Privacy Policy

Effective date: November 11, 2026 · Last updated: October 27, 2026

The Korean version of this Privacy Policy is the original, and if this English version differs from it in meaning, the Korean version prevails, except as to sections that appear only in this English version and except where mandatory laws of the country or state where you live require otherwise.

GYMKC (hereinafter referred to as "the App") is a service that provides personal workout records and coaching. The App values users' personal information and transparently explains the information collected and the purposes of its use as follows.

1. Information Collected

The App uses advertising identifiers only for ad performance measurement ("Ad performance measurement (App)" above). On Android, you may reset or delete the advertising ID in your device's Settings › Google › Ads, and on iPhone, you may choose not to allow it when the App first asks or turn it off in Settings › Privacy & Security › Tracking. If you turn it off, measurement is done without the advertising identifier. We do not collect contacts, address books, or call logs. The App does not display third-party advertisements.

Our website uses cookies from advertising media and analytics tools for "Ad performance measurement (Web)" and "Website visit analytics" above (from October 30, 2026; we currently use Google Ads). You can block or delete cookies in your browser settings, and the website and the web app still work if you do. You can turn off personalized ads in each advertising medium's ad settings (for Google, adssettings.google.com).

When we run ads with the relevant medium or enable a tool, we may use other advertising media, remarketing to website visitors, web analytics, and server-reported conversions within the scope of "Ad performance measurement (Web)" and "Website visit analytics" above. The data items, regional restrictions, and ways to refuse cookies and personalized ads remain as described above. Raw workout records and health information are not used for this processing.

Statistics for service improvement. Of the information above, workout records and how the App is used (such as which exercises were skipped or replaced and whether suggested weights or reps were adjusted) are aggregated in a form that cannot identify an individual and used to improve the accuracy of prescriptions (starting weight, increments, and rest time) and the exercise list and guidance text. These aggregates do not include names or emails, and the advance health check (conditions), body composition, and progress photos are excluded from aggregation. They are not published at a size that could identify a specific individual. These statistical aggregates are used only for service improvement, and raw workout records are not used for advertising or personalized marketing. However, for members who consent to "Advertising notifications" above, usage status such as not having started a first workout may be used to select recipients. If you do not want your information to be included in statistics, let us know at the contact below and we will exclude it.

Location information (GPS) is processed within the device (phone, watch) while measuring workouts only if the user has consented, and only for the purpose of calculating the travel distance and average speed of outdoor running, walking, and cycling. The location coordinates themselves are not collected. They are neither stored nor sent to the server, and only the calculated distance (meters) remains in the record. Travel routes are neither plotted nor stored; during measurement, the location is continuously read to calculate distance even if the screen is turned off, but it stops immediately when measurement is stopped, and location is not collected outside of measurement. Even if location permissions are denied, you may enter the distance directly or import it from connected smartwatch records and use all features as they are.

2. Storage Location of Information

• Server: Stored separately by account in the Cloudflare D1 database (for the purpose of multi-device synchronization).
• User device: A copy is kept inside the device (IndexedDB) so that workouts are possible even offline.
• Progress photos are not transmitted to the server and are stored only on the device on which they were taken. If the App is deleted, they are removed together.

3. Processing for AI Coaching

For the workout analysis, routine generation, and coach conversation features, your workout records, body and condition information, profile (gender, proficiency, goals, weekly frequency, workout days, injured areas and joints, Big 3 records, height, weight, and preferred cardio), and age group are sent to AI models (Cloudflare Workers AI, Google Gemini) to generate coaching results. When you use the equipment recognition and routine import features, the photos you take or select are sent as well (those features currently send them only to Cloudflare Workers AI, and the photos are kept on the server only while being processed and are deleted immediately after processing, or within 7 days at the latest). Progress photos (Section 1) are not sent. Age is sent only as an age group (e.g., 30s) instead of the year of birth. Regardless of your plan, the providers above generate coaching results, and which provider processes a request depends on the type of feature and on outages (if one provider does not respond, the request is passed to another). Cloudflare is already the processor responsible for the App's hosting and database (Section 5).

• Name, email, contact details, and other information that directly identifies the user are not sent.
• The transmitted data is used only for the purpose of generating coaching results.

4. Handling of Health Data (Android Health Connect · iOS Apple Health/HealthKit)

5. Provision to Third Parties and Overseas Transfer

The App does not sell personal information. It uses the following only to the extent necessary for service operation.

