Privacy policy

Last updated: 2026-10-22

Who is responsible

The Gym Timer is an independent personal project. For any question about your data, write to nihqh67g6yn8zv49i3vz@proton.me.

What is stored on your device

Your routine, your training history and your preferences (language, theme, sound, radio) are kept in your browser's local storage and in first-party cookies (lang, theme, sound). They are needed for the app to work and never leave your device unless you sign in.

Account (optional)

If you sign in with Google, we receive your email address and your Google account id. We use them to store your routines and training sessions so they sync across devices. The session is kept with a necessary cookie (gymtimer_auth, 30 days). To show the Google button, Google's sign-in script (accounts.google.com) is loaded, only when you open that window. If you prefer to sign in with a code by email, we send the code to the address you type through Brevo (Sendinblue SAS, France); that email is used only for the code and to identify your account, not for advertising. The legal basis is providing the service you ask for. The data is kept while you use the account; you can ask us to delete your account and data by writing to the contact address.

Analytics (only if you accept)

If you accept analytics cookies, we use:

Google Analytics 4 (Google Ireland Ltd.): usage statistics. Cookies _ga and _ga_*, up to 2 years.
Microsoft Clarity (Microsoft Corp.): heatmaps and anonymised session recordings to find usability problems. Cookies _clck (1 year) and _clsk (1 day).

If you are also signed in, we send them a pseudonymous id for your account (derived from it, without your email or your Google account id) so that your visits from different devices count as one user. Both services infer your approximate location (country, city) from your IP address; we do not store your IP address.

The legal basis is your consent. If you reject, neither is loaded and nothing is sent to them. You can change your choice at any time from Settings → Privacy & cookies. These providers may process data outside the European Economic Area under the safeguards required by the GDPR.

Other services

AI routines: the text you type is sent to Google's Gemini API to generate the routine. Under Google's terms, on the free tier Google may use that text to improve its services, so don't include personal data. Your IP address is used temporarily to limit the number of daily requests.
Radio: the station list comes from radio-browser.info and the audio from each station. Those servers receive your IP address when you use it.
QR code (desktop only): the library that draws the QR code is downloaded from cdnjs (Cloudflare), which receives your IP address.
Hosting: the app is hosted on Microsoft Azure, which logs technical request data (such as the IP address) for security.

Your rights

You can ask for access, rectification, erasure, portability or objection to the processing of your data, and withdraw your consent at any time, by writing to nihqh67g6yn8zv49i3vz@proton.me. You can also complain to the data protection authority in your country.