GymDaysBack to Mandooist

Privacy Policy

Last updated 13 October 2026

1. About this policy

GymDays ("we", "us", "our") is a Mandooist app operated by Jason Reeve, based in Australia. This Privacy Policy explains what information the GymDays mobile application ("the App") uses, where it goes, and the choices you have.

We handle personal information in accordance with the Australian Privacy Act 1988 and the Australian Privacy Principles. This policy also addresses the EU and UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) where they apply.

The short version: your training, including your plans, workouts, sets, weights, body measurements, notes and pictures, lives on your phone and works fully offline. An account isoptional. If you sign in, your training is backed up to, and synced through, a Mandooist cloud account. If you never sign in, none of it is sent to us. Heart rate from your watch, Health Connect, Strava and the link to Stridefall, our movement game, are each off until you switch them on.

2. Information the App uses

2.1 Your training, on your device

The App stores your plans, your workouts and their sets (weights, reps, times, rest, notes and the records the App works out), your body stats (weight, body fat and measurements such as waist, chest and height, if you log them), the exercises and equipment you add, the pictures and exercise videos you attach, your goals, reminders and settings on your device. You may also give your sex and your age, which the App keeps on your phone to choose strength standards, to show a few tips and to work out your heart rate zones. Both are optional and are not part of what the App backs up.

Signed out, we never receive this information, and nothing is backed up for you: use the file backup or the CSV export in Settings to keep your own copy. Signed in, a copy is stored in your account as described in 2.7. Deleting the App, or Delete all data in Settings, removes it from the phone. If you export a backup or a CSV file, or share a workout card or a plan, you choose where it goes.

2.2 What the App does not ask for

The App does not ask for your location, your contacts or your microphone, and has no advertising and no advertising or tracking SDKs. It plays rest alarms and spoken cues only while it is open. Rest alarms and workout reminders are notifications that your phone creates itself, on your phone; they are not sent from a server. The App asks to send them on Android 13 and later, and on iPhone.

2.3 Pictures and camera

If you add a cover to a plan or a picture to an exercise of your own, the App uses your phone's system photo picker, so it sees only the picture you choose and needs no access to your whole library. The camera is used only if you choose to take a photo for one of those, and only after you allow it. A chosen picture is resized and kept in the App. If you sign in, it is backed up with your training (2.7).

2.4 Health Connect and Apple Health (optional)

Everything here is off until you switch it on in Settings, under Connected apps, and your phone then asks you for permission. The App does not use these in the background.

Android, Health Connect. The App can write two kinds of record. A finished workout is written as a strength training session with its name, start and end time and a short summary of the sets. A body weight you log in Body stats is written as a weight entry. These are the WRITE_EXERCISE and WRITE_WEIGHTpermissions. If you edit or delete the workout or the weight in the App, the record in Health Connect follows.

Heart rate, read only. If you also allow heart rate (READ_HEART_RATEon Android, and Apple Health on iPhone), the App reads the heart rate samples that your watch has recorded between the start and the end of a workout you have saved, so it can show them with that workout and count them toward a game you have linked. It keeps only samples written by a known watch app (Garmin Connect, Samsung Health, Fitbit, Google, Polar, or an Apple Watch) and ignores manual entries and records written by other apps or by GymDaysitself. If you gave no age, it also asks Health Connect once for the highest heart rate of the last 90 days, as a single value, to set your zone limits.

From the samples, the App works out and stores with that workout your average and highest heart rate, the seconds you spent in each of five heart rate zones, and the name of the watch app that recorded it. The individual samples are not stored. The App never writes heart rate, reads no other health data, and does not read your older history beyond what is described here.

These figures belong to the workout, so if you sign in they are backed up with it (2.7), and if you link Stridefall they are read by Stridefall to score that workout (2.8). They are never sold and never used for advertising. The App's use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements. We use it only to provide the features described on this page that you can see in the App, we do not allow humans to read it except where you ask us to look at it, for security or abuse investigation, or where the law requires it, and we do not use it or transfer it for advertising, for profiling, or for anything that is not running the App. Its use of HealthKit data follows Apple's HealthKit guidelines. You can switch heart rate off at any time in Settings, under Connected apps, or take the permission away in Health Connect or in the Health app on iPhone. Declining leaves everything else in the App working as before.

2.5 Strava (optional)

If you connect Strava in Settings, under Connected apps, each finished workout is sent to Strava as a weight training activity with its name, start time, duration and a summary of the exercises and sets. Edits to the workout follow. The App keeps the id of the Strava activity with the workout, so it can update it and so a linked game does not count it twice; that id is backed up with the workout if you sign in. Strava gives the App a sign in token, which is kept in your phone's secure storage and never in the cloud backup. To keep Strava's client secret out of the App, the code exchange and token refresh pass through a small Mandooistservice, which adds our credentials, forwards the request to Strava, and stores and logs nothing. Disconnect in the App at any time, which also revokes the connection at Strava. Deleting a workout in the App does not delete it on Strava. How Strava handles your data is set out in its own privacy policy.

