Privacy policy
Effective · Last updated
Your training log is personal, and cycle data even more so. This policy explains what personal data Gibky collects, why, the legal basis for each use, who processes it, how long we keep it and the rights you have. It is written to meet the EU and UK General Data Protection Regulation (GDPR) and Google's API Services User Data Policy.
Who is responsible for your data
Gibky is run by an individual, who is the data controller for the personal data described in this policy:
- Controller
- Marco David Galindo Samayoa
- Country
- Guatemala
- Postal address
- 01057
- support@getgibky.com
We have not appointed a data protection officer or a representative in the EU or UK. If you are in the EU or UK and have a question about your data, including anything you would raise with a representative under Article 27 GDPR, write to support@getgibky.com.
What data we collect
We collect only what you give us and what is needed to sign you in and run the app. By category:
- Account data from Google
- When you sign in with Google through our sign-in provider Stytch, we receive your name, email address and profile picture link, and Stytch keeps your Google account identifier to recognise you next time. We store your name, email, picture link and a Stytch user id. We ask Google only for the basic sign-in permissions (openid, email and profile), so we never get access to your Gmail, Google Drive, contacts, calendar or any other Google data.
- Your profile
- Display name, avatar colour, weight unit, display level and the names of your routines.
- Training data
- Workouts you log or import (date, routine, exercises, sets, weights, reps, how hard a set felt, notes, start and end times), custom exercises and exercise names you confirm, per-exercise notes and rest times, your training profile (goal, experience, days per week, equipment, plates and bar), your routine and its schedule, how weights go up for each exercise, strength goals, body weight entries and saved AI coaching reports.
- Daily check-ins
- Energy and sleep ratings (1 to 5) for a day, if you log them.
- Cycle and health data
- Only if you turn cycle tracking on: period start and end dates, your tracking mode (for example natural cycle, hormonal contraception, pregnancy or perimenopause) and, if you add them, day logs of flow, symptoms, mood, notes, morning (basal body) temperature and ovulation (LH) test results. This is health data, a special category of personal data under Article 9 GDPR.
- Feedback
- If you send feedback from the contact page: its category, your message, the page it was sent from and your browser's user agent (browser and operating system name).
- Technical data
- The sign-in cookies described under Cookies, and standard request logs kept by our hosting provider Vercel (IP address, time, requested address and browser type). Stytch records sign-in and session events, which can include IP address and browser type. Our own error logs are written to leave personal data out.
- Page-view statistics
- Vercel Web Analytics counts page views without cookies: the page address, the referring site, country, browser, operating system and device type. It stores nothing on your device and tells visits apart only with an anonymous hash that resets every day and is never linked to your account.
- After you delete your account
- We keep one thing: a one-way hash (a scrambled fingerprint made with SHA-256) of your email address, after trimming spaces and lowercasing it, with the date you deleted your account. It holds no other data, cannot be turned back into your email and is never used to contact you. We use it only to recognise the same email if it signs up again, so that, if we offer free trials or introductory offers, each person can use them only once. You can still sign up again. A hash of an email is still personal data (pseudonymised), so the GDPR applies to it.
We don't collect passwords (Google handles your sign-in), payment details, precise location, contacts or advertising identifiers.
Cycle and health data
Cycle tracking is optional. New accounts choose during setup, and you can turn it on or off at any time in Settings → Cycle tracking. It is private to your account: no other user can see it, and we use it only for your cycle calendar, your predictions and your training plan.
When you use an AI feature while tracking is on, a short summary of your current cycle phase, prediction and planned heavier or lighter days is included in the request (see AI features). Nothing else about your cycle leaves our database.
You can export all of it, delete all of it, or turn tracking off at any time from Settings → Data & privacy and Settings → Cycle tracking. Deleting it removes your period logs, day logs and daily check-ins and switches tracking off.
Why we use your data and our legal basis
The GDPR requires a legal basis for each use of personal data. Ours are:
- Running your account and the app
- Signing you in, storing your workouts, check-ins and settings, and building your plans, charts, records and progress. Basis: performing our contract with you (Art. 6(1)(b) GDPR), that is, providing the service you signed up for.