• Cloudflare: Hosting, database, and generation of AI coaching results (Workers AI; see Section 3)
• Cloudflare, Google: Generation of AI coaching results (see Section 3), and receipt and forwarding of customer inquiry emails
• Google (Firebase Cloud Messaging): When we send notifications to the App on Android, receives and delivers the device registration token and the notification title and body. Friend and crew notifications may include the other Member's nickname and crew or routine names, crew coach notifications may include a member's nickname, how many days they have rested, and figures from the previous week's workout summary, and event win notices may include the event name and the prize name
• Apple (Apple Push Notification service): When we send notifications to the App on iOS, receives and delivers the device token and the notification title and body. Friend and crew notifications may include the other Member's nickname and crew or routine names, crew coach notifications may include a member's nickname, how many days they have rested, and figures from the previous week's workout summary, and event win notices may include the event name and the prize name
• Google Health Connect · Apple Health (HealthKit): Integration with health data on the device (see Section 4)
• Kakao: Identity verification when you log in with a Kakao account (Kakao member number, nickname, and email). Workout records are not sent to Kakao.
• Naver: Identity verification when you log in with a Naver account (Naver user identifier and email, and nickname if you consent). Workout records are not sent to Naver.
• Apple: Identity verification when logging in with an Apple account (account identifier, name and email upon initial consent. If Hide My Email is used, a private relay address is received). Workout records are not transmitted to Apple.
• Google: Identity verification when logging in with a Google account (account identifier, name, verified email). Workout records are not transmitted for login purposes.
• Google Play: Payment processing and verification of subscription status when paying for a subscription in the App. Payment method information is processed by Google, and the App does not store it.
• App Store (Apple): Payment processing and checking subscription status when you pay for a subscription in the App on iPhone. Payment method information is processed by Apple, and the App does not keep it.
• Toss Payments: Payment processing when paying for a subscription on the web. Card information is directly received and stored by Toss Payments, and the App neither receives nor stores card numbers. What the App stores is payment identification values (billing key, order number) and payment results. In order to display the name on the card registration screen and send payment history emails, name and email are also transmitted together (items not registered are not sent).
• Courier company (the courier used to send prizes): Event prize delivery. When we ship a physical prize to a winner, we pass on only the recipient name, mobile phone number and address.
• AppsFlyer: Measurement of the App's ad performance (processing of the "Ad performance measurement (App)" items in Section 1). It counts which ad led to an install, sign-up, or subscription (including filtering out fake installs) and reports those conversion results to advertising media. Member names, emails, health information and workout details are not sent; from workout records we report only whether a first set was saved within 7 days of signing up.
• Advertising media (entities running app installation advertisements, such as Naver): Receives, via AppsFlyer, whether installation, sign-up, subscription or a first logged workout occurred (conversion), advertising identifiers, and access IP addresses of devices that entered through advertisements of that medium, and counts advertising performance. Member name, email, and Member number are not received.
• Web advertising media and analytics tools (currently Google Ads; Meta (Facebook and Instagram), Naver, Kakao, Danggeun, and Google Analytics when we run ads with them or turn the tool on): Ad performance measurement, personalized advertising, and visit analytics for the website (processing of the "Ad performance measurement (Web)" and "Website visit analytics" items in Section 1). The tags send the information from your browser directly to those companies (conversions may also be sent from our server), which count which ad led to a web sign-up or a visit to the App Store. Member names, emails, Member numbers, workout records, and health information are not sent. Each company's privacy policy also applies to the information it receives.
• YouTube (Google): Videos in "Exercise Guide" articles on the website are loaded from YouTube only when you press the play button. Before you press it, no information goes to YouTube. When you press it, your browser connects to YouTube directly, connection information (IP address and browser information) is sent to YouTube, and the privacy policy of YouTube (Google) applies. The App does not send Member information to YouTube.

Overseas transfer

Among the above business operators, the following are located overseas, and process personal information only within the scope of entrustment of processing necessary to provide the service. The Privacy Policy of each business operator may be checked at the address below the company name.

Kakao and Naver (login and web advertising), Danggeun (web advertising), Toss Payments (web payments), and the courier company used for prize delivery are domestic (Korean) businesses, so they do not involve an overseas transfer. Health Connect and Apple Health data stays on the device and is not transferred overseas (Section 4).

When you do not want overseas transfer

• AI coaching (receiving analysis, routine creation, trainer chat, weekly report) is transferred only when the Member requests. If you do not use this feature, nothing is transferred to the AI business operator, and you may use the remaining features such as records, prescriptions, and timers as they are. However, for sessions conversed in trainer chat, a summary of that conversation is automatically created to continue in the next conversation.
• Hosting and the database (Cloudflare) are the foundation of the service, so if you refuse this transfer, it will be difficult to use Member features. In that case, you may stop the processing by deleting your account (Section 6).

