Privacy Policy

Effective date: 24 September 2026

GymLab Diary LLP
Stoney Works, 8 Stoney Lane, London SE19 3BD, United Kingdom
Contact: support@gloox.app

Simplified Summary

The short version, in plain language. The numbered sections below are the full text and are what legally applies.

1. Introduction

Gloox is a fitness and nutrition app for iOS and Android, operated by GymLab Diary LLP ("Gloox", "we", "us"): workout logging, an exercise catalogue with videos, an AI coach you chat with, AI-generated programmes, interval training, progress analytics, body measurements with photos, a nutrition diary, coach mode, and a paid subscription. On iOS it also works with Apple Watch and the Health app through Apple HealthKit.

This policy explains what personal data we collect through the app and the gloox.app website, why, who else sees it, how long we keep it, and what you can do about it. It is governed by the law of England and Wales. In the UK and the EEA the UK GDPR and the GDPR apply; in Russia, Federal Law No. 152-FZ also applies and section 16 is written for you; in California, see section 6.

We have written this to be honest rather than impressive: where a section says we do not do something — that we do not verify your age, for example — that is a deliberate statement of fact.

2. Information We Collect

2.1 Account. Your e-mail address and password, or, if you sign in with Apple or Google, the account identifier, the e-mail address and — where the service provides it — the name those services return. Passwords are stored as bcrypt hashes. We also issue your device a session token so the app stays signed in.

2.2 Profile. Name, date of birth, sex, training goal, available equipment, avatar, app language, and the personality you chose for the AI coach.

2.3 Body and health. Weight, height, body measurements (neck, shoulders, chest, biceps, waist, hips, calf), "before/after" progress photographs, and your weight history. This is health data — a special category under the UK GDPR and the GDPR, and a special category under Russian law. We process it only on the basis of your explicit consent, which you can withdraw (section 6).

2.4 Workouts. Completed sets, weights, repetitions, RPE, duration, calculated calorie burn, weekly streaks, personal records, and training volume by muscle group.

2.5 Nutrition. Meal entries (dish name, calories, protein, fat, carbohydrates, grams, meal type, time), how the entry was created (photo, text, voice, barcode, food label, search), the product barcode where you scanned one, and your personal calorie and macronutrient targets. Photographs of meals and food labels are sent to an AI model for recognition and assessment (section 14). When you scan a barcode, we look the product up in our own product database, then in the open Open Food Facts database and, if it is still not found, through an internet search with an estimate by the AI model; only the barcode is used for this. If our server does not respond, the app queries Open Food Facts directly.

2.6 AI coach conversations. The full text of your chat with the coach; the files you attach — photographs and PDFs, which in practice may include food labels, training programmes or medical test results you choose to share; and a "dossier" of facts extracted from your conversations (goals, injuries, limitations, preferences) so the coach keeps context. Anything you type or attach becomes part of this data set, including health information nobody asked you for. Send only what you are comfortable sending.

2.7 Voice input. If you dictate instead of typing, your speech is converted to text and from then on is handled exactly like typed text. Recognition is performed by the operating system's own speech engine — Apple's on iOS; on Android, the speech recognition service chosen on your device, usually Google's. Depending on your device, language and settings, the audio may be processed on the device or sent to the platform's servers; that step is covered by Apple's or Google's privacy policy, not ours. We receive only the resulting text and never store the audio.

2.8 Device and usage. Device and application identifiers, OS and app version, language, usage events (screens opened, actions taken) and crash reports. Tools used: AppMetrica (Yandex) on both platforms; AppsFlyer on both platforms, to attribute installs to paid traffic; on Android, Firebase by Google — Crashlytics for crash reports, Google Analytics for Firebase for usage statistics and Firebase Cloud Messaging for push notifications; Apple Push Notification service for iOS push; and Yandex Metrica on the website.

2.9 Apple Health (iOS) and Health Connect (Android). Optional, and only with your permission. The iPhone app saves your completed Gloox workouts and the calories burned to the Health app; during a workout the Gloox app on Apple Watch reads your heart rate and calories to show them on the watch. If you turn on "Coach sees my activity", the app also reads your steps, active energy, workouts recorded by other apps (type, date and time, duration, distance, calories, average heart rate, app name) and sleep duration for the last two weeks from Apple Health (iOS) or Health Connect (Android), and attaches a short summary to your messages to the AI coach (section 14). You choose the data types on the system permission screen and can revoke them at any time (iPhone: Settings → Privacy & Security → Health → Gloox; Android: Health Connect → App permissions → Gloox); the switch in the app stops the summary immediately. This data is never sold, never used for advertising, marketing or data mining, never stored in iCloud, never shown to a linked trainer, and not used by us to train AI models.

