Privacy Policy

What data we process

Account and profile

• Email and password: the password is stored only as a cryptographic digest (hash), never in plain text;
• Sign in with Apple or Google, when you choose to sign in with them;
• Name and nickname: your account name, your profile nickname and, if you want, a different name in each team;
• Profile photo, optional;
• Preferences: language, theme and notification choices;
• Devices: the identifier of each device, used to receive notifications;
• Teams, organizations and memberships: which ones you belong to and your role in each;
• Goals and plans that you set in the app.

Workouts, photos and location

• Workouts and activity, from the sources you connect or from manual logging (details in section 02);
• Photos, videos and stories that you post;
• Workout location: when the source reports where the workout took place, we store the point on the map, the name of the place and, when available, the route. In manual logging, only if you turn on "Record location", which starts off. Location is private: currently, only you can see it.

Payments

Whoever subscribes to a plan for the organization provides their name, CPF or CNPJ (Brazilian individual or company taxpayer ID) and the payment method. The card is stored by Stripe, not by GymDogs; Pix Automático is processed by Efí. We keep the organization's billing history.

Website and contact form

The website does not use advertising or analytics or tracking cookies. Through the contact form we receive your name, your email, your message and the subject you chose. To block bots, the form goes through a check that receives your IP address and technical data from your browser.

Technical logs

Like any internet service, we log access to the app (date and time, IP address and port, account, operation and the device or browser used), sensitive actions taken on the account and errors, to keep the service secure and running.

Workout and health data

GymDogs reads only steps, distance, calories, check-ins and workouts with type and duration, and only from the sources you connect:

• Apple Health (HealthKit), on iPhone;
• Health Connect, on Android;
• Strava;
• Google Health;
• Garmin and Wellhub, when available.

You can also log workouts manually. Connecting a source is optional and depends on your authorization, requested at the time of connection; you can disconnect it at any time, and GymDogs stops receiving data from it. Workouts already logged remain in your history until you delete your account.

The use of information received from the Google Health API follows the Google Health API User Data Policy, including the Limited Use requirements.

When you connect Strava, the data arrives through the Strava API, which also records the use of this connection in accordance with the Strava privacy policy.

What we use it for and on what legal basis

• Creating and maintaining your account and making GymDogs work (profile, teams, goals, medals, notifications): performance of the contract, that is, of the terms of use;
• Importing and using your workout and health data: your consent, requested in the app when you connect a source, which can be withdrawn at any time;
• Showing your workout data to whoever manages the team and sending it to the organization's system: your consent, requested for each team, also revocable;
• Billing organizations for their plans: performance of the contract and tax obligations;
• Keeping the access log for 6 months: legal obligation (Marco Civil da Internet, the Brazilian Internet Civil Rights Framework, Law No. 12,965/2014, art. 15);
• Responding to contact through the website, preventing fraud and abuse and keeping the service secure: legitimate interest, without using health data;
• Defending rights in legal proceedings: regular exercise of rights.

We do not make automated decisions with legal effects on you. The medal and adherence are calculations based on the plan you set yourself.

Who sees your data

Teammates and friends

They see your name, your photo and your medal in each team you share. Your goal, your plan and your workout log only appear to them if you make them public in the goal. Your adherence percentage, points, streak, location and email never appear to them.

Whoever manages the team

The team owner can turn on the member data policy. With it on, whoever manages the team (the owner, the coordinators and the administrators of the organization that owns the team) can see, only for those who authorized it in that team: adherence, medal, current streak and record, points per period and the workout log, with metric, value, date and source. They also see your account name next to the name you use in the team. Each view of a member's details is logged.

Location, photos, videos, stories, cheers and your email are left out of this view. In a team with this policy, authorizing is a condition for joining: the invite shows beforehand what will be seen and by whom. The authorization applies only to that team and can be withdrawn at any time, with immediate effect and without you being removed from the team. Those who were already in the team when the policy was turned on choose between authorizing or leaving; until they decide, their data remains hidden.

The GymDogs staff

They only access an account's data when needed to handle a request from you, investigate abuse or comply with the law.

Organizations and automatic sending

Teams can belong to an organization, such as a company, a gym or a coaching group. The organization can promise a prize to those who reach a medal; the prize is defined and delivered by the organization.

