key is not included in the backup file you export.
• The workspace identifier is not included in that backup either.
• You can delete it at any time from Settings.

Protection is weaker in the browser. The web version of Gymnasia runs in a browser, where no operating system keystore exists: there, the key is stored in browser storage alongside the rest of your data, without that additional layer of protection. The app warns you about this on the provider settings screen. If this concerns you, use the mobile app.

The API-key exclusion applies to the regular backup. If the web version finds damaged storage and you choose to export the original for recovery, that file preserves exactly what was stored in the browser and may contain the API key. The recovery screen warns you before downloading it.

What the app sends to AI providers

When an assistant question needs the model, your device connects directly to the provider you chose. An explicit calories per 100 g lookup answered from the local catalogue does not make that request. When sent, the request includes:

• the assistant's system instructions;
• in the main chat, Gymnasia selects up to the last 20 messages using the same local rule for every provider. It then adapts that context to each API's format. For Google, the request keeps the exchanges from that selection, including their response and tool steps; if it exceeds the API's size limits, it removes complete exchanges starting with the oldest. Food assistants send their recent session history, limited to ten exchanges on Google;
• the results of the tools the assistant uses at your request, which may include your weight, your body fat percentage, your measurements, the day's meals or your routines;
• in the food estimator, the images you provide, encoded within the request.
• for Anthropic, the workspace identifier, only when you configured one because the key type requires it.

If you enable additional health-safety evaluation in Settings, the text of a query that the local check considers ambiguous may be sent to the provider you are using at that moment (the Coach's or the Estimator's) in a separate classification request before the normal response is generated. It is a single switch for all providers: it can only be enabled once you have saved the key of at least one provider, it turns itself off if you delete the last key, it is off by default, and it can be revoked at any time. Messages classified locally as high or critical risk are intercepted on the device and are not sent to the provider.

All generation requests to Google disable Interactions conversation storage using store: false. The app resends the recent context that fits within those limits from the device and does not use a conversation stored at Google to continue the dialogue. The complete history remains stored on the device and is not deleted when preparing a smaller request. This setting does not replace the provider's general terms.

The Coach's OpenAI Responses requests also use store: false: the app selects the history on the device and, during a tool workflow, resends the responses and results needed to continue. Encrypted reasoning items remain in memory only for that request; they are neither displayed nor saved in the app's conversation history. This setting prevents OpenAI from storing the responses as application state, but does not remove abuse monitoring logs that OpenAI may retain under your account's configuration.

That content is subject to the privacy policy and terms of the provider you chose, under your own account with them:

• OpenAI
• Anthropic
• Google

If you configure an OpenAI-compatible server, consult its own policy and terms: Gymnasia does not control that destination. The optional model test sends a short query and may incur charges under the service you choose. If the model rejects tools, the Coach cannot use it; the food estimator can answer without barcode lookup and will tell you so.

If you configure no key, the app contacts no AI provider and every other feature keeps working.

Photographs

Gymnasia uses the camera and the photo library in two places, and treats them differently:

• Food estimator: the images you select (up to six) are sent to the AI provider to estimate nutritional values. They are not stored in the app and are not uploaded anywhere else. To complete the same turn with Google, they remain available during any tool rounds. When you send a later message, the app keeps the earlier text and answer as context but no longer resends those image bytes. Images are discarded when the session is reset. Technical history from these temporary assistants is not added to persistent chat.
• Progress photographs attached to a measurement: the app creates a JPEG copy in its private storage, limits its longest edge to 2048 pixels and removes EXIF, XMP, IPTC and comment metadata, including any location carried by the original. It does not send them automatically to a server. They leave the device only if you export and share a manual backup; the assistant can see the local reference if it reads that measurement.

