Privacy

Privacy policy

Last updated 2026-10-07

GymPilot ("the app") is developed by Viral Tandel, trading as Viral Labs. This policy explains what information the app collects and how it is used. The short version: the app is local-first. Your workouts, collections, programs and history live on your device, and you can use the app fully without creating an account.

Information we collect

Stored on your device only. Your saved workouts, collections, plans, schedule, workout history, streaks and preferences, including the answers you give when you set up the app (goal, experience, where you train, days per week and an optional first name). This data never leaves your device.

Workout links you import. When you paste or share a public link from TikTok, Instagram, YouTube or Facebook, the link is sent to our server (a Cloudflare Worker we operate). The server fetches publicly available information about that post: the title, caption, transcript and up to 8 images from the post itself. It sends that content to Google Gemini (gemini-2.5-flash), Google's AI service, to convert it into a structured workout. For YouTube links, the server also passes the public video's address to Gemini, which watches that public video directly. The app asks for your agreement before the first link is sent. The AI is called from our server, so no AI credentials ship inside the app. Only the link you chose leaves your device: the app has no camera or photo-library access at all, and nothing from your photos or other apps is ever sent. The link and extracted content are used only to build your workout. We do not access your social-media accounts, we do not download videos, and the app does not work on private posts.

No accounts. The current version of the app has no sign-in and no cloud sync. Your library never leaves your device except for the import processing described above.

Notifications and Face ID

Workout reminders, streak reminders and the rest timer's alert are local notifications: your iPhone schedules and shows them, and nothing about them is sent to us. They need your permission, which you can withdraw in the iPhone Settings app. The optional App Lock uses Face ID through iOS; the app only learns whether the check passed and never receives your face data.

Purchases

The app uses RevenueCat to manage in-app purchases and subscriptions. When you make a purchase, RevenueCat receives a transaction identifier and an anonymous app user ID to validate and manage your purchase. See RevenueCat's privacy policy at revenuecat.com/privacy. Payment is processed entirely by Apple; we never see your payment details.

Analytics

The app may collect anonymous usage analytics through PostHog, such as which features are used and basic device information, to help us improve the app. Analytics are not tied to your identity and are never sold.

Data sharing

We do not sell your personal information. Third-party services we rely on: Apple (payments), RevenueCat (subscription management), Google Gemini (AI processing of the public post content you import), PostHog (anonymous analytics in the app), Microsoft Clarity (anonymous usage analytics on this website only, never in the app) and Cloudflare (hosting of our API and this website).

Data retention and deletion

All app data is stored on your device and is deleted when you delete the app. Links you import are processed transiently: our server fetches the public post, sends it to Google Gemini for analysis, returns the result to your device, and retains nothing. No server-side copies of the post, its images or the extracted workout are kept.

Children's privacy

The app is not directed at children under 13 and we do not knowingly collect personal information from children.

Your rights (GDPR and CCPA)

You may request access to, correction of, or deletion of your personal data at any time by emailing us. We honor applicable rights under GDPR and CCPA.

This website

This site is static. It has no login, no sign-up and no forms, so there is nothing here for you to fill in and nothing for us to store about you.

Two analytics tools may load on these pages. Both are loaded only after your first scroll or tap, so neither delays the page.

Microsoft Clarity records anonymous usage: which pages you visit, how far you scroll, where you click, and a replay of your movement through the page. It is used to find layout and navigation problems. Clarity masks page text and any input by default, we do not send it your name, email or any account information, and we do not use it to identify you. Clarity sets cookies for this purpose, both on this domain and on Microsoft's own domains, and those include a Microsoft advertising identifier that Microsoft syncs with Bing. That identifier is Microsoft's, not ours: we do not run ads, we do not build audiences, and we send Microsoft nothing about you beyond what the recording itself contains. Microsoft describes the data it collects and how to opt out in the Microsoft Privacy Statement.

Google Analytics counts page views and link clicks in aggregate, and only if a measurement id is configured.

The App Store links on this site pass through a redirect on our own domain so we can see which page sent you, and nothing else. None of this applies to the GymPilot app itself: Clarity runs on this website only and is not in the app.

Not affiliated

GymPilot reads publicly available post pages to extract exercise information. Not affiliated with, endorsed by, or sponsored by TikTok, Instagram, YouTube or Facebook.

Changes

We may update this policy. Changes will be posted on this page with the date above.

Contact

Questions? Email viral.b.tandel@gmail.com.