- Cycle and health data
- Your cycle calendar, predictions and cycle-aware training plans. Basis: your explicit consent (Art. 9(2)(a) GDPR), which you give by keeping cycle tracking on and choosing what to log. You can withdraw it at any time by turning tracking off or deleting your cycle data.
- Check-ins and body weight
- Adjusting today's plan to how you slept and feel, and showing your body weight on bodyweight exercises. Basis: our contract with you (Art. 6(1)(b)); because these entries can say something about your health, we also rely on your explicit consent (Art. 9(2)(a)), which you give by choosing to log them. They are always optional.
- AI features
- Sending a summary of your data to Anthropic to answer a request you make. Basis: your consent (Art. 6(1)(a), and Art. 9(2)(a) for any cycle or health data in the summary), which you give by choosing to start an AI feature. Nothing is sent until you do, and if you never use one, nothing is sent at all.
- Security and abuse prevention
- Keeping sessions secure, limiting how often feedback can be sent and investigating misuse. Basis: our legitimate interest in keeping the service and your data safe (Art. 6(1)(f)).
- Feedback and support
- Reading and answering your feedback and emails, and improving the app from them. Basis: our legitimate interest in supporting users and improving the app (Art. 6(1)(f)).
- Page-view statistics
- Counting page views without cookies to see which pages are used. Basis: our legitimate interest in understanding and improving the app (Art. 6(1)(f)).
- Preventing repeat free trials
- Keeping the hash of a deleted account's email (see What data we collect) so that, if we offer free trials or introductory offers, each person can use them only once. Basis: our legitimate interest in preventing repeat use of free trials and introductory offers (Art. 6(1)(f)). You can object by emailing support@getgibky.com.
- Legal obligations
- Keeping or disclosing data when the law requires it. Basis: Art. 6(1)(c).
Where we rely on legitimate interest, you can object (see Your rights).
Google user data
- What we access
- When you choose "Continue with Google", Google shares your name, email address, profile picture link and Google account identifier with us through Stytch, using only the openid, email and profile permissions. We request no other Google data and cannot read your Gmail, Drive, contacts or calendar.
- How we use it
- Only to sign you in, to recognise you on later visits, and to show your name and profile picture in the app. We don't use it for advertising, to build a profile about you or to train AI models.
- How we store it
- Your name, email and picture link are stored in our database (Amazon Web Services, encrypted at rest), tied to your account. Stytch stores your account record and Google account identifier. Your profile picture is loaded directly from Google when the app shows it.
- How we share it
- We don't sell or rent Google user data and never share it with advertisers, data brokers or information resellers. It is processed only by the providers listed under "Who we share data with", to run sign-in and the app. No person reads it unless you ask us to (for example in a support request), it is needed for security or to investigate abuse, or the law requires it.
- How to delete it
- "Delete my account" in Settings → Data & privacy removes it from our database right away (we keep only a one-way hash of your email, see How long we keep your data) and asks Stytch to delete your user record there. You can also remove Gibky's access in your Google Account; that stops future sign-ins but doesn't delete data we already hold, so delete your account too or email support@getgibky.com.
Gibky's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can read the policy on Google's developer site.
AI features
Some features use Anthropic's Claude AI: AI coaching reports, the AI option of Today's workout and the AI workout planner. Only when you start one of them, we send Anthropic a summary of the data it needs: recent sessions (dates, routines, exercises, sets, weights and reps), your best lifts and progress numbers, today's check-in (energy, sleep and any symptoms you logged), your body weight, your training profile (unit, goal, experience, equipment, days per week) and, only if cycle tracking is on, your current cycle phase, prediction and planned heavier or lighter days.
We don't send your email address or your Google account details. The workout planner includes the display name on your profile so the answer can address you.
We save only the coaching reports you get back, in your account, until you delete them or your account.
Under its commercial terms, Anthropic doesn't use API inputs or outputs to train its models, and keeps them only for a limited period for safety and abuse monitoring.
If you never use an AI feature, none of your data is sent to Anthropic.
Automated decisions
The app works out training suggestions automatically: the weights and reps in today's plan, cycle predictions, recovery weeks and AI coaching. They are suggestions for you to accept, change or ignore.
We make no decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR), and we don't profile you for advertising or for any purpose other than your own training. Cycle predictions are estimates, not medical advice and not a contraceptive method.