2.10 Payments. Purchases are processed by the Apple App Store, Google Play Billing, or — for card payments on our website in Russia — YooKassa. We never receive or store your card number or other card details. What reaches us is the fact of purchase and the status of your subscription.

3. How We Use Your Information

We do not use your data for automated decision-making that produces legal effects. The AI coach makes suggestions; it does not make decisions about your rights.

4. How We Share Your Information

We share data only with the recipients below, and only for the purposes below.

The trainer sees the same screens you do: your workouts, your body measurements including any progress photographs attached to them, and your nutrition diary. Photographs of meals are not stored in the diary — they are sent for recognition and discarded — so there are none for the trainer to see.

We may also disclose data where legally required, or where necessary to establish, exercise or defend legal claims. If the business is sold or reorganised, data may transfer to the acquirer, who remains bound by this policy until users are told otherwise.

We do not sell personal data and we do not share it with advertising networks.

5. Data Retention

We keep your data for as long as your account exists — Gloox is a training diary, and its value is its history, so we do not delete workouts or measurements on a timer while you use the app.

When you delete your account — Profile → delete account, or by writing to support@gloox.app — we delete your personal data from our live systems. Copies remaining in backups are deleted within 90 days.

Logs of requests to AI models are kept for a limited period for diagnostics and cost control, then deleted. These logs contain the content of the request, including the activity summary from Apple Health or Health Connect if one was attached. We do not keep these logs longer than twelve months, and we delete them sooner once they are no longer needed for diagnostics or cost control. If you want the logs of your own requests deleted earlier, write to support@gloox.app.

Where the law requires us to keep records, such as transaction records for accounting, we keep them for the required period even after the account is deleted. Records held by Apple, Google and YooKassa about your purchases are governed by their own policies.

6. Your Privacy Rights

If you are in the UK or the EEA you have the rights to: access your data and receive a copy; rectification of inaccurate data (most of it you can correct yourself in the app); erasure — you can delete your account yourself at any time under Profile → delete account, or ask us at support@gloox.app; portability of the data you provided, in a machine-readable format; restriction of processing while a dispute is resolved; objection to processing based on our legitimate interests, including analytics; withdrawal of consent given for health data, HealthKit or notifications (withdrawal does not affect processing that already happened, and in practice means the features that depend on that data stop working); and complaint to a supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk); in the EEA, the authority of your country of residence.

To exercise any of these, write to support@gloox.app from the e-mail address on your account. We respond within one month, as the UK GDPR requires, and we do not charge for it.

California residents (CCPA/CPRA). We do not sell personal information and we do not share it for cross-context behavioural advertising; we have not done so in the preceding twelve months. You may request access or deletion at support@gloox.app, and we will not discriminate against you for asking.

7. Data Security

Traffic between the app and our servers, and between our servers and our processors, is encrypted in transit with TLS. Passwords are stored as bcrypt hashes. Access to production data is limited to the people who need it to run the service and is controlled through our hosting provider's access rules.

We claim no security certification and we do not promise that a breach is impossible — no internet service can honestly promise that. Your part: use a password you do not reuse elsewhere, do not share your account, and remember that whatever you type into the AI chat is transmitted and stored.

8. Data Breach Notification

If a personal data breach occurs we will investigate, contain it, and record what happened. Where it is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware, as the UK GDPR requires. Where it is likely to result in a high risk to you, we will notify you directly without undue delay, by e-mail or in the app, describing what happened, what data was involved and what you can do. Where a breach affects users in Russia, we will additionally notify the competent Russian authority in the manner and within the timeframes required by Federal Law No. 152-FZ.

9. International Data Transfers

Gloox is operated from the United Kingdom and its infrastructure sits in several countries, so your data is processed outside your country of residence: our company is in the UK, hosting and media storage are with the processors named in section 4, traffic from users in Russia is proxied through our server in Russia, and AI requests are processed abroad. Data therefore moves between the United Kingdom, the European Union, Russia and the United States, where some of our providers — including OpenRouter and Cloudflare — are based. By using Gloox you acknowledge and agree to this; where the transfer includes health data, it takes place on the basis of your explicit consent.

