Privacy Policy and KVKK Notice
Last updated: 2026-10-28
This policy explains what personal data the Gymliga mobile app and gymliga.com process and why, who we share it with, how long we keep it, and your rights. It is also the notice required by Article 10 of Türkiye's Personal Data Protection Law No. 6698 (KVKK).
1. Data controller
The data controller is Alperen Yalçın, Türkiye. For any question or request: [email protected].
2. What we process and why
We collect your data electronically, through the app and the website: from what you enter, from how you use the app, and from Google or Apple if you sign in with them.
| Data | When | Why | Legal basis (KVKK Art. 5/2) |
|---|---|---|---|
| Guest account identifier | When you first open the app, without signing in | To keep your account and workouts on this phone | Performance of a contract (c) |
| Email address, name, Google or Apple account identifier, password (a one-way hash only) | When you save your account | Signing in and opening your account on another phone; verification and password-reset emails | Performance of a contract (c) |
| Username, avatar and profile photo (optional) | When you pick them for friends and the league; when you upload the photo from your phone | So your friends and your league group can recognise you; the photo is checked automatically for inappropriate content before anyone sees it (OpenAI, §5) | Performance of a contract (c) |
| Profile: the name the app calls you, goal, motivation, experience, sex (or "prefer not to say"), bodyweight, birth year and height (both optional), unit, weekly goal, session length, equipment, time zone, country code | In the first-run questions and in Settings | To personalise your program; to compute your muscle ranks relative to bodyweight, by sex and age; to run your streak and reminders in your local time; to pick the default unit | Performance of a contract (c) |
| Workouts: exercises, sets, reps, weights, start and end time, program, app language | When you log a workout; when you import a Strong or Hevy file | History, stats, ranks, XP, streak, league and weight suggestions | Performance of a contract (c) |
| Game and social data: XP, level, streak, ranks, badges, quests, your league group and standing, your friendships, your invite code, username reports | While you use the app | The game layer, the weekly league, friends, and moderation of inappropriate usernames | Performance of a contract (c); legitimate interest for moderation (f) |
| AI coach comments | When a comment is written for one of your workouts (§3) | To comment on your workout and show it in History | Performance of a contract (c) |
| Purchases: plan, store transaction identifiers, subscription status and dates, amount and currency | When you buy Gymliga Pro | To unlock Pro, handle renewals and refunds, and keep financial records | Performance of a contract (c); legal obligation (ç) |
| Device: installation identifier, platform, app version, language, time zone, push token | When the app starts | To send notifications, to sign a device out, and to tell an old version it must update | Performance of a contract (c); for push, your consent given through the device permission (Art. 5/1) |
| Notification preferences and email delivery records | When you change notification settings; when an email is sent to you | To send the notifications you want and track that an email arrived | Performance of a contract (c); legitimate interest (f) |
| IP address and request metadata | On every request | Security: rate limits, sign-in attempt lockout, abuse prevention; delivering the service | Legitimate interest (f) |
| What you write to us | When you email us | To answer your question or request | Legitimate interest (f); legal obligation for requests (ç) |
We do not sell personal data. The app has no ads, no advertising identifier, and no third-party analytics or tracking tools.
If you turn on "Write to Apple Health" in Settings, the type (strength training), start and end time of each finished workout are written to Apple Health on your iPhone. This happens on your phone; we read no data from Apple Health and no Health data reaches our servers. You can turn the permission off at any time in Settings or in your iPhone's Health settings.
3. AI coach comment
When you finish a workout, Gymliga may write a short comment on it with Anthropic's Claude model: for Gymliga Pro members' workouts (within a daily limit) and for a limited number of free members' workouts.
- Sent to the model: exercise names and muscle groups; sets, reps and weights (in your unit); the same exercises over the last four weeks; your rank changes; the workout's XP, your level and your streak; your goal and experience; the workout's length; whether it is your first workout and the days since your last one; the app language.
- Not sent to the model: your name, username, email, account identifier, age or birth year, bodyweight, height and sex.
- Under Anthropic's commercial terms, this data is not used to train Anthropic's models.
- The comment is generated automatically and is for information only; it is not medical advice, diagnosis or treatment. It does not comment on injuries, pain, nutrition or your body. If you are in pain or have a health condition, talk to a doctor.
- The comment makes no decision about your account: Pro, ranks, XP and the league are computed without it.
4. Who sees your data
- Your friends and your league group (if you are in the same group this week or last week): your username, avatar or profile photo, weekly XP and standing; on your mini profile, your level, streak, muscle ranks and badges.
