GainCurve Privacy Policy

Effective date: 6 September 2026

The short version: GainCurve is offline-first. Your workout database, notes, routines, settings and progress photos stay on your device unless you explicitly enable the optional Connect AI feature. Connect AI sends a limited cloud copy of exercise, workout and set data to GainCurve so that you can synchronise it and connect an AI client you choose. GainCurve has no advertising or third-party analytics SDKs and does not sell personal data.

Who controls your data

GainCurve is provided by the independent GainCurve developer. Privacy and deletion enquiries can be sent to gaincurve.app@gmail.com.

Data stored only on your device

Workout notes, routines, app settings and progress-photo records.
Progress-photo image files in the app's private storage.
Collages until you choose to save or share them using your device's system features.

GainCurve does not upload progress photos, workout notes, routines or settings through Connect AI.

On iOS, files in the app's storage may be included in iCloud or device backups made by Apple's backup services. Backups are controlled by the device owner through their Apple settings.

Optional Connect AI data

Connect AI is off by default. If you enable it, GainCurve uses Google sign-in to authenticate you and processes:

a Google account subject identifier. GainCurve does not request or retain your Google email address or profile;
exercise names and muscle groups;
workout timestamps, duration, exercises, set numbers, weights and repetitions;
GainCurve device and record identifiers needed for reliable synchronisation;
consent, connection, rate-limit and security-audit metadata. Audit logs exclude workout payloads and access tokens.

This information is used only to provide account authentication, cloud synchronisation, data export, security, abuse prevention and the AI connection you authorise. It is not used for advertising or marketing.

AI clients and service providers

Cloudflare provides the Worker, database and OAuth infrastructure used by GainCurve. Workout data is stored in an EU-jurisdiction Cloudflare D1 database. OAuth grants, refresh tokens, client-registration and protocol metadata are processed in Cloudflare's globally distributed KV service and are not claimed to remain solely in the EU. Cloudflare D1 encrypts data at rest and in transit.

If you connect an external AI client, that client can receive the fitness data covered by the permissions you approve. This transfer is initiated and authorised by you. The AI provider's own privacy policy and terms then apply to its processing. GainCurve does not automatically send your data to an AI provider that you have not connected.

Permissions

Camera: used only when you take a progress photo inside GainCurve.
Save photos: write-only access used when you choose to save a generated collage. GainCurve does not request broad access to read your media library.
Internet: used for Connect AI, Google sign-in and connections that you authorise.

Retention

Your active workout cloud copy and consent record are retained while your Connect AI cloud account exists.
OAuth authorisation state lasts about 10 minutes; access tokens about one hour; refresh grants up to 30 days unless revoked earlier; dynamic client registrations 24 hours.
Pending AI routine proposals expire after seven days.
Identified security audit events are retained for no more than 90 days. An anonymised deletion or security event may be retained for up to 365 days.
Deletion from the active database may remain in Cloudflare's encrypted recovery system until the applicable recovery window expires.

Your choices and rights

Use GainCurve without Connect AI.
Export your local data separately from the Settings screen.
Export your cloud copy from Settings > Connect AI.
Revoke a connection, disconnect synchronisation, or permanently delete your GainCurve cloud account from Settings > Connect AI.
Request access, correction or deletion by email.

Delete your GainCurve cloud account and data

In the app, open Settings > Connect AI > Delete cloud account. This revokes GainCurve connections and permanently deletes the active cloud account and its exercises, workouts, sets, devices, proposals, sync records and consent records. Data held locally on your device is not deleted.

If you no longer have the app, use the GainCurve account-deletion request page or email gaincurve.app@gmail.com from the Google account you used with GainCurve. We may ask you to verify control of that account before deletion.

To remove local workout history, use Settings > Clear all workout data. This does not remove routines, exercises, settings or photo records.

Uninstalling GainCurve removes the app and its locally stored files. On Android this also clears the saved sync connection. On iOS the system Keychain can retain the sync connection after an uninstall, so reinstalling may restore it; to sever it fully, delete your cloud account or revoke the connection in Settings > Connect AI, or use the account-deletion request page below after uninstalling. Copies you saved to your gallery remain under your control.

Children

GainCurve is not directed to children and we do not knowingly collect children's personal data through Connect AI.

Changes

We will update this notice when GainCurve's data practices materially change. If a Connect AI consent change is required, synchronisation will pause until you review and accept the updated disclosure.