Privacy Policy

Who this covers

This policy applies to the Gym Buddy app for iPhone and Android and to the pages at gymbuddyrhino.com. The app is developed and operated by an independent developer based in Australia (“we”, “the developer”). Write to support@gymbuddyrhino.com with any question about this policy or about the data we hold.

Data stored on your device

Everything you build up in the app lives in its private storage on your phone:

• Workouts: names, exercises, and the sets, reps and weights for each.
• Session history: the date, workout name and number of sets completed for each finished session. This is what drives your streak and the activity heatmap.
• Settings: your gym’s name, its country (kept only to choose which holiday badges you see) and equipment list, unit and appearance preferences, and a random identifier the app generates on first launch (see My Gym below).

The country of your gym, or one you choose in Settings, decides which holiday badges appear. It is a preference stored on your phone; it is not your location and it is not sent to us.

Unless you sign in and back up (see Signing in and cloud backup below), we never see this data: it is not uploaded or synced. It is included in any iCloud, Google or computer backup you make of your phone, under Apple’s or Google’s terms, in the same way as any other app’s data. Deleting the app deletes it from the phone.

Sessions you bring in. Settings, Data, Bring my history reads an export file from Strong, Hevy or Gym Buddy on your phone and adds its sessions to your history. The file is read on the device and is not uploaded. Once added, those sessions are treated like any other: they are part of the training brief Rhino receives, and they are included in a backup if you are signed in.

Matching exercise names. When you bring in history, paste a routine or open a shared workout, some exercise names may not be on the app’s list. If you tap Match, only those names are sent to our server so it can suggest the right exercise from the list; the sets, weights, dates and everything else stay on your phone. The names are not stored or logged. Nothing is sent unless you tap Match.

Progress photos. If you take or choose progress photos in the app, they are stored in the app’s private storage on your phone and nowhere else. They are not uploaded to us, are not part of the optional cloud backup, are never sent to Rhino, and cannot be shared from the app. They are included in any iCloud or Google backup you make of your phone, under Apple’s or Google’s terms, and deleting a photo in the app deletes it from the phone. Camera and photo-library access are asked for only when you tap a feature that needs them.

Data sent to generate Rhino’s replies

Rhino is a large language model. It does not run on your phone. When you create a workout, ask Rhino to revise one, or send a chat message, the app transmits the following to a server operated by the developer, over an encrypted (HTTPS) connection:

• The messages in the current conversation, including everything you have typed into it and Rhino’s earlier replies.
• When you chat from inside a workout, or ask Rhino to revise one: that workout’s name, exercises, sets, reps and weights, and how far through it you are.
• When you create a workout: the names of your existing workouts, so the new one can be given a name that does not clash, and the equipment list of your gym if you have set one.
• When you ask Rhino to name a piece of equipment from a photo: that photo, after the phone has taken out where and when it was taken and which camera took it. It is used only to produce the name and is not stored.
• When you pick a gym on the My Gym page and nobody has listed its equipment yet: the gym’s name, so Rhino can suggest a list.
• A training brief, so the plan fits you: the exercises, sets, reps and weights you have logged, your saved workouts, your training goal and days a week, your gym and its equipment, your Rhino rank and today’s readiness word, how hard you said your recent sessions and lifts were (the effort and “How was that?” ratings you tap in the app), and, where you have set them, your age, your maximum and resting heart rate and the heart-rate zones the app shows you, so Rhino can talk about your own zones. If you have set a name in Settings it is sent too, so Rhino can address you by it; the server never stores it. Never your sex. Your body weight, your resting heart rate and the workouts in your history are part of this brief even where the app first read them from Apple Health or Health Connect, because they are part of your training record.
• Only if you agree: a few rounded lines from Apple Health or Health Connect (last night’s sleep, heart-rate variability and resting heart rate against your usual, the week’s protein, energy balance, steps and mindful minutes, body fat if known), and today’s readiness worked out with them. No dates and no raw samples. The app asks once, the first time Rhino could use them (“Share health data with Rhino?”), and nothing goes until you tap Allow. You can change your answer at any time under Settings, Workout, Rhino can see my health data.
• A random identifier the app generated when it was first launched, so the server can apply fair-use limits per install. It is not your device serial, advertising identifier or Apple ID, and it is reset if you reinstall the app.

Since September 2026 every Rhino request goes through the developer’s server rather than to the model directly, and the server holds each install to a fair-use allowance of messages per hour and per day. The server records which kind of request it was (a chat, a plan, a name) and when, to operate those limits, and keeps no copy of your messages after the reply is sent.