2.6 Exercise videos

The App can play a short video for each built in exercise. Videos you have not downloaded are streamed from a public folder in Mandooist's Google Firebase Storage. Like any web request, a video request carries your IP address and the name of the video. It carries no account or training content. Videos you attach to your own exercises stay on your phone, and back up with your account if you sign in.

2.7 Your account, backup and sync (optional)

You can use the App without an account. If you choose to sign in, you can use Google or Apple. The account is a Mandooist account, shared with our other apps that use the same login, and it is held with Google Firebase. We receive your sign in identifier and email address (or the private relay address Apple gives us). We never see a password.

Once you are signed in, the App backs up your training to your account and keeps your phones in step. This includes your plans and their days, exercises and sets; the exercises, equipment, pictures and videos you added; your saved workouts with their exercises and every set (weights, reps, times, rest and records), the workout name, notes and effort rating, the length and volume, and the heart rate figures, entry mode and Strava activity id described in 2.4, 2.5 and 2.8; exercise notes and goals; body stats and body goals; reminders; achievements; your equipment lists; and portable settings such as units, week start, rest defaults and training preferences. It is stored in Google Cloud (Firestore and Cloud Storage) and is readable only by your account. A workout in progress stays on your phone, except as described in 2.8.

Signing out stops syncing. Delete GymDays cloud backup removesGymDays's records and pictures from the cloud and leaves your login and other apps alone.Delete account deletes your GymDays data from the cloud and then the login itself, which is shared with other Mandooist apps, so you are signed out of those too and their cloud data is removed as well. The App tells you this before it does it. Your data on your phone is yours to keep or delete.

2.8 Linking to Stridefall (optional, off by default)

Stridefall is a movement game made by Mandooist. The link is off until you turn it on in Stridefall's Sources screen, signed in with the same Mandooistaccount. GymDays sends nothing new for it: Stridefall's backend reads, from the backup already in your account, the workouts you complete after you switched the link on, with their sets, and uses them to count your training toward your character's strength. For that it reads when the workout started and ended, its sets and weights, how it was logged (live, meaning started in the App and finished as it happened, or retro, meaning added or changed long after it was done), the heart rate figures from 2.4, and the Strava activity id from 2.5, which is used to avoid counting the same workout twice. It reads the workout and its sets, not your pictures, body stats or settings.

While the link is on and you are signed in, the App also sends each set to your account as you tick it during a workout, instead of when you save the workout, so Stridefall can check that it was logged as it happened. The workout's name and exercises go first. A set you take back is removed. With the link off, a workout in progress never leaves your phone. The App checks whether the link is on by reading one small record, and shows "Counts toward your Stridefall training" after a workout when it is.

You can turn the link off at any time in Stridefall's Sources screen, which stops any further reading. See Stridefall's privacy policy for how it handles what it has read. To have the records Stridefall has already made from your workouts removed, email us.

2.9 Purchases

The App shows no advertising. GymDays Plus is an optional purchase, a yearly subscription or a one time lifetime purchase, that adds muscle recovery, the plan builder and extra share card styles. Purchases are processed by the Apple App Store or Google Play, andRevenueCat verifies them. The App does not give RevenueCat your account, so RevenueCat knows you by an anonymous id it creates on your phone, plus the purchase receipt and what you bought. It never receives your payment card details or any of your training.

2.10 Crash reports and suggestions

When the App crashes or hits an error, it may send a report to Sentry so we can fix it, along with some timing information about how fast screens load. A report can include your device model, operating system and App version, the error and its stack trace, and a short trail of what the App did just before, such as which screen was open. It is sent without personal details such as your name or email address, and anything that looks like an email address or coordinates is removed. Reports do not include your workouts or body stats.

If you send a feature suggestion from Settings, that text is sent through Sentry too. If the App cannot send it, it opens your email app to write to us instead. If you send crash feedback, it includes an email address only if you type one in so we can reply.

3. How we use information

4. Third parties

We do not sell your personal information. The App shares limited data only with:

5. International transfers

Crash reports and suggestions (Sentry) may be processed in the United States, purchase records (RevenueCat) are processed in the United States, your synced training is stored in Google Cloud data centres that Google selects, and workouts you send go to Strava wherever it operates. We rely on those providers' compliance and transfer mechanisms where required.

6. Retention

7. Your rights

Depending on where you live, you may have the right to access, correct or delete information about you, to withdraw consent, and to complain to your privacy regulator. You can view, export and delete your training yourself in the App, delete the cloud backup or your account from the account screens, switch off heart rate, Health Connect and Strava in Connected apps, turn off the Stridefall link in Stridefall, and withdraw any permission in your phone's settings. For anything held by Sentry or Stridefall, or for help with any of this, email us.

Australia: OAIC. EU and UK: your local data protection authority. California (CCPA): we do not sell personal information.

8. Children

The App is not directed at children under 13 (or 16 in the EU), and we do not knowingly collect personal information from children.

9. Changes to this policy

We may update this policy. The "Last updated" date above will change, and anything that changes where your training goes will be explained in the App before it happens.

10. Contact us

You can reach us by email at hello@mandooist.com.

Operated by Jason Reeve, Australia. GymDays support.

Back to Mandooist