Privacy Policy

Updated at 2026-10-02

GainWagon is a training app. To suggest your next set we have to store what you lifted, and that is health data. We would rather be specific about it than hide behind boilerplate.

This policy describes every category of data we actually hold, every company we actually send it to, and what we do not collect at all. If something here does not match what the app does, that is a bug in this page and we want to hear about it.

Who we are

GainWagon s.r.o., Kupeckého 5, 821 08 Bratislava, Slovakia, is the data controller for everything described here. You can reach us at info@gainwagon.com.

This policy covers gainwagon.com, its subdomains, and the GainWagon mobile app.

What we collect

Your account

• Account id: the internal identifier that ties your training data to you
• Email address: your identity in the app, and where we send sign-in links and service email
• Name: optional, shown in the app
• Profile picture: optional, only if you upload one
• Language and units: your locale and whether you use kilograms or pounds
• Onboarding state: whether you have finished setting up

Health and fitness data

This is the heart of the app, and the reason the rest of this policy exists.

• Bodyweight: the figure you enter so we can weight bodyweight exercises correctly
• Diet mode: whether you are eating in a deficit or a surplus
• Every set you log: reps, weight, resistance band, your bodyweight at the time, and whether you hit the target effort
• Personal records: the lift, the date, the reps, and the weight
• Your progression model, derived per exercise: projected one-rep max, the weight and reps we will suggest next, how fast you are advancing, calibration state, consecutive missed targets, and deloads since your last record
• Streaks: how many consecutive weeks you have trained a given exercise

We use this to generate your plan, pick your next weight, and show your progress. Nothing more.

Reading from Apple Health or Health Connect. On iPhone and Android you can fill in your bodyweight from Apple Health or Health Connect instead of typing it. We ask for read-only access to one measurement, your body weight, and only when you tap the button. We never write anything back, and we never read in the background.

The app takes the most recent body weight and shows it to you. If you confirm it, that one number is saved to your account, exactly as if you had typed it. The underlying samples and the dates they were recorded never leave your phone. If you decline, or there is nothing to read, nothing is sent at all.

What you write

• Exercise notes: free text you attach to an exercise
• Plan and session names, including any you rename yourself
• Check-in answers: when the app asks how a week went, or how a plan is working for you, we store your answer. These are self-reported and often health-adjacent, so we treat them like the rest of your training data.

Sign-in credentials

We do not use passwords. Depending on how you sign in, we store:

• Magic link tokens: short-lived, tied to your email address
• Apple and Google account links: the provider and its identifier for you
• Passkeys: the credential id, its public key, device type, and supported transports
• Session tokens, so you stay signed in

Purchases

• Subscription: which store you bought through (Apple, Google, or Stripe) and that provider's identifier
• Entitlement: when your access expires
• Referrals: your referral code, and Stripe Connect details if you join the referral programme

Product analytics

Actions in the app (creating a plan, finishing a session, subscribing) send a server-side event to Vercel Analytics. These events are cookieless and carry no user id, so they are not linked to you. We use them to see which features get used.

Search

When you search in the app, the text reaches our server. If you are signed in, your session comes with it, so searches are associated with your account.

What we do not collect

Stated plainly, because the old version of this page implied otherwise:

• No passwords, because the app is passwordless by design
• No IP addresses stored against your account
• No phone number, mailing address, or billing address
• No date of birth or age
• No precise location, and no map or location services
• No advertising identifiers, and no cross-site or cross-app tracking

We do not serve ads, we do not sell your data, and we have never integrated an advertising, remarketing, or social tracking pixel.

Why we are allowed to hold it

Under the GDPR:

• Performance of a contract: your account, plans, training history, progression model, and subscription. Without these the app cannot work.
• Explicit consent: health and fitness data. You give it when you start training with us, and you can withdraw it by deleting your account.
• Legitimate interest: security, error reporting, and cookieless product analytics.

Who we share it with

We do not sell your data. These are the only companies that receive any of it, and only to run the service:

Sentry runs in your browser only. We deliberately do not run it on the server, and we do not send it personally identifying request data.

We will also disclose data where the law requires it, such as a court order or a valid request from law enforcement. If GainWagon is ever sold or merged, your data moves with the service and stays under a policy at least as protective as this one.

Where your data goes

We are based in Slovakia and our database is hosted in the EU. Some of the companies above are based in the United States and process data there under the EU-US Data Privacy Framework or standard contractual clauses.

How long we keep it

We keep your training data for as long as your account exists. Your history is the product, and old sessions are what the progression model reads.

When you delete your account, we delete your data. Residual copies may persist briefly in routine backups before they age out.

Your rights

Delete your account

You can delete your account yourself, from your account settings. It removes your user record and your profile picture. There is no form to fill in and no one to email first.

Export your data

You can export your full training history as a CSV file from the plan editor, at any time.

Everything else

You have the right to access your data, correct it, restrict or object to how we use it, and withdraw consent. Email info@gainwagon.com and we will respond within one month.

If you think we have handled your data badly, you can complain to the Slovak Data Protection Authority (Úrad na ochranu osobných údajov SR, dataprotection.gov.sk).

Children

GainWagon is not for children under 16, and we do not knowingly collect data from them. If you are a parent or guardian and believe your child has an account, email us and we will delete it.

Security

Traffic is encrypted in transit. We are passwordless, so there are no password hashes to steal, and card numbers never touch our servers. Apple, Google, and Stripe handle payments. Access to production data is limited to people who need it.

No system is perfectly secure, and we will not pretend otherwise.

Cookies

We set three cookies, all of them necessary. See the cookie page for what each one does and how to change your settings.

California residents

The CCPA gives you the right to know what personal information we collect, to request its deletion, and to equal service if you exercise those rights. Both are covered above and available to everyone, not just California residents. We do not sell personal information.

Changes to this policy

When we change what we collect, we change this page, and we will tell you in the app before the change takes effect. If you do not agree with an update, you can delete your account.

Contact us

Questions about any of this, or something on this page that looks wrong:

• Via email: info@gainwagon.com