Where we transfer personal data out of the United Kingdom or the EEA to one of the processors named in section 4, we rely on the transfer terms of that processor's data processing agreement, which include the UK International Data Transfer Addendum or the EU Standard Contractual Clauses where those apply. You can ask us which terms apply to a particular processor at support@gloox.app.

10. Children

Gloox is not intended for anyone under 16, and we do not knowingly collect their data.

We do not verify your age at registration. There is no document check, no identity check and no automated age gate. We rely on the age you state and the date of birth you enter in your profile.

If we learn that an account belongs to a person under 16, we delete that account and its data. If you are a parent or guardian and believe your child has created an account, write to support@gloox.app and we will remove it.

11. Changes to This Privacy Policy

We may update this policy when we add a feature, change a processor, or are required to by law. The current version is always at gloox.app/privacy_policy (English) and gloox.app/privacy_policy_ru (Russian), and is reachable from inside the app; when we update it we change the effective date at the top. If changes materially affect how we handle your data, we will make reasonable efforts to tell you before they take effect, and where a change requires your consent we will ask for it rather than assume it.

12. Third-Party Services

These companies process data on our behalf or receive it in connection with Gloox; section 4 says what each one gets, and each has its own privacy policy.

Service Role
Lovable Hosting of our server and database (Lovable Cloud)
Cloudflare The network our server application runs on
Supabase The database
Yandex Object Storage Media storage (exercise videos, measurement photographs) and website hosting
OpenRouter Gateway to AI models
Google (Gemini) The AI model itself, reached through OpenRouter
AppMetrica (Yandex) Product analytics, iOS and Android
AppsFlyer Paid-traffic attribution, iOS and Android
Yandex Metrica Website analytics
Firebase (Google): Crashlytics, Google Analytics for Firebase, Cloud Messaging Crash reports, usage statistics and push notifications, Android
Apple Push Notification service Push notifications, iOS
Apple, Google Sign-in with Apple or Google; payments and subscriptions (App Store, Google Play Billing)
YooKassa Card payments in Russia; card details go to YooKassa, not to us
Open Food Facts Product lookup by barcode (only the barcode is sent)

We do not pass data to advertising networks.

13. Cookies

The mobile app does not use cookies. It uses local storage on your device for your session token and app settings, plus the identifiers described in section 2.8.

The gloox.app website uses cookies set by Yandex Metrica for analytics. The payment page and the YooKassa payment form may set technical cookies needed for payment to work. You can block or delete cookies in your browser; blocking technical cookies may break payment. The cookies we use serve analytics and the operation of the site — they do not pass data to advertising networks.

The site itself is a set of static pages hosted on Yandex Object Storage; it sets no cookies of its own and remembers your chosen language in your browser's local storage. A current list of the cookies set on the site, with their lifetimes, is available on request at support@gloox.app.

14. AI Functionality and Data Processing

The AI coach, AI programme generation, food photo recognition and the nutrition and progress assessments are all produced by a large language model. What that means in practice:

What is sent. The text of your message and the relevant conversation history; the files you attached; your dossier — the goals, injuries, limitations and preferences extracted from earlier conversations; and the parts of your training history, nutrition records and body parameters relevant to the request. Photographs of meals and labels are sent as images for recognition. Activity from Apple Health or Health Connect — only if you turned it on: the summary described in section 2.9. It is attached only to messages you send to the coach, never in the background, and it is not added to your dossier.

Where it goes. Through OpenRouter, which routes the request to a Google Gemini model; both process this data in the course of producing the answer. We do not send your e-mail address or password to the model; your first name is included so the coach can address you.

Accuracy. The answers are generated, not retrieved from a verified database. Training recommendations, calorie and macronutrient estimates, progress analyses and plan adjustments are approximate and can be wrong. Estimates made from a photograph are especially approximate: the model cannot see the weight of the food, the oil it was cooked in, or what is hidden inside it. Treat them as a guide, not a measurement; where precision matters, weigh your food and enter the values manually.

Not medical advice. See section 15.