The server uses this text solely to generate the reply that is shown to you. It is not used to train models, is not sold, and is not shared with advertisers or data brokers. The server is hosted by the developer and the model runs there; your messages are not forwarded to a third-party AI provider.

A chat request is counted against your account when you are signed in, and against the install otherwise. That is what the fair-use allowance is measured on and what the server records alongside the kind of request and the time. The app does not send your email address, your contacts, your location, or any device or advertising identifier other than the random install id above. As with any internet request, the server necessarily receives your IP address in order to send the response back; standard connection logs are kept only as long as needed for operating and securing the service.

My Gym and shared equipment lists

The app searches a worldwide directory of gyms that is held on a server operated by the developer. Until September 2026 that directory shipped inside the app and was searched on your phone; it is now asked for over the internet, so the text you type into the gym search box is sent to that server, along with the usual details of any web request. Those searches are recorded so that gyms people look for and cannot find can be added, and they are kept for 90 days. They are not attached to your name, your email, your Apple ID or the identifier the app uses for equipment lists.

The directory is built from Overture Maps Foundation data, OpenStreetMap (© OpenStreetMap contributors, ODbL) and gym chains’ public location pages, and it is rebuilt monthly on the developer’s server. Overture’s places include data from Foursquare (© 2025 Foursquare Labs, Inc., Apache License 2.0), Meta and Microsoft; the suburb, the state or region and the country come from Overture’s division boundaries, which include geoBoundaries and Esri Community Maps (CC BY 4.0). The country on a directory row is what fills in the gym country described above, which chooses your holiday badges and is never treated as your location. Each search is logged with the number of results it found, to see which gyms are missing. It is not joined to an account, to the random identifier below, or to your history, and as with any request the server sees your IP address for the moment it answers.

If you choose a gym and keep an equipment list for it, the app publishes that list to a server operated by the developer so other members of the same gym can start from it instead of typing it out. What is sent is the gym’s identifier, your equipment list, and a random identifier the app generated when it was first launched. That identifier lets the server replace your earlier list when you edit it and count how many people contributed; it is not linked to your name, email, Apple ID, device serial or advertising identifier, and it is reset if you reinstall the app. Lists are combined before they are shown to anyone: other members see “3 members listed 24 items here”, never who listed what.

If you mark a place “Not a gym” or answer “Yes, I train here”, the app sends the gym’s identifier, your answer and the random identifier described above, and your account if you are signed in. The server stores a scrambled form of the first part of your IP address with the answer (a keyed hash of your network, never the address itself), only to tell answers from different networks apart. Answers are used only to decide which places the directory shows, are never shown to anyone, and are deleted after 12 months, or sooner with Delete all data (below).

If your gym is missing you can add it (name, and the suburb and the state or region it is in, in whichever country you train); that entry becomes part of the shared directory for everyone. Please do not put personal information in a gym name.

Sharing workouts

You can share a workout as a link or a QR code. The whole workout (name, exercises, sets, reps and weights) is compressed and encoded inside the link itself, along with your latest body weight and your sex if you have set one, so that the other phone can offer to match the weights to whoever is receiving it. Those two are in the link and nowhere else, so only the person you sent it to ever sees them. Nothing is uploaded and no copy is kept on any server. Anyone who receives the link or scans the code can open the workout, so share it as you would share the workout itself. The page at gymbuddyrhino.com/w that opens when the app is not installed decodes the link in your browser and does not send its contents anywhere.

So that the app can tell you when someone has added a workout you shared (the “Buddy” app icon), the server keeps one small record per share: a short random share code, the random identifier of the phone that shared it, and the random identifier of each phone that added it, with the dates. The workout itself is never sent to the server. These identifiers are not linked to your name, email, Apple ID or account; what the server can see is that one installation shared something another installation added. If you are offline when you share, the link is made without a share code and nothing is recorded. Records of shares nobody added are deleted after a year.

Friend streaks (optional). After two phones have exchanged a workout, each can choose to keep a streak with the other. If you accept, your phone sends the server the calendar dates that count towards your own streak (trained days and covered rest days) for the last 60 days, and receives the same from your friend’s phone. The server holds those dates against the two random installation identifiers and nothing else: no names (you name your friend on your own phone and that name never leaves it), no times, no workouts, no heart rate. Either person can leave at any time, which deletes the pair and all of its dates for both. Nothing is shared until both have accepted.

