Privacy policy

1. Who is responsible

The controller of your data is GainOS LLC, CNPJ {{LEGAL_ENTITY_ID}}, headquartered at {{LEGAL_ADDRESS}}, responsible for the GainOS app and for this site. The controller is the one who decides how your data is processed and is answerable for it.

The data protection officer (encarregado) is {{DPO_NAME}}. To reach the data protection officer or GainOS about your data, write to {{CONTACT_EMAIL}}. We answer in Portuguese.

2. What this policy covers

This policy applies to the GainOS app for iPhone during the beta, distributed through Apple's TestFlight, to the beta waitlist and to this site.

The beta is free. You get in by invitation, in small batches, or through the public TestFlight link, when it is open. During the beta, the app uses a test server. The data stored on it is real and follows this policy. The What has no automatic time limit yet section explains what happens at the end of the beta.

This policy exists in Portuguese and in English, and the two versions have the same value: they say the same thing, change together and always have the same version number. If a sentence can be read in different ways in the two languages, the reading most favorable to you applies. The app exists only in Portuguese, so the English version quotes the names shown in the app (screens, buttons and labels) in Portuguese, with the translation in parentheses.

3. Data we collect

We group the data by source. The items marked as health data are sensitive personal data (LGPD, art. 5, II). The following are also health data, and therefore sensitive, even without that mark: your dietitian's plan; meal and body photos; the water and supplements checked off for the day; Apple Health and Apple Watch data; the text you type or dictate about meals, workouts and your plan; the excerpts kept by the coach memory; and the workouts you share with friends. Unless we say they stay only on the device, the data goes to GainOS servers and is linked to your account.

• Account: name, email and password. The password is stored only as a hash, never as readable text. We also store your preferences, such as notifications and level of scientific detail, and login attempts.
• Onboarding profile (health data): biological sex, age, height, weight, body fat, waist and measurement method; experience, days, time and length of workouts, location and equipment; goals, priority muscles and the injuries or limitations you describe.
• Habits (health data): nutrition goal, number of meals, restrictions, intolerances, allergies, preferences, alcohol intake, how often you eat out and supplements; sleep hours and quality, stress, type of work, steps and other sports.
• Logs (health data): workouts, with each set, load, reps and RIR, including those imported from Apple Watch; meals, with time, items, amounts, estimated calories and macronutrients, and notes; weight, waist, body fat and lean mass, including weigh-ins imported from the Health app; workout and meal plans; badges; progress assessments, each with that day's numbers (such as weight and trend, lean mass, workouts, logged calories and protein, estimated expenditure and calorie target), the analysis and your decision on the suggestion.
• Your dietitian's plan: the text you paste, type or dictate to import it.
• Coach conversations (health data): your questions and the answers, with the mode used, including the Confessar (Confess) mode, in which you tell what you ate or how your day went; the title of each conversation; and whether each question was dictated.
• Coach memory (health data, optional): it comes switched off. If you turn on the Lembrar o que eu contar (Remember what I tell it) option, on the O que o Allday lembra (What Allday remembers) screen (Allday is the coach's name in the app), at the top of the coach's conversation list, we store verbatim excerpts, of up to 240 characters, of what you wrote to the coach or when asking for a workout adjustment, such as a pain, an injury, a pregnancy, a medication, a restriction, a preference, a food you avoid, how the plan was followed or a goal, with the type and the date. To choose what to keep, the message text, without your profile, goes once more to the AI provider: always in the Confessar (Confess) mode and, in other cases, only when an automatic word filter indicates that the message says something about you. The stored excerpts go to the AI in coach conversations, workout adjustments and progress assessments. We keep up to 40 excerpts, and each one disappears on its own after 60 days to 1 year, depending on the type, unless you repeat it. On the same screen you see each excerpt and can delete one, delete all or turn the memory off, which deletes everything. Deleting a conversation does not delete the excerpts kept from it.
• Photos of meals, labels and packaging: they go to the AI provider to produce the estimate and are not stored on GainOS servers. The location is removed before sending. A thumbnail stays only on the device.
• Progress photos (of the body): they stay only on the device. The two photos you choose go to the AI provider when you ask for the comparison.
• Water and supplements checked off for the day: they stay only on the device.
• Apple Health and Apple Watch data, detailed in their own section.
• Typed or dictated text: meal descriptions, imported workouts, comments to adjust the plan and corrections. We store the text that becomes part of a log or a plan and, if coach memory is on, excerpts of what you tell the coach or write to adjust the plan, as the item on coach memory explains.
• Social: friend requests and friends, messages with friends, shared workouts and messages on the community wall.
• Notifications: the device token for push notifications, language, time zone, app version and the history of the Central de Comunicação (Communication Center).
• Technical data: IP address, used to limit attempts; date and time; request addresses, which contain your account identifier and, when you sign out, the notification token; your email, when we send a password recovery code; and the device and browser identification (User-Agent) in sessions.
• Usage events: records without content linked to the account identifier, such as the type of input used, whether an estimate was corrected, the response time and which notification was opened. They do not include photos, dishes or text.
• AI calls: since app version 1.4.0, each call to the AI provider creates a record without content, with the feature, the provider and the model used, the response time, the volume of text processed, the cost, the outcome and, where applicable, whether it was routed to a specific model. It does not store the question, the answer or the account identifier, but it may store a code derived from that identifier, which lets us link the record to your account. If we route your calls to a specific model, for example to move you off a model that is answering poorly, we also store that choice, the reason, who made it and until when it applies, at most 90 days. On that date, this routing record is deleted.
• Waitlist, the record of the consents you gave on it and TestFlight: detailed in their own section. Acceptances in the app: since version 1.6.0, each time you tick the two boxes, when creating the account or on the O combinado (The deal) screen, we store on the account the version of the text, the version of these documents, the date and time, where the acceptance was given and the app version; the 20 most recent are kept.

