• Who is the controller
• Data we collect
• Purposes
• Legal bases (LGPD art. 7)
• Sharing with third parties
• YouTube videos
• International transfer
• Retention
• Your rights (LGPD art. 18)
• Security
• Children and adolescents
• Cookies and similar technologies
• Changes to this policy
• Contact

This Privacy Policy describes how the GymSquad app (“GymSquad”, “app”, “we”) collects, uses, stores and protects the personal data of its users (“you”, “data subject”), in compliance with Brazil’s General Personal Data Protection Law (Lei nº 13.709/2018, “LGPD”).

By using GymSquad, you agree to the practices described below.

1. Who is the controller

GymSquad is maintained by Allan Scofield, acting as the controller of the personal data collected by the app.

Contact (data protection officer): contato@gymsquad.com.br

2. Data we collect

2.1. Data you provide

• Sign-up: name, email, password, date of birth and role in the app (client or coach). A client may also enter the invite received from their coach.
• Profile, filled in later and always optional: phone, gender, training goal, avatar photo; for coaches, squad name, logo and accent color.
• Training content: programs, workouts, custom exercises, exercise photos, sets, loads, durations, notes and personal records.
• Body measurements: weight, body fat percentage and any other measurements you enter.

2.2. Data collected automatically

• Health data via Apple Health (with your explicit permission): heart rate and calories burned during the session, read from your Apple Watch.
• Notifications: the identifier required to send push notifications related to your activity.
• Usage and diagnostic data: app usage events and information about crashes and performance, used to improve the product.

We do not collect: geographic location, contacts, advertising identifiers, financial data or biometrics.

When you play an exercise video, YouTube collects data on its own, directly from your device. This does not go through us and is described in section 6.

3. Purposes

We use your data strictly to:

1. Provide the service: create and maintain your account, sync your workouts, log sessions and measurements, show history and generate progress charts.
2. Support the client-coach link: allow coaches to add clients, build workouts and follow their progress, within the relationship you yourselves established.
3. Send notifications: workout reminders, updates to your workout and messages from your coach.
4. Keep the service secure: prevent abuse and fraud.
5. Improve the product: understand aggregate usage patterns, identify bugs and bottlenecks.

4. Legal bases (LGPD art. 7)

• Performance of a contract (art. 7, V): processing necessary to provide the service you requested.
• Consent (art. 7, I): for access to sensitive health data (Apple Health) and for sending push notifications.
• Legitimate interest (art. 7, IX): for security, fraud prevention and product improvement.
• Compliance with a legal obligation (art. 7, II): the age check at sign-up, required by Brazil’s Digital Statute of Children and Adolescents (Estatuto Digital da Criança e do Adolescente, Lei nº 15.211/2025), and other applicable cases.

5. Sharing with third parties

We do not sell personal data. We may share data, strictly when necessary, with third-party service providers hired for hosting, sending emails, delivering notifications, and app usage analytics and diagnostic tools. These providers access only the minimum information essential to perform the contracted service and are subject to their own data protection policies and contractual clauses.

Besides these providers, the app embeds the YouTube video player under the conditions described in section 6.

6. YouTube videos

GymSquad uses YouTube API Services. Some exercises come with a demonstration video chosen by the coach, played by the official YouTube player inside the app.

This only happens if you open the video. No YouTube content is loaded until you ask to play it.

6.1. What Google receives

When you play the video, communication happens directly between your device and YouTube’s servers. At that point Google may receive, among other things, your IP address, device information and data about the playback. This processing is carried out by Google as an independent controller and is governed by the Google Privacy Policy and the YouTube Terms of Service.

GymSquad receives no data from Google about what you watched. We do not use Google sign-in, we do not ask for authorization to any of your accounts and we do not receive audience reports.

6.2. Cookies and storage during playback

The YouTube player may store cookies and use similar technologies on the device while the video plays. Whatever is stored is valid only for that session: it is discarded when you close the video and does not remain in the app.

GymSquad does not read, keep or share anything YouTube stores during that period.

6.3. Responsibility for the link

The video address is chosen and entered by the coach. GymSquad does not host, review or take responsibility for the content played, as set out in the Terms of Use.

7. International transfer

Part of the processing may take place on servers located outside Brazil. The transfer is necessary to provide the service and is backed by contractual safeguards with the providers involved.