6. Retention and Deletion

• Advertising notification consent records are retained until withdrawal. On withdrawal, the consent time is cleared and withdrawal status and time are kept to maintain the opt-out. These settings and member IDs used to prevent duplicate invitations are deleted with the account.
• Information is retained while the account exists, and when the account is deleted, the account, workout records, measurements, profile, and payment method information (billing key and card information) are deleted from the server immediately. However, under Article 6 of 「전자상거래법 시행령」 (Enforcement Decree of the Act on the Consumer Protection in Electronic Commerce), web payment contract and payment records (order number, payment identifier, product, amount, payment date, and status), payment conversion consent records (the payment date concerned, the amounts before and after the change, whether consent was given and when, and the version of the notice text), and refund request records (the payment concerned, the time of the request, its type, and the result of processing) are separated from the account and kept for 5 years after account deletion and then deleted. These records do not contain card information, names, or emails. Deleted data cannot be restored, and copies remaining in backups for disaster recovery are deleted in sequence within 30 days at most (the same standard as Article 7 of the Terms of Service).
• However, three items are not deleted together on the spot. Because error and synchronization diagnostic logs are used to check App quality, the records themselves are kept and only the account identifier is immediately disconnected (it becomes impossible to know whose it is). Records of notifications already sent are automatically deleted within 7 days. App usage records are automatically deleted after 180 days. In addition, any crew created by the Member as a coach is immediately disbanded and disappears from participants' screens.
• For accounts that received a free trial or invitation benefit or subscribed, the login identifier is converted into an irreversible value and kept for 1 year and then deleted (Section 1, "Prevention of duplicate benefits"). It remains for that period even after account deletion. This value alone cannot identify a person, and it does not contain names, emails, or workout records.
• Workout records (exercise, weight, reps, rest, perceived exertion) are retained without reduction while the account is maintained, and are fully included in exports (JSON, CSV).
• Narrative reports written by AI (sentences of session analyses and weekly reports) are retained for 12 months. Thereafter, only numerical summaries such as volume and intensity remain, and sentences are deleted. Analysis may be received again with the same records.
• AI coach conversations (questions and answers) are retained while the account is maintained and are deleted together when the account is deleted. Conversation summaries for continuation are deleted after 12 months, like the narrative reports above.
• Confirmation materials received for creator verification are deleted within 30 days after confirmation is completed (the verification request note and the identity confirmation code).
• Prize delivery details (recipient name, mobile phone number, address) are deleted as soon as the prize is shipped or the win is cancelled, and in any case automatically by the deadline set for each event (shown on the event page).
• Event participation and draw records (whether goals were met, number of entries, draw order, wins and cancellations, exclusion reasons, handling times) are kept with the account and deleted when the account is deleted. For other members' draw order, only the deleted member's line is removed. Winner announcements (partly hidden nicknames) are shown for one month from the announcement date only.
• App usage statistics before sign-in are not linked to any account and are automatically deleted 13 months after receipt.
• Screen state during exercise (temporary values for progress, such as timer start time) is cleared when the session ends. Actual rest time and recorded values remain as they are.
• Plan snapshots of old sessions may be reduced in size by keeping only the items used by screens and statistics. Even then, the sets you recorded and statistical figures do not change. (For details, see Article 7 of the Terms of Service.)
• Records of routines being saved: after 90 days, the individual records are deleted and only the totals are kept. What is deleted is ‘who saved it’, and the ‘number of people who saved it’ shown on the page remains as the total for the entire period.
• When you delete your account, your public routines, likes, difficulty feedback, comments, and creator profile are deleted with it. However, copies of routines that other Members have already saved remain in their saved routines. This is because they are those Members' data, copied at the time of saving. Those copies do not contain an account identifier pointing to the original poster.
• You may delete your account in the App under Settings → Delete account or at gymkc.org/delete-account.
• Data recorded in Health Connect and Apple Health may be deleted directly in the App (Section 4).
• Data stored on the device is removed together when the App is deleted.
• If you wish for deletion, please make a request to the contact information below.

7. Rights of Users

Users may request access, correction, deletion, and suspension of processing regarding their information. In Settings › Data & sync in the App, you may download the workout records you created as JSON (sessions, sets, personal records, body measurements, and condition, plus the exercises, routines, and locations you created, for the entire period). Analyses and reports written by AI and trainer conversations can be viewed in the App and are not included in the file, because they are not information entered by Members but information we generated and processed on the basis of Members' records.

