Beta version · Effective October 12, 2026
This policy covers the Gymsona beta for iPhone, run by Seven Agent Studios LLC, for testers in the United States. Contact: matt@mattneves.com. It hasn't had a lawyer's review yet and will be updated before a public launch. The app will tell you about material changes before they apply.
Gymsona saves the setup choices you provide: optional first name, training goal, experience, equipment, available time, training days, movement exclusions, preferred coach, units and communication preferences. It stores your adult confirmation without asking for your date of birth. These choices build your program and guide the experience.
Gymsona saves workouts you start, weights and reps you enter or clearly report, optional effort, timestamps, accepted targets, corrections, exercise changes, pauses and safety-stop events. Corrections retain the earlier event in the workout audit history. You can correct or remove a set in a finished workout, and delete a whole workout from your history: a deleted workout leaves history, trends and coaching context, and its records stay in the workout audit history and in exports until you delete local data. You can also log a workout you did earlier, up to six months back, and it is saved on the day you choose. A safety event records a stop category rather than the original symptom narrative. Your schedule, dated changes and check-in preferences are also stored locally. Body weight you enter by hand is stored with your profile; it is never read from Apple Health. When you tap “Not now” while your coach is speaking, Gymsona counts that kind of moment so it says less of it: the counts live in your profile, Settings shows them, and you can reset them. Nothing else about how you use the app is turned into a preference. These records support resume, history, comparisons and explainable planning.
Gymsona does not currently have customer accounts, cloud workout backup or device-to-device sync. The optional Gym (below) keeps only what you choose to share there. Its internal outbox is local bookkeeping; it does not upload workout events. The workout directory is marked for exclusion from system backup. This is an operating-system setting, not a guarantee about every backup or restored device. Keep a separate export if you need your own copy. Deleting the app or losing the phone may mean losing local records.
Optional known lifts are saved with your setup as user-stated exercise, weight, reps and entry time. They are not completed workout records or verified personal records. Matching lifts can inform starting-weight guidance; a brief containing that stated reference can be sent for AI phrasing and requested premium speech under your existing cloud choices. Remove individual references in setup or delete local data to remove them.
Hold-to-talk opens the microphone only while you hold the voice control in the foreground and have granted iPhone permission. Recognition requests on-device processing; if it is unavailable, use typing or manual entry. With separate enhanced-speech consent and cloud coaching enabled, Gymsona sends a short recording through its coaching server to OpenAI for transcription. Release to stop capture and send the complete message; slide away to cancel. Held captures are limited to 44 seconds; reaching that limit discards the message instead of submitting a clipped result. A permission dialog, backgrounding or leaving the screen cancels the hold and requires a fresh hold afterward. Gymsona temporarily writes protected audio on this iPhone, excludes the capture directory from backup, and deletes the file after capture or cancellation; interrupted-process leftovers are removed when its audio service next starts. Audio also passes through app/server memory. Gymsona does not archive recordings or send your microphone audio to ElevenLabs. OpenAI and infrastructure retention rules still apply. You can disable enhanced speech in Settings to use on-device recognition.
Realtime microphone streaming is not enabled in this build. Automatic rest and preparation cues play coach audio without opening your microphone. Voice transcripts and conversation context remain in memory, not a general chat archive; accepted set comments still become workout records. Release ends microphone capture before cloud transcription or a spoken reply begins.
Recognized words and typed questions are used for the current interaction. Gymsona does not keep a general chat archive for coaching. The Coach tab conversation is saved on this iPhone so it is still there when you come back, up to the most recent 200 messages. It is included in Export workout archive, “Clear conversation” in the Coach tab removes it on its own, and local data deletion removes it with everything else. Post-workout feedback (how the workout felt and an optional note) is saved with that workout. Submitted set comments are saved locally with accepted results, including the words of the result message when needed to preserve context. Reported safety concerns are saved with the stopped workout. These notes remain in workout history and exports until local data deletion; they are your reports, not observed form or diagnoses. Numeric corrections preserve the original note. Incomplete drafts are not saved. If you enable Conversation diagnostics, it saves recognized/typed messages, coach text, active exercise/set/revision, interpreted actions, save outcomes and failure stages locally for troubleshooting. This can include personal information you said. No raw audio, pairing token or provider request payload is included. The protected log is excluded from backup and bounded to 300 entries from the last seven days; expired entries are removed when it is next accessed. Settings lets you review, export, disable or clear it. It is not uploaded automatically or used to train a model. Exported copies you share are outside app deletion. Local data deletion removes the log and its temporary export. Up to six recent conversation turns stay in memory while the current workout revision and screen remain active; leaving or backgrounding clears them. Confirmed structured set feedback (for example, technique uncertainty or clarified muscle effort) is saved with the set. Incomplete set reports are temporary and expire after five minutes; leaving the conversation, backgrounding or changing the workout invalidates them. Complete, unambiguous set reports and supported numeric corrections save automatically after you submit them. You can review and correct the saved set rows. Missing or unclear results require clarification; the app does not fill in missing results. Questions you explicitly send for cloud coaching are handled as described below; local processing of speech does not mean the resulting text can never leave the phone.
