Privacy policy

1. Controller

The controller under the General Data Protection Regulation (GDPR) is:

Cloo GmbH, Reumtengrüner Str. 32B, 08209 Auerbach, Germany. Amtsgericht Chemnitz, HRB 38181. Managing directors: Yannick Seeger and Paul Otto.

Contact: support@gorillagainz.app. For data protection requests (access, export, deletion without the app, objection), write to datenschutz@gorillagainz.app. More details are in the Impressum.

2. Which data we process and why

For each processing we name the data, the purpose, the legal basis and the retention period. Art. 6(1)(b) GDPR means that we need the data to perform the user agreement with you. Point (a) is your consent, point (c) a legal obligation, point (f) a legitimate interest of ours that does not override your interests.

2.1 Account and sign-in

• Data: e-mail address (with Apple also the relay address if you hide your e-mail), the ID of your Apple or Google account, name, username, home town (optional), language, settings, your sign-ins (device, last use). There are no passwords.
• Purpose: create your account, sign you in, manage sign-ins and devices, security.
• Legal basis: Art. 6(1)(b) GDPR.
• Retention: until the account is deleted. Sign-ins last 90 days and extend with every use. We delete an account that is not set up 7 days after sign-in. Your username stays blocked for 30 days after deletion.
• Apple and Google: if you sign in there, we receive the details you release on their consent screen (ID, e-mail, name).
• Protection against abuse: so that nobody tries codes by brute force, we limit requests per IP address and per e-mail address for a short time (one hour at most). Legal basis: Art. 6(1)(f) GDPR.

2.2 Age and minimum age

• Data: date of birth, time of confirmation.
• Purpose: Gorilla Gainz is for ages 14 and up. Your date of birth decides which rules and features apply to you (see 7). We show it to nobody.
• Legal basis: Art. 6(1)(b) and (f) GDPR (proof of the age check, protection of younger people).
• Retention: until the account is deleted.
• Under 14: if you enter an age under 14, we delete the account at once. So that nobody registers again with the same sign-in, we keep a fingerprint (hash) of your sign-in ID or e-mail address for 30 days, never the plain text. The same applies if we block an account because of an age under 14.

2.3 Profile, posts and other content

• Data: profile photo (optional), bio, posts with photo or video and text, comments, reactions, friendships, followers, groups, planned sessions and your answers, live sessions and their results, challenges, streak and pauses (only that you pause, not why), blocked and muted people.
• Purpose: share training, find friends, train together.
• Legal basis: Art. 6(1)(b) GDPR.
• Who sees what: you choose the audience for every post (for example friends, everyone, a group, only me). An account under 18 starts private. If your account is public, all users see your name, username, photo, counts, streak, home town and bio. A public account of someone 18 or older also has a page on the website; posts with the audience "Everyone" can be seen there by anyone with the link. Whether your profile appears in search engines is set under Settings › Privacy.
• Retention: until you delete the content or your account. We remove deleted posts permanently after 24 hours (if an open report still needs them, until 30 days after the review ends). We keep feed entries and notifications for 60 days. We delete results of live sessions 90 days after the end, planned sessions 366 days after the start (cancelled ones 90 days after cancellation). We delete join requests after 30 days, invitations after 14 days and the log of group admins after 180 days.
• Photos and videos are with Cloudflare in the EU (see 3.2). The app removes metadata such as the place of capture before uploading. Your browser may cache public photos on the website for up to one hour.
• Sharing: if you share something with another app through the share menu, that app's privacy notice applies.

2.4 Training

• Data: your workouts (exercises, sets, reps, weights, duration, time), personal bests, statistics, templates, your own exercises, your weekly plan, notes you log afterwards and, for a workout at a spot, the spot.
• Purpose: record, analyze and show your training. We do not ask for health data.
• Legal basis: Art. 6(1)(b) GDPR.
• Retention: until the account is deleted. We remove deleted workouts and templates permanently after 30 days. Part of the data is also on your phone and disappears when you sign out or delete the app.

