Privacy Policy

This Privacy Policy explains how Marvian Tech Ltd ("GainzMate", "we", "us") collects, uses, and shares information when you use the GainzMate mobile app (the "App"). By using the App you agree to this Policy, together with our Terms of Service.

1. Who we are and what this covers

GainzMate is a gym-focused calorie and macro tracking app. The data controller is Marvian Tech Ltd · marvian.tech. Contact: support@gainzmate.com.

This Policy covers the GainzMate iPhone app (the “App”) and the gainzmate.com website. Where a section applies to only one of them, we say so.

2. Information we collect

We collect only what's needed to run the App's features.

You provide

Account information: email address and a username (and, if you use Sign in with Apple or Google, the identifier and email those services return).
Profile & biometrics: age, sex, height, current and target weight, body-fat estimate, activity level, training frequency/experience, dietary preference, allergies/exclusions, your goals, and your food region (a country, chosen by you or defaulted from your device's Region setting, and never your location). A short bio and an optional avatar photo.
Meals & nutrition: food names, serving sizes, calories and macros, meal dates, optional meal photos, and meals you save as favorites.
Social content: friend requests, reactions, comments, and (for coaches) feedback you write. Content you report or users you block.
Your contacts' email addresses, only if you ask. When you tap “Find friends from contacts” and allow access, the app reads the names and email addresses in your contacts. Names never leave your iPhone. Each email address is turned into a one-way code (a SHA-256 hash) on your iPhone, and only those codes are sent to our servers. We compare them with the same codes made from GainzMate accounts' email addresses and send back the usernames and profile photos of the accounts that match. The codes are discarded as soon as the comparison is done and are never stored. To prevent abuse we keep a note of when a check happened and how many addresses it included, for up to two days. We never read phone numbers, and never upload your address book.
Support communications: anything you send us when you contact support.

Generated by your use of the App

Device push token (APNs) if you enable notifications, and your notification settings.
Time zone (to schedule reminders at the right local time).
Streaks, goal history, and weekly recap figures derived from your logs, so progress and streaks survive changes to your targets.
Consent records: what you consented to (for example AI processing) and when, so we can prove the choices you made and honour a withdrawal.
AI usage records: a per-account daily count of AI requests (and the tokens they used), kept to enforce fair-use limits and prevent abuse. Stored with your account and deleted with it.
Cached AI results: the AI's reading of a meal description you entered may be cached for up to 30 days so repeat lookups are faster and cheaper; insight and recommendation results are cached for the day. Expired entries are purged automatically.
Corrections you make to AI estimates: when you change a portion before saving, we keep the correction, linked to your account, so future estimates for you lean toward your real portions, and to measure accuracy overall. Deleted with your account. See AI processing.
Subscription status: whether you have an active GainzMate Pro entitlement or free trial (verified on your device through Apple, with a server-side record so the service knows your access is active).
Diagnostics — crash reports, app performance measurements, and technical error details (device model, iOS version, app version, and where in the app the problem happened), linked to your account's internal ID so we can fix problems you report. Diagnostics never include the meals, photos, or body measurements you log, or your name or email.
Usage analytics, only if you allow it — which screens of the app you reach, how long each one takes, whether you skipped an optional step or allowed or declined a permission, which sign-up method you chose, whether you added a profile photo or bio, whether you allowed contacts access, how many GainzMate members a contacts check found and how many people you added from suggestions (never who), and when you open the app. These are linked to your account's internal ID and to a random identifier that PostHog creates on your device when you allow analytics (it is not an advertising identifier, and it stays on the device until you delete the app). Each report also carries standard technical details: your device model, iOS version, app version, language, time zone, screen size, whether you are on Wi-Fi or cellular, and whether the app is a TestFlight or test build. We ask before collecting any of it, and you can change your answer any time in Settings → Privacy & AI. Usage analytics never include anything you type or log: no meals, photos, weights, goals or answers to the setup questions, and not your name or email.

We do not track you across other companies' apps or websites, we do not use third-party advertising identifiers, and we do not run ads.

3. Health and other sensitive data

Some of what you enter (weight, body-fat estimate, dietary preferences, allergies and exclusions, and your meal and nutrition history) is health-related data, which data-protection law treats as a special category needing extra protection.

We process this data only on the basis of your explicit consent, which you give when you create your profile and enter this information, and which you can withdraw at any time by editing or deleting the data or by deleting your account. We do not use health data for advertising, we do not sell it, and we do not share it with anyone except the service providers listed under How information is shared and the people you personally choose to share with.

4. Camera and photo access

The camera is used only when you choose to scan a barcode or take a meal photo. The photo library is accessed only for photos you pick.
Meal photos you attach are stored privately in our backend and shown only to you and to people you've approved (friends/coaches), per the access rules below.
On iPhones with a LiDAR Scanner, Precision Scan also reads the camera's depth data while you take the photo. Your iPhone turns it into a few measurements of the food on the plate (each food area's volume, footprint, height and position in the photo), and only those numbers are sent with the photo. The depth map itself never leaves your iPhone.

