GymFork Privacy Policy

Jump to a section

Effective date: September 26, 2026

The short version

• We only collect what the app needs to track your food and workouts.
• You make an account with your email or with Apple at the end of the sign-up quiz, so your logs are backed up and come back on a new phone.
• We only send you tips and offers if you tick the box that says so. Every one has an unsubscribe link.
• We never sell your data. We don’t use it for ads, and there are no ad trackers in the app or on our website.
• The camera is only used to scan barcodes and take progress photos. A barcode’s camera image is read on your phone and never saved or sent anywhere, and progress photos never leave your phone.
• Meal reminders, the workout plan and its calendar are off unless you turn them on. Reminders are made on your phone, and the calendar never leaves it.
• Apple Health data is only shown to you in the app. We never copy it to our server or save it anywhere, we never use it for ads or marketing, and we never sell it.
• Connecting WHOOP is optional. If you do, your WHOOP data passes through our server to your phone while you look at it, and neither keeps it.
• Apple handles your payment. We never see your card number.
• You can see, fix, download or delete your data any time. You can delete your account right in the app, and it’s deleted right away.
• GymFork is for people 16 and older. If you’re 16 or 17, section 12 explains the extra protections.

1. Who we are

GymFork is an iPhone app for logging workouts and tracking food and calories. It is made by Flint Social Marketing, operating as Flint AI Systems, a sole proprietorship in Nova Scotia, Canada. In this policy, “we”, “us” and “our” mean that business.

This policy covers the GymFork app and our website, gymfork.com. It explains what we collect, why, who else sees it, how long we keep it, and what you can do about it.

The person responsible for privacy is Kade Lavoie, our privacy officer. Canadian privacy law requires every business to name someone for this job. You can reach them at privacy@gymfork.com.

2. What we collect, why, where it’s kept and who else sees it

We only collect what you give us or what you allow the app to read. At the start of the sign-up quiz, after your age, we ask for your OK to store your food, workout and body info so the app can work.

Your account. The last step of the sign-up quiz makes your account. You can type your email address and enter the 6-digit code we email you, or use Sign in with Apple. There’s no password and no phone number. Your account lets us back up your logs and bring them back if you get a new phone.

Backups. The app keeps your logs and progress photos out of your iCloud backup. Our server is the backup for your logs, but never for progress photos.

What we don’t collect: your location, your contacts, your phone number, your real name (unless you type it in yourself), your card number, your phone’s advertising ID, what you do in other apps and websites, the camera image when you scan a barcode, your other calendar events, the PR cards you share (see section 3), the Health data the app reads from Apple Health (it’s shown to you in the app and never sent to us), or your WHOOP data (it passes through our server to you and isn’t kept, see section 4).

Emails from us.

• Account emails. We email your sign-in code when you ask for one, and we may email you about your account, like a big change to this policy. You don’t need to say yes to these, because the app can’t work without them.
• Tips and offers, only if you said yes. At sign-up there’s a box that says “Email me tips and offers from GymFork”. It’s never ticked for you and it isn’t part of agreeing to the terms. If you tick it, we may email you tips and offers about GymFork. Every one of these emails says who sent it, gives our mailing address, and has an unsubscribe link. When you unsubscribe, we stop within 10 business days at most (the longest Canada’s law allows), and usually right away. You can also untick it in the app under Profile. If you’re 16 or 17, the app doesn’t show this box, and we don’t send you tips or offers.
• Support. We email you to answer a message you sent us.
• Waitlist. We email waitlist members only about the launch (see section 7).

3. Food logging, the camera, your calendar and sharing

How you log food. You can search for a food, scan its barcode, pick it from your recent or favourite foods, make your own custom food, quick add calories and macros you type in yourself, or copy a meal you logged before. In My meals, you can build a meal from ingredients with grams, save it, and log it again in one tap. You can edit every portion, before and after you save it. If you’d rather not count, you can log a meal roughly without weighing, or tap a usual meal you set up once and pick smaller, usual or bigger. All of this is stored like the rest of your food log: on your phone, and backed up on our server.

Ranges, Meals today and tips. Your calorie and protein goals are shown as ranges, and you choose how much the app shows: no numbers, some, or every number. Meals today gives each meal a colour from the food data (sugar, salt and fat, plus protein, fibre and vegetables), and the tips come built into the app. Both are worked out on your phone, and nothing is sent anywhere to make them.

