1. Who We Are

Gainfully is a fitness tracking application built and operated by Jesper Larsen ("we", "us", "our"). Questions about this policy or your data: support@gainfully.app

2. What Data We Collect

We collect the following when you use Gainfully:

• Account: your name and email address, provided when you register
• Profile: optional fields you fill in yourself: age, body weight, height, fitness level, and training goals
• Workout data: the exercises, sets, reps, weights, and timestamps you log in the app
• AI conversations: messages you send to the AI trainer and the responses generated
• Subscription status: whether you are on the free or Pro plan

We do not collect your location, contacts, camera or microphone access, or any health data beyond what you actively choose to log.

3. How We Use Your Data

Your data is used to run the app and nothing else:

• To sign you in and keep your account secure
• To store and show your workout history and progress
• To give the AI trainer context so its responses are based on your actual training data
• To manage your subscription and verify purchases
• To send transactional emails: account confirmation and password reset

We do not use your data for advertising, profiling, or anything beyond operating Gainfully.

4. Legal Basis for Processing (GDPR)

For users in the European Economic Area, we process your data on these legal bases:

• Contract (Art. 6(1)(b)): processing needed to deliver the service you signed up for
• Consent (Art. 6(1)(a)): for optional profile data and AI coaching, which you can withdraw at any time
• Legal obligation (Art. 6(1)(c)): where required by applicable law

5. Third-Party Services

Three processors handle specific parts of the service on our behalf:

• Supabase (database and authentication): your account, profile, and workout data is stored in Supabase's infrastructure, hosted in the EU. Supabase Privacy Policy
• Anthropic (Claude API): messages you send to the AI trainer are sent to Anthropic's API to generate responses. Anthropic does not use your messages to train their models. Anthropic Privacy Policy
• RevenueCat: verifies subscription status via the App Store and Google Play. RevenueCat receives your anonymised user ID and subscription events, not your payment details. RevenueCat Privacy Policy

Payment processing is handled entirely by Apple and Google. We never see or store your payment card information.

6. Data Retention

We keep your data for as long as your account is active. If you delete your account (Profile → Delete Account in the app), everything is permanently deleted from our systems within 30 days: your workouts, programs, AI conversations, and profile.

7. Your Rights (GDPR)

If you are in the EEA, you have the following rights:

• Access: request a copy of the data we hold about you
• Rectification: correct inaccurate data via your profile settings
• Erasure: delete your account and all associated data from within the app
• Portability: request an export of your data in a machine-readable format
• Objection: object to processing where we rely on legitimate interest
• Withdraw consent: at any time, without affecting anything processed before that point

To use any of these rights, email support@gainfully.app. We respond within 30 days.

8. Data Security

All data travels over encrypted HTTPS. Passwords are stored as hashed values, never in plain text. Database access uses Row Level Security: each user can only read and write their own data, enforced at the database level.

9. Children's Privacy

Gainfully is not intended for children under 13. If you believe a child has created an account, contact us and we will delete it immediately.

10. Changes to This Policy

If we make significant changes, we will notify you via the app or email before they take effect. The "last updated" date at the top always shows the most recent revision.

11. Contact

support@gainfully.app