Friends league (optional). If you join, your phone sends the server one number each week: the XP it worked out for you for that week, against the same random installation identifier, and receives your friends’ numbers back. No names and no workouts. Your phone’s own date for today travels with the number, so the server can check that the week is one you have had; it is used for that and is not stored. Only the people you already keep a friend streak with can see your number, and it reaches them against the shared identifier for that streak rather than against anything of yours. Leaving deletes your numbers, and the server deletes every number older than eight weeks.

Scanning a QR code uses the camera. Frames are processed on the device to find a code and are not saved or transmitted.

Apple Health, Health Connect and the lock screen

Apple Health on iPhone and Apple Watch, and Health Connect on Android, are optional. The app asks for access only when you turn them on, reads and writes only what you allow on the system’s own permission screen, and works without them.

• Read from Apple Health: heart rate, resting and walking heart rate, heart-rate variability, respiratory rate, blood oxygen, sleep, wrist temperature during sleep, VO2 max, workouts, physical effort, active and resting energy, exercise minutes, steps, mindful minutes, body weight, waist, body fat percentage, lean body mass, and the energy, protein, carbohydrate and fat that other apps log.
• Written to Apple Health: your finished workouts, with their heart rate, beat-to-beat intervals, heart-rate variability and active energy, and any body weight, waist or body fat percentage you enter in the app.
• Read from Health Connect: heart rate, resting heart rate, heart-rate variability, respiratory rate, oxygen saturation, sleep, weight, VO2 max, exercise sessions, active and total calories burned, distance, nutrition, steps, body fat, lean body mass and mindfulness sessions.
• Written to Health Connect: your finished workouts, with their heart rate, heart-rate variability and active calories, and any body weight you enter in the app.

The app uses these to show your heart rate during a workout, to work out readiness, recovery and your heart-rate zones, to bring workouts you did with other apps into your history, and to keep the body log in step. All of that is worked out on the phone. Health data leaves the phone only in these ways: the summary for Rhino, sent only after you agree (above); the body weight, resting heart rate and workouts that are part of Rhino’s training brief (above); and, if you sign in, the backup described below, which keeps what the app has saved from Health as part of your training: heart rate for each session, workouts brought in from Health, body weight and measurements, and your resting heart rate.

Health data is never used for advertising or marketing, never sold, never used to train models, and never shared with third parties except when you direct it, for example by sharing a workout yourself. Gym Buddy’s use and transfer of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements.

Your rest timer can also appear on the lock screen as a Live Activity; that shows only the timer and exercise name and stays on your phone. On Android the rest timer runs as a notification instead.

Heart-rate straps and Bluetooth

If you pair a heart-rate strap or band, the app connects to it directly over Bluetooth and reads only its heart rate. The readings are handled on the phone like heart rate from Health: shown live, kept with the session, and saved to Apple Health or Health Connect if you have that on. On iPhone the app asks only for Bluetooth. On Android 12 and later it asks only for Nearby devices, and declares that it never uses the scan for location. On Android 11 and older, Android itself requires the location permission before any app can scan for Bluetooth devices, so the app asks for it there for that reason only. On every phone the app never reads, stores or sends your location.

Signing in and cloud backup (optional)

You can use the whole app without an account, and nothing below happens unless you choose to sign in. If you do, Gym Buddy offers Sign in with Apple and Google Sign-In so your training can be backed up and restored on a new phone, or after reinstalling, and so that invites and a Rhino Pro bought on this website can follow you.

• What signing in sends. Apple or Google gives the app a signed identity token, which is passed to our server to verify who you are. From it the server keeps only the stable, provider- specific identifier for your account and, if the token includes one, your email address. We never receive your Apple or Google password. Signing in with both providers links them to the same account. For each phone or browser that is signed in, the server also keeps its random identifier and when it was last used, so it can be signed out.
• Email about the account, and nothing else. When an account is created we send one welcome message to the email address from your first sign-in, explaining what the account does and how to delete it. If you later link a second provider, that same first address gets a short note saying which sign-in was added, so you would know if it was not you. Both are sent through Resend. There is nothing else: no newsletters, no marketing, no reminders, and the second provider's address is never written to.
• What a backup contains. Your workouts, your session history (including the heart rate recorded for each session and workouts brought in from Apple Health or Health Connect), your settings, your body-weight log and your body measurements, including any read from Health. Your name, age and sex are taken out of the settings before upload and stay on the phone, and progress photos are never included. The backup is tied to your account, stored on the developer’s own server, in Australia, and used only to give it back to you.
• When a backup happens. While you are signed in, the app backs up on its own after you save a workout, finish a session, or bring history in, and whenever you tap Back up now. Deleting things never triggers a backup. This is a backup rather than live sync between devices.
• Deleting your account. Settings → Account → Delete account removes the account, the linked sign-ins and every backup from the server, permanently and immediately, with your invite codes and the friend-streak, league, share and equipment-list records of every phone signed in to it.
• Deleting all data instead. Settings → Data → Delete all data deletes your workouts and history from the phone at once. What the phone has left on our server is hidden at the same moment: friend streaks (which end for your friend straight away), league entries, the weekly events it finished, shared workouts and who added them, equipment lists, its answers about which places are gyms, and its link to any gym it added to the directory. If you are signed in and also tick “Also delete my backup”, your cloud backups are hidden the same way. Everything hidden is erased for good after 30 days. Until then, Settings → Data offers to undo it, which brings all of it back and restores your workouts from the backup if there is one. Workouts that were never backed up cannot be recovered. This does not close your account, and your purchase record, the count of free Rhino messages you have used, and when you first used Rhino are kept as before, so your free allowance does not start again.