Third parties the app contacts

Besides the AI providers:

• GitHub (raw.githubusercontent.com, api.github.com, github.com): the app downloads the public catalogues of exercises, foods, products and recipes, their images and the assistant's instructions; and checks which version of those instructions applies to it. No data of yours is sent, but GitHub, like any server you connect to, sees your IP address.
• Gymnasia feedback backend (gymnasia-feedback.maximofn.com): only when you ask for it. When you suggest an assistant improvement, or submit a food or exercise that is missing from the catalogue, the app first shows you the exact title and summary and sends nothing until you approve them. It sends only that title, that summary, the proposal type and a technical identifier used to prevent duplicates. Suggestions do not include literal conversation text or user identifiers. If you use Report on a response, the preview contains the reason, optional details, immediately preceding question, selected response and technical context (surface, origin, provider, model, app version and, where applicable, health-intervention data). It does not send the rest of the thread, internal reasoning, technical errors, API keys or an account identifier. The developer operates the service on Cloudflare infrastructure, and it creates a record in a private GitHub repository visible only to the developer. The app and service remove recognisable key and password patterns before storing it. Cloudflare receives the IP address needed to serve the connection; the service applies an HMAC before rate limiting, keeps only that pseudonymous value for up to 48 hours and does not store the raw IP. A report body is scheduled to be automatically replaced with a deletion notice when it reaches 30 days. If you submit no suggestion or report, this service is never used.
• Open Food Facts (world.openfoodfacts.org): if the assistant reads a barcode in one of your photos, it looks that barcode up in their public database to obtain the product's nutritional information. The barcode is sent, not the image.

Backups and export

You can export all your data to a .gymnasia package from Settings, and import it back later. It is a manual action: there is no automatic backup. The app also keeps support for importing older JSON files, although an old photograph reference can only be recovered if that file is still accessible on the device.

The local recovery copy is not a cloud backup or a second portable file: it is one prior generation inside the app's own storage. It is used only when the current state cannot be read. Gymnasia then blocks writes and lets you recover the latest copy, retry, discard the affected data, or export the damaged payload. This recovery export preserves the original without sanitising it; it is particularly sensitive and may contain AI keys in the web version. Before saving it, Gymnasia requires you to choose a password and encrypts the file in the same way as a normal backup. It is never sent to a Gymnasia server.

The exported package contains: your measurements and body fat percentages, the normalised JPEG copies of your progress photographs that fit within the app's limits, your complete diet log, your training history, your personal settings (sex, height, date of birth), the assistant's memory, the selected models and the custom server's base URL if configured, and the entire history of your conversations. It is the most sensitive file the app produces: store it carefully and think about who you send it to.

Each photograph carries a SHA-256 checksum so it can be checked during restoration. The app accepts at most 500 photograph links, 5 MiB per normalised photograph and 200 MiB of images per backup. If a photograph is missing, damaged or does not fit, the backup keeps all numeric measurements and tells you which photographs were omitted.

The package does not contain your API keys or legacy credentials from removed features. New backups are encrypted and authenticated with XChaCha20-Poly1305; the key is derived from a password you choose using scrypt. Gymnasia neither stores nor transmits that password and cannot recover the file if you forget it. On import, the complete file is decrypted and verified before the app shows the confirmation that can replace your current data.

Gymnasia continues to accept old JSON v1 and ZIP v2 backups so that you do not lose access to your data. Those older formats were not encrypted: the app warns you before importing them, and you should use them only if you recognise the file and its origin. There is no option to create new unencrypted exports.

When exporting on mobile, only the already encrypted package is written to the app's temporary storage before you choose where to share it, and that temporary copy is deleted when the share sheet closes. Temporary copies made when selecting a file for import are also removed on completion or cancellation. Any file you choose to save to Drive, Dropbox, your files app or another destination is outside Gymnasia's control and must be deleted there.

Reporting an assistant response

Every reportable final response shown by the assistant includes a Report action. It is also available on health interventions generated on the device, but not on introductions, technical errors, content that is still streaming or internal reasoning. After selecting it, you choose a reason, may add details, and see an exact preview before confirming.

The report includes the immediately preceding question and selected response, not the rest of the conversation. Review the preview because those two messages may contain personal or health data. The app removes recognisable secret patterns, but do not include your API key or data you do not want to share.

Reports are reviewed manually and may lead to changes in the assistant's instructions or safeguards. You can also write to maximofn@maximofn.com if you cannot use the in-app action.

Permissions the app requests

• Notifications, exact alarms, vibration and screen wake: to alert you when a rest period ends, even with the screen off.
• Run after device restart: to reschedule those alerts.
• Camera and image access: only when you pick a photo for the food estimator or for a measurement.

None of these permissions is used to collect data in the background. Notifications are local: they are generated on your device, and there are no push notifications from a server.