Meal ideas. The app suggests example meals that fit your targets and how you eat. They’re ideas, not orders, and they’re built into the app, so looking at them sends nothing anywhere. If you log one, it goes in your food log like any other food.

Water and body measurements. You can log the water you drink and your body measurements (waist, chest, arms, thighs, hips and neck). They’re stored like your other logs: on your phone, and backed up on our server.

Extra tracking. Profile > Extra tracking has optional extras for people who want more: a sleep log, body fat %, a quick check before a workout, reps left in each set, and a supplements tick list. They’re off unless the quiz or you turn them on. Anything you log there is stored like your other logs. Body fat % and the supplements list are hidden if you’re 16 or 17.

Where the food data comes from. Generic foods, like an apple or a chicken breast, come from USDA FoodData Central and Health Canada’s Canadian Nutrient File. Both are built into the app, so searching them sends nothing anywhere. To find a branded food or a barcode, the app sends your search words or the barcode number to our server. It looks them up in our own copy of the Open Food Facts database (Canadian and US products) and doesn’t keep them. If a barcode isn’t in our copy, our server asks Open Food Facts for it, sending only the barcode number, so your IP address never reaches them.

The camera. The app uses your camera for two things only: scanning barcodes and taking progress photos. It asks for your OK the first time you need it. When you scan a barcode, the camera image is read on your phone to find the barcode number. That image is never saved, and it never leaves your phone. Only the barcode number is used, as explained above. You can say no and search for foods instead. To turn camera access off later, open your iPhone’s Settings app and go to Privacy & Security > Camera.

Progress photos stay on your phone. Progress photos you take or pick are kept on your phone only, inside the app. We never upload them, never sync them and never back them up, and the app keeps them out of your iCloud backup like the rest of its data. So they don’t move to a new phone, even though your other logs do. They’re deleted when you delete them, delete your account or delete the app. To pick a photo you already have, the app uses Apple’s photo picker, which gives the app only the photos you pick, so it never needs access to your photo library. Deleting a progress photo in the app doesn’t touch the original in your Photos app. If you’re 16 or 17, progress photos are turned off.

Meal reminders, habit reminders and the rest timer. Meal reminders are off unless you turn them on in Profile > Meal reminders and pick a time for a meal. Habit reminders and the evening check-in are off unless you turn them on too. If you’ve already logged that meal, the app skips its reminder. When you tick a set, the rest timer can also tell you your rest is up while you’re in another app. The app asks your OK to send notifications the first time you need one, never when you first open it. If you say no, the timer still counts down inside the app. These notifications are made on your phone, and none comes from our server. To turn them off later, open your iPhone’s Settings app and tap Notifications, then GymFork.

Your workout plan, reminders and calendar. These are off unless you turn them on in Profile > Workout plan. If you do, the app asks your OK to send notifications (unless you already said yes), so it can remind you about workouts. The reminders are made on your phone and don’t come from our server. The app also asks for full access to your calendar, because the smaller “add events only” option doesn’t let an app move events it already added. The app makes its own calendar called “GymFork”, reads and writes only that calendar, and never reads your other events. Nothing about your calendar or your reminders leaves your phone. The calendar connection belongs to each phone: a new phone asks you again before it touches its calendar. When you turn the calendar off, or delete your account, the app deletes the GymFork calendar and its events. If you delete the app without turning the calendar off first, iOS keeps that calendar in your Calendar app, and you can delete it there.

Sharing a PR card. You can make an image of a personal record (a PR, like your best lift) and share it through your iPhone’s share sheet. Only you start it, it goes only where you choose, and nothing goes to us. Once you share it, what happens to it is up to the app or person you sent it to.

No AI. The app doesn’t use AI. Your targets, your workout week and the weekly check-in’s suggestions come from formulas and rules, and every food comes from a food database or from what you type in.

4. Apple Health and WHOOP

Apple Health

Connecting Apple Health is optional. The app only reads or writes Health data after you allow it on Apple’s own permission screen, and you choose each type of data one by one.