- Anyone who opens your invite link: your username and avatar or profile photo.
- Shown to nobody else: your workout details and weights, your body measurements, your email and the name the app calls you.
- League groups are not separated by age. The app has no messaging and no feed.
- Our authorised staff can see your account and workout data to handle support requests, username reports and account actions. Every action staff take on an account is logged.
5. Who we share it with
Your data is processed on our behalf by the service providers below, only for the stated purpose. Apple and Google are independent controllers for your accounts and store purchases with them. Where the law requires it, we may share your data with the competent public authorities.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Hetzner | Our servers and database | All of the account data in this policy | Germany |
| Cloudflare | Domain, network delivery and protection; database backups, exercise images and profile photos on R2 | IP address and request metadata; account data in backups | Global network |
| Anthropic | AI coach comment (§3) | The workout data listed in §3 | USA |
| OpenAI | Checking profile photos for inappropriate content | The profile photo you upload, through a short-lived link, only for the check | USA |
| RevenueCat | Subscription and purchase management | Account identifier, purchase history, store transaction identifiers | USA |
| Apple, Google | Store purchases, sign-in with Apple or Google, push delivery | Purchases, sign-in identifier, push token and notification content | USA |
| Expo | Push notification delivery and app updates | Push token, notification content; app version and platform | USA |
| Resend | Account emails (verification, password reset) | Email address and email content | USA (sent from Ireland) |
Most of these providers are outside Türkiye: your data is transferred abroad, for the purposes above and to the countries in the table (KVKK Art. 9).
6. How long we keep it
- Your account, profile, workouts, game and social data, and AI comments: until you delete your account.
- An unused guest account: an account you used without signing in, on which nothing was ever bought, is deleted automatically with all its data after 400 days without use.
- If you delete your account it is deleted immediately and permanently: your profile, sign-ins, workouts, ranks, XP and streak, league memberships, friendships, AI comments and notification preferences. Your address is removed from our email records, your devices are unlinked from the account and their push token is deleted.
- Kept after deletion, without your name or email: subscription and payment records, entitlement history and records of staff actions. They are needed for accounting, refunds and disputes, and carry only an internal identifier.
- Expired sessions, verification links and sign-in attempt records: deleted 7 days after they expire.
- The recipient address in email delivery records: deleted after 90 days.
- The raw content of notifications from the payment provider: deleted 90 days after they are processed.
- Database backups: kept for a limited period, then deleted. A deleted account leaves the backups at the end of that period.
- Kept by others: Apple, Google and RevenueCat keep their own purchase records under their own policies. Resend deletes email content and logs after 30 days.
- On your phone: the workout in progress, workouts not sent yet, and a cache. They are removed when you delete the app.
7. Your rights (KVKK Art. 11)
Under Article 11 of the KVKK you have the right to:
- learn whether your personal data is processed and, if so, request information about it;
- learn the purpose of the processing and whether the data is used accordingly;
- know the third parties, in Türkiye or abroad, to whom it is transferred;
- ask for it to be corrected if it is incomplete or wrong;
- ask for it to be erased or destroyed under the conditions of KVKK Art. 7;
- ask for a correction or erasure to be passed on to the third parties it was transferred to;
- object to an outcome against you that arises solely from automated analysis of your data;
- claim compensation if you suffer damage from unlawful processing.
How to apply: you can delete a saved account yourself in the app: Settings → Delete account. For a guest account and for every other request, write to [email protected]; so we can find your account, write from the email address registered to it or tell us your username. You can also ask for a copy of your data. We will answer within 30 days at the latest, free of charge (KVKK Art. 13). You can withdraw your permission for push notifications at any time in Settings or in your phone's settings. If your request is refused, you find the answer insufficient or you get no answer in time, you can complain to the Personal Data Protection Board (KVKK Art. 14).
8. Age limit
Gymliga is for people aged 13 and over; we do not knowingly collect data from children under 13 and delete such an account when we learn of it. A parent can write to [email protected] for that. The app does not verify age; the birth year is optional and used only to compute ranks. People aged 13 to 17 can be placed in the same league groups as adults: what others see is limited to §4, and there is no messaging. The AI coach comment is written with the same limits for everyone (§3).
9. Security
The connection between the app and our servers is encrypted (HTTPS). Passwords are stored only as a one-way hash. Staff access is limited by role.
10. Cookies
gymliga.com uses no advertising or analytics cookies; it may use a strictly necessary cookie to remember your language. Nothing in the app tracks you across other apps or websites.
11. Changes
When we change this policy we publish it here with a new date, and we also announce material changes in the app.