The web version

Gymnasia can also be used in a browser. It works the same way, with two differences you should know about:

• Data is stored in browser storage, not in the private storage of an installed app. Clearing the site's data deletes it.
• The API key is not protected by the operating system keystore, as explained above.
• Progress photographs can be included when exporting, but the browser cannot guarantee that their local references remain available or keep restored photographs durably. A web import keeps the measurements and warns about photographs it could not retain.

How long your data is kept

Confirmed technical operations described above expire after seven days. An unresolved operation is kept until the app can verify its result or until you delete activity, so that an automatic retry cannot duplicate its effect. Other local data is kept indefinitely for as long as you keep it. Gymnasia does not synchronise it or retain it on its own server: you keep and delete it, both on the device and anywhere you choose to send a manual backup.

Data you have sent to an AI provider is governed by that provider's retention period, under your account with them.

Suggestions remain in the private repository for as long as needed to manage the project. For assistant-response reports, the body containing the question and response is scheduled for automatic deletion when it reaches 30 days. Technical rate-limit records based on the IP HMAC are deleted within 48 hours.

How to delete your data

Settings → Data provides two options:

"Delete activity and conversations" empties your workouts and routines, diet history, measurements, conversations and any active session. It replaces the verified recovery snapshot with one that no longer contains that activity and removes any prior quarantine, so those data cannot return during recovery. It keeps the assistant's memory, personal foods, diet and interface settings, API keys, legacy credentials, catalogue caches, debug traces and backup metadata. It also cancels pending workout alerts and deletes the assistant's technical operation-control record.

"Delete all my data" deletes and verifies the personal data, credentials, preferences, diagnostics and caches that Gymnasia controls on this device. This includes the main state, sessions, assistant memory, personal foods, current and old API keys, legacy credentials, traces, consents and backup metadata. You must type BORRAR to confirm. This also includes the assistant's technical operation-control record. If any target cannot be deleted or verified, the app does not report success: it shows what remains and lets you retry.

The only local entry preserved by the second option is the signed public cache that prevents the assistant from loading older safety instructions. It contains none of your data or responses and is retained specifically to protect you from a security rollback.

The debug log is cleared with its own button, under Settings → Traces.

Storage recovery: recovering a valid copy or completing a retry removes the quarantine. If you discard the damaged data, the main state, its recovery snapshot and the dependent training session are removed; partitions that remain readable, such as assistant memory, personal foods, preferences and secure keys, are preserved.

Exported backup files, photographs in your library, operating-system permissions and notification channels, logs kept by the operating system, and Android or browser backups are outside Gymnasia's control. Manage those items where they were stored, in your device settings, or by uninstalling the app.

Data held by an AI provider: request it directly from that provider, through your account with them. Gymnasia cannot delete it on your behalf.

Minors

Gymnasia is intended for people aged 16 or older and is not designed for children under 16. The app does not verify the age of its users. If you are 16 or 17, use it with the consent and supervision of someone responsible for you, particularly regarding training and nutrition.

Your rights

The General Data Protection Regulation grants you the rights of access, rectification, erasure, restriction, portability and objection.

In Gymnasia those rights are exercised, in practice, without an intermediary, because the controller does not hold your data:

• Access and portability: the export feature gives you your data and the included progress photographs in a documented and verifiable .gymnasia package.
• Rectification: you can edit any data inside the app.
• Erasure: see the section above.
• Objection and restriction: stop using the features that send data to third parties; with no API key configured, nothing is sent to any AI provider.

If you believe the processing does not comply with the regulation, you can write to maximofn@maximofn.com and lodge a complaint with the Spanish Data Protection Agency (aepd.es).

Gymnasia is not a medical device

Gymnasia is not a medical device and does not replace advice from a healthcare professional.

The app does not diagnose, treat, cure or prevent any disease. Its calorie, macronutrient and body composition figures are estimates based on general formulas, not clinical measurements.

The artificial intelligence assistant is not a person and can be wrong. It is not a doctor, a dietitian or a certified trainer, however much its tone may suggest otherwise. Do not follow its guidance on health, injuries, medication or dietary restriction without checking it with a qualified professional.

Consult a healthcare professional before starting a training programme or a nutrition plan, especially if you have a medical condition, are pregnant or take medication.

Changes to this policy

Whenever what the app does with your data changes, this policy is updated and its version and date change with it. The version in force is the one shown at the top of this document.

Contact

maximofn@maximofn.com