Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Algorillas GmbH Münsterstr. 1a 55116 Mainz Germany

Managing Director: Tomislav Pree Commercial register: HRB 53058, Amtsgericht Mainz Email: support@gorillamode.de Phone: +49 151 65526514

We have not appointed a data protection officer, as we are not legally required to do so. Please send all privacy requests to support@gorillamode.de.

2. The essentials at a glance

• We do not sell your data.
• We do not use any analytics, tracking or advertising services.
• We do not carry out profiling with legal or similarly significant effects.
• Only your accepted friends can see your training, body and photo data.
• We process health data only with your explicit consent.
• You can export your data and delete your account in the app at any time.

3. Account and profile

To register, we process your email address, username and password. We store your password only as a cryptographic hash – we never know it in plain text. We also store the time at which you accepted our Terms of Use.

In your profile you can voluntarily add further details: name, display name, avatar photo, gym, city, date of birth and height.

The legal basis is Art. 6(1)(b) GDPR (performance of the user agreement). Section 5 additionally applies to your height.

Forgot your password? We will email you a 6-digit code. The code is stored only as a hash and is valid for 15 minutes (Art. 6(1)(b) GDPR).

4. Training, photos and app features

For GorillaMode to work, we process the content you enter yourself:

• Workouts: title, muscle groups, start and end time, notes, sets with weight, reps and RPE, templates or splits, and optionally your average heart rate
• Workout photos
• Body entries: weight, body fat percentage and notes
• Nutrition: meals and targets
• Supplements and intakes

The Live Activity and lock-screen widget on iOS display your current workout locally on your device.

The legal basis is Art. 6(1)(b) GDPR; where health data is concerned, additionally your consent (section 5).

5. Health data (Art. 9 GDPR)

Body weight, body fat, heart rate, height, nutrition and supplement data may be health data within the meaning of Art. 9 GDPR. We process this data only on the basis of your explicit consent (Art. 9(2)(a) in conjunction with Art. 6(1)(a) GDPR). You give it at sign-up or later in the app; we store the time of your consent as proof.

You can withdraw your consent at any time with effect for the future (Art. 7(3) GDPR), in the app or by emailing support@gorillamode.de. We will then stop processing or delete this data, and the related features will no longer be available to you. Withdrawal does not affect the lawfulness of processing carried out before it.

6. Friends, feed and community

GorillaMode is social: you can send and accept friend requests. So that others can find you, your name, username and avatar can be found through user search.

Your workouts, body data and photos are visible only to your accepted friends. There is a weekly leaderboard among friends. Friends can like your posts with “Bussis” and comment on them.

Roasts or nudges are short push notifications to friends; a one-hour cooldown applies per person. Notifications are also shown to you in the app.

The legal basis is Art. 6(1)(b) GDPR.

7. Safety: blocking, reporting, bug reports

You can block other users and report content. When you report something, we store the reason, your optional details and who made the report. The reported person is not told who reported them. We use reports to review violations and protect the community (Art. 6(1)(b) and (f) GDPR; legitimate interest in a safe platform).

If you report a bug, we store your message, platform, app version and optionally a screenshot (Art. 6(1)(f) GDPR; legitimate interest in a working app).

8. Gym Lock (Apple Screen Time)

Gym Lock lets you lock distracting apps while you train. It uses Apple’s Screen Time interfaces (FamilyControls/ManagedSettings). Your app selection consists of opaque Apple tokens stored only on your device. We never see which apps you select or use. The manual lock is free; the automatic lock is part of Premium.

9. Personal access key for AI assistants (MCP)

In the app you can create a personal access key that lets an AI assistant of your choice read your training data. This happens only on your initiative: you decide which external service receives the key. The provider of that service is responsible for its processing. You can revoke the key at any time (Art. 6(1)(b) GDPR).

We ourselves do not send any user data to AI services. We use Google Gemini only internally to create exercise illustrations – without any personal data.

10. Premium subscription

You purchase Premium as an in-app subscription via the App Store (Apple Distribution International Ltd.) or, where offered, Google Play. Payment is handled by the respective store; we receive no payment data.

We use RevenueCat, Inc. to manage subscriptions. RevenueCat receives an internal pseudonymous user ID as well as purchase and receipt data from the store, and tells us your subscription status (Art. 6(1)(b) GDPR).

11. Emails and push notifications

We send transactional emails (e.g. password code, welcome email, data export link, notices about reports) to perform our contract with you (Art. 6(1)(b) GDPR). You receive marketing emails only if you actively opt in – this is off by default (Art. 6(1)(a) GDPR). You can withdraw this consent at any time.

For push notifications we store one device token (FCM token) per device. You can turn off push notifications at any time in your device settings.

12. Service providers and recipients

We use carefully selected processors with whom we have concluded agreements under Art. 28 GDPR:

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany – hosting of the backend, PostgreSQL database and web app on servers in Germany.
• Cloudflare, Inc. (Cloudflare R2) – storage and delivery of uploaded images (avatars, workout photos, bug-report screenshots). Images are delivered via non-guessable links; however, anyone who has the exact link can open the image.
• Mailgun Technologies, Inc. (Sinch) – sending transactional emails; processing takes place in the EU region where configured.
• Google Ireland Ltd. / Google LLC – Firebase Cloud Messaging for push notifications (device token, notification content); on iOS, delivery is via the Apple Push Notification service.
• RevenueCat, Inc. – subscription management (see section 10).
• Apple Distribution International Ltd. – App Store and payment processing for subscriptions.

Where data is transferred to the USA, we rely on the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR), under which the US providers named are certified, and additionally on EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

13. Website, storage and server logs

We use only technically necessary cookies and local storage (localStorage): your login token, language, theme, the last app page you opened, your cookie choice, and Django session and CSRF cookies for the admin area. The legal basis is § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) and Art. 6(1)(b) or (f) GDPR.

Our website currently loads the fonts “Barlow Condensed” and “DM Sans” from Google servers (Google Fonts). In doing so, your IP address is transmitted to Google. The legal basis is our legitimate interest in a consistent presentation (Art. 6(1)(f) GDPR).

For security and troubleshooting, the web server may log your IP address, time, requested URL and user agent. We keep these logs for no more than 14 days (Art. 6(1)(f) GDPR).

14. Retention and deletion

We keep your data for as long as your account exists. You can delete your account in the app at any time (Profile → Legal → Delete account). Your account and associated data are then deleted immediately; residual copies in backups and logs are removed within 30 days.

We keep bug reports and moderation reports without any link to your account for as long as necessary to resolve them or for evidence purposes. Statutory retention obligations (e.g. under tax law) remain unaffected.

15. Minimum age

GorillaMode is intended for people aged 16 and over. If you are under 16, you may not use GorillaMode.

16. Your rights

You have the right to:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing based on legitimate interests (Art. 21 GDPR)
• withdraw any consent given, with effect for the future (Art. 7(3) GDPR)

You can exercise many of these rights directly in the app: with data export, we email you a signed link to download your data as JSON (valid for 7 days). You can delete your account in the app. For anything else, write to support@gorillamode.de.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz Hintere Bleiche 34 55116 Mainz, Germany

You can also contact the supervisory authority where you live.