Privacy policy

GymThrottle stores some sensitive information – like your weight, measurements and injuries – so we want to be clear about exactly what we collect, why, and the control you have.

Last updated 12 October 2026 · Version 2026-10

The short version: we only use your data to run your plan and the features you choose. We never sell it or use it for advertising. Only your lifts are shared with other members – your measurements, photos and injuries stay private. You can download or delete everything from Account at any time.

1. Who we are

GymThrottle is fitness software created by Matt Bleasby. For this service, Matt Bleasby is the data controller – the person responsible for your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. You can contact us using the Report a problem or idea option in the app’s More menu.

2. What we collect

Type	Examples
Account details	Your first name, username and password (stored only as a secure one-way hash – we can't see it).
Plan questions	Goal, age, sex, height, weight, body type, training experience, days and time available, equipment, food preference, how often you drink, and any injuries.
Training log	Exercises, weights, reps, effort ratings, workout times and notes, swaps, water and creatine ticks.
Body tracking	Weigh-ins, body measurements and progress photos you choose to add.
Community	Activity posts (finished workouts, PBs, levels, badges), reactions, challenge results and leaderboard stats.
Coaching	Comments from a coach you've chosen to add.
Feedback	Messages you send with “Report a problem or idea”, plus the page you were on and your device type.
Notifications	If you switch them on, a push subscription address from your browser.
Security records	Failed login attempts, stored against a scrambled (hashed) version of your IP address for 15 minutes to stop password guessing.
Visit counts	Anonymous daily counts of things like page visits and sign-ups. These use no cookies, and the scrambled visitor code changes every day, so you can't be tracked over time.

3. Health information

Your weight, body measurements, injuries, progress photos and some effort or readiness ratings are health data – a “special category” of personal data under UK GDPR. We only process it with your explicit consent (UK GDPR Article 9(2)(a)), which you give with a separate tick box when you sign up. You can withdraw consent at any time by deleting your data or your account in Account. Withdrawing consent doesn't affect anything we did before, but without this information we can't build or adjust a personalised plan.

4. Why we use it, and our legal basis

To provide GymThrottle – build your plan, set starting weights, track progress, run focus mode, challenges and the leaderboard. Legal basis: performing our agreement with you (Article 6(1)(b)), plus explicit consent for health data.
To keep the service secure – stop password guessing, spam sign-ups and misuse. Legal basis: our legitimate interest in protecting members (Article 6(1)(f)).
To improve the app – using anonymous, aggregated counts (for example how many people finish the plan questions) and feedback you send. Legal basis: legitimate interests (Article 6(1)(f)).
To send notifications you've switched on, such as rest timer alerts or challenge updates. Legal basis: consent, which you can turn off in Account.

We don't use your data for advertising, we don't sell it, and we don't make automated decisions that have legal or similarly significant effects on you. Plan suggestions are fitness guidance you can change at any time.

5. Who can see your data

You – everything.
Other members – your first name, level, badges, lifts and PBs, finished workouts and challenge results. Never your measurements, photos, injuries, notes or plan answers.
A coach you add – your training log and notes so they can give feedback. Progress photos only if you turn on photo sharing.
Admins – account details and usage needed to manage accounts and help with support requests.

We use a small number of service providers who process data only on our instructions:

Our web hosting provider, which stores the app and its data on its servers.
Browser push services (run by Apple, Google or Mozilla, depending on your device), which deliver notifications if you switch them on. These may be outside the UK; they're covered by the UK's adequacy regulations or standard contractual safeguards.

We don't use third-party analytics, advertising networks or tracking pixels, and our fonts and icons are hosted on our own server. We'll only share data with others if the law requires it.

7. How long we keep it

Your account and training data – for as long as your account is open. Deleting your data or account in Account removes it from the live service straight away.
Failed login records – 15 minutes.
Anonymous daily visit counts – up to 400 days (they contain no personal data).
Feedback messages – until resolved, and no longer than 2 years.
Accounts with no activity for 2 years may be deleted after we've given notice in the app.

8. Your rights

Under UK GDPR you have the right to access, correct or delete your data, to restrict or object to how we use it, to move it to another service (data portability) and to withdraw consent. Most of these are built into Account: you can download all your data as a file, export your lifts as a spreadsheet, and delete your data or your whole account. For anything else, contact us using the Report a problem or idea option in the app’s More menu and we'll reply within one month.

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to put things right first.

9. Keeping it safe

Passwords are stored as one-way hashes, the site runs over HTTPS, login cookies can't be read by scripts, repeated failed logins are paused, the data folder can't be opened from the web, and each member can only reach their own data. No system is perfect, so if we ever have a data breach that's likely to put you at risk, we'll tell you and the ICO as the law requires.

10. Age limit

GymThrottle is for people aged 16 and over. We don't knowingly collect data from anyone younger. If you think a child has signed up, contact us and we'll delete the account.

11. Changes and contact

If we make important changes to this policy, we'll show a notice in the app and ask you to review them before you carry on. Questions? Contact us using the Report a problem or idea option in the app’s More menu. See also our Terms of use and Cookie notice.