When Gymsona opens, it automatically provisions coaching access without a code, using only a random installation identifier. This does not turn on cloud coaching or send workout data; you choose whether to enable voice and cloud answers. A random installation identifier and your personal connection key are stored in this iPhone's Keychain. The server identifies this installation by an opaque tester ID, not your Apple Account or email. Existing personal invite links still work and may include the first name Matt entered. Each tester has daily limits, and code-free connections also share a beta-wide allowance. When you reach the voice limit, the coach goes quiet until the next day, and nothing about your workouts changes. We can pause beta coaching at any time.
Send feedback to Matt in Settings opens your email app with a message addressed to matt@mattneves.com, which includes the app version, your coach, your tester name and your iOS version. Nothing is sent until you send that email. Coach audition ratings stay on your iPhone, labelled with your tester name. If you tap Send my ratings, your email app opens with the ratings attached and addressed to matt@mattneves.com, and nothing is sent until you send that email. Feedback you send through TestFlight goes to Apple and then to us, under Apple's terms. Crash reports you choose to share through TestFlight work the same way. The app's own usage and crash data is a separate choice, described next.
Gymsona can share anonymous usage data with us, so we can see what works and fix what breaks. It is your choice. For a new tester it is on from the moment they agree to the beta: the agreement screen says so, and nothing is sent before they tap I agree. Anyone who agreed to the beta before this existed is asked once, and nothing is sent until they answer. You can switch it off or on any time in Settings or in Privacy & terms. With it off, the app sends none of this and makes no connection to the analytics provider.
What is shared: that the app was opened; which main screens you visit; each setup screen as it is shown, and that setup finished, with the coach you picked and whether reminders were on; that a plan was created or changed; that a workout was started or finished, and how many workouts are in your log; that you sent your coach a message by typing or by voice, and whether an answer came back; that a change your coach suggested was applied; whether spoken coaching is on, and how many spoken cues in a workout played or failed; and that something you tried did not save. Each of these is a fixed word, a yes or no, or a count. The app version, build number and iOS version go with each one.
Crash reports are shared the same way: the kind of error and where in our code it happened. The error's own message is removed on your iPhone before the report is sent, because a message can quote something you typed.
What is never shared this way: your workouts, exercises, weights, reps or notes; health or body details; your goal; anything you say or type to your coach, or anything your coach says; recordings; your name, email, tester name, account or gym profile; your location. This data has no free-text field at all, so none of that can be sent by mistake.
It goes to PostHog, our analytics provider, on servers in the United States, under a random ID made on your iPhone. That ID is not your tester ID, account or Apple Account, and we don't join it to them. We have PostHog discard IP addresses and skip looking up your location. There is no session recording, screen or touch capture, advertising ID or cross-app tracking, and we don't sell this data or use it for advertising. Turning the switch off stops new data at once. Delete local data, signing out and Delete account give this iPhone a new random ID; your choice stays as you set it. What was already sent stays with PostHog under the old random ID until its retention period ends (one year on our plan as of October 2026).
The Gym tab shows a live gym floor, a feed and profiles. You can look without joining. Nothing about you is shared until you tap Join, and you can leave at any time.
When you join, Gymsona creates a gym profile on our social database, which Supabase hosts for us in the United States (US East). The profile holds the first name and handle you type, the illustrated look you pick or the photo you add, your current coach (it changes when you switch coaches; posts keep the coach they were written with), whether everyone or only your friends can see you, your friend code, and a fingerprint (SHA-256) of a random key that stays in this iPhone's Keychain; that key is how the app proves it's you, so there's no password or email. It also holds the people you follow, the people you block and any reports you make. Following is one-way; when two people follow each other, or one redeems the other's invite code or link, they're friends.
A profile photo is optional. The app crops it square and shrinks it on your phone, then sends it through our coaching server, which asks OpenAI to check that it's suitable for a public gym (no nudity or sexual content, violence, hate symbols or harassment). We don't ask it who is in the photo, and the OpenAI terms described below apply. Only a photo that passes is saved in the social database, at most ten new photos a day. It's shown wherever your face appears in the Gym, and anyone with its web address can load it, so don't use a photo you wouldn't want seen by other people. Remove it from your gym profile at any time; leaving the gym deletes it.