8. Retention

We keep your data while your account is active. You can request the deletion of your account at any time. After deletion:

• Sign-up and profile data are deleted within 30 days.
• Technical logs may remain, anonymized, for up to 90 days for diagnostic purposes.

9. Your rights (LGPD art. 18)

You may, at any time:

• Confirm that your data is being processed;
• Access the data we hold;
• Correct incomplete or inaccurate data;
• Anonymize, block or delete unnecessary data or data processed in non-compliance;
• Port your data to another provider;
• Revoke your consent;
• Request the deletion of your account and all associated data.

To exercise any of these rights, send an email to contato@gymsquad.com.br. We will respond within 15 days.

10. Security

We adopt reasonable technical and organizational measures to protect your data against unauthorized access, alteration, disclosure or destruction. Despite these precautions, no system is absolutely secure. If a security incident affecting your data occurs, we will notify you and the ANPD (Brazil’s National Data Protection Authority) as required by the LGPD.

11. Children and adolescents

GymSquad is rated 16+ on the App Store, and that is our minimum age. We follow the age brackets of Brazil’s Statute of Children and Adolescents (Estatuto da Criança e do Adolescente): a child is anyone under 12, an adolescent is anyone aged 12 to 17. We do not accept sign-ups from anyone under 16, child or adolescent.

How we verify. Date of birth is required at sign-up, and a sign-up with an age below 16 is refused before the account is ever created. The check is ours and does not rely only on the store’s age rating, as required by Brazil’s Digital Statute of Children and Adolescents (Lei nº 15.211/2025).

Date of birth is used only for this. It is used to check the minimum age, and you can view and correct it at any time. We do not use this information for advertising, profiling, targeting, recommendations or any other purpose, and we do not share it with third parties beyond the infrastructure providers described in section 5.

11.1. Under 16

The app is not intended for children or for adolescents under 16, and we do not accept their sign-up. We do not knowingly collect data from anyone under 16. If we identify an account in this age range, it is closed and the associated data is deleted.

11.2. Adolescents aged 16 and 17

Use by an adolescent depends on the consent and supervision of at least one parent or legal guardian, who is also the one who accepts the Terms of Use on the adolescent’s behalf and who purchases any subscription, since people under 18 do not have full legal capacity to enter into contracts.

All processing of an adolescent’s data is carried out in the adolescent’s best interest, under art. 14 of the LGPD. In practice, this means that:

• We do not use adolescents’ data for advertising, commercial profiling or any form of tracking. GymSquad has no advertising for anyone.
• We do not make use of the app conditional on providing more data than is necessary for training.
• An adolescent’s health data, body measurements and photos are treated as sensitive data and are restricted to the adolescent and to the coach they are linked to.

11.3. What the coach sees of an adolescent client

The client-coach link is at the center of the app, and in this case it gives an adult access to a minor’s information: workouts, logged sessions, progress and, when the client records them, body measurements. For that reason:

• The link only exists when the client accepts the coach’s invite. No coach reaches a client they did not invite.
• The legal guardian must be aware of and agree to this link before the adolescent joins the squad.
• The guardian may, at any time, ask for the link to be undone, for the account to be deleted, or for access to everything we keep, at the email below.

11.4. Rights of the guardian

The rights in section 9 may be exercised by the legal guardian on behalf of the adolescent: confirm the processing, access, correct, port, revoke consent and request deletion. Just write to contato@gymsquad.com.br identifying the relationship.

12. Cookies and similar technologies

GymSquad does not use tracking cookies, does not use advertising and does not integrate any cross-app tracking tool. The app’s local storage serves only the operation of the app itself and is not shared with third parties.

One exception, narrowly defined: when you play an exercise video, the YouTube player may store its own cookies on the device during the session, as described in section 6. These cookies are Google’s, not ours, and do not survive closing the video.

This website does not use cookies, has no analytics tool and loads nothing from third parties. The host logs the IP address and technical data of each visit, like any web server, to deliver the pages and protect them against abuse.

13. Changes to this policy

We may update this policy from time to time. Relevant changes will be communicated in the app or by email. The date of the last update is at the top of this document.

14. Contact

Questions, requests or complaints about this Policy and the processing of your data:

Email: contato@gymsquad.com.br

You can also contact Brazil’s National Data Protection Authority (ANPD) at gov.br/anpd.