Privacy Policy
Last updated: September 5, 2026
What we collect
- Account info — the email you sign up with (via Amazon Cognito).
- Speediance credentials — if you connect your Speediance account, we store your Speediance login and the session token it produces so we can sync your data and send workouts on your behalf. They are stored encrypted in AWS Secrets Manager, never in our database, and used only for that purpose.
- Training data — workout history, exercises, sets, and related stats retrieved from your Speediance account, including any activity Speediance relays from Apple Health or Google Fit if you have connected those inside the Speediance app.
- Profile and coaching preferences — bodyweight, units, goals, session length, limits you tell the coach about (for example an injury), and coach memories: short notes the coach keeps about your preferences so it can program for you. You can view and delete any memory from the app.
- Things you send the coach — your messages and any screenshots you attach. Screenshots are used for that conversation only and are not stored in our database.
- Workouts and routines the coach builds, whether or not you put them on your machine, plus a log of every change the coach makes to them so you can undo it.
- Feedback you submit in the app, which is also emailed to us with your email as the reply-to address.
- Usage analytics — first-party events (pages visited, features used, screen-size class, whether the coach’s suggestions were approved) to understand how the app is used and where to improve it. We do not sell this or use third-party ad trackers.
AI processing
The coach is powered by a large language model (Anthropic Claude) running on Amazon Bedrock inside our AWS account. To answer you, we send it the relevant parts of your training data, profile, preferences, memories, and your message or screenshot. Amazon Bedrock does not use this data to train models and does not retain it after the response is generated. Anything the coach proposes to change on your Speediance account is shown to you first and happens only after you approve it.
How we use it
To provide the Service — show your training history, generate and schedule workouts, secure your account, and improve the product. We do not sell your personal data.
Where it lives & who processes it
Data is stored in Amazon Web Services in the United States (us-west-2: DynamoDB, Secrets Manager, Cognito). If you are outside the US, your data is transferred to and stored there. We share data with a small set of processors only as needed to run the Service: AWS (hosting, storage, and AI processing via Amazon Bedrock), Resend (transactional email), and Speediance (to sync your data and place workouts, at your direction). We don’t share your data with anyone else.
Cookies & local storage
We set first-party cookies to keep you signed in (Cognito session tokens), to remember your theme, and to know your time zone so dates line up with your calendar. Your browser’s local storage holds small conveniences such as whether the coach drawer is open and your recent coach conversation (text only, no images); that history stays on your device unless you send it to the coach. There are no third-party or advertising cookies.
Optional integrations you control
API key for other AI tools — you can generate a personal key that lets an external assistant (for example Claude Desktop) read your training data through our server. The key is shown once, can be revoked from your profile, and gives read access only. Apple Health / Google Fit — we never connect to these directly; if you connect them inside the Speediance app, Speediance relays that activity to us with the rest of your history. Neither is required to use the Service.
Retention & deletion
We keep your data while your account is active. You can request deletion of your account and associated data — including your stored Speediance credentials, training history, coach memories, and analytics tied to your account — at any time by emailing support@gymmonsterfit.com; we complete deletion within 30 days and confirm by email. You can also disconnect your Speediance account or delete individual coach memories from your profile at any time. Deleting your account here does not affect your Speediance account or workouts already on your device.
Security
We use encryption in transit and at rest and scope access to your data to your own account. No system is perfectly secure; we can’t guarantee absolute security, and you share your Speediance credentials with the Service at your own risk.
Your rights
Depending on where you live (e.g. the EU/UK under GDPR, or California under CCPA), you may have rights to access, correct, delete, or export your data, and to object to certain processing. Contact us to exercise them.
Children
The Service is not directed to children under 13 (or the age your local law sets).
Changes & contact
We may update this policy; material changes will be reflected by the “last updated” date. Questions or requests: support@gymmonsterfit.com.