GymPilot ("the App") is developed by Viral Tandel. This policy explains what information the App collects and how it is used. The short version: the App is local-first — your workouts, collections, programs, and history live on your device by default, and you can use the App fully without creating an account.
Stored on your device only: your saved workouts, collections, programs, schedule, workout history, streaks, and preferences. This data never leaves your device.
Workout links you import: when you paste or share a public social-media link (TikTok, Instagram, YouTube, Facebook), the link is sent to our server (a Cloudflare Worker we operate), which fetches publicly available information about that post — title, caption, transcript, and up to 8 images from the post itself — and sends it to Google Gemini (gemini-2.5-flash), Google's AI service, to convert it into a structured workout. The AI is called from our server, so no AI credentials ship inside the App. Only the link you chose leaves your device: the App has no camera or photo-library access at all, and nothing from your device's photos or other apps is ever sent. The link and extracted content are used only to build your workout; we do not access your social-media accounts.
No accounts: the current version of the App has no sign-in and no cloud sync — your library never leaves your device except for the import processing described above.
The App uses RevenueCat to manage in-app purchases and subscriptions. When you make a purchase, RevenueCat receives a transaction identifier and an anonymous app user ID to validate and manage your purchase. See RevenueCat's privacy policy at revenuecat.com/privacy. Payment is processed entirely by Apple / Google; we never see your payment details.
The App may collect anonymous usage analytics (via PostHog) such as which features are used and basic device information, to help us improve the App. Analytics are not tied to your identity and are never sold.
We do not sell your personal information. Third-party services we rely on: Apple/Google (payments), RevenueCat (subscription management), Google Gemini (AI processing of the public post content you import), PostHog (anonymous analytics), and Cloudflare (hosting of our API and these pages).
All data is stored on your device and is deleted when you delete the App. Links you import are processed transiently: our server fetches the public post, sends it to Google Gemini for analysis, returns the result to your device, and retains nothing — no server-side copies of the post, its images, or the extracted workout are kept.
The App is not directed at children under 13 and we do not knowingly collect personal information from children.
You may request access to, correction of, or deletion of your personal data at any time by emailing us. We honor applicable rights under GDPR and CCPA.
We may update this policy; changes will be posted on this page.
Questions? Email viral.b.tandel@gmail.com.