Privacy Policy

Last updated: March 2026

This Privacy Policy describes how Gains (“we,” “us,” or “our”) collects, uses, and shares information when you use the Gains mobile application and related services at api.gainsai.net (the “Service”).

By creating an account or using the Service, you agree to this policy. If you do not agree, do not use the Service.

1. Who we are

Gains is a strength-training app for logging workouts, tracking progress and recovery, managing routines, and optional AI-powered coaching. For privacy questions or requests, contact stixietv@gmail.com.

2. Information we collect

We collect information you provide and data generated by your use of the app.

Account and identity

• Email address and password (password stored only as a secure hash on our servers)
• If you use Sign in with Google or Sign in with Apple, we receive an identifier and email from the provider according to your choices with that provider
• Email verification and password-reset codes sent to your email

Profile and fitness data

• Profile details you enter, such as training goal, experience level, height, weight, activity level, and optional injury or limitation notes
• Workouts you log (exercises, sets, reps, weight, RPE, notes, duration, volume)
• Routines you create or copy from templates
• Recovery check-ins (sleep, energy, calories, protein, optional notes)
• Strength Elo rating and related workout statistics derived from your logged lifts

AI features

• Messages and prompts you send to the AI coach
• Workout and profile context we send to our AI provider to generate coaching, post-workout analysis, and routine suggestions
• AI-generated content we store (insights, chat history, routine drafts you confirm or discard)

Physique scans (optional)

• If you use physique scan, you choose photos from your device for that request
• We do not save your scan photos on Gains servers — they are processed in memory and sent to our AI vision provider (OpenAI) only to generate an estimate for that scan
• We store the text results only: estimated body-fat range, confidence, summary, and reasoning. This is not medical imaging or diagnosis

Technical and security data

• Authentication tokens on your device (stored in secure storage on mobile)
• Refresh session metadata such as user agent and IP address when you sign in or refresh tokens
• Basic request logs needed to operate and secure the API

3. How we use information

We use your information to:

• Create and manage your account and authenticate you
• Provide core app features (home dashboard, workouts, routines, progress, recovery)
• Calculate strength metrics, targets, and recommendations shown in the app
• Run AI coach chat, workout analysis, and AI routine generation when you request them
• Send transactional emails (verification, password reset) when applicable
• Protect the Service against abuse, fraud, and security incidents
• Comply with law and enforce our Terms

We do not sell your personal information.

4. How we share information

We share data only as needed to run the Service:

• OpenAI — workout/profile/chat context, and physique photos you submit for a scan (transmitted for that request only; not kept by Gains as image files), are processed by OpenAI under their terms and privacy policy
• Google / Apple — when you choose social sign-in, authentication is handled by those providers
• Resend (or similar email provider) — to deliver verification and password-reset emails
• Hosting providers — our API and database run on infrastructure we control (e.g. cloud VPS hosting)
• Legal requirements — if required by law, court order, or to protect rights and safety

We do not share your data with advertisers for cross-app tracking.

5. Storage and retention

• Account and fitness data (including physique scan text results, not scan photos) are stored in our database while your account is active
• When you delete your account in the app (Profile → Delete account), we permanently delete your user record and related data via our systems, including workouts, profile, physique scan results, tokens, and cascaded linked records
• We may retain minimal backups for a limited period as part of normal server operations, then overwrite them

6. Your choices and rights

• Access and update — edit profile details in the app
• Delete account — Profile → Delete account (permanent; cannot be undone)
• Email — contact stixietv@gmail.com for access, correction, or deletion requests where applicable under your local law
• OAuth — you can revoke Gains access in your Google or Apple account settings; you may still need to delete your Gains account separately

7. Security

We use HTTPS, hashed passwords, signed access tokens, and industry-standard practices to protect data in transit and at rest. No method of transmission or storage is 100% secure.

8. Children

The Service is not directed to children under 13 (or the minimum age required in your country). We do not knowingly collect personal information from children. Contact us if you believe a child has provided data and we will delete it.

9. International users

Your data may be processed in countries where we or our service providers operate. By using the Service, you understand your information may be transferred to those locations.

10. Changes

We may update this policy. We will post the new version at this URL and update the “Last updated” date. Continued use after changes means you accept the updated policy.

11. Contact

Email: stixietv@gmail.com
Website: gainsai.net