5. Apple Health (optional)

If you choose to connect Apple Health, GainzMate reads (never writes) your step count, your workouts, your body weight, and the active and resting energy you burn. This data is used on your device: your recent daily step average calibrates the activity level behind your calorie and macro targets, workouts tell training days from rest days, your recent weight readings form the trend behind the Weekly Fuel Check-in, and active and resting energy show your estimated calorie balance (what you ate against what you burned). The raw Health data, and the balance worked out from it, are not uploaded to our servers, not sent to the AI provider, and never used for advertising or shared with third parties. Your calorie balance never changes your targets. Saved to your account are your calorie and macro targets and, when the Weekly Fuel Check-in makes a suggestion, that suggestion with the summary it was based on (such as your weekly weight trend, the number of weigh-ins and the estimated expenditure it worked out). Individual Health readings (including active and resting energy) and your calorie balance are never uploaded. You can disconnect GainzMate at any time in Settings → Connected apps & devices, and in the Apple Health app. Clear stored readings on the same screen deletes the copies kept on your iPhone.

6. AI processing of your data, and your consent

Some features use a third-party AI provider (currently Google (Gemini, via its OpenAI-compatible endpoint), via our secure backend) to estimate nutrition or generate guidance:

AI meal logging sends the meal text or photo you submit (with any note you add to a photo) for estimation, along with your food region (a country) if you have set one. Set it to Off in Settings → Privacy & AI → Food Region to send no country.
Text logging also sends a short list of your saved foods (name, serving, calories and macros) and your meals from the last day and a half (meal slot, food name and calories), so the AI can recognise “my usual shake” or “same as yesterday”.
Precision Scan sends the food measurements described under Camera and photo access with the photo. The depth map itself is never sent.
AI insights / recommendations send your nutrition history and goals for analysis.

We ask for your explicit, in-app consent before any data is sent to the AI provider, and you can withdraw consent at any time in Settings → Privacy & AI → AI meal estimation. We do not send your name, email, or account credentials with these requests. AI outputs are estimates you review and edit before saving. They are not medical advice (see the AI features and nutrition disclaimer in our Terms).

Withdrawing consent stops any further AI processing. It does not undo processing already carried out, and it does not delete estimates you already reviewed and saved to your log. Those are your entries, and you can edit or delete them individually.

Improving estimate accuracy

Where you don't give an amount, our backend, not the AI provider, sizes portions for you from your profile (such as age, sex, height, weight, body fat, activity and training), your targets, your recent daily calorie totals and the corrections below. None of these are sent to the AI provider.

When you edit an AI estimate before saving it, we keep the correction (what was estimated and what you changed it to) so we can personalise future estimates for you and measure accuracy. Corrections are stored against your account ID (never your name or email), are readable only by you and our backend, and are deleted when you delete your account. We do not use your meal photos, your nutrition history, or your corrections to train the AI provider's own models.

No automated decisions about you

AI features produce suggestions and estimates only. Nothing in GainzMate makes an automated decision that produces a legal or similarly significant effect on you, and there is no automated profiling that determines access, pricing, or eligibility. A human (you) reviews and approves every estimate before it is saved.

7. Barcode lookups

When you scan or enter a barcode, our backend queries Open Food Facts and, where configured, USDA FoodData Central to retrieve product nutrition. Only the barcode number is sent to those services; no personal data is shared.

8. How we use information

We use your information to:

Provide the core features (tracking, goals, history, analytics, reminders).
Generate AI estimates and recommendations (with your consent).
Operate social/accountability features you opt into (friends, feed, leaderboard, coaching) and enforce safety (reporting, blocking, moderation).
Suggesting people you may know. We may suggest GainzMate members you share friends with (showing how many friends you have in common, never who they are), and, if you check your contacts, members whose email address is in your contacts.
Send notifications you've enabled.
Provide and manage GainzMate Pro subscriptions.
Maintain security, prevent abuse, debug, and comply with law.

How others can find you. If someone has your email address in their contacts, or you share friends on GainzMate, we may show them your username and profile photo in Find Friends. We never show them your email address. Turn this off any time in Settings → Privacy & AI → Suggest me to people I know. Turning it off doesn't hide you from username search.

Our legal bases (UK/EU users)

Where UK or EU data-protection law applies, we rely on the following bases:

Performance of our contract with you: creating and running your account, storing and displaying your logs, calculating targets, delivering Pro entitlements.
Your consent: AI processing, push notifications, connecting Apple Health, and the health-related data described under Health and other sensitive data. You can withdraw any of these at any time, without affecting the lawfulness of processing before withdrawal.
Our legitimate interests: keeping the service secure, preventing abuse and fraud, enforcing fair-use limits on AI, debugging, and improving estimate accuracy. We balance these against your rights, and you can object (see Your rights and choices).
Legal obligation: responding to lawful requests, keeping records we are required to keep, and meeting tax and accounting duties.

10. Storage, location, and retention

Data is stored with Supabase in the European Union (AWS eu-west-1, Ireland). Crash and error diagnostics are stored by Sentry in the European Union (Germany) and deleted automatically within 90 days. Usage analytics are stored by PostHog in the European Union (Frankfurt, Germany) and kept for up to 1 year. If you delete your account, we delete the usage analytics linked to it within 30 days. If you are outside that region, your data is transferred to and processed there. Transfers out of the UK/EEA to our other providers are covered by Standard Contractual Clauses or an equivalent approved safeguard.