Your phone also keeps a few numbers on your gym profile current, worked out from your own workout history: how many workouts you've done, your current and best week streaks, the total weight you've lifted (weight × reps, in lb), how many times you've beaten an earlier best, and this week's workouts, working sets and total volume. Your profile also shows what you've earned and lifted: your heaviest bench press, squat, deadlift and overhead press and most pull-ups in a set (for awards), your three best estimated one-rep maxes, and your working sets per muscle over the last 30 days. They show on your profile, set your level and rank you on the leaderboards. The app sends them again whenever they change.
While you train with a gym profile, the app shares what you're doing right now: the exercise name (or "Checking in" before your first set, and "Warming up" during warm-ups), the area of the gym it uses, your set number, sets planned, sets done so far and when the workout started. That row is removed when you finish or pause, and it stops showing after 15 minutes without an update. When you tap Post to the Gym, the post holds the workout's name, your coach, its length, total volume, set count, number of new bests, up to three best sets and your best record. Your coach's caption is written by each phone from those numbers; there's no typed caption. Reactions (one emoji per person per post) and hype sent mid-workout record who sent which emoji to whom and when.
Who can see it: anyone using Gymsona can see your profile, live sets, posts, numbers, and who follows you and whom you follow. If you chose friends-only before that option was removed (build 111), only your friends can, and everyone else still sees that a private lifter is training on that area of the gym, with the set number, sets planned and start time, but never your name, handle, photo, look or exercise. People you block can't see you, and you can't see them. Your notes, health details, body weight, Apple Health data, voice, conversations and full workout history are never sent to the Gym.
The gym also shows regulars generated by the app on your phone, to keep it busy until more people join. They aren't people. You can follow them or cheer their workouts, but that stays on your phone: nothing you do with them leaves it.
Reports go to Matt, who reviews them. A post or profile reported by three different people is hidden until he does. Leave the gym (tap your picture at the top of the Gym tab) deletes your gym profile, photo, numbers, live row, posts, reactions, follows, blocks and your reports right away. Delete local data also leaves the gym. Supabase keeps standard request logs (such as IP addresses and timestamps) for security under its own retention. The coaching server tells the app where the social database is and passes photos through for their check; your other gym activity doesn't go through it.
When cloud coaching is on, the coach may note a durable fact you tell it in chat, such as an old injury, your schedule or the music you train to. Notes are saved on this iPhone and sent with later chat questions so the coach can remember them. You can read and delete each note in Settings, or undo one right after it appears.
The gyms you set up and their equipment are saved on this iPhone. A workout records the name of the gym it was started at.
Share cards are drawn on your iPhone from your own workout. They leave the phone only when you tap Share to Story or choose a destination in the share sheet. Instagram receives the image through the iPhone pasteboard.
With cloud coaching enabled, an unresolved workout report or request can also go to OpenAI to interpret your intent. This includes the current exercise, set position, unit, workout phase, latest saved set and available alternatives. The model proposes an action; the app checks it against your actual words and current workout before saving a complete result, applying an explicit exercise replacement, or presenting another material adjustment for review. Common recognized reports continue to work locally. This adds no audio sharing beyond the separate enhanced-speech choice above.
Cloud coaching is off by default. If you connect and turn it on, questions that need the cloud can go to that server and OpenAI, together with limited context: goal, experience, equipment, number of weekly training days, available minutes and your optional coaching emphasis (such as motivation or accountability). For workout coaching, context also includes the current exercise list and instructions, recorded sets, confirmed feedback, accepted target, unsaved result being reviewed, available swaps, and up to twelve relevant prior set references. A bounded summary of the saved split and program rationale, up to three plan previews, recorded session/set totals, the four latest ended-session summaries, and revision-matched native target proposals can also accompany a question. Questions from the Coach tab can also include up to five recent completed workouts: each exercise's working sets (weight and reps), up to two of your set notes per exercise, and your post-workout rating and note. These are read-only records; the model cannot change the workout. Up to six recent conversation turns can accompany a question. So that your coach can act on what you ask in the Coach tab (build a workout, change your plan, move a day), a message from that tab also includes the workouts in your plan and their lifts, today's workout, the date and which of the coming days are done, planned or rest days, your training days, how your lifts are varied, any movements you have left out of your plan, and the suggestion currently on screen. The model names an action and the app checks it; no workout or plan change is made until you tap the button or type yes. Optional context is omitted when needed to keep the request bounded. The context does not automatically include your name, raw workout events, complete workout history or Apple Health records. A question can itself contain personal or health information you choose to type or say.
