Gainy Privacy Policy

Gainy is published by Ongun Labs, an individual developer based in Ankara, Türkiye. For the purposes of KVKK (Law No. 6698) and the GDPR, the data controller is Ongun Labs, Ankara, Türkiye.

You can reach us about anything to do with your data at hi@ongunlabs.com. This policy applies only to the Gainy iPhone app (bundle ID com.tariklabs.mobile2).

Everything below is collected only to make Gainy work. Gainy works offline: your data is first written to a local database (SQLite) on your iPhone and synced to our server when a connection is available.

• Account. If you sign in with Apple: the unique identifier Apple provides, your name (optional), and your email address or Apple’s “Hide My Email” relay address. If you don’t sign in, the app creates an anonymous session identifier so you can use it without an account — if you then sign out and delete the app, you can lose access to that anonymous data. Email-and-password sign-in exists only for test accounts used during App Store review.
• Profile (all optional). Height, weight, date of birth, gender, fitness level, primary goal, unit system (kg/lb), language, and theme and accent-color preferences — only if you choose to enter them.
• Workout data. Workout sessions, sets, weight, reps, duration (cardio), perceived exertion, programs, exercise selections, personal records, and points, badge and streak statistics.
• Subscription. Your Pro status (active or inactive) and plan. Your payment-card details never reach us — Apple processes payments.
• Advertising data. Free users see a Google AdMob banner on the workout rest screen. Section 6 explains what that involves, including the App Tracking Transparency (ATT) prompt and a stored personalized-ads preference.
• Security signal. When you sign in with email and password, hCaptcha is used for bot protection and may process device and network signals under its own policy.
• Welcome email. If we have your email address, we send a single transactional welcome email from noreply@ongunlabs.com. We don’t send marketing email.
• Leaderboard statistics. We compute your weekly total points. The leaderboard is designed to show other users only an anonymous label (for example “User #1234”) — never your name, email or location. The leaderboard screen isn’t currently visible in the app; we describe it here because the underlying statistics are still processed.

We do not collect your location (GPS). Gainy does not use your camera, microphone, contacts or health data (HealthKit), and it contains no third-party analytics or crash-reporting SDK.

Gainy may ask for these permissions:

• Notifications — a reminder when your rest timer ends and a weekly summary. These are local notifications scheduled on your device.
• Photos (add-only) — to save a share image you create. Gainy cannot read your existing photos.
• Tracking (ATT) — asks whether apps may track you across other companies’ apps and sites; see section 6.

You can change any of these at any time in iOS Settings › Gainy (for tracking: iOS Settings › Privacy & Security › Tracking).

We use your information only for the purposes below. For each, we also say which legal basis we rely on under KVKK and the GDPR.

• To provide Gainy — create and sync your account, record your workouts, produce your analysis, records and badges, compute weekly leaderboard statistics, and send the one-time welcome email. Basis: performing our agreement with you (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)).
• To manage your Pro subscription status. Basis: performing our agreement with you.
• To show ads to free users, and to use the advertising identifier for personalized ads. Basis: your consent (the ATT permission and your personalized-ads preference) — KVKK Art. 5/1; GDPR Art. 6(1)(a). Without consent only non-personalized ads are shown, which rests on our legitimate interest in sustaining the free version (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)).
• To keep sign-in secure and block bots. Basis: legitimate interests (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)).
• To process the optional profile fields you enter (such as height, weight and date of birth). Because details like these can be treated as health-related data in some legal contexts, we process them only on your explicit consent, which you give by choosing to enter them. You can withdraw it by emailing us or deleting your account.
• To comply with legal obligations. Basis: legal obligation (KVKK Art. 5/2-ç; GDPR Art. 6(1)(c)).

We don’t use your information for anything else.

We don’t sell your data. We share it only with the service providers below, each of which processes it to deliver one specific part of Gainy.

• Supabase — database and authentication. Data is hosted in the EU (AWS eu-west-1, Ireland). Privacy policy: https://supabase.com/privacy
• Apple — Sign in with Apple, App Store subscription billing (StoreKit) and the iOS notification system. Privacy policy: https://www.apple.com/legal/privacy/
• Google AdMob — ads for free users. Privacy policy: https://policies.google.com/privacy
• RevenueCat — subscription status. The only identifier we send is your in-app user ID. Privacy policy: https://www.revenuecat.com/privacy
• hCaptcha — bot protection on email-and-password sign-in. Privacy policy: https://www.hcaptcha.com/privacy
• Our own mail (SMTP) server — the one-time welcome email.