The team owner can set up automatic sending of team events to an organization system. This sending only includes you if you consent, in the app, for that team; you can withdraw your consent at any time. With your consent, the organization's system receives:

• the member, team and goal identifiers in GymDogs;
• joining and leaving the team;
• the goal accepted in the team;
• the end of the cycle, stating whether the goal was completed;
• the medal earned and the prize promised for it, if any.

What the organization does with the data it receives is its own responsibility, as an independent controller, and follows its own privacy policy. Under our terms, it may not use this data for employment decisions against you.

Service providers and international transfer

We use providers that process data on our behalf, only for the purposes of this policy and under a contract that requires them to protect it:

• Servers, database and files (photos, videos and stories), access and error logs: Google Cloud, in Brazil (São Paulo);
• Mobile notifications and app crash reports: Google (Firebase), in the United States;
• Website hosting and receipt of the contact form: Google (Firebase and Cloud Functions), in the United States;
• Sending emails, such as the code to delete your account: email provider, in the United States;
• Bot protection and domain address: network provider, in the United States;
• Payments: Stripe, in the United States (card), and Efí, in Brazil (Pix Automático).

Apple, Google, Strava and the other sources you connect are not our providers: they are independent services, with their own policies, that you choose to link to GymDogs.

International transfer

Data sent to providers in the United States leaves Brazil only for the purposes above and while the service is used, with the safeguards of art. 33 of the LGPD (Brazilian General Data Protection Law, Law No. 13,709/2018), such as data protection contractual clauses with each provider. Your workout and health data is stored in Brazil. You have the same rights over this data as in section 08, including the right to file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD, the Brazilian Data Protection Authority). If you would like the list of providers by name or the clauses used, email the Data Protection Officer.

How long we keep it

• Account and content: as long as the account exists. When you delete the account, the content is erased and the account is anonymized, except for what the law requires us to keep;
• Workouts: in your history until you delete your account; disconnecting a source only stops new data from coming in;
• Access log: 6 months, as a legal obligation;
• Trail of sensitive actions (money, permissions, consents and account deletion): 5 years, with personal data recorded only as "changed", without the value;
• Ordinary changes: 1 year;
• Errors and technical traces: 30 days;
• Billing history: for the period of the tax obligations;
• Contact form messages: for as long as the request is being handled and, afterwards, for up to 2 years, to follow up on requests and prove that they were handled.

Your rights

Under the LGPD, you can, at any time:

• confirm whether we process your data and access it;
• correct incomplete, inaccurate or outdated data;
• request the anonymization, blocking or deletion of unnecessary data or data processed in violation of the law;
• receive your data in a structured format (portability);
• delete data processed on the basis of your consent;
• know with whom we share your data;
• know that you may refuse consent and what happens if you do;
• withdraw consent, without affecting what has already been done with it;
• object to processing that violates the law;
• file a complaint with the ANPD.

You can handle a lot of this in the app itself: edit your profile, disconnect sources, withdraw team authorizations and delete your account. For everything else, write to privacidade@gymdogs.app. We respond within 15 days and may ask for confirmation that the request is yours.

How to delete your data

In the app, under Settings → Delete account, with confirmation by a code sent to your email. What is erased and what remains is described in Delete account.

Security

We use encryption in data transmission (HTTPS), passwords stored only as a hash, role-based access control, logging of who accesses what, and infrastructure providers with security certifications. No system is immune to failures; if an incident occurs that may pose a risk to you, we will notify you and the ANPD, as required by law.

Minimum age

GymDogs is for people 18 years of age or older and is not directed at children or adolescents. If we learn that an account belongs to someone under 18, it will be deleted. If you are the parent or guardian of a minor who created an account, write to privacidade@gymdogs.app.

Changes to this policy

When we change something relevant, we will give prominent notice in the app or by email before the change takes effect and will update the date at the top. If the change affects something that depends on your consent, we will ask for your consent again.

Who we are and how to contact us

The controller of the data processed by the GymDogs app and the gymdogs.app website is Guaraci, the trade name of:

JONATHAN DIAS REZENDE LTDA
CNPJ 54.702.453/0001-99
Av. João de Almeida Melces, 163, ap. 11, Jardim Zulmira
Sorocaba, SP · CEP 18061-165 · Brazil

Data Protection Officer (Encarregado pelo tratamento de dados pessoais): Jonathan Dias Rezende, privacidade@gymdogs.app.

For other matters, use the support form.