Apple Health can hold data from other devices you connected to it, like an Apple Watch, a Garmin, an Oura ring or a WHOOP. The app sees that data only through Apple Health, with the same permissions.

How we use it. Only to run the features you turned on, like showing your bodyweight trend, counting your workouts and cardio minutes, showing your sleep and heart numbers, and saving your meals and workouts to Apple Health. We only write entries you saved yourself.

Where it’s kept. Health data the app reads stays in Apple Health on your phone. The app reads it live, each time it shows it to you. We never copy it to our server and never save it anywhere else, not even in the app’s own storage on your phone. So there’s nothing of it for us to keep or delete. The meals, workouts and weights the app saved to Apple Health stay there until you delete them in the Health app.

Our promises about Health data:

• We never use it for ads or marketing.
• We never sell it, and we never give it to data brokers (companies that buy and sell personal data) or ad networks.
• We never copy it to our server, and we never store it in iCloud or anywhere else.
• We never send it to RevenueCat or anyone else.

How to turn it off. Open the Health app, tap Summary, tap your picture or initials, tap Apps under Privacy, then tap GymFork and turn off what you want. You can also stop syncing in our app under Profile > Apple Health.

WHOOP

Connecting a WHOOP account is optional.

• How you connect. In Profile > Extra tracking > WHOOP, tap Connect, sign in on WHOOP’s own page, and choose to allow GymFork. We never see your WHOOP password.
• What we read. Your recovery score, heart rate variability (HRV), resting heart rate, sleep, strain and WHOOP workouts. We only read. We never write anything to your WHOOP account, and we don’t ask for your WHOOP profile or body measurements.
• Where it goes. When you open a screen that shows WHOOP data, our server asks WHOOP for it and passes it straight to your phone. Neither our server nor the app keeps it. The key WHOOP gives us to keep the connection open is stored on our server, encrypted, and the app can’t read it.
• Our promises. We never use your WHOOP data for ads or marketing, we never sell it, and we never send it to anyone else.
• How to disconnect. In Profile > Extra tracking > WHOOP, tap Disconnect. That tells WHOOP to stop our access and deletes the key. Deleting your account does the same. You can also remove GymFork in your WHOOP account settings.
• What WHOOP learns. WHOOP knows you connected GymFork. WHOOP’s privacy policy covers what WHOOP does with your data.

5. Payments

You buy subscriptions through Apple. Apple takes the payment, so we never see your card number or billing address. Apple tells us, through RevenueCat, which plan you have, when it started, when it renews or ends, and the country and currency of the purchase. We use this only to unlock what you paid for and to count how many people subscribe. Apple’s own privacy policy covers what Apple does with your payment details.

6. Crash reports and ads

• There are no ads and no ad tools in the app.
• We don’t track you. “Tracking” means linking what you do in our app with data from other companies’ apps or websites for ads, or passing your data to data brokers. We don’t do it, so the app never asks for permission to track you.
• We don’t sell your data or share it for ads.
• There are no analytics or crash tools in the app. We don’t record which screens you open or which buttons you tap.
• If you’ve turned on Share With App Developers in your iPhone settings, Apple sends us crash reports. They don’t include your name or email. You can turn this off in your iPhone’s Settings app, under Privacy & Security > Analytics & Improvements.

7. Our website and waitlist

Waitlist. If you join the waitlist, we collect only your email address. We ask for your clear OK first, which Canada’s anti-spam law (CASL) calls express consent. We use your email only to tell you when GymFork launches and to send a few updates about it. You can unsubscribe any time: every email has an unsubscribe link. When you use it, we stop within 10 business days at most (the longest the law allows), and usually right away. Your email is stored with Netlify, our website host. After you unsubscribe, we keep your email only on a “do not email” list, so we never email you by mistake.

No ad trackers. Our website has no ad trackers, no ad pixels (hidden code that reports your visit to ad companies), and no cookies for ads. If we count visits, we use a simple counter that uses no cookies and doesn’t record who you are.

Server logs. Like every website, our web host briefly records technical details like your IP address to show you the page and block attacks.

8. Who else sees your data

We use a few outside companies to run GymFork. They are service providers, which means they work for us and may only use your data to do that work.