Signing out leaves your data on the phone and on the server; deleting the account removes the server copy. We do not use any of it to train models, and it is never sold or shared with advertisers.

Purchases (optional)

Rhino Pro and the icon pack are sold in three places, and who holds your payment details depends on which one you bought through.

• The App Store, on iPhone and iPad. Apple takes the payment and tells us only that a purchase happened: which product it was, whether it is still active, and when it renews or expires. We never see your card, your Apple ID, your name or your email. Subscriptions renew automatically until cancelled in your App Store account settings, at least 24 hours before the end of the current period, and refunds are handled by Apple.
• Google Play, on Android. Google takes the payment and sends us the same kind of notice and no more: the product, whether it is still active, and when it renews. We never see your card, your Google account, your name or your email. Subscriptions are cancelled under Subscriptions in the Play Store app, and refunds are handled by Google.
• This website, through Stripe. A web purchase is the one that works differently. Stripe takes your card details and your email address and keeps them as the payment processor; our server is never sent either, and does not store them. Here the developer is the seller rather than a store, so any refund is the developer’s to issue. You have to be signed in to buy this way, and what our server keeps is the customer reference Stripe gives the purchase, so that the renewals, failed payments and refunds Stripe reports afterwards can be matched back to your account and nobody else’s. Changing the card, changing the plan and cancelling are all in Stripe’s own customer portal, which this site opens for you.

Buying on this website is open to people in Australia and the United States. Stripe asks for your billing address and uses it to work out the tax. Our server keeps the country of that address only when a purchase from somewhere else has to be refunded, as the record of why.

Whichever way you bought, the rest is the same:

• What our server keeps. That purchase state, and the store notifications behind it, against the random identifier for your install. If you sign in for cloud backup, the purchase is attached to your account instead so it follows you to a new phone; that is the only way a purchase is ever linked to you.
• The free allowance. Without Pro, Rhino answers a fixed number of messages a week. The server keeps a count per week against your account when you are signed in, and against the random identifier for your install otherwise, and nothing else about the messages.
• Invites. An invite code belongs to an account, and only a signed-in account can use one. If you share your invite link, or arrive on somebody else’s, the server keeps the code and the claim against the two accounts, with the dates, so the extra month can be paid to both sides when a yearly plan actually starts. The badge an invite unlocks is worked out on your own phone from those same facts, and nothing more is sent. Deleting your account deletes them.
• What we do with it. Unlocking what you paid for, and counting how many people start a trial and stay. Nothing is sold, and there are no advertising identifiers involved.
• Restoring what you paid for. A purchase made in a store is restored on a new phone from that same store; a purchase made on this website follows the account you were signed in to. Buying in one place does not cancel a subscription bought in another, because only the store that sold it can end it.

This website

The pages at gymbuddyrhino.com, fonts included, are served from the developer’s own server, which sees your IP address in order to send them. The site sets no cookies and runs no analytics. It keeps a few small things in your browser: the language you picked on the footer’s language links, and a note that it has already guessed your language once, which is forgotten when you close the browser.

The Rhino Pro page keeps two more: your answer to where you live, and a random identifier for the browser that is sent when you sign in, as the app sends its own. While you are signed in it keeps your session for that tab only, and forgets it when the tab is closed. That page also loads Google’s and Apple’s sign-in buttons from their own servers, so Google and Apple receive your IP address when it opens and handle a sign-in under their own privacy policies, which may include their own cookies. Checkout and the customer portal are Stripe’s pages, described above.

