GymLockGet the app
Legal Privacy

Privacy,
in plain English.

This policy explains what GymLock handles, why it is needed, who helps us provide the service and the choices you have.

Effective 21 August 2026GymLock by Velentis LabsNo third-party ads

1. Who this policy covers

GymLock is an iPhone app operated by Velentis Labs ("GymLock", "we", "us" or "our"). For data-protection purposes, Velentis Labs is the controller of personal data handled through GymLock, except where another provider acts as an independent controller—for example, Apple when it processes an App Store purchase.

This policy covers the GymLock app, gymlock.co and support requests sent to us. It does not replace the privacy terms of Apple, Google or another service you choose to use.

The short version

We do not sell personal data, run third-party ads or use GymLock data to track you across other companies' apps and websites.

2. Data we handle

The data involved depends on the features you use.

Account and identityEmail address, display name, username/handle, optional profile photo, user ID and authentication provider identifiers.
Training and fitnessWorkouts, exercises, sets, reps, weights, volume, session duration, focus scores, streaks, goals, body-weight entries, personal records and custom plans.
Nutrition and recoveryFood and meal entries, calories and macros, hydration, supplements and logs, targets, plus profile inputs such as height, birth year and sex when you choose to provide them for personalisation.
Settings and contentTraining schedule, notification choices, units, custom exercises, saved meals and other in-app preferences or content you create.
App-blocking choicesApple-generated opaque tokens representing the apps or categories you select. GymLock cannot turn those tokens into readable app names.
Subscription and usagePurchase receipts, product and entitlement status, subscription identifiers, device or app-user identifiers, and product interaction data used to provide purchases and understand reliability.
DiagnosticsCrash reports, stack traces, device model, operating-system version and performance information.
Optional location contextA saved gym name, address and coordinates remain on your device for arrival reminders. If you opt in to leaderboards, the app may send your city, device-region country and derived continent for ranking.
SupportYour email address and anything you include when you contact us.

We do not collect your payment-card details. Apple handles payment information for App Store transactions.

3. How and why we use data

  • Provide the service: create and secure your account, run workouts, block chosen distractions, calculate progress, show widgets and Live Activities, and sync your information between devices.
  • Personalise GymLock: calculate training and Fuel targets from information you choose to provide and remember your settings.
  • Manage purchases: check trial, subscription and entitlement status and restore access.
  • Communicate: deliver optional local reminders and answer support or privacy requests.
  • Protect and improve: diagnose crashes, maintain security, prevent abuse and understand whether core product flows work reliably.
  • Meet obligations: keep records or respond where law requires it.

Legal bases in the UK and EEA

Where UK or EEA data-protection law applies, we mainly process data because it is necessary to perform our contract with you (running GymLock), because you consent to an optional feature such as notifications or location, because we have a legitimate interest in keeping GymLock secure and reliable, or because we must meet a legal obligation. You can withdraw consent for optional permissions in iOS Settings without affecting earlier lawful processing.

4. Screen Time & app blocking

GymLock uses Apple's Family Controls, Managed Settings and Device Activity frameworks. You select apps or categories in Apple's own picker. GymLock receives encrypted or opaque selection tokens—not a readable app list, browsing history or the contents of those apps.

The tokens may be kept on your device and synced to your private GymLock account so your choice persists. They are used only to apply the shield you requested during GymLock sessions. GymLock does not use Screen Time access to monitor your wider phone activity.

5. Optional location features

Gym-arrival reminders are optional. If enabled, your iPhone monitors an on-device geofence around the gym you save. Your gym's name, address, coordinates and radius are stored locally to run that reminder. We do not build or store a history of your movements.

Leaderboard location is separate. If you opt in to leaderboards, GymLock may send a city name derived from the gym you saved, the country code from your device region and a derived continent. Exact gym coordinates are not sent to the leaderboard. You can remove the gym, turn off location access or leave the leaderboard at any time.

6. Opt-in leaderboards

Leaderboards are off until you choose to join. When enabled, other signed-in users in the selected city, country or continent can see your username, ranking, focus or volume score and qualifying session count. Your email, exact workouts, nutrition entries and exact gym coordinates are not shown.

Turning leaderboards off requests deletion of your leaderboard row. Deleting your account also removes it. Your main account and private training record remain protected separately.

7. Service providers & sharing

We disclose data only as needed to run GymLock, follow your instructions, complete a business transaction, protect rights and safety, or comply with law.

  • Supabase provides authentication, database and private profile-photo storage, cloud sync and account deletion infrastructure.
  • RevenueCat processes app-user identifiers, purchase receipts, entitlement status and related usage needed to manage subscriptions.
  • Apple provides the App Store, StoreKit purchases, Sign in with Apple, Screen Time frameworks, device notifications and platform services.
  • Google provides optional Google Sign-In and Firebase Crashlytics for crash and performance diagnostics.

These providers may process data in countries outside the one where you live. Where required, we rely on provider contracts and recognised transfer safeguards such as adequacy decisions or standard contractual clauses. Their own policies explain their roles and safeguards: Supabase, RevenueCat, Apple, and Google.

8. Storage, security & retention

Account and cloud-sync data, including an optional profile photo, is stored while your account is active so GymLock can provide the service across devices. If you delete your account, GymLock requests deletion of the account and its associated cloud rows and files. Signing out clears account data cached by GymLock on that device. Some limited records may remain temporarily in provider backups or be retained when necessary for security, fraud prevention, legal claims, tax or accounting obligations.

Leaderboard data remains while you are opted in and is removed when you opt out or delete your account. Diagnostic and purchase records follow the retention settings and legal obligations of the providers that process them. Support correspondence is kept only as long as reasonably needed to answer the request and maintain necessary records.

We use access controls, encrypted network connections and row-level database rules designed to keep each user's private account data separate. No storage or transmission system can be guaranteed completely secure.

9. Your choices & rights

  • Access or correct: view and edit profile and training information in GymLock, or ask us for a copy.
  • Delete: use Settings → Account → Delete Account. If you cannot access the app, email us from the account address.
  • Permissions: change Screen Time, notification and location access in iOS Settings.
  • Leaderboard: opt out in GymLock to remove your public ranking row.
  • Subscription: manage or cancel via iPhone Settings → your Apple Account → Subscriptions. Account deletion does not cancel Apple billing.
  • Data-protection rights: depending on where you live, you may have rights to access, correct, erase, restrict or object to processing, receive portable data, withdraw consent and complain to a regulator.

We may need to verify your identity before completing a request. UK users can contact the Information Commissioner's Office; EEA users may contact their local supervisory authority.

10. Children

GymLock is not directed to children under 13, and we do not knowingly collect personal data from children under 13. Where local law requires parental consent at a higher age, do not create an account without that consent. Contact us if you believe a child has provided data improperly.

11. Changes to this policy

We may update this policy as GymLock changes or legal requirements develop. We will post the revised version here, change the effective date and, for material changes, provide an additional notice where appropriate.

12. Contact

Velentis Labs operates GymLock. For privacy questions, requests or complaints, email support@gymlock.co. Please write “Privacy request” in the subject line so we can route it correctly.