Privacy Policy

Updated at 2026-10-15

GainWagon is a training app. To suggest your next set we have to store what you lifted, and that is health data. We would rather be specific about it than hide behind boilerplate.

This policy describes every category of data we actually hold, every company we actually send it to, and what we do not collect at all. If something here does not match what the app does, that is a bug in this page and we want to hear about it.

Who we are

GainWagon s. r. o., Kupeckého 5, 821 08 Bratislava, Slovakia, is the data controller for everything described here. You can reach us at info@gainwagon.com.

This policy covers gainwagon.com, its subdomains, and the GainWagon mobile app.

What we collect

Your account

• Account id: the internal identifier that ties your training data to you
• Email address: your identity in the app, and where we send sign-in links and service email
• Name: optional, shown in the app
• Profile picture: optional, only if you upload one
• Language and units: your locale and whether you use kilograms or pounds
• Onboarding state: whether you have finished setting up
• Consent: that you confirmed you are 16 or older and agreed to us processing your health and fitness data, when you did, and which version of the consent section below you agreed to

Health and fitness data

This is the heart of the app, and the reason the rest of this policy exists.

• Bodyweight: the figure you enter so we can weight bodyweight exercises correctly
• Diet mode: whether you are eating in a deficit or a surplus
• Every set you log: reps, weight, resistance band, your bodyweight at the time, and whether you hit the target effort
• Personal records: the lift, the date, the reps, and the weight
• Your progression model, derived per exercise: projected one-rep max, the weight and reps we will suggest next, how fast you are advancing, calibration state, consecutive missed targets, and deloads since your last record
• Streaks: how many consecutive weeks you have trained a given exercise

We use this to generate your plan, pick your next weight, and show your progress. Nothing more.

Reading from Apple Health or Health Connect. On iPhone and Android you can fill in your bodyweight from Apple Health or Health Connect instead of typing it. We ask for read-only access to one measurement, your body weight, and only when you tap the button. The iPhone app never writes anything back. The Android app writes only your watch workouts, and only if you turn that on (see below). Neither app reads in the background.

The app takes the most recent body weight and shows it to you. If you confirm it, that one number is saved to your account, exactly as if you had typed it. The underlying samples and the dates they were recorded never leave your phone. If you decline, or there is nothing to read, nothing is sent at all.

Apple Watch and Apple Health. If you train with the Apple Watch app, it asks at the end whether to save the workout to Apple Health. If you tap Save, it is saved as a strength training workout, with the active energy you burned, so it counts toward your Activity rings. If you tap Discard, nothing is saved. To estimate that energy, the watch reads your heart rate and active energy during the workout. All of this stays between your watch and Apple Health. Your heart rate, the energy and the workout itself never reach our servers.

Wear OS and Health Connect. If you turn on Save watch workouts under Account, the Android app writes each workout you train with your watch to Health Connect on your phone. It is off by default. Each workout records when it started, when it ended, and that it was strength training. Nothing else is written, and none of it is sent to our servers. Turn the setting off and the app stops writing. Workouts it already saved stay in Health Connect until you delete them there.

Training you log offline. Both apps keep what you log in a queue on your phone until it reaches our servers, together with a copy of your next session so you can train without a connection. The queue lives in the app's private storage, and on Android it is left out of device backups. Changes drop out of it once they have synced. The queue belongs to your account. While you are signed out nothing in it is sent, and signing in with a different account discards it, as does deleting your account. If you sign out with changes still unsynced, the app asks before discarding them.

What you write

• Exercise notes: free text you attach to an exercise
• Plan and session names, including any you rename yourself
• Check-in answers: when the app asks how a week went, or how a plan is working for you, we store your answer. These are self-reported and often health-adjacent, so we treat them like the rest of your training data.

Sign-in credentials

We do not use passwords. Depending on how you sign in, we store:

• Magic link tokens: short-lived, tied to your email address
• Apple and Google account links: the provider and its identifier for you
• Passkeys: the credential id, its public key, device type, and supported transports
• Session tokens, so you stay signed in

Purchases

• Subscription: which store you bought through (Apple, Google, or Stripe) and that provider's identifier
• Entitlement: when your access expires
• Referrals: your referral code, and Stripe Connect details if you join the referral programme

Product analytics

Actions in the app (creating a plan, finishing a session, subscribing) send a server-side event to Vercel Analytics. These events are cookieless and carry no user id, so they are not linked to you. We use them to see which features get used.