What we do not do

• No account is required. Signing in is for backup, invites and a Rhino Pro bought on this website, and everything else works without one.
• No crash-reporting service and no user tracking. The app does send anonymous usage counts to TelemetryDeck, a privacy-preserving analytics service. The whole list of what they count: that the app was opened and which screens were opened; how far setup got and that it finished; that a workout was saved or a session finished; that the get-to-know-you session was started, finished or put off, whether it was the gym or the bodyweight version, and whether it was a retest; that the paywall was shown, dismissed or bought from; that a trial started, a purchase was made, or a purchase was restored; that the free preview ran out, that a note about its end was shown, and whether its offer was taken up or put off; that a locked insight or a blurred Rhino reply was seen; that Rhino’s allowance for the week was reached; that a reminder was tapped, and which kind of reminder it was; that a review was asked for; that a workout was shared, and that a shared workout was imported with the weights matched; that a friend streak was formed; that a lift reached a new strength level, and which lift and which level; that a break was declared, and how many days it was for; that the welcome-back card was shown or its workout started, with how long the gap was in bands of days; how long it has been since the last workout, in bands of days, when the app is opened; that notifications are on, off or not yet asked for; that a permission was granted; that one of the bundled programs was started or ended, which of the six it was and how it ended; that the exercise guide was opened, and which door it was opened by; that the one-rep-max calculator was opened; that a history was brought in from another app, which app it came from, how many sessions it held in bands, how it ended and whether it was started from setup or from Settings, and that an import was undone; that a reminder was switched off, and which of the reminders it was; that something was added to the body log, and whether that was measurements or a photo; and that the Holidays row in Settings was changed, and which of its three answers was given: never which country; how each exercise of a workout finished in the app compared with its plan and with the app’s last suggestion for it and whether that suggestion was taken, and the same for the first session of each program day against the heaviest you had logged before, so the suggestions can be improved: the kind of equipment (barbell, dumbbell, machine or bodyweight), the units, the lifting experience you gave, whether the sets were ticked on the phone, on a watch or from the lock screen, and counts of sets, effort ratings and differences in reps and in weight steps, never an exercise name, a date or a weight; how many sessions a history import brought in and what share of them had effort ratings, in bands; the rep range chosen in Settings; and, if you join the weekly league, that its screen was opened and, on the Monday after a week ends, whether you came first, second or third, or further back, in bands and never as a rank. The body-log count is a count and nothing else: never a measurement, never a value, and never the photo, which does not leave your phone at all. Each count carries the app’s id, a session id for that run, and a one-way hash of a random string the app minted on first launch. There is no device identifier, no advertising identifier, no exercise name, weight or date from your workouts, and nothing that could be joined back to you. You can turn these counts off in the app under Settings, Data, Usage counts. Turning them off also forgets the random string, so turning them back on starts a fresh count that cannot be joined to the old one.
• No advertising and no advertising identifiers.
• No third-party software development kits that report data to anyone.
• No access to your microphone or contacts, and the app never reads your location (on Android 11 and older the location permission is asked for only because Android requires it for Bluetooth scanning, see Heart-rate straps and Bluetooth). Camera and photo-library access is asked for only when you tap a feature that needs it (taking a progress photo, naming equipment from a photo, scanning a QR code), and Apple Health or Health Connect access only when you turn it on.
• No cookies or trackers set by this website (see This website).

Health information

Training records such as exercises, weights and reps may be considered health-related information in some jurisdictions. Those records stay on your device unless you sign in and back up, as described above. Anything you choose to tell Rhino about your body, injuries or health is transmitted as described above; it is your choice what to include, and we recommend keeping it general.

Nothing Rhino says is medical advice. Please read the disclaimer.

Children

Gym Buddy is not directed at children under 13, and we do not knowingly collect information from them. Unless you have signed in, we cannot identify individual users; if you believe a child has sent personal information through the chat, contact us and we will delete any corresponding server records we are able to locate.

Your rights

Your workouts and history are under your direct control: edit or delete them in the app, or delete the app to remove them from the phone. If you have signed in, you can delete your account and every backup from the server in the app at any time (Settings → Account → Delete account), or write to us to ask what we hold for your account or to have it deleted. Delete all data in Settings, Data hides what your phone left on our server at once and erases it after 30 days; until then you can undo it there. Without an account we hold no name, email or identifier that leads to you, so we generally cannot connect a server-side record to a particular person; contact us and we will help where we can. Australian users may also complain to the Office of the Australian Information Commissioner; users in the EU or UK to their local supervisory authority.

Changes to this policy

Any change will be published at this address with a revised effective date. If a future version of the app sends additional data, or sends it somewhere new, this policy will be updated before that version is released and the change described plainly.

Contact

Questions about this policy can be sent to our support address.