Last updated: September 9, 2026
GymBro ("the app") is a workout tracking application published by Valdrake LLC, a Virginia limited liability company ("we", "us"). Valdrake LLC is the data controller for the information described here. This policy explains exactly what information the app collects, where it goes, who can see it, and how to remove it.
The short version: GymBro stores your workout history so it can sync across your devices. It contains no analytics, no advertising, no tracking, and no third-party marketing SDKs of any kind. We never sell your data. Nothing about you is shared with other users unless you turn on Community Sharing, which is off by default. You can delete everything from inside the app.
When you create an account you sign in with Google, Apple, or an email address and password. From that sign-in we receive:
Authentication is handled entirely by Firebase Authentication (Google LLC). We never see, receive, or store your password. If you sign in with Apple and choose "Hide My Email", Apple gives us only a private relay address, never your real one. Your email address, display name, and profile picture stay within Firebase Authentication for login purposes. They are not copied into our database, not published to the community, and never shown to other users.
You can link more than one sign-in method to the same account from Settings, so that signing in with either method reaches the same workout history. Linking stores nothing extra beyond the additional login identifier held by Firebase Authentication. If you link an account that uses Apple's Hide My Email, only the relay address is recorded.
Everything you record in the app, including: sets logged, exercises performed, cardio minutes and distance, personal records and their history, volume goals and targets, custom exercises you create, notes you attach to exercises, favorites, rest timer settings, training streaks, your chosen workout pattern, and your theme preference. If you use multiple profiles within the app, each profile's history is stored as well.
You may optionally provide an age range (for example "35–44"), a body weight range (for example "150–174 lb"), and a dominant hormone profile (Testosterone, Estrogen, or Neutral). These are selected from ranges rather than entered as exact values. They are used to tailor training recommendations, such as recovery pacing, and to match you with similar users if you enable Community Sharing. You can leave all of these blank and the app works normally.
If you allow notifications on iOS, your device generates an anonymous messaging token that lets us deliver notifications to that device. It is stored separately from your workout data and is never readable by other users. If you decline notification permission, no token is stored.
The app keeps a local copy of your data plus some purely cosmetic state, such as your cached daily plan, which motivational quotes you have already seen, and which reactions you have sent today. This stays on your device and is cleared when you delete the app or delete your account.
Community Sharing is off by default. Until you deliberately turn it on in Settings, no other user can see anything about you, and you do not appear in the community feed at all.
If you opt in, a public profile is published that any other signed-in GymBro user can view. It contains:
Handle#86279) so that two people choosing the same name remain distinguishable.Your real name and profile picture are never published. Other users see only your handle, whether it is the generated one or a custom one you chose. The name and photo attached to your Google or Apple account are not copied into your community profile and are not used in notifications.
The feed shows users who have trained recently. Your list of favorited users is deliberately not published, so nobody can see who you follow.
Friend codes: a short code derived from your account that lets someone find your profile directly. Anyone who has your friend code, or who browses the community feed, can look up your public profile. Only share your friend code with people you want to be findable by.
Bear in mind that a community profile can still be identifying in context. Your training pattern, age range, weight range, and a custom handle you pick could let someone who knows you personally recognise you. If that concerns you, keep the generated handle and leave the optional profile fields blank.
We do not use your information for advertising, profiling, scoring, or any purpose unrelated to running the app.
Notifications are optional and require your explicit permission on your device. You can revoke that permission at any time in your device settings. If Community Sharing is enabled, the app may send:
These are limited to once per person per day to prevent spam. Rest timer alerts are generated entirely on your device and involve no server.
To be explicit, GymBro contains none of the following:
Your data is stored on Google's Firebase infrastructure in the United States. The following providers process data on our behalf:
| Service | Purpose |
|---|---|
| Firebase Authentication (Google LLC) | Account creation and sign-in; holds your email address |
| Cloud Firestore (Google LLC) | Stores your workout data and community profile |
| Cloud Functions (Google LLC) | Server code that delivers reactions and notifications |
| Firebase Cloud Messaging (Google LLC) | Delivers push notifications to your device |
| Cloudflare (Cloudflare, Inc.) | Hosts this privacy policy page |
| Sign in with Apple (Apple Inc.) | Optional sign-in method |
| Google Sign-In (Google LLC) | Optional sign-in method |
Their privacy practices are described at Firebase, Google, Apple, and Cloudflare.
Links to exercise form videos open YouTube in your browser. Once you follow such a link you are on Google's service and their privacy policy applies. The app does not embed or preload YouTube content.
Opting out from Settings immediately deletes your public community profile and removes your personal records from the shared leaderboards. Your own workout history is untouched and remains private to you. Your friend code entry remains until you delete your account, though with no public profile attached there is nothing for it to reveal.
Settings → Delete Account permanently removes your cloud backup, your community profile, your leaderboard records, your friend code, your locally stored data, and your authentication account, including every sign-in method linked to it. For security, if you have not signed in recently you may be asked to sign in again to confirm.
Two small technical records may briefly persist after deletion: your device's notification token, which is invalidated and discarded automatically once it stops working, and anonymous per-day counters used to rate-limit reactions and notifications. Neither contains workout data or anything that identifies you once your account is gone.
Data is kept for as long as your account exists. There is no separate archive, and we hold no backup outside of Firebase that survives deletion.
All data is transmitted over encrypted connections (HTTPS/TLS) and is encrypted at rest by Firebase. Access is enforced by server-side security rules: your workout backup is readable only by you, notification tokens are readable by no user at all, and internal rate-limiting records are inaccessible to every client. Community profiles are readable by signed-in users by design, which is the point of the feature and the reason it is opt-in.
No system is perfectly secure. Please use a strong, unique password if you sign in with email.
GymBro is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has created an account, contact us and we will delete it. Resistance training carries physical risk for developing bodies; minors should train under adult or professional supervision.
Depending on where you live you may have rights under laws such as the GDPR or CCPA. Regardless of location, GymBro gives every user the ability to:
We do not sell personal information, so there is no "Do Not Sell My Personal Information" process to opt out of. For any request we cannot satisfy through the app itself, contact us using the details below.
We may update this policy as the app changes. The "Last updated" date above will always reflect the current version. If a change materially affects how your information is used, we will surface a notice in the app rather than relying on this page alone.
Valdrake LLC, a Virginia limited liability company, is responsible for the data described in this policy.
Questions about this policy or your data: gymbroappcompany@gmail.com