2.5 Camera counting and verified sets

• Camera counting and QR scanner: the app analyzes the camera image on your phone. Nothing is recorded, stored or uploaded. On Android the QR scanner uses Google ML Kit (see 3.7).
• Verified sets (16 and up, with consent): for ranked challenges and verified personal bests, the app records a set as a video and detects the body keypoints (positions of joints). We upload the video and the keypoints to check the count and to look at it in a dispute. A program checks the keypoints; in case of doubt or an appeal, a person looks at the video.
• Purpose: checking challenges and preventing cheating.
• Legal basis: your consent (Art. 6(1)(a) GDPR).
• Retention: we delete video and keypoints 30 days after the upload, at once if you withdraw your consent. The counts stay in the ranking.

2.6 Spots and location

• Data: spots you add or change, photos, ratings, descriptions, condition reports. Spot details are public and come partly from OpenStreetMap (see Data sources).
• Location: the app uses your location only if you allow it, and never in the background: to show you spots near you and to recognize the spot nearby when you start a workout (can be turned off under Settings › Privacy). We do not store your location, only the recognized spot of the workout.
• Map in the app: the app shows the map with Apple Maps (iOS) or Google Maps (Android). The provider receives its own data for this, for example your IP address (Apple, Google).
• Legal basis: Art. 6(1)(b) GDPR and your permission for the location (Art. 6(1)(a) GDPR, section 25(1) TDDDG).
• Retention: photos and ratings until you delete them or your account; condition reports 180 days. Spots stay after your deletion, without your name.

2.7 Notifications (push)

• Data: push token of your device, platform, device model, app version, language, your notification settings.
• Purpose: notifications about your account, your friends, sessions, challenges and your streak.
• Legal basis: Art. 6(1)(b) GDPR.
• Retention: we delete the token when you sign out, when it becomes invalid, and after 90 days without the app being opened. Delivery through Apple and Google (see 3.6).

2.8 E-mails

• Data: e-mail address, language, content of the mail.
• Purpose: sign-in codes, notices about your account and, if you said yes to a session on the website and do not use the app, mails about that session. No advertising, no newsletters, no open or click tracking.
• Legal basis: Art. 6(1)(b) GDPR.
• Retention: we do not store the content of mails. We delete the send notes of session mails after 7 days. Sent through Resend (see 3.3), which keeps metadata for 30 days.

2.9 Premium and AI reading

• Premium: you buy Premium in the App Store or on Google Play; we never see payment data. To manage it, RevenueCat receives your account ID (no name, no e-mail) and the subscription and purchase data of the store. Legal basis: Art. 6(1)(b) GDPR. Retention: until the account is deleted; then we also delete your record at RevenueCat. You cancel the subscription in the store.
• AI reading (16 and up, with consent): if you log workouts as a note, we send only the lines the app cannot read itself to Anthropic (USA), which turns them into sets. Your name and account are not sent, and we do not store the text. You can withdraw your consent under Settings › Privacy. Legal basis: Art. 6(1)(a) GDPR.

2.10 Safety and moderation

• Data: reports, a copy of the reported content as evidence, decisions, warnings, blocks, appeals, review logs; for blocks a hash of your sign-in ID.
• Purpose: protect the community, stop violations of the community rules and meet our obligations under the Digital Services Act (DSA).
• Legal basis: Art. 6(1)(f) GDPR and Art. 6(1)(c) GDPR (DSA). Whoever reports stays anonymous to the reported person.
• Review: a word list checks names and texts when they are saved. Our team looks at photos after they are uploaded. We review videos after reports and in samples of new or warned accounts; content that only you see, never. A person always decides on removals and blocks.
• Retention: evidence of rejected reports 30 days, of cases with action 12 months, the case itself 24 months. Warnings expire after 180 days, the hash of a block after 3 years. This data stays after your account is deleted, where necessary (Art. 17(3) GDPR).
• Proof of age: if we ask for proof because we suspect an age under 14, we look at it once and delete it within 24 hours; only the decision stays.

