Last updated 24 September 2026. This policy covers the Gym Training Lab website (gymtraininglab.com) and the Gym Training Lab app for iPhone and iPad.
In short: there is no account and no sign-in. We don't use analytics, advertising or tracking cookies, and we don't sell or share your data. Your training history is kept on your own device and never sent to us. The only time a session leaves your device is when you choose to send it to Strava.
The data controller for Gym Training Lab is:
Unlabelled SLYou can write to us at this address about anything in this policy, including exercising the rights listed below.
To work, Gym Training Lab saves the following in your browser's storage (on the website) or in the app's storage (in the iOS app):
None of this is sent to us or stored on our servers. You can delete a session with ✕ in Training History, and delete everything by clearing this site's data in your browser or by deleting the app.
When you connect a BikeErg, rower, treadmill, cross trainer or other Bluetooth machine, its readings (power, cadence, speed, distance) are read and processed on your device only. The iOS app asks for Bluetooth permission solely for this.
If you tap Send to Strava, you log in on Strava's own page and authorise Gym Training Lab to upload activities. Our server exchanges Strava's one-time code for access tokens (this needs our app's secret key, which can't be kept on your device) and passes the tokens straight back to your device. Session files and activity details are sent to Strava, some of them through our server, which forwards them without storing them. We only request permission to upload activities, not to read your Strava data.
We do this because you asked us to send the session (Article 6(1)(b) GDPR). Once on Strava, your activities are covered by Strava's privacy policy. You can disconnect Gym Training Lab at any time in Strava under Settings → My Apps.
If you tap Save to Apple Health after a session, the app writes it to Apple Health as a workout: activity type, start and end time, distance where there is one, and energy burned when it was calculated from measured power. The app asks for your permission first and only ever writes to Health — it never reads any Health data.
Health data stays in Apple Health on your device (and in your iCloud, if you sync Health there). It is not sent to us, is not used for advertising or marketing, and is not shared with anyone. You can delete saved workouts in the Health app and withdraw permission in Settings → Health → Data Access & Devices.
The website and the small server that handles Strava are hosted by Cloudflare, Inc. As with any website, Cloudflare processes technical data such as your IP address and request details in order to deliver pages and protect the service from abuse. We rely on our legitimate interest in running a secure, working service (Article 6(1)(f) GDPR). Cloudflare may process this data outside the European Economic Area, under the EU–US Data Privacy Framework and the European Commission's Standard Contractual Clauses. See Cloudflare's privacy policy.
The iOS app contains its own copy of the app, so using it doesn't contact our server except for Strava.
Gym Training Lab is not aimed at children under 14 and we don't knowingly process their data.
Under the GDPR and Spain's data protection law (LOPDGDD), you have the right to access, rectify and erase your personal data, to restrict or object to its processing, and to data portability. Because we don't keep your training data on our servers, you control most of it directly on your device, as described above. For anything else, write to us at the address above.
You also have the right to lodge a complaint with the Spanish data protection authority, the Agencia Española de Protección de Datos (aepd.es), C/ Jorge Juan 6, 28001 Madrid.
If we change how Gym Training Lab handles data, we will update this page and the date at the top.