With cloud coaching enabled, the app may also send a short native workout brief, clarification question or feedback based on your saved sets to OpenAI for natural phrasing. The greeting uses your optional saved name and the phone’s local day/time on-device; those greeting fields are not included in that OpenAI phrasing request.
When you request premium speech, the text to be spoken goes through the server to ElevenLabs. That text may include your saved name and local-day greeting, workout results, coaching feedback or other personal information present in the response. ElevenLabs generates the coach's voice; it does not receive a recording of your voice from this app. Generated audio is saved in the app's cache on this iPhone, so a line your coach has said before replays without being generated again. It stays on the phone, iOS may clear it at any time, and deleting local data clears it.
The coaching server runs on Vercel in the United States. It does not save your questions or workouts. So the same coach line isn't paid for twice, it keeps rendered coach audio in our database (Supabase, United States), found by a one-way code made from the line and the voice. Lines we wrote keep their text there. Lines that include your details (such as your name or a weight you lifted) keep no text, only the audio, and are deleted after 60 days without use. Only the coaching server can read this store. It also keeps exact fixed coach lines in memory briefly, with a bounded size and a fifteen-minute expiry. For each request it logs your tester ID (not your name or code), the kind of request, whether it worked, how long it took, and how many voice characters were generated. These logs run the daily limits and help us spot problems. Vercel keeps them for a limited time under its standard log retention. Vercel and the providers may also process request details such as IP addresses and timestamps for security.
OpenAI: our API account has sharing of API data for model training turned off, and the service asks OpenAI not to store responses. That is not a zero-retention promise, because OpenAI's abuse monitoring and some endpoint or model-specific retention can still apply. ElevenLabs: the text your coach speaks, which can include your first name and workout numbers, and the audio generated from it are kept in our ElevenLabs account's generation history. ElevenLabs also retains data under its own privacy policy. Zero retention is only offered to ElevenLabs enterprise customers, and this beta doesn't have it. Neither provider receives your workout history, your Apple Health data or recordings of your voice through the coach's speech. To ask about anything held by either provider on our behalf, email matt@mattneves.com.
You can turn cloud coaching off in Privacy & terms. This stops new app requests for cloud answers, enhanced transcription and premium speech, cancels pending app playback and returns to local support, the saved training library and system voice. It cannot retract data already received by a provider. Clearing the connection removes the app's pairing credential from this iPhone; it does not revoke the server-side token or close a provider account.
Show on Lock Screen is off until you enable it in workout options. It displays your current exercise, load convention, weight/reps draft and rest countdown in a Live Activity. Anyone holding the phone can use those visible controls to save the displayed result or adjust rest without unlocking. Changing numbers alone does not log a set. Turn the switch off to remove the activity. Finishing the workout or deleting local data ends it; iOS also controls its visibility and lifetime.
The private workout database remains accessible to Gymsona after your first unlock following a restart so an explicit Lock Screen action can save while the phone is locked. It remains inside the app sandbox and excluded from backup. No Health data, symptom notes, conversation or full workout history is placed in the Live Activity. Workout coach playback may finish while locked, and explicit actions can request premium speech using your existing cloud consent. The microphone stays off. This build does not promise automatic timed coaching while the app is suspended.
Apple Health is optional. Save workouts to Apple Health is off until you turn it on, on the screen after a workout or in Settings, and iOS asks you to allow workout writes. While it is on, each workout you finish with sets entered is saved to Apple Health on its own, and turning it on also saves the workouts you had already finished. Workouts imported from another app's file are not sent this way. A saved workout carries its type (strength training), an indoor-workout mark, the name Gymsona, its recorded timing and pauses, and a sync identifier. While it is on, deleting a workout in Gymsona also removes the copy Gymsona saved to Apple Health; the copy of a workout you deleted while it was off is removed the next time you turn it on. Turning it off stops new saves and removals and leaves what is already in Health. With it off, a workout goes to Apple Health only when you choose Save to Apple Health on that workout in your history. Saving never exports estimated calories, heart rate, distance or individual set details. Permission remains controlled by iOS. Removing local Gymsona data turns Save workouts to Apple Health off; it does not revoke Health permission or delete previously saved Health workouts. Manage those in Apple Health.
