GymRat

Privacy Policy

Last updated: September 7, 2026

GymRat is a workout tracker for iPhone and Apple Watch. You build or import training programs, run workout sessions, and track strength and cardio progress over time.

GymRat is designed to work without an account. Your training data lives on your device. This policy explains what stays on your device, the few things that are sent off it, what is stored, and the choices available to you.

What stays on your device

GymRat stores the following locally, in its own on-device database:

• Training programs, workout sessions, exercises, sets, reps, weights, and cardio intervals (distance and time).
• Body-weight measurements you log.
• Preferences such as units (kg/lb, km/mi), the selected theme, and rest-timer settings.
• For AI import: your remaining import-credit count and a device credential (described below).

This data stays on your device until you delete it in the app or uninstall GymRat. Deleting a program, session, or measurement in the app removes it from the device database. A full device backup (iCloud or computer) includes GymRat's data and restores it on a new device; those backups are governed by Apple. There is no cloud account and no server-side copy of your training history.

Apple Health (HealthKit)

Health access is optional and stays off until you grant it.

• Read: with your permission, GymRat reads your body-mass (weight) samples from Health to chart your weight alongside your training.
• Write: GymRat writes the body-weight measurements you enter to Health. If you turn on "Save cardio to Health," GymRat also writes a workout for each cardio session you finish.
• On Apple Watch, GymRat reads your heart rate during a workout to power the rest timer and recovery display.

Health data is processed on your device and written to Apple Health. GymRat does not transmit Health data to our servers or to any third party, and does not use it for advertising. You can review or revoke GymRat's Health permissions at any time in Settings › Health › Data Access & Devices, or in the Health app.

Photos and camera

GymRat can create a program from a photo of a written or printed plan. The camera and photo-library permissions are used only for this.

Text recognition runs on your device using Apple's Vision framework. The photo itself is never uploaded. Only the recognized text is then handled as described under "AI program import."

AI program import

When you import a program — by typing or pasting text, or from on-device photo text recognition — GymRat sends the following over an encrypted (HTTPS) connection to the GymRat import service (api.thegymrat.app):

• the program text (what you typed, or the text recognized from your photos);
• your chosen target language, if you ask for a translation.

The import service forwards that text to a third-party large-language-model provider (through OpenRouter) to structure it into a program. Every request is configured for zero data retention: the provider uses the text only to produce the result for that request and does not retain it or use it to train models.

The import service does not store your program text, the recognized photo text, the parsed program, or any other training content. The request is processed and discarded.

What the import service does store, in a small per-device ledger:

• an Apple App Attest key identifier — a per-installation value that proves the request comes from a genuine, unmodified copy of GymRat on Apple hardware. It is not linked to your name, Apple ID, or contact details.
• a hashed access token derived from that attestation;
• your remaining import-credit count;
• if you buy an import pack: the Apple transaction identifier and product identifier for that purchase, used to add credits and to prevent a purchase being credited twice.

This ledger contains no training content and no contact information. It exists only to run the free allowance and the paid credit packs. GymRat also sets one Apple DeviceCheck bit on your device to record that the free import allowance has been used, so reinstalling the app does not reset it.

Your IP address is necessarily visible to our hosting provider and the model provider while a request is in flight, and may be briefly processed or logged by that infrastructure for security, rate limiting, and abuse prevention. It is not stored in the credit ledger or associated with your training data.

Program text can itself contain personal information you typed into it, so send for import only content you are comfortable processing this way. Manual program entry never sends anything off your device and is always free and unlimited.

Program sharing

If you generate a share link or QR code for a program, the program's structure (name, exercises, sets, reps, weights) is uploaded to the GymRat sharing service so another device can import it.

• Shared programs are held in memory only and are automatically deleted after about 24 hours (or sooner if the service restarts).
• Private notes are never included in a shared program.
• A share is anonymous and is not associated with you.

Importing a program from a QR code that already contains the whole program happens entirely on your device, with no network request.

Purchases

GymRat is a one-time-purchase app with no ads and no subscriptions. It offers two kinds of in-app purchase:

• AI import packs — add import credits. The purchase is verified by the import service as described above.
• Tips ("Support GymRat") — a way to support development. Tips unlock nothing; the app is already complete. The only record kept is a local flag on your device that you have tipped, used to show a thank-you message.

Apple processes all payments. GymRat never receives your payment-card number or billing address. Apple's handling of the transaction is governed by Apple's privacy policy.

Advertising, analytics, and tracking

GymRat shows no advertising and includes no third-party analytics, attribution, or crash-reporting SDKs. We do not build user profiles, do not sell personal information, and do not track you across apps or websites owned by other companies. GymRat does not use the advertising identifier (IDFA).

Your choices and deletion

• Delete individual programs, sessions, or body-weight entries in the app.
• Revoke Health, Camera, or Photos permissions in iOS Settings.
• Uninstall GymRat to remove its local database from the device.
• To ask a privacy question, or to request deletion of the per-device import-ledger record, email ratgymcompany@gmail.com. Because GymRat has no user accounts, we may need the current App Attest key identifier from your device (or recent purchase details) to locate the pseudonymous record. We may retain limited information where necessary for fraud prevention, purchase administration, or legal compliance.

What we do not do

• No advertising.
• No third-party analytics, attribution, or crash-reporting SDKs.
• No cross-app or cross-website tracking; no advertising identifier.
• No sale or sharing of personal information with data brokers.
• No account, sign-in, or routine collection of your name, email, or phone number.
• No upload of your photos, your Health data, or your training history.

Children

GymRat is a general-purpose fitness tool. It is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information through the service, contact us so we can investigate and delete it where appropriate.

Changes

If we change how GymRat handles data, we will update this policy and the "Last updated" date above. Material changes may also be noted in the app's release notes.

Contact

For privacy questions or deletion requests, write to ratgymcompany@gmail.com.