Privacy Policy
Last updated: 14 October 2026
GymNexa AI ("the app") is operated by Xflash Cloud ("we", "us"). This policy explains what data the app collects and how it is used.
Data we collect
- Account: your name, email address and profile photo from Google Sign-In.
- Fitness profile: goal, gender, birth year, height, weight, training level, training place, days per week, diet and cuisine preferences, and exercises you choose to hide.
- Activity you log: workout plans, completed workouts (sets, reps, weights, duration), food diary entries, water intake and body-weight entries.
- Food photos: when you scan food, the photo is sent to our AI provider only to estimate nutrition. We do not store the photo.
- AI coach messages: sent to our AI provider to generate a reply. Chat history is stored only on your device.
Health Connect
If you connect Health Connect, the app reads today's steps, active calories burned, exercise sessions and sleep sessions to show them on your dashboard and estimate calories burned. This data is read on your device only. It is not uploaded to our servers, not sent to the AI provider, not shared with anyone and not used for advertising. The app never writes to Health Connect. You can revoke access at any time in Health Connect settings. Use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements.
Manual activities you add (for example "Cricket, 60 min") are stored in your account like other logs.
How we use it
Only to provide the app's features: personalised workout and meal plans, nutrition estimates, coaching replies, progress tracking and daily targets. We do not sell your data and do not use it for advertising.
Service providers
- Supabase (database, authentication and server functions) stores your account and logs.
- Groq (AI processing) receives the text or photo of a single request together with a short fitness summary (goal, level, age, height, weight). Your name and email are never sent.
- Google (Sign-In).
Security
Data is encrypted in transit (HTTPS). Database row-level security ensures each account can only access its own data.
Retention and deletion
Your data is kept while your account exists. You can delete your account and all associated data at any time in the app (Profile → Delete account) or by following these steps. Deletion is permanent and immediate.
Health disclaimer
The app provides general fitness information, not medical advice. Consult a doctor before starting a new exercise or diet programme.
Children
The app is not intended for children under 13.