Search

When you search in the app, the text reaches our server. If you are signed in, your session comes with it, so searches are associated with your account.

What we do not collect

Stated plainly, because the old version of this page implied otherwise:

• No passwords, because the app is passwordless by design
• No IP addresses stored against your account
• No phone number, mailing address, or billing address
• No date of birth or age
• No precise location, and no map or location services
• No advertising identifiers, and no cross-site or cross-app tracking

We do not serve ads, we do not sell your data, and we have never integrated an advertising, remarketing, or social tracking pixel.

Why we are allowed to hold it

Under the GDPR:

• Performance of a contract: your account, plans, training history, progression model, and subscription. Without these the app cannot work.
• Explicit consent: health and fitness data. Before you log your first set, the app asks you to confirm you are 16 or older and to consent to us processing your health and fitness data, with a link to this policy. We record when you agreed and to which version of this section. The app cannot work without this data, so withdrawing consent means deleting your account.
• Legitimate interest: security, error reporting, and cookieless product analytics.

This section's version is 2026-10-08. When it changes, the app asks for your consent again.

Who we share it with

We do not sell your data. These are the only companies that receive any of it, and only to run the service:

Sentry runs on the website, in your browser and on our server, so a server error from a request the apps make reaches it too. The apps themselves do not run it, and we do not send it personally identifying request data. On iPhone, crash reports come from Apple's MetricKit and go to our own servers, not to a third party. On Android, Google Play collects crash and stability data from people who share usage and diagnostics with Google, and shows it to us in aggregate.

For a Google Play purchase, the app sends Google the purchase and an internal id that stands in for your account, and our server checks the subscription with Google.

We will also disclose data where the law requires it, such as a court order or a valid request from law enforcement. If GainWagon is ever sold or merged, your data moves with the service and stays under a policy at least as protective as this one.

Where your data goes

We are based in Slovakia and our database is hosted in the EU. Some of the companies above are based in the United States and process data there under the EU-US Data Privacy Framework or standard contractual clauses.

How long we keep it

We keep your training data for as long as your account exists. Your history is the product, and old sessions are what the progression model reads.

When you delete your account, we delete your data. Copies can remain in our database backups, which we keep only to restore the service if something breaks.

Your rights

Delete your account

You can delete your account yourself, in the app under Account, or on the web at gainwagon.com/delete-account, which works without the app. It removes your user record and your profile picture. There is no form to fill in and no one to email first, though you can also email us and we will do it for you. Deleting your account does not cancel a subscription bought through the App Store or Google Play, so cancel that in the store first.

Export your data

You can export a plan's progress as a CSV file from that plan's page, one plan at a time. It holds every set you logged in that plan, with what we prescribed for it. For a full copy of everything we hold about you, email info@gainwagon.com.

Everything else

You have the right to access your data, correct it, restrict or object to how we use it, and withdraw consent. Email info@gainwagon.com and we will respond within one month.

If you think we have handled your data badly, you can complain to the Slovak Data Protection Authority (Úrad na ochranu osobných údajov SR, dataprotection.gov.sk).

Children

GainWagon is not for children under 16, and we do not knowingly collect data from them. If you are a parent or guardian and believe your child has an account, email us and we will delete it.

Security

Traffic is encrypted in transit. We are passwordless, so there are no password hashes to steal, and card numbers never touch our servers. Apple, Google, and Stripe handle payments. Access to production data is limited to people who need it.

No system is perfectly secure, and we will not pretend otherwise.

Cookies

We set three cookies, all of them necessary. See the cookie page for what each one does and how to change your settings.

California residents

The CCPA gives you the right to know what personal information we collect, to request its deletion, and to equal service if you exercise those rights. Both are covered above and available to everyone, not just California residents. We do not sell personal information.

Changes to this policy

When we change what we collect, we change this page, and we will tell you in the app before the change takes effect. If you do not agree with an update, you can delete your account.

Contact us

Questions about any of this, or something on this page that looks wrong:

• Via email: info@gainwagon.com