We may also disclose information when the law requires it, for example in response to a valid request from a competent authority.

Free users see a Google AdMob banner ad on the workout rest screen. Gainy Pro has no ads.

The first time you open the app, Gainy shows Apple’s App Tracking Transparency (ATT) prompt. If you allow tracking, AdMob can use your device’s advertising identifier (IDFA) to show personalized ads. If you decline, Gainy shows only non-personalized ads. We store your personalized-ads preference. You can change your tracking choice at any time in iOS Settings › Privacy & Security › Tracking.

AdMob collects and uses data under Google’s own policies: https://policies.google.com/privacy

Our service providers operate in several countries, so your information can be processed outside Türkiye and outside the EEA and UK. Our database is hosted in Ireland; Apple, Google, RevenueCat and hCaptcha may process data in other countries, such as the United States.

When data is transferred from Türkiye, we do so as Article 9 of KVKK allows — relying on an adequacy decision, appropriate safeguards such as standard contractual clauses, or another ground the law provides. For users in the EEA or UK, transfers outside those regions rely on an adequacy decision, Standard Contractual Clauses, or another safeguard recognized by the GDPR.

You can ask us for details about the safeguards that apply at hi@ongunlabs.com.

We keep your information for as long as your account is active.

In the app, go to Profile › Legal and Account. “Delete My Account” immediately and permanently deletes your account and all data associated with it — this can’t be undone. It doesn’t affect your Apple ID, and it doesn’t cancel an active Pro subscription; manage that in iOS Settings (see the Terms of Use). “Download My Data” in the same place exports your data as a JSON file.

If you use Gainy without an account, deleting the app removes the data stored on your device. To have the anonymous record on our server deleted, email hi@ongunlabs.com and we’ll help you find and delete it.

Apart from what the law requires us to keep, we don’t retain your information once it has been deleted.

Under Article 11 of KVKK (Law No. 6698), you have the right to:

• learn whether your personal data is processed;
• request information if it has been processed;
• learn the purpose of processing and whether it is used accordingly;
• know the third parties, in Türkiye or abroad, to whom your data is transferred;
• request correction if your data is incomplete or inaccurate;
• request deletion or destruction under the conditions in Article 7 of KVKK;
• request that corrections and deletions be notified to the third parties your data was transferred to;
• object to an outcome against you that results from analysis exclusively by automated systems;
• claim compensation if you suffer damage because your data was processed unlawfully.

To exercise these rights, email hi@ongunlabs.com. We reply to requests free of charge within thirty days at the latest, depending on the nature of the request; if a request requires an additional cost, the fee set in the Personal Data Protection Board’s tariff may be charged.

You can withdraw any consent you gave at any time: notification and tracking permissions in iOS Settings, and optional profile data by emailing us or deleting your account.

If you’re not satisfied with our answer, you can lodge a complaint with the Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu): https://www.kvkk.gov.tr

If you’re in the European Economic Area or the United Kingdom, you have the right to:

• access your personal data;
• have inaccurate data corrected;
• have your data erased;
• restrict how we process your data;
• receive your data in a portable format (data portability);
• object to processing that rests on legitimate interests;
• withdraw your consent at any time, without affecting processing that happened before.

In the app, “Download My Data” (access and portability) and “Delete My Account” (erasure) take effect immediately. For anything else, email hi@ongunlabs.com; we reply within one month.

You also have the right to lodge a complaint with your local data protection supervisory authority.

Data moves between the app and our server over TLS. Our database uses row-level security (RLS), so each user can only access their own data. No system is perfectly secure, so we can’t promise absolute security, but we take reasonable measures to protect your information.

Gainy isn’t directed at children under 13, and we don’t knowingly collect their information. If you believe a child has given us information, email hi@ongunlabs.com and we’ll delete it.

We may update this policy as Gainy changes. We’ll change the “Last updated” date above, and if a change materially affects how we handle your information, we’ll let you know in a reasonable way before it applies.

Questions, requests or complaints about your data: hi@ongunlabs.com. Data controller: Ongun Labs, Ankara, Türkiye.