Who we are
ChallenGYM is a free app for fitness coaches and their clients: training plans, cardio plans, general nutrition guidance, client onboarding with a health questionnaire and signed terms, daily check-ins and progress tracking. This policy explains exactly what data is collected, why, who receives it and how long it is kept.
ChallenGYM is operated from Israel by the developer named on the app’s store listings. Privacy questions: support@challengym.app or the feedback form on this site.
Coach accounts
To open an account we collect:
- Email address — your sign-in and how we reach you. We confirm it with a 6-digit code sent by email.
- Password — stored only as a salted one-way hash (scrypt). We cannot read it.
- Name, and optionally a phone number and city.
- Country and app language — recorded at sign-up to show the right language and the features that apply in your country.
Data coaches enter about clients
A coach can record a client’s name, email or phone, gender, year of birth, height, goal, intake answers, notes and the plans built for them.
For this data the coach decides what is entered and why. In GDPR terms the coach is generally the controller and ChallenGYM processes the data on the coach’s behalf. Coaches must have a lawful basis to enter a client’s details and must tell their clients that the data is kept in ChallenGYM. We never contact a client on our own initiative.
Client accounts, health questionnaires and check-ins
A client who joins with an invite code opens an account with an email address, a password and a name.
Health questionnaire and signed terms: the client answers health questions (for example about heart conditions, chest pain, dizziness, blood pressure, joints, surgery, pregnancy and medication) and signs the coach’s training terms. This is health data — a special category of personal data. It is collected only with the client’s explicit consent at the time of signing, is encrypted at rest (AES-256-GCM), is shared only with the client’s own coach, and is used only to keep training safe.
Daily check-ins: what the client ate, how closely they followed the guidance, workouts, weight, sleep and mood, plus messages between client and coach. Visible only to the client and their coach.
The AI assistant
When a coach uses the AI assistant, the request text and the plan or client context needed to answer it are sent to our AI provider, Anthropic (United States), which returns a draft. Under its commercial terms the provider does not use this data to train its models.
Drafts are suggestions. Nothing the assistant writes is sent to a client unless the coach reviews and approves it. If you do not use the assistant, nothing is sent to the AI provider.
Feedback and support messages
When you send feedback (in the app or on this site) we store the type of message, the text, your email, the platform and your language. A short notification with the start of the message is pushed to the operator’s phone through the ntfy notification service so that we can answer quickly.
Technical data
When codes are sent, content is reported or forms are submitted we also store an IP address and a request id, for security, abuse prevention and rate limiting. This is never used for advertising and is not linked to a marketing profile.
Reporting a problem with learning content also sends an install id — a random string created on your device, not a hardware identifier and not linked to an account. It only groups one person’s repeated reports together. Deleting the app deletes it.
This website uses only functional cookies: fm_lang remembers the language you chose, and fm_ref remembers an invite link you arrived from. It sets no analytics or advertising cookies.
Who receives data
We do not sell data and do not share it with advertisers. The app shows no ads and contains no third-party marketing trackers. These service providers process data for us, each only for its own task:
- Amazon Web Services — hosting and database, in the Tel Aviv (Israel) region; sending emails (Amazon SES) from the Ireland (EU) region.
- Anthropic — the AI assistant, only when a coach uses it (United States).
- ntfy — operator notifications about new feedback messages.
- An SMS provider — only for accounts that sign in with a phone code; it receives the phone number and the message text.
- Apple and Google — app distribution and, if you allow them, push notifications, under their own policies.
International transfers
Our main servers are in Israel, which the European Commission recognises as providing an adequate level of protection for personal data from the EU. Data sent to the AI provider in the United States is transferred under that provider’s data-processing terms.
How long data is kept
Account data, client records, forms and check-ins are kept while the account exists. Email codes expire after 15 minutes and are deleted once used.
After an account is deleted only an anonymous programme skeleton remains (sets, reps, split and exercise list), plus any record we are legally required to keep.
Deleting your account
You can delete your account in the app at any time: Account → Delete account. It is immediate and cannot be undone.
Deletion permanently removes your email, name, phone, city and password; for clients, also their health questionnaires, signed forms, check-ins and messages; and, inside the plans a coach built, the client names, contact details, health answers and free-text notes.
You can also ask us to delete your account through the feedback form or at support@challengym.app — see the “Delete account” page on this site.
Your rights
Wherever you live, you can ask to see the data we hold about you, correct it, receive a copy, or have it deleted, and you can withdraw consent at any time. Write to support@challengym.app; we answer within 30 days.
Under the Israeli Protection of Privacy Law, 5741-1981 (including Amendment 13) you may review, correct and request deletion of your data. If you are in the EU, the EEA or the UK you also have the GDPR rights of access, rectification, erasure, restriction, portability and objection, and you may complain to your local data-protection authority. Users in Brazil have the corresponding rights under the LGPD.
Minors
The app is intended for people aged 16 and over. We do not knowingly collect data about anyone younger. A coach who trains a minor is responsible for obtaining a parent’s or guardian’s consent where the law requires it.
Changes
Material changes will be published on this page with a new version number and effective date, and announced in the app when they affect how your data is used.