Showing activity and steps from Apple Health is a separate choice, also off until you connect it on the Progress screen or in Settings. Only if you connect it, iOS asks you to let Gymsona read two things, your workouts and your step counts, and the app reads them to show them next to your Gymsona workouts: the runs, sports and other workouts that other apps and devices saved (their type, start time, length, distance when there is one, and the name of the app or device that saved them) and your daily step totals. It reads nothing else from Health: no heart rate, routes, calories, sleep or body measurements. This data is read on your iPhone and stays there. It is not sent to our servers, to your coach, to OpenAI or ElevenLabs, to the Gym or to analytics, it is not in your backup or your workout export, and it is never used for advertising. It is shown only: it does not count as a Gymsona workout or toward a streak, and your coach is not told about it. The app keeps a copy of the last read on the phone so the screen can open at once. Disconnecting in Settings clears that copy and stops the data being shown, and so does deleting local data or signing out. iOS does not tell an app whether you allowed a read, so anything you chose not to share simply stays empty. Access itself is managed in the Health app.
Coach check-ins are optional local iPhone notifications. Gymsona gives iOS a finite schedule and a private message without your weights, medical details or full workout. These are automated notices from an AI coach, not messages from a human monitoring you. You can move or skip dates, pause or turn reminders off. Gymsona does not collect a phone number or send SMS, email, remote push or marketing messages in this build.
You can sign in with Apple or with a 6-digit code sent to your email. We keep your email address (with Sign in with Apple this can be Apple's private relay address), which way you signed in, and when. Nothing requires an account: without one, everything stays on this phone.
Signed in, the app keeps one private backup of this phone's Gymsona data in your account: your setup and plan, your workouts and their history, your schedule and your conversation with your coach. It is sent over HTTPS, stored in our database (Supabase), readable only with your signed-in session, and used only to bring your data back when you sign in on a phone. It updates after workouts and when you leave the app. It never includes anything read from Apple Health.
Signing out backs up first, then clears this phone. Settings → Delete account deletes your sign-in, gym profile, posts and backup right away and clears this phone; it can't be undone.
If you join the waitlist on gymsona.com, we store the email address you enter, the link that brought you (for example, one of the coaches' pages) and the date, so we can tell you when the app is available. We don't sell it or use it for advertising. It stays in our database (Supabase, the same service that runs the Gym) until you ask us to remove it or the waitlist closes. To remove it, email matt@mattneves.com. The website sets no cookies and runs no analytics.
Your profile, workout and schedule records remain on this iPhone until you delete them. Export workout archive creates a JSON copy containing setup, workouts, event history and schedule records; the iPhone share sheet sends it only where you choose. The app keeps a temporary export file until it is replaced, removed by the system or cleared by local deletion. Copies you share have their own retention under your control or the recipient's.
Delete local data removes Gymsona's profile, workout history including the active workout, event history, schedule, scoped reminders, app pairing credential, automatic-voice and enhanced-speech settings, temporary export, local Health-save acknowledgements and anything the app had read from Apple Health. You confirm this action separately. If interrupted, Gymsona requires deletion to finish before normal use resumes. It also deletes your gym profile, if you joined the Gym. It cannot undo the deletion or import the archive back into this build. Export first if you want a copy.
Local deletion does not remove previously exported files, records already in Apple Health, operating-system backups or data already processed by providers. It is logical removal from the app, not a guarantee of forensic erasure from storage hardware. System permissions remain under iPhone settings. Off the phone, the only records are the optional gym profile, the optional account with its backup, and usage and crash data under a random ID if you chose to share it. Leave the gym or Delete local data removes the gym profile; Delete account removes the account, its backup and the gym profile.
For questions, or to ask us to delete information we hold about you (such as your tester entry or feedback you sent), email matt@mattneves.com. We may need to confirm the request came from you.
Gymsona uses the iPhone app sandbox, system file protection for exports and deletion intent, and Keychain for its internal pairing credential. A remote coaching service requires HTTPS; localhost is allowed for internal development. No security measure eliminates every risk. Production access controls, incident response, vendor contracts and retention operations remain release requirements.
This build has no advertising, cross-app tracking, data-broker sale, video capture or model training on-device. Its one analytics SDK, PostHog, runs only with the choice described under Usage and crash data. Health and fitness data must not be used for advertising or data-broker purposes. New collection or materially different use requires an updated policy and the appropriate user choice before it begins.
Gymsona is intended for adults 18 and over and requires adult confirmation during setup. It is not directed to children. If information about a child reaches the operator, contact matt@mattneves.com so it can be addressed. The response process must be established before launch.
Material changes will be explained in the app before new collection or sharing begins where consent is required. A published version will show its effective date and contact details. Live multi-phone sync, subscriptions, recovery reads, SMS and video are future possibilities, not activities authorized by this draft.