Logs and deletion. We keep logs of AI requests for a limited period for diagnostics and cost control. Deleting your account deletes your chat history and dossier along with the rest of your data.

Clearing the chat. You can clear the conversation yourself at any time: open the AI coach and tap the bin icon in the header. That removes the chat. The dossier — the facts the coach remembered about you — is removed when you delete your account, or earlier if you ask us at support@gloox.app.

15. Health and Fitness Data

Apple Health and Health Connect. See section 2.9. This data is used only for the fitness features of the app. It leaves Gloox only to our AI provider (OpenRouter, which routes the request to Google Gemini), only when you write to the coach and only if you turned this on. It is not used for advertising or marketing, not sold and not given to data brokers. Gloox's use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements. You can revoke access at any time — on iPhone in Settings → Privacy & Security → Health, on Android in Health Connect.

Measurements, photographs and nutrition data. Weight, body measurements, "before/after" photographs, meals, macronutrients and targets are health data, processed only with your explicit consent, and used to show your progress, build your analytics and — if you linked a trainer — to show them to that trainer. Photographs are stored in Yandex Object Storage; we do not use them to train AI models. Photographs of meals and labels are sent to an AI model for recognition (section 14).

Medical disclaimer. Gloox does not provide medical services; it is a fitness and nutrition tracking application. The AI coach is not a doctor, dietitian or physiotherapist, and its recommendations do not replace consultation with a qualified healthcare professional, diagnosis or treatment.

Consult a doctor before starting any training programme, particularly if you have a chronic condition or an injury, a heart or blood pressure condition, if you are pregnant, or if you are returning to training after a long break or surgery. If you feel pain, dizziness, breathlessness or any unusual symptom while exercising, stop immediately and seek medical help. Do not use the app to diagnose or treat a medical condition, and do not delay seeking medical advice because of something the AI coach said. Nutrition targets generated by the app are general estimates, not a prescribed diet; if you have a medical condition affecting your diet, follow your doctor's instructions rather than the app's.

16. Russian Users and Federal Law No. 152-FZ

This section applies if you are in the Russian Federation.

Basis of processing. We process your personal data with your consent, which you give by creating an account and entering your data in the app. For data concerning health — weight, measurements, progress photographs, nutrition records, and health information you write in the AI chat — consent is separate and explicit, as Article 10 of Federal Law No. 152-FZ of 27 July 2006 "On Personal Data" requires.

Where your data is processed, honestly. Part of our infrastructure is in Russia: the proxy server ru-api.gloox.app, which speeds up access for users there, and Yandex services (Object Storage, AppMetrica, Metrica). Part is abroad: our company is in the United Kingdom, our backend hosting is outside Russia, and AI requests are processed abroad.

We do not claim that your data is localised in Russia — it is not. Your data — including, if you turn it on, data from Apple Health and Health Connect — is transferred across borders, including to the United Kingdom, the European Union, the United States and other countries where our processors operate. By using Gloox you consent to this cross-border transfer, including to countries that may not provide protection equivalent to Russian law. If that is unacceptable to you, do not use the app and delete your account.

Withdrawing consent. You may withdraw consent at any time, in either of two ways: delete your account in the app (Profile → delete account), which withdraws consent and removes your data; or send a written request to support@gloox.app from the e-mail address linked to your account. After withdrawal we stop processing your data and delete it, except where the law requires us to retain particular records. Withdrawal means the app can no longer be used, because processing your training and body data is what the app does.

Other rights. You may ask us to confirm that we process your data, to tell you what we hold and where it came from, to correct inaccurate or incomplete data, and to block or delete data that is unlawfully obtained or no longer needed — write to support@gloox.app. You may also complain to Roskomnadzor or go to court.

Payments in Russia. Card payments on our website are processed by YooKassa. We do not receive or store your card details.

17. Contact Us

For any question about this policy, about the data we hold, or to exercise any of the rights above:

E-mail: support@gloox.app

GymLab Diary LLP
Stoney Works, 8 Stoney Lane
London SE19 3BD
United Kingdom

Please write from the e-mail address associated with your Gloox account, so we can identify you without asking for extra documents. If our response does not satisfy you, you may complain to the Information Commissioner's Office (ico.org.uk) in the UK, to the supervisory authority of your country of residence in the EEA, or to Roskomnadzor in Russia.