Privacy policy

Last updated 2026-09-06

GymPilot ("the app") is developed by Viral Tandel, trading as Viral Labs. This policy explains what information the app collects and how it is used. The short version: the app is local-first. Your workouts, collections, programs and history live on your device, and you can use the app fully without creating an account.

Information we collect

Stored on your device only. Your saved workouts, collections, programs, schedule, workout history, streaks and preferences. This data never leaves your device.

Workout links you import. When you paste or share a public link from TikTok, Instagram, YouTube or Facebook, the link is sent to our server (a Cloudflare Worker we operate). The server fetches publicly available information about that post: the title, caption, transcript and up to 8 images from the post itself. It sends that content to Google Gemini (gemini-2.5-flash), Google's AI service, to convert it into a structured workout. The AI is called from our server, so no AI credentials ship inside the app. Only the link you chose leaves your device: the app has no camera or photo-library access at all, and nothing from your photos or other apps is ever sent. The link and extracted content are used only to build your workout. We do not access your social-media accounts, we do not download videos, and the app does not work on private posts.

No accounts. The current version of the app has no sign-in and no cloud sync. Your library never leaves your device except for the import processing described above.

Purchases

The app uses RevenueCat to manage in-app purchases and subscriptions. When you make a purchase, RevenueCat receives a transaction identifier and an anonymous app user ID to validate and manage your purchase. See RevenueCat's privacy policy at revenuecat.com/privacy. Payment is processed entirely by Apple; we never see your payment details.

Analytics

The app may collect anonymous usage analytics through PostHog, such as which features are used and basic device information, to help us improve the app. Analytics are not tied to your identity and are never sold.

Data sharing

We do not sell your personal information. Third-party services we rely on: Apple (payments), RevenueCat (subscription management), Google Gemini (AI processing of the public post content you import), PostHog (anonymous analytics) and Cloudflare (hosting of our API and this website).

Data retention and deletion

All app data is stored on your device and is deleted when you delete the app. Links you import are processed transiently: our server fetches the public post, sends it to Google Gemini for analysis, returns the result to your device, and retains nothing. No server-side copies of the post, its images or the extracted workout are kept.

Children's privacy

The app is not directed at children under 13 and we do not knowingly collect personal information from children.

Your rights (GDPR and CCPA)

You may request access to, correction of, or deletion of your personal data at any time by emailing us. We honor applicable rights under GDPR and CCPA.

This website

This site is static. It sets no cookies of its own and has no login. If a web analytics measurement id is configured, Google Analytics is loaded to count page views and link clicks in aggregate. The App Store links on this site pass through a redirect on our own domain so we can see which page sent you, and nothing else.

Not affiliated

GymPilot reads publicly available post pages to extract exercise information. Not affiliated with, endorsed by, or sponsored by TikTok, Instagram, YouTube or Facebook.

Changes

We may update this policy. Changes will be posted on this page with the date above.

Contact

Questions? Email viral.b.tandel@gmail.com.