International transfers
Our providers store and process data in the United States. If you are in the EU, the EEA, the UK or Switzerland, this means your data is transferred outside your country.
We rely on the safeguards each provider offers: the EU-US Data Privacy Framework (and its UK and Swiss extensions) where the provider is certified under it, and otherwise the European Commission's Standard Contractual Clauses in the provider's data processing terms. To ask about these safeguards, write to support@getgibky.com.
How long we keep your data
- Account and training data
- As long as you have an account. "Delete my account" removes it from our database right away, except the email hash below, and asks Stytch to delete your user record there. We don't delete inactive accounts automatically; email support@getgibky.com if you want yours removed.
- Cycle and health data
- Until you delete it or your account. "Delete everything" under Cycle & health data removes it right away.
- AI coaching reports
- Until you delete a report or your account.
- Feedback
- Until you delete your account.
- Email hash after account deletion
- Kept for 2 years (730 days) after you delete your account, then removed. Deleting an account with the same email again starts the 2 years over.
- Sign-in cookies
- The session cookies last up to 30 days (the length of a sign-in session) or until you log out. The Google sign-in cookie lasts at most 10 minutes and is removed as soon as sign-in finishes.
- Backups and logs
- Deleted data can remain for a limited period in encrypted database backups and in our providers' logs until they are rotated out. It isn't used for anything else in the meantime.
- Data on your device
- Local storage stays in your browser until you clear it or delete your account from that browser.
Your rights
Under the GDPR you have the right to:
- Access: get a copy of the personal data we hold about you (Art. 15).
- Rectification: have data that is wrong or incomplete corrected (Art. 16).
- Erasure: have your data deleted (Art. 17).
- Restriction: ask us to limit how we use your data (Art. 18).
- Data portability: receive the data you gave us in a common, machine-readable format, or have it sent to another service (Art. 20).
- Objection: object to any use based on our legitimate interest (Art. 21).
- Withdraw consent: withdraw any consent at any time, for example by turning cycle tracking off. This doesn't affect processing done before you withdrew it (Art. 7(3)).
- No automated decisions: not to be subject to a decision based solely on automated processing that has legal or similarly significant effects on you (Art. 22). We make none.
- Complain: lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work. The European Data Protection Board keeps the list of EU and EEA authorities; in the UK it is the Information Commissioner's Office.
How to use your rights
Most of them work directly in the app:
- Access and portability: Settings → Data & privacy → Import / export downloads your workouts, body weight and check-ins as JSON or CSV, and "Export my cycle data" downloads your cycle data as JSON.
- Rectification: edit your workouts in the Workout log, and your profile, training profile, routine and cycle entries where they are shown.
- Erasure: delete single workouts in the Workout log; "Delete everything" under Cycle & health data deletes your cycle data and check-ins; "Delete my account" deletes your account and all your data, except a one-way hash of your email kept for 2 years to prevent repeat free trials (you can object to it by email). For security, deleting your account needs a sign-in within the last 10 minutes.
- Withdrawing consent: turn cycle tracking off in Settings → Cycle tracking, and simply stop using AI features.
For anything else (restriction, objection, a copy that includes your account data, or a question), email support@getgibky.com from the address you sign in with. We may ask you to confirm your identity. We reply within one month; if a request is complex we may extend that by up to two more months and will tell you why. Using your rights is free.
Security
Every connection is encrypted (HTTPS/TLS), including the one between our servers and the database, and the database is encrypted at rest. Sign-in cookies are httpOnly and SameSite, changes are only accepted from our own site, and every request is checked against your session so data is only ever read for your own account. Sign-in goes through Google, so we never handle passwords.
No system is perfectly secure. If a personal data breach puts your rights at risk, we will notify the competent supervisory authority within 72 hours where the law requires it, and tell you without undue delay.
Children
Gibky is not meant for children. You must be at least 16, or older if the age of digital consent in your country is higher. We don't knowingly collect data from children; if you believe a child has given us data, email support@getgibky.com and we will delete it.
Changes to this policy
When we change this policy we update the dates at the top of this page. For significant changes, such as a new kind of data or a new provider, we tell you in the app or by email before they take effect, and where a change needs your consent we ask for it.
Contact
Questions about this policy or your data? Write to support@getgibky.com, or use the contact page.