2.11 Website

• Visiting pages: the website runs on our server in Germany. When you visit, it processes your IP address and your browser details as technically necessary. Legal basis: Art. 6(1)(f) GDPR (providing and protecting the website).
• Map of Mapbox: the spot maps come from Mapbox (see 3.9). When a map loads, Mapbox receives your IP address, your browser details, the map area shown and a random identifier from your browser's storage (see 4). Mapbox does not receive your location. Legal basis: Art. 6(1)(f) GDPR (a map on which people find spots). According to Mapbox, it deletes the IP address after 30 days.
• Map and search: when you move the map or search, your browser sends the map area, the filters or your search words to our server to find matching spots and places. We do not store them. "Use my location" stays in your browser; your position is not sent to us. Legal basis: Art. 6(1)(f) GDPR.
• "Open in the app": we count per day how often this button was tapped in a normal browser and in the browser of another app, to improve it. Only the number is stored, nothing about you. Legal basis: Art. 6(1)(f) GDPR.
• Signing in on the website: the same rules apply as in the app. Cookies and storage: see 4.
• We use no audience measurement and load no scripts or fonts from third parties, except the map of Mapbox.

2.12 Hosting and security

• Server: the data of the app and the website are on our server at Hetzner in Germany (see 3.1).
• Backups: every 6 hours we back up the database at Hetzner in Finland; each backup is kept for 7 days. Deleted data can therefore remain in backups for up to 7 days.
• Protection: connections are encrypted. Our team sees content only for reports, for the review of photos or in samples (see 2.10); every look is logged.
• Legal basis: Art. 6(1)(b) and (f) GDPR.

2.13 Contacting us

• Data: your e-mail address and your message when you write to us, also for reports and appeals.
• Purpose: answer your request.
• Legal basis: Art. 6(1)(b), (c) and (f) GDPR.
• Retention: as long as handling it requires; reports and appeals as in 2.10.

3. Recipients and processors

We pass on data only when it is necessary to run Gorilla Gainz. With service providers that process data on our behalf we have contracts under Art. 28 GDPR. We do not sell data.

3.1 Hetzner Online GmbH

• Role: processor. Hetzner provides our server.
• Data: all data of the app and the website.
• Location: Germany; backups in Finland. No transfer outside the EU.

3.2 Cloudflare

• Role: processor. Cloudflare stores photos, videos, data exports and evidence from reports, and manages the DNS records of our domain.
• Data: your media; when the app loads media, the IP address of your device.
• Location: EU.
• Transfer basis: EU-US Data Privacy Framework; in the alternative EU Standard Contractual Clauses.

3.3 Resend

• Role: processor for sending e-mail.
• Data: e-mail address, content of the mail, metadata (30 days).
• Location: sent from the EU (Ireland); metadata in the USA.
• Transfer basis: EU Standard Contractual Clauses and EU-US Data Privacy Framework.

3.4 Anthropic

• Role: processor for the AI reading of notes (see 2.9), only with consent and from 16.
• Data: the lines of your note that the app cannot read. No name, no ID.
• Location: USA.
• Transfer basis: EU Standard Contractual Clauses.

3.5 RevenueCat

• Role: processor for managing Premium (see 2.9).
• Data: account ID, subscription and purchase data.
• Location: USA.
• Transfer basis: EU Standard Contractual Clauses.

3.6 Apple and Google (push notifications)

• Role: Apple (iOS) and Google (Android, Firebase Cloud Messaging) deliver our notifications. For Firebase, Google is our processor; Apple processes the notifications under its own privacy notice.
• Data: push token and content of the notification.
• Location: USA and worldwide.
• Transfer basis: Google: EU-US Data Privacy Framework and Standard Contractual Clauses. Apple: Standard Contractual Clauses.

3.7 Google ML Kit (QR scanner on Android)

• Role: on Android the QR scanner uses Google ML Kit. The camera image stays on your phone; ML Kit sends usage and performance data to Google.
• Data: usage and performance data, no camera images.
• Transfer basis: as for Google in 3.6.

3.8 Apple and Google (sign-in, maps, stores)

• Role: Apple and Google process sign-in with Apple or Google, Apple Maps and Google Maps in the app, and the App Store and Google Play under their own privacy notices.
• Data: for sign-in your ID, e-mail and name; for the map, for example, your IP address; in the store your purchases.
• Transfer basis: as in 3.6.

