Skip to content
GainsmithOpen app

Privacy policy

Last updated: 23 October 2026

In short

This site uses no cookies and no tracking. Apart from the technically necessary server logs, personal data only comes up when you join the waitlist or use the web app with an account. This page explains which data that is, why it is processed and what rights you have.

Controller

Nils Plützer, email: contact@nils-pzr.eu. More details are in the legal notice.

Hosting

This site, the web app and the Gainsmith server are hosted by Hetzner Online GmbH, Gunzenhausen (Germany). Hetzner processes the data as a processor under Art. 28 GDPR.

Server logs

With every request your browser sends technically necessary data to the server: your IP address, date and time, the requested address, the browser identifier and, if any, the referring page. The web server (Caddy) needs this data to deliver the site, and the server may log errors and requests for a short time to keep it secure and fix problems.

The legal basis is the legitimate interest in secure and stable operation (Art. 6 (1) (f) GDPR). The logs are not analysed for statistics, not combined with other data and deleted regularly.

No cookies, no tracking

This site sets no cookies and uses no analytics, no ads and no tracking. Fonts, images and scripts come from our own server. No third-party content, such as Google Fonts or a CDN, is loaded.

Waitlist

If you join the waitlist, we process the following data:

  • Purpose: We email you once Gainsmith is in the App Store and on Google Play. We use the address for nothing else.
  • Data: your email address, the language of the site and, if you choose one, your platform. The waitlist entry contains no IP address. To prevent abuse, the server counts requests per IP address briefly in memory only.
  • Legal basis: your consent (Art. 6 (1) (a) GDPR), which you give by clicking the confirmation link in the email (double opt-in). The link is valid for 48 hours.
  • Sending: Resend (Resend, Inc.) sends the emails as our processor through its EU region (Ireland). Resend is based in the USA. Should data reach the USA, the data processing agreement provides for the EU Standard Contractual Clauses.
  • Retention: until we send the launch notice or until you withdraw your consent. Unconfirmed entries are deleted after 7 days.
  • Withdrawal: at any time via the unsubscribe link in the email or by writing to the address above. Your address is then deleted.

The web app

This policy also covers the Gainsmith web app. The app stores training, nutrition and body data locally in your browser first. Without an account, this data does not leave your device.

With an account, the Gainsmith server, the same server at Hetzner, stores your email address and your data to sync them between your devices. The legal basis is providing the feature you asked for (Art. 6 (1) (b) GDPR). For signing in, the app sets technically necessary cookies and no others. Resend sends the sign-in code as described above. If you sign in with Google, Google learns about that sign-in. If you delete your account, we delete the data on the server.

The online food search and the barcode lookup query Open Food Facts through the server. Only the search term or the barcode leaves it.

AI features

The AI features of the app need an account and run through the Gainsmith server. It sends only what is to be analysed to Claude by Anthropic (Anthropic PBC, USA), so the data is also processed in the USA.

  • AI meal: the photo or description of a meal, from which the AI estimates the nutrients. The app tells you before sending.
  • Import: the PDF or text of a training plan or of your training notes, from which the AI reads plans and workouts. Here too, the app tells you beforehand.
  • Coach: With “Training coach” on, the server sends, for suggestions made with AI, the exercises that have stalled, your sets for them (weight, reps, RIR), your phase and details on your recovery, including sore muscles. With your consent, this also includes your averages for sleep, HRV, resting heart rate, mood and pump. Without it, only whether these values stand out is sent, such as “sleep below your average”.
  • Legal basis: your consent (Art. 6 (1) (a) GDPR). For the health values, it is your explicit consent (Art. 9 (2) (a) GDPR). The app asks once, as soon as you switch on “Training coach”, and sends the values only after “Allow”.
  • Withdrawal: at any time with effect for the future. Switch off “Send health values to the AI” or the coach in the coach settings. You use the AI meal and the import only when you start them yourself.
  • Storage: The server does not store photos or texts. For each request it stores a checksum of the input, the AI’s result and the cost, so it can answer the same request for 24 hours without calling the AI again. If you delete your account, it removes the checksum and the result.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7 (3)). Just write to contact@nils-pzr.eu.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the one in your country or German state.