KanGym – iOS Strength Training App
Effective: October 2026
Özkan Yilmaz
Buckower Damm 159
12349 Berlin
Germany
Email: app.kan.gym@gmail.com
The KanGym app stores all workout data exclusively on your device. The app transmits no personal data to our or third-party servers, uses no analytics or tracking services and shares no data with third parties. Exceptions that do not originate from the app are described in sections 5 (purchases via Apple), 12 (crash reports via Apple), 13 (contact), 14 (hosting of this website) and 15 (Instagram).
The app stores the following data locally on your device:
All data is stored exclusively on your device and protected by iOS device encryption. No data is transmitted to external servers.
Legal basis: Art. 6(1)(b) GDPR (performance of contract – providing app functionality).
KanGym offers in-app purchases via Apple's StoreKit. Payment processing is handled entirely by Apple. We do not receive any payment data, credit card numbers, or personal account information. Apple (Apple Distribution International Ltd., Cork, Ireland) is an independent controller for downloads, purchases, billing and subscriptions. Apple's privacy policy applies.
KanGym does not use any analytics, tracking, or advertising SDKs. No usage data, device IDs, or advertising identifiers are collected. No profiling takes place.
The home screen widget displays aggregated workout statistics. This data is shared locally on your device via a secure App Group. Live Activities display the rest timer on the Lock Screen and Dynamic Island. Notifications (rest end, monthly recap on the 1st of the month) are scheduled locally on the device – only with your permission, and can be turned off in the iPhone settings or in the app. All data remains on the device.
KanGym can optionally sync completed workouts to Apple Health. This feature is disabled by default and must be explicitly enabled by the user in the app settings.
When enabled, the app:
Apple Watch (from version 1.2): If you follow a workout with the KanGym app on Apple Watch and allow access in the Health dialog, the watch starts a strength-training workout in Apple Health. During the workout it reads your heart rate and active energy (calories) to show them on your wrist, and saves the workout to Apple Health. Between the watch and the iPhone only workout data (exercise, set, weight, reps, rest) is exchanged, over Apple's encrypted connection between your own devices.
No health data is transmitted to external servers. All HealthKit data remains on your devices and is protected by iOS and watchOS. Apart from workout records and – only on Apple Watch during a workout – heart rate and active energy, the app reads no health data (e.g. no step count).
Legal basis: Art. 6(1)(a) and Art. 9(2)(a) GDPR (explicit consent – workout data in Apple Health can be health data; you enable the feature yourself and confirm access in the iOS dialog). You can revoke access at any time in iOS Settings > Privacy & Security > Health.
KanGym allows you to import workout data from CSV files exported by other fitness apps. The import is performed entirely on your device. No data is uploaded to any server. Imported data is stored locally alongside your existing workouts.
You can export all your data as a JSON file at any time via the Settings. The export is performed locally and is not transmitted to any server. You have full control over your data and can delete it at any time.
App data stays on your device until you delete it in the app, reset the app or uninstall it. You manage exported backup files yourself.
If you have agreed in the iOS settings to share analytics with app developers, Apple provides us with aggregated crash reports and usage statistics. Apple collects this data; we only receive it in aggregated form without reference to you. You can turn this off at any time under iOS Settings > Privacy & Security > Analytics & Improvements. If you take part in test versions via TestFlight, we also receive what you voluntarily send us there (e.g. feedback, screenshots) and your name and e-mail address if you joined via an invitation. Legal basis: Art. 6(1)(a) and (f) GDPR.
If you contact us by e-mail or via the contact form, we process your e-mail address, the optional name and the content of your message to answer your request. Messages from the contact form are stored by our host Netlify (see section 14, Netlify Forms) and forwarded to us by e-mail. For spam detection, Netlify checks every form message (content and technical data such as the IP address) with the Akismet service of Automattic Inc. (USA); legal basis is our legitimate interest in an abuse-free contact channel (Art. 6(1)(f) GDPR). The form uses no cookies and no reCAPTCHA. If you prefer to avoid this, e-mail us instead. We delete form messages at Netlify as well once the request is closed. Our mailbox is provided by Google (Google Ireland Ltd., Dublin, and Google LLC, USA; Gmail); data may also be processed in the USA, based on the EU-US Data Privacy Framework (Art. 45 GDPR). The data is deleted once your request has been fully handled, unless statutory retention obligations apply. Legal basis: Art. 6(1)(b) or (f) GDPR.
This website (privacy policy, imprint, support) is hosted by Netlify, Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107, USA. Netlify processes the data as our processor (Art. 28 GDPR) under its Data Processing Agreement. When you open the pages, the host processes technically necessary data in server log files: IP address, date and time, requested page, browser and operating system, and the referring page. This data is used to operate the website securely and reliably and is not combined with other data; we do not analyse it, and Netlify deletes it automatically after a short period. The website uses no cookies, no tracking or analytics services and embeds no third-party content (e.g. fonts). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation). Transfers to the USA are based on the EU-US Data Privacy Framework (Art. 45 GDPR) or the EU Standard Contractual Clauses (Art. 46 GDPR).
We run the Instagram profile @kangymapp. For its statistics feature (Insights) we are joint controllers with Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland (Art. 26 GDPR; agreement: Page Insights Controller Addendum). Meta takes primary responsibility, including for access and erasure requests. We only receive aggregated statistics without personal reference. Legal basis is our legitimate interest in promoting the app (Art. 6(1)(f) GDPR). Meta also processes data in the USA, based on the EU-US Data Privacy Framework. More information: Instagram Privacy Policy.
We run the YouTube channel @kangymapp. The provider is Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. When you visit the channel or watch our videos, Google processes your data as an independent controller under its privacy policy, also in the USA (EU-US Data Privacy Framework). We only receive aggregated statistics without personal reference. Legal basis is our legitimate interest in promoting the app (Art. 6(1)(f) GDPR).
We run the TikTok profile @kangymapp. The provider is TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, Ireland. When you visit the profile or watch our videos, TikTok processes your data as an independent controller under its privacy policy, also outside the EU. We only receive aggregated statistics without personal reference. Legal basis is our legitimate interest in promoting the app (Art. 6(1)(f) GDPR).
Under the GDPR, you have the following rights:
Since all app data is stored locally, you can exercise these rights at any time by editing, exporting, or deleting data within the app. For data from an e-mail request, contact the address above.
Right to object: Where we process data based on Art. 6(1)(f) GDPR (server logs, spam checks, Instagram statistics), you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). An e-mail to app.kan.gym@gmail.com is enough.
Providing data is neither a legal nor a contractual requirement; without workout data you simply cannot use the app meaningfully. There is no automated decision-making, including profiling (Art. 22 GDPR).
You also have the right to lodge a complaint with a supervisory authority. The competent authority for Berlin is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61
10555 Berlin
www.datenschutz-berlin.de
This privacy policy may be updated occasionally. Changes will be published within the app and on this page. The current version applies from the time of publication.