Privacy Policy

Welcome to GymBooster ("we", "our", or "Application"), developed and operated by Allan Hirose / Hirose Tech. This Privacy Policy clearly outlines how we collect, use, store, share, and protect your personal information when you use the GymBooster mobile application and related services.

This policy is written in strict compliance with global privacy regulations, including the European Union General Data Protection Regulation (GDPR - Regulation EU 2016/679), the California Consumer Privacy Act (CCPA/CPRA), the Brazilian General Data Protection Law (LGPD - Law No. 13,709/2018), and the Google Play Developer Distribution Agreement & User Data Policy (including the Google Health Connect Permissions Policy).

1. Data Controller Identification

The entity responsible for processing your personal data is:

• Developer/Entity: Allan Hirose (Hirose Tech)
• Package ID: tech.hirose.gymbooster
• Privacy & Inquiries: contato@hirose.tech
• Account & Data Deletion URL: https://gymbooster.hirose.dev/delete-account-en.html

2. Information We Collect

We collect and process the following categories of data:

2.1. Account & Authentication Data

• Google Sign-In / Email Authentication: User display name, email address, profile picture (if provided), and unique Firebase User ID (UID).
• Guest Mode: An anonymous local identifier generated on your device to support full offline tracking without requiring account registration.

2.2. Workout & Fitness Activity Data

• Workout Plans & Routines: Selected exercises, routine splits, target muscles, and weekly workout frequency.
• Workout Session Logs: Sets, repetitions, weight/load lifted, rest timer logs, personal records (PRs), workout dates, and exercise notes.

2.3. Body Metrics & Progress Photos

• Body Weight: Weight entries (kg/lbs), weight goals, and timestamped logs.
• Progress Photos (Optional): Photos captured or selected by you to track physical transformation. Photos are stored locally and, for authenticated users, backed up securely to your private cloud folder in Firebase Storage (users/{uid}/weight_photos/). Your photos are strictly private and never publicly visible or shared with other users.

3. Google Health Connect Integration (Android)

4. Technical Identifiers, Diagnostics, and Advertising

• Firebase Analytics & Crashlytics: Aggregated anonymous usage events, crash logs, and frame-rate performance diagnostics to ensure application stability. Health data and photos are never sent to Crashlytics or Analytics.
• Subscriptions (RevenueCat & Google Play Billing): Premium subscription status verification. We do not process or store credit card details; all financial transactions are handled securely by Google Play.
• Google Mobile Ads (AdMob): In the free version, the app displays ads via Google AdMob, which may process non-sensitive device advertising IDs (GAID) in accordance with Google Play rules. Subscribed GymBooster Premium users enjoy a 100% ad-free experience.

5. Device Permissions Requested

• Camera (CAMERA) & Storage: Used only if you choose to take or upload progress photos.
• Notifications (POST_NOTIFICATIONS): Used for rest timer completion alerts, scheduled workout reminders, and habit streaks.
• Vibration (VIBRATE): Provides haptic feedback when rest intervals finish or personal records are achieved.

6. Legal Bases for Data Processing (GDPR & LGPD)

We process your personal data under the following legal bases:

• Contract Performance (GDPR Art. 6(1)(b)): Delivering app features, syncing routines, and managing your subscription.
• Explicit Consent (GDPR Art. 6(1)(a) & Art. 9(2)(a)): For access to progress photos and health metrics synced with Health Connect.
• Legitimate Interests (GDPR Art. 6(1)(f)): App performance optimization, crash diagnostics, and fraud prevention.

7. Third-Party Service Providers

We share data only with verified infrastructure providers strictly necessary to operate the application:

• Google Firebase / Google Cloud: Secure database hosting (Firestore), user authentication (Firebase Auth), and cloud storage (Firebase Storage).
• RevenueCat Inc.: Secure in-app purchase validation.
• Google AdMob: Ad serving for non-premium accounts.

8. Security and Data Protection

We implement robust technical and organizational safeguards:

• Encryption at Rest: Encrypted on-device NoSQL storage (Hive).
• Encryption in Transit: End-to-end TLS/HTTPS encryption for all network requests.
• Strict Security Rules: Granular database and cloud storage rules ensuring only authenticated users can access their own data.

9. Your Privacy Rights (GDPR, CCPA, LGPD)

Depending on your jurisdiction, you have the right to:

• Access & Portability: Request a copy of your stored workout history and profile data.
• Rectification: Correct inaccurate or outdated information directly inside the app.
• Erasure (Right to be Forgotten): Permanently delete your account and all associated workout logs and photos.
• Revoke Consent: Disconnect Google Sign-In or revoke Health Connect permissions at any time via Android System Settings.

10. Account and Data Deletion (Google Play Compliance)

In compliance with Google Play's Account Deletion Policy, you can request full deletion of your account and data via:

1. In-App: Navigate to the Profile tab and tap "Delete account" at the bottom of the screen. Deletion of all cloud and local data is executed immediately.
2. Web URL: If you have already uninstalled the app, visit our deletion portal at https://gymbooster.hirose.dev/delete-account-en.html or email contato@hirose.tech with your registered account email.

Upon request, all user records, cloud workouts, and progress photos are permanently deleted within 7 business days.

11. Children's Privacy (COPPA / GDPR)

GymBooster is not intended for individuals under 13 years of age (or 16 in the EEA). We do not knowingly collect personal information from children. If we discover that a minor's data has been collected without parental consent, we will promptly delete it.

12. Contact Information