Privacy Policy
Your training data is yours. Here is exactly what GoldLift collects, why we need it, who we share it with — and how to get it all back or wiped.
Introduction
Welcome to GoldLift. We respect your privacy and are committed to protecting your personal data. This privacy policy explains how we collect, use, share, and protect your data when you use our fitness and nutrition application.
What data do we collect?
We collect various types of data:
- Account and profile data: name, username, email, password (encrypted), profile photo, bio
- Physical and health data: weight, height, age, gender, weight measurements, injury information you provide
- Training data: workout plans, workout sessions, exercise progress, personal records, workout schedules
- Nutrition data: nutrition goals, food logs, water logs, recipes, supplements
- Social data: friends list, posts, comments, shared workouts
- Location data: main gym, workout locations
- Media: photos and videos (stored via Cloudinary)
- Device permissions: camera and microphone permission (both optional)
- AI data: AI conversations, voice recordings and transcripts from voice chat with the AI coach, and ML feedback
- Gamification: XP, levels, streaks, badges, rankings
Why do we collect this data?
We use your data for:
- Service delivery: account management, personal workout and nutrition planning, progress monitoring, AI recommendations
- Service improvement: analysis of usage patterns, optimization of AI algorithms
- Communication: notifications, reminders, service updates
- Legal obligations: compliance with applicable legislation
Legal basis
We process your data based on:
- Your consent: for optional features
- Contract performance: for delivering core services
- Legitimate interest: for service improvement and security
- Legal obligation: for compliance with legislation
Who do we share your data with?
We share your data with:
- OpenAI (USA): powers the AI coach, workout generation, and voice features. Your chat messages, voice recordings (for transcription), and relevant context such as your weight, goals, and injury information are sent to OpenAI. This data is not used to train OpenAI’s models and is deleted by OpenAI after at most 30 days.
- Google (USA): the gym map loads map data from Google Maps, which shares your IP address with Google.
- RapidAPI (USA): exercise information and demonstration media are retrieved via ExerciseDB and MuscleWiki APIs. Only the exercise being looked up and your IP address are shared — no account or health data.
- Cloudinary: media storage for your photos and videos
- Database and hosting providers
- Other users: based on your privacy settings (public profile, shared content, rankings)
- Legal obligations: when legally required
We do NOT sell your data to third parties.
Data security
We take appropriate measures to protect your data:
- Encryption: passwords are hashed with bcrypt
- Secure connections: HTTPS for all data transmission
- Access control: limited access for authorized personnel
- Regular updates: security updates and patches
- Backups: regular backups of data
Your rights (GDPR)
Under the GDPR, you have the following rights:
- Right of access: know what data we process
- Right to rectification: correct inaccurate data
- Right to erasure: deletion of your data
- Right to restriction: restriction of processing
- Right to data portability: receive a copy of your data
- Right to object: object to certain processing
- Right to withdraw consent
Contact us to exercise your rights.
Data retention
We retain your data as long as:
- Necessary for the purposes for which they were collected
- Required by legal obligations
- Your account is active
Upon deletion of your account, personal data will be deleted or anonymized, except when legally required.
Privacy settings
You have control over your privacy through the App settings:
- Stats Privacy: choose who can see your statistics (public/friends/private)
- Main Gym Privacy: choose who can see your main gym
- Notifications: manage which notifications you receive
- Friends list: manage who can find and add you
- Blocked users: block unwanted users
Cookies & tracking
Our App uses:
- Local storage: for app settings and authentication tokens
- Analytics: for service improvement (anonymized)
We do not use cookies for advertising purposes.
Device permissions — camera
Our App requests camera permission (android.permission.CAMERA) to:
- Take profile photos
- Capture progress photos for tracking your fitness journey
- Take workout photos to share with the community
- Create posts with photos
Important:
- Camera permission is OPTIONAL and only requested when you choose to take a photo
- We do not access your camera in the background
- We do not record video or audio through the camera
- Photos are stored securely via Cloudinary
- You can revoke camera permission anytime in device settings
- If denied, you can still use the app by selecting photos from your library
Device permissions — microphone
Our App requests microphone permission (android.permission.RECORD_AUDIO) for voice chat with the AI coach.
Important:
- Recording only starts when you explicitly begin a voice interaction
- We never record in the background
- Voice clips are forwarded to OpenAI for transcription and are not stored on our servers
- The microphone button in the chat uses your device’s built-in speech recognition (Apple on iPhone, Google on Android) to turn speech into text; that audio is handled by Apple or Google under their own privacy policies and never reaches our servers
- Microphone permission is OPTIONAL — the AI coach works fully via text
- You can revoke microphone permission anytime in device settings
Children
Our App is not intended for users under the age of 16, and we ask for your date of birth during onboarding to enforce this. We do not knowingly collect data from children. If you suspect that a child has provided data, please contact us.
International data transfer
Your data may be stored and processed in countries outside the EEA. In particular, our service providers OpenAI, Google, RapidAPI, and Cloudinary are based in the United States. Where data is transferred outside the EEA, we rely on appropriate safeguards in accordance with the GDPR, such as the EU–US Data Privacy Framework and/or Standard Contractual Clauses.
Changes
We may update this privacy policy from time to time. We will notify you of changes via a notification in the App, email (for important changes), or via the updated "Last Updated" date. Your continued use means agreement with the updated policy.
Contact & complaints
For questions about this privacy policy or your data, contact us at:
We will respond within 30 days.
If you are not satisfied with how we process your data, you have the right to file a complaint with the relevant data protection authority.
For Belgian users: Gegevensbeschermingsautoriteit (GBA)
Website: https://www.gegevensbeschermingsautoriteit.be
Phone: +32 2 274 48 00