How long we keep things

Your account and logs: for as long as your account exists. You are in control: delete individual meals at any time, or delete the whole account.
After you delete your account: we remove your account and associated data from live systems, and complete deletion within 30 days.
Encrypted backups: deleted data can persist in routine backups for up to 30 days after deletion, then ages out automatically. We do not restore deleted accounts from backup.
AI usage counts, cached AI results, and corrections: stored with your account and deleted with it; cached meal parses are purged after 30 days.
Safety records: reports about content or users, and records of enforcement action, are kept as long as needed to keep the service safe and handle repeat abuse, even if the reporting or reported account is deleted; the deleted account's identity is removed from the report. Blocks are deleted with the account.
Support emails: up to 24 months from the last message in the conversation.
Records we must keep by law: tax, accounting, and subscription records for the period the law requires.

Deleting your GainzMate account does not cancel an Apple subscription. Cancel that separately in your App Store settings. See the Support page.

11. Your rights and choices

Depending on where you live, you may have rights to access, correct, export, or delete your data, and to object to or restrict certain processing. In the App you can:

Edit your profile, goals, and biometrics.
Export a copy of your data (Settings → Export my data).
Withdraw AI consent (Settings → Privacy) and manage notifications.
Turn usage analytics on or off (Settings → Privacy & AI).
Choose whether you're suggested to people you may know (Settings → Privacy & AI).
Delete your account (Settings → Delete account).

To exercise any other right (including access, correction, restriction, objection, or portability), contact support@gainzmate.com. We answer within one month, and will tell you if we need longer because the request is complex. We do not charge for this, and we will not treat you differently for asking.

If you think we have handled your data badly, please tell us first so we can put it right. You also have the right to complain to a data-protection authority. For us that is the Office of the Commissioner for Personal Data Protection (Cyprus), and you may also complain to the authority where you live or work.

12. US state privacy rights

If you live in the United States, your state may give you specific rights. We honour these requests from any US resident, regardless of whether the law technically applies to us.

Know, access, and port: ask what we hold about you and get a copy. The App's export tool does this immediately.
Correct: fix inaccurate information. Profile, goals, and every meal entry are editable in the App.
Delete: delete your account and data in the App, or ask us to.
Opt out of sale, sharing, or targeted advertising: nothing to opt out of: we do not sell or share personal information for money or for cross-context behavioural advertising, and we do not run targeted ads.
Limit use of sensitive personal information: we use your health-related data only to provide the features you asked for, never for advertising or profiling.
Non-discrimination: we will not degrade your service for exercising any of these rights.

To make a request, email support@gainzmate.com from your account address. An authorised agent may act for you if they provide proof. If we refuse a request, you may appeal by replying to our decision, and you may contact your state Attorney General.

Consumer health data (Washington, Nevada)

Washington's My Health My Data Act and Nevada's SB370 treat information like body metrics, nutrition intake, and dietary restrictions as consumer health data. Under those laws we confirm:

What we collect and why: the health-related data under Health and other sensitive data, collected directly from you (and, if you connect it, from Apple Health), used only to run the features you asked for.
Who we share it with: only the service providers under How information is shared, and the people you personally choose to share with. We do not share consumer health data with advertisers or data brokers.
We never sell it: we do not sell consumer health data, so we never ask you for the signed authorisation a sale would require.
Your rights: withdraw consent, get a copy, or have it deleted, by emailing us or using the App's export and delete tools. You may appeal a refusal, and then complain to the Washington or Nevada Attorney General.

13. Children

GainzMate is not intended for children under 13 (or the minimum age required in your country). We do not knowingly collect data from children under that age. If you believe a child has provided us data, contact us and we will delete it.

14. Security

We use industry-standard measures: encryption in transit, access controls, private storage buckets, and row-level security so one account cannot read another's data. Access to production data is limited to those who need it. No method of transmission or storage is 100% secure, but we work to protect your information.

If a breach affects your personal data and is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and will tell you directly without undue delay where the risk to you is high. If you believe you have found a security vulnerability, please report it to support@gainzmate.com. See the Support page.

15. The gainzmate.com website

This section is about the website, not the App.

No cookies and no analytics. The website sets no cookies, uses no analytics or advertising trackers, and does not build a profile of you. There is nothing to consent to, which is why you see no cookie banner.
No account is needed to browse the site, and there are no forms that collect personal data. Contacting us is a plain mailto: link to our support address.
Hosting. Our host processes standard server request data (including your IP address) to serve pages and protect against abuse.
Web fonts. Typefaces are served from our own domain. The site makes no requests to third-party CDNs, font services, or trackers. Loading a page contacts our servers and nobody else.

16. Changes to this Policy

We may update this Policy. We will revise the “Last updated” date and, for material changes, provide notice in the App. Continued use after changes means you accept the updated Policy.

17. Contact

Questions or requests: support@gainzmate.com · Marvian Tech Ltd · marvian.tech.