3.9 Mapbox

• Provider: Mapbox, Inc., USA.
• Role: Mapbox provides the map of the website (see 2.11) and also processes usage and billing data as a controller of its own.
• Data: IP address, browser details, map area, a random identifier from your browser's storage.
• Location: USA.
• Transfer basis: EU-US Data Privacy Framework; where needed, EU Standard Contractual Clauses.

3.10 Authorities and third parties

We pass on data to authorities when the law requires it (for example under the DSA) and when necessary to enforce legal claims. Content you make public is seen by everyone you release it to.

4. Cookies and local storage

As a visitor of the website you get no cookies from us. When a map loads, Mapbox stores a random identifier in your browser's local storage (see 2.11).

When you sign in on the website, we set a cookie for the sign-in process, a session cookie (up to 90 days, extended with use) and a marker cookie by which the website knows that you are signed in. All three are strictly necessary for signing in (section 25(2) no. 2 TDDDG).

In the app we use the secure storage of your phone for sign-in and local storage for data needed offline. We do not read an advertising identifier, and there are no advertising or tracking tools.

5. Data transfers to third countries

Where data goes to a country outside the EU or the EEA, we rely on the bases named for the recipients in section 3: the EU-US Data Privacy Framework (adequacy decision of the EU Commission of July 10, 2023) and EU Standard Contractual Clauses. You get a copy of the clauses on request at datenschutz@gorillagainz.app.

6. Deleting your account

You can delete your account at any time: in the app under Profile › Settings › Account › Delete account, or on the website under Delete account. The account is hidden at once and all sign-ins end. After 14 days we delete it permanently; until then you can keep it by signing in again.

What is deleted: your profile and all your content, workouts, photos and videos, connections, devices, data exports, consents, your Premium record with us and at RevenueCat, and your sign-in. We revoke the sign-in with Apple at Apple.

What stays:

• Cases, evidence and hashes from moderation, for as long as named in 2.10.
• Results of past challenges and sessions, under the name "Deleted account".
• Spots you added, without you as the author.
• Reports you made, without your ID.
• The blocked username for 30 days and backups for up to 7 days.

Deleting your account does not end a Premium subscription. Cancel it first in the App Store or on Google Play.

7. Children and teens

Gorilla Gainz is for ages 14 and up. Accounts under 18 start private, are not suggested to others and can only be found by their exact username. There are no direct messages, and adults who do not know a 14 or 15 year old through mutual friends or a group cannot send them a request.

Under Art. 8 GDPR, in Germany a person can give consent alone only from 16. So for 14 and 15 year olds there is no AI reading, no verified sets with video. Parents with questions write to support@gorillagainz.app.

8. Automated decisions

We make no decisions based solely on automated processing that have legal effects on you or similarly significantly affect you (Art. 22 GDPR). A person always decides on removals, warnings and blocks, and you can appeal.

9. Your rights

You have the following rights if the conditions are met:

• Access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20).
• Objection (Art. 21 GDPR) to any processing that we base on legitimate interests, on grounds relating to your situation.
• Withdrawal of consent (Art. 7(3) GDPR) with effect for the future.

Data export: in the app under Profile › Settings › Account › Download data you get all your data as files, once every 7 days. Without the app, write to datenschutz@gorillagainz.app. We answer within one month.

Complaint: you can complain to a supervisory authority. The authority responsible for us is the Sächsische Datenschutz- und Transparenzbeauftragte (Saxon Data Protection and Transparency Commissioner), Maternistraße 17, 01067 Dresden, Germany, datenschutz.sachsen.de. You can also contact the authority where you live.

10. Do I have to provide data?

For an account we need your e-mail address (or your Apple or Google ID), a name, a username and your date of birth; without them we cannot give you an account. Everything else (home town, profile photo, bio, location, notifications, AI reading, video upload) is optional.

11. Changes to this policy

We update this policy when Gorilla Gainz or the law changes. You can see the date above. If there are significant changes, we tell you in the app.