8. Security

• All communications are encrypted with HTTPS.
• Login is performed using Google · Kakao · Apple · Naver accounts (OAuth), and passwords are not stored.
• Passkeys (biometric authentication) are stored only on the device, and only the public key, device name, and time of last use are retained on the server.
• Data is separated on an account basis, and other users' records cannot be accessed.

9. Children's Personal Information

The App does not target individuals under 16 years of age, and does not knowingly collect personal information of children.

10. Notice of Changes

If this Policy is changed, the modified contents and effective date are posted on this page. Significant changes are also notified through notices within the App.

11. Inquiries

12. Chief Privacy Officer

Requests for access, correction, deletion, or suspension of processing are received at the contact above, and we act on them and notify you of the result within 10 days of receipt. As a sole proprietorship, we have no separate department, and the Chief Privacy Officer handles them directly.

13. Remedies for Infringement of Rights and Interests

If consultation or dispute mediation is needed due to personal information infringement, you may contact the institutions below. If you notify us first, it can be resolved more quickly, but regardless of that, you may use them at any time.

• Personal Information Dispute Mediation Committee: 1833-6972 · www.kopico.go.kr
• Personal Information Infringement Report Center: 118 without area code · privacy.kisa.or.kr
• Supreme Prosecutors' Office: 1301 without area code · www.spo.go.kr
• National Police Agency Cybercrime Reporting System: 182 · ecrm.police.go.kr

For California Residents

Sale and sharing: We do not sell your personal information for money. However, if you install the App from an advertisement, the App, through AppsFlyer, informs the advertising media that ran the advertisement whether the installation led to a sign-up or a subscription, together with your device's advertising identifier and IP address, so that they can count the results of their advertising and deliver advertisements appropriately (Sections 1 and 5). Under the California Consumer Privacy Act (CCPA), this disclosure may be considered a "sale" of personal information or "sharing" of personal information for cross-context behavioral advertising. We do not disclose your name, email, workout records, or health information for this purpose, and the App does not display third-party advertisements. On our website, when you visit without signing in, the tags of advertising media (currently Google Ads; Meta only if we run ads with it) send them the "Ad performance measurement (Web)" information (Sections 1 and 5), which may also be considered "sharing" under the CCPA. We treat a Global Privacy Control signal from your browser as a request to opt out of sale and sharing, and the tag is not loaded when your browser sends it.

Your choices: You may reset or delete the advertising identifier on Android, or not allow or turn off tracking on iPhone (Section 1). Measurement then continues without the advertising identifier. On the website, you can block or delete cookies in your browser, turn off personalized ads at adssettings.google.com, or use a browser that sends Global Privacy Control.

Your rights: The rights described in Section 7 (access, correction, deletion, and suspension of processing) are also available to you. You can exercise them at support@gymkc.org.

Tracking and "Do Not Track": When you use the App, AppsFlyer and advertising media may collect information that links your device's interaction with advertisements in other apps or on other websites to your installation of and activity in the App, as described above. On our website, YouTube receives connection information only if you press the play button on a video (Section 5), and, when you visit without signing in, the tags of advertising media may link your arrival from an ad to a sign-up or a visit to the App Store (Section 1). The App and our website do not respond to browser "Do Not Track" signals; our website honors Global Privacy Control as described above.

Washington and Nevada Residents: Consumer Health Data

If you live in Washington or Nevada, our Consumer Health Data Privacy Policy explains what consumer health data we collect, how we use and share it, and how you can exercise your rights under the laws of those states.

For Users in Australia, Canada, New Zealand, and Singapore

Our Chief Privacy Officer (Section 12) is responsible for our compliance with the privacy laws that apply to us, including as the person in charge of the protection of personal information under the laws of Québec, and is the person to whom you may send questions, requests, and complaints about how we handle your personal information, at support@gymkc.org or at the business address in Section 11. We will look into each complaint and reply to you with the outcome.

If you are not satisfied with our response, you may also contact the privacy regulator in your country: the Office of the Australian Information Commissioner (OAIC) in Australia, the Office of the Privacy Commissioner of Canada in Canada (in Québec, also the Commission d'accès à l'information du Québec), the Office of the Privacy Commissioner in New Zealand, or the Personal Data Protection Commission in Singapore.

Privacy governance. Our Chief Privacy Officer has approved our policies and practices for protecting personal information. GYMKC is a sole proprietorship, so the Chief Privacy Officer (Section 12) handles personal information directly at every stage, from collection and use to storage, disclosure, and deletion, and the companies listed in Section 5 receive it only as described there. We keep and delete personal information as described in Section 6. You can send a complaint about how we protect your personal information as described above, and we will look into it and reply to you with the outcome.