• Supabase runs our server in Canada. It keeps your account (your email address and account ID), the backup of your logs and your WHOOP key if you connect a WHOOP, and looks up branded foods and barcodes.
• The company that sends our emails sends your sign-in codes, account emails and, only if you said yes, tips and offers. It gets your email address and the email we’re sending, nothing else.
• RevenueCat keeps track of your subscription status and any creator’s referral code you typed in, using only your account ID.
• Apple handles payments, Sign in with Apple, Apple Health on your phone, and crash reports if you allow them. Apple can also tell the app your age range if your iPhone shares it, and, in some US states, whether a parent approved the app. If a parent withdraws that approval, Apple tells our server so we stop backing up that account.
• WHOOP, only if you connect it, gets your OK when you connect and our requests for your data. We send WHOOP nothing else about you.
• Netlify, our website host stores waitlist emails.
• Our email provider handles support emails.

Every company we share data with must protect it at least as well as this policy does.

What you share yourself. When you share a PR card, it goes to the app or person you pick, not to us.

Food databases. When a barcode isn’t in our own copy of the Open Food Facts database, our server asks Open Food Facts for it. They get the barcode number only, never your IP address or anything else about you. USDA FoodData Central and the Canadian Nutrient File are built into the app, so they get nothing.

We may also share data if the law makes us, like a valid court order, or if it’s needed to protect someone from serious harm. Where the law lets us, we’ll tell you first.

If GymFork moves to a new company that we set up, or is sold or merged, your data would move with it. The new owner would have to follow this policy, and we’ll tell you before it happens.

We never sell, rent or trade your personal data. We never give it to data brokers or ad networks.

9. Where your data is stored and how we protect it

What our server keeps is stored in Canada, by Supabase in its Canada (Central) region. Some of our service providers, like Apple, RevenueCat, the company that sends our emails, WHOOP and Netlify (our website host, which also keeps the waitlist), work in the United States, so some of your data may be processed there. While it’s in the United States, US laws apply, and US courts or government may be able to get it.

How we protect it:

• Your data is encrypted (scrambled so outsiders can’t read it) while it travels between your phone and our servers.
• Our database is locked so each account can only read its own data.
• Our secret keys, the ones that give full access to our systems, and your WHOOP connection keys stay on our server and never go inside the app.
• Only the people who build and run GymFork can get into our systems, and only when they need to, for example to fix a problem you reported.

No system is perfectly secure, but we work hard to keep your data safe, and we’ll tell you if something goes wrong (see section 13).

10. How long we keep your data

Deleting the app from your phone doesn’t delete your account. Your backup stays on our server, so it comes back if you sign in again. To delete it, use Delete account (section 11).

We may keep a small amount of data longer when the law requires it, for example a record of a privacy request you made or of a security problem.

11. Your rights and choices

You can:

• See your data. The law calls this your right of access. Most of it is right in the app.
• Fix it if it’s wrong. You can edit almost everything right in the app.
• Download it in a common file format you can take to another app. In the app, go to Profile > Account > Export my data.
• Delete it. In the app, go to Profile > Account > Delete account. This deletes everything at once:
  • Our server deletes your account right away, with your email address, your choice about tips and offers, your backup, your WHOOP key and everything else it keeps about you.
  • We tell Apple to disconnect your Sign in with Apple from the app, and we tell WHOOP to stop our access.
  • We delete your record at RevenueCat.
  • The app deletes your data from your phone, then shows a screen confirming it’s done.
  • We keep anonymous purchase records for accounting and tax, with nothing that identifies you: the plan bought, the dates, whether it was a real purchase or a test one, and any creator’s referral code used, so we can pay that creator their commission. Copies in our backups are gone within 90 days.
  • Deleting your account or the app does not cancel your Apple subscription. To cancel, open Settings on your iPhone, tap your name, then tap Subscriptions.
• Take back your OK (the law calls this withdrawing consent) for the camera, notifications, your calendar, Apple Health, WHOOP, tips and offers, or waitlist emails, any time. This won’t undo what already happened, and a feature may stop working without it.
• Ask how your targets were set. Your starting calorie and macro targets, your workout week and the starting weights we suggest are worked out by formulas and rules from your quiz answers, with no person involved. If you’re 16 or 17, a different formula made for teens is used, and the app never suggests eating less. Each week, the check-in can suggest new calorie targets from what you logged and your weight trend. That maths runs on your phone only, the suggestion is labelled as an estimate, and it’s never applied by itself: your targets change only if you tap to accept. You can see what went into your targets and change them any time.

