GymBuddy

GDPR overview

There is no GDPR implementation to describe. The term appears nowhere on the site, in the privacy policy, or in the copy hosted at PrivacyPolicies.com: a search across every archived page returned zero occurrences. There is no rights section, no legal basis, no response deadline, no data protection officer and no Article 27 representative. No DPA is offered, no subprocessors are listed and no hosting country is named. This matters because the policy itself declares Ireland as the company's country, placing the publisher inside the EU and making the regulation directly applicable, and because it has registered as a trader on Google Play attesting compliance with EU law. The policy does acknowledge cross-border transfers and promises adequate controls, without naming any mechanism.

Who owns the data?

The privacy policy, dated 13 March 2023, is a generated template and contains no clause claiming ownership of your content or of the workouts the tool produces. It grants the right to view, correct and delete personal data from account settings or by email, and the publisher repeats on Google Play that deletion can be requested. Sharing is described broadly: service providers, affiliates, business partners, corporate transfers and other users in public areas of the service. The publisher states it never sells personal data to third parties. One reservation limits the deletion right, since information may be kept where a legal obligation or another lawful basis applies.

Reuse rights

No published document restricts what you may do with the programmes GymBuddy generates for you. Neither the privacy policy nor the page served at /terms contains a licence, an ownership clause or any limit on reuse, so nothing on paper stops you following, adapting or sharing your own plans. That freedom rests on silence rather than on a stated permission, which is worth noting for trainers who intend to resell programmes commercially. On the publisher's side the declared uses are wide: operating and improving the service, analytics, and marketing contact, which the policy says you accept simply by signing up. The FAQ adds that fitness information is processed to personalise recommendations while identifiable information is not used for workout generation. Nothing is said, either way, about training AI models on customer data.

Data retention & training

Hosting summary

Nothing is published about where GymBuddy stores data. No hosting country, no region and no provider is named in the privacy policy, on the site, or in the copy hosted at PrivacyPolicies.com. The policy states only that information is processed at the company's operating offices and anywhere the parties involved in the processing are located, and it acknowledges that data may be transferred outside the user's jurisdiction while promising adequate controls, without naming any mechanism such as standard contractual clauses. No subprocessor list is published. For reference only, the domain resolves to an address announced by Amazon and flagged as anycast, which identifies a content delivery node in front of the site rather than a storage location, and should not be read as showing where personal data actually lives. Given that the service collects health and fitness data, and that the publisher declares Ireland as its country, this silence is the most significant documentation gap on the product.