Privacy policy
Effective October 19, 2026
This is a translation. If there is any discrepancy, the Spanish version prevails, except where the law of your country requires otherwise.
- To use Gymnastés you need an account (email and password; soon also Google or Microsoft). Your workouts, routines, measurements and settings are stored in your account, on our own server, and synced across your devices.
- The connection to the server is encrypted (HTTPS) and passwords are stored with one-way hashing (scrypt): nobody, not even us, can read them.
- Progress photos and voice recordings stay, for now, only on your device.
- Today the app shows no ads and uses no third-party analytics or trackers. When the free version shows ads, they will be short and at the end of your workout, and we will update this policy first. We never sell your data.
- You can view, export and delete everything, including your account, from the app.
1. Who is responsible
Gymnastés is an app by Inquieto (SFT division), based in the Argentine Republic. For any privacy question, write to [email protected].
2. What data is used and where it is stored
| Data | Purpose | Where it is stored |
|---|---|---|
| Account: email, name, password (hashed), whether you want news, sign-up and last-use dates | Signing in, account recovery, service notices and, if you agreed, news | On our server |
| Workouts: routines, sets, weights, reps, rests, notes | Recording and showing your progress on all your devices | On your device and in your account |
| Body measurements: weight, fat, muscle, water, waist | Progress charts | On your device and in your account |
| Profile: name, date of birth, email and phone (optional) | Personalizing the app | On your device and in your account |
| Teachers: their students (name, group, level, physical limitations or training precautions, springs, notes) and the classes given | Planning and adapting classes | On the teacher's device and account |
| Places (studio, gym, personal trainer): name, brand, people and their roles | Letting staff and students work together | On our server |
| Progress photos and profile photo | Comparing your progress | Only on your device |
| Your own voice recordings | Rest alerts in your voice | Only on your device |
| Weekly plan, preferences and settings | Reminders and configuration | On your device and in your account |
Body measurements and physical limitations or conditions (for example, an injury or a pregnancy) may be sensitive data under Argentine Law 25,326 on Personal Data Protection and the EU General Data Protection Regulation (GDPR, art. 9). We use them only for training, never for any other purpose. If you are a teacher, enter a student's limitations only with their consent (the app records it in their file).
Measurements, photos and profile contact details are optional.
3. Device permissions
- Microphone: only if you record your own voice alerts. The recording stays on your device.
- Photos and files: only when you pick an image or a backup. The app does not browse your gallery.
- Notifications and alarms (Android app): to alert you when a rest ends and remind you of your plan days. They are scheduled on the phone itself.
- Screen on: so it does not turn off during your workout, if you enable it.
4. Who else can see your data
- Your place: if you join a studio, gym or teacher, they see your name, your email and your role there. What your teacher records about you in their account is seen by them (and by the place's staff, according to their role).
- Gymnastés: only to run the service (support, security, backups) and to see aggregated usage metrics. We do not look at your workouts unless you ask us to, to fix a problem.
- What you share: backups (you can protect them with a password, AES-GCM 256-bit encryption), medal and record images, feedback you send us by email or WhatsApp, and the calendar or music services you open (under their own policies).
5. Server and hosting
The app, the website and account data run on our own server, rented from Hostinger and located in São Paulo (Brazil). The database is ours: it is not shared with any other service. The website goes through Cloudflare, which protects it from attacks and may log the IP address and technical connection data under its privacy policy. We make a daily database backup, kept for 14 days.
6. Legal bases (GDPR)
For people in the European Union or the United Kingdom: data is processed to provide the service you request (art. 6.1.b); health data, with your explicit consent when you enter it (art. 9.2.a), which you can withdraw by deleting it; news emails and the feedback you send us, with your consent (art. 6.1.a); and service security, on the basis of legitimate interest (art. 6.1.f).
7. Your rights
You have the right to access, rectify, update, delete and export your data, and to object to its processing (arts. 14 to 16 of Law 25,326; arts. 15 to 22 of the GDPR; and equivalent rights in other jurisdictions, such as the California Consumer Privacy Act).
- From the app: Settings → Data → Backup to export it; Profile → Account to stop receiving news or delete your account (everything stored on the server is deleted).
- For any other request, write to [email protected] and we will reply within 10 calendar days.
The owner of personal data has the right to access it free of charge at intervals of no less than six months, unless a legitimate interest is shown, as established in article 14, paragraph 3 of Law No. 25,326. The AGENCY FOR ACCESS TO PUBLIC INFORMATION, as the Control Body of Law No. 25,326, is empowered to handle complaints and claims filed by those whose rights are affected by non-compliance with the rules on personal data protection.
If you are in the European Union, you can also complain to the data protection authority of your country.
8. Security and retention
The connection is encrypted (HTTPS), passwords are stored with scrypt, sessions use temporary keys that expire and are renewed, and the server only accepts connections on the web ports, with key-only administrative access. Your account data is kept while you have the account; when you delete it, it is removed from the server (backups roll over within 14 days). Photos and recordings depend on your device: use a screen lock and make backups.
9. Children
The app is not directed at children under 13 (16 in EU countries that set that age) and we do not knowingly collect their data. People under 18 should use it with the permission and guidance of their parents or guardians, and train under adult supervision.
10. International transfers
The server is in Brazil, so your data is transferred from Argentina or another country to that server, with the security measures in this policy. If you email us, the message goes through the email provider's servers.
11. News emails and artificial intelligence
We send service emails (for example, about your account security or important changes). News and promotions only if you ticked the box, and you can unsubscribe at any time. If we add artificial intelligence features that use your data in the future, we will update this policy and ask for your consent first.
12. Changes to this policy
If we change it, we update the date above and, if the change is significant, we let you know in the app.