For anything the app can’t do by itself, email privacy@gymfork.com from the email address you signed up with, or tell us your account ID, which you’ll find in the app under Profile > Account. If you used Sign in with Apple with “Hide My Email”, the account ID is the easiest way for us to find you. We may ask a question to make sure it’s really you. We answer within 30 days, and it’s free.

Canada. These rights come from PIPEDA, Canada’s main privacy law for businesses, and, for people in Quebec, Law 25, Quebec’s privacy law. If you’re not happy with how we handled your data, please tell us first so we can fix it. You can also complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca or 1-800-282-1376. People in Quebec can also complain to the Commission d’accès à l’information du Québec at cai.gouv.qc.ca.

Everywhere else. Wherever you live, you can make the same requests and we’ll honour them.

• Europe and the UK: Under the GDPR (Europe’s privacy law) and the UK’s version of it, we use your data because you asked us to provide the app (our contract with you) and, for health data, because you gave your clear OK. You can also object to how we use your data, and you can complain to your local data protection authority.
• United States: We don’t sell your data, we don’t share it for targeted ads, and we don’t use it to make decisions about you that have legal effects. Some states, like Washington and Nevada, have laws just for health data. For those laws: section 2 lists the health data the app uses, where it comes from (you, Apple Health if you allow it, and WHOOP if you connect it, see section 4), why we use it, where it’s kept and who we share it with. We only collect it with your OK, and we never sell it. If we turn down a request, you can ask us to look at it again by replying to our answer with the word “appeal”.
• We will never treat you worse for using any of these rights.

12. Children and teens

GymFork is only for people 16 and older. The app asks your age before anything else and won’t let anyone younger go on, so nothing is saved and no account is made for them. Where your iPhone shares it, the app also checks the age range Apple gives it, and stops the same way if Apple says you’re under 16. We don’t knowingly collect data from anyone under 16. If we find out someone under 16 made an account, we’ll delete it within 14 days. If you’re a parent and think your child under 16 is using GymFork, email privacy@gymfork.com.

If you’re 16 or 17:

• We collect only what the app needs to work, the same as for adults. The only extra thing is the month and year you were born, so the app knows when you turn 18.
• We never sell your data, never use it for ads, never share it for ads and never collect your location. (That’s true for everyone.)
• We don’t send you tips or offers, and the app doesn’t show that box.
• Your plan fuels training and growing. The app never sets a weight-loss goal or a calorie deficit for you, and it won’t let a target go below a safe minimum.
• Streaks and progress photos are turned off, and so are body fat % and the supplements list.
• In some US states, Apple asks a parent to approve downloads and purchases for under-18s. If a parent withdraws approval, Apple stops the app from opening, and we stop backing up the account.
• When you turn 18, the app tells you and lets you choose adult settings.

13. If there’s a data breach

A breach means someone got into data they shouldn’t have. If a breach could seriously hurt you (Canadian law calls this a “real risk of significant harm”, like identity theft or embarrassment), we will tell you as soon as we can and report it to the Office of the Privacy Commissioner of Canada, as the law requires. If people in Quebec are affected, we’ll also report it to Quebec’s Commission d’accès à l’information. We’ll also tell any other regulator the law requires. We keep a record of every breach, even small ones.

United States. The US Federal Trade Commission (FTC), the government agency that protects consumers, has a Health Breach Notification Rule that covers apps like ours that track diet and fitness. If a breach affects US users’ health data, we will tell them without unreasonable delay, and within 60 days of finding it, and we’ll tell the FTC as that rule requires.

14. Changes to this policy

If we change this policy, we’ll update the date at the top. If it’s a big change, we’ll tell you in the app and by email before it takes effect. We will never start using your data in a new way without asking you first.

15. Contact us

• Privacy officer: Kade Lavoie
• Business: Flint Social Marketing, operating as Flint AI Systems, a sole proprietorship in Nova Scotia, Canada
• Email: privacy@gymfork.com
• Mail: 5300 Morris Street, Halifax, NS

For help using the app, email support@gymfork.com.