4. Apple Health and Apple Watch

The app only reads data from the Health app, and only the types you allow on Apple's screen. GainOS does not write anything to the Health app.

With the Apple Watch card connected, the app can read: workouts, with average and maximum heart rate and calories; heart rate; resting heart rate; active energy; resting energy; heart rate variability (HRV); VO₂ max; and respiratory rate.

With the Apple Health card connected, the app can read: weight, body fat percentage, lean mass, BMI, steps and sleep.

Before connecting, you choose how far back to fetch the data: since sign-up, the last 30 or 90 days, the whole history or a date. iOS may limit this period on its own screen.

The data read goes to GainOS servers. We keep daily histories of up to 90 days, and each imported workout and weigh-in goes into your history. Each progress assessment also keeps the 7-day averages of resting heart rate, HRV, sleep and steps for the day it was made. With a card connected, iOS can open the app in the background, even when it is closed, to fetch and send new data.

Apple Health data goes to the AI provider in several ways. The coach and progress assessments receive a summary of the last 7 days, with the device name. In addition, each workout imported from Apple Watch, with average and maximum heart rate and calories, and each imported weigh-in, with body fat and lean mass, are part of your history, which goes in full to these two features. Since app version 1.4.0, the workout plan adjustment also receives the workouts of the last 28 days, including those imported from Apple Watch, with heart rate and calories. And the most recent weigh-in updates the weight and body fat in your profile, which goes to the AI in plans, the coach and assessments; the weight also goes in meal estimates.

The health analysis receives the daily series of resting heart rate, sleep and HRV, plus steps, active energy, respiratory rate, VO₂ max, up to 20 workouts, your name, your age and the device name. The Artificial intelligence section details each case.

Disconnecting a card or revoking access on the iPhone stops the reading. To revoke: Settings > Privacy & Security > Health > GainOS. Signing out of the account or deleting it does not revoke this access. Disconnecting the card in the app, with the iPhone connected to the internet, also deletes from the server the daily histories and the health analysis it stored, as long as the card is also disconnected on any other iPhone where you use the account, because, while connected, it sends them again; revoking access only on the iPhone is not enough to delete what was already stored. Workouts and weigh-ins already imported stay in your history and keep being used in the app's features, including being sent to the AI provider, until you delete them: each workout in the Treino (Workout) tab, under Histórico (History); each weigh-in on the Pesagens (Weigh-ins) screen, which you open by tapping the strip with your weight at the top of the Coach tab and then, on the Evolução (Evolution) screen, Pesagens; or everything at once by deleting the account, under Você > Configurações > Excluir conta (You > Settings > Delete account). An imported workout you deleted can come back if you reconnect the Apple Watch card or change its period, and a workout deleted on one iPhone stays on another iPhone with the same account and can go to the AI from there. The weight and body fat percentage in your profile may also have come from the latest imported weigh-in, and each sync of the Apple Health card copies to the profile again the weight and body fat from the day of the most recent imported weigh-in; to change them, disconnect the card and edit the profile under Você > Meu perfil (You > My profile). You can also ask at {{CONTACT_EMAIL}} for us to delete from the server, without deleting the account, what came from Apple Health: the cards' readings and the health analysis, imported workouts, the Apple Watch heart rate and calories in the workouts you logged, and imported weigh-ins; on a day when you also typed the weigh-in, what you typed stays. First, disconnect the cards on every iPhone where you use the account, with internet, because, while connected, they send everything again; then close the app completely and open it again on each iPhone. Some things stay: the weight and body fat percentage in your profile, until you edit them; weigh-ins saved by app versions before 1.1.0, which the server cannot tell apart from the ones you typed, until you delete them in Pesagens; the list of weigh-ins you deleted, with only the date and time, so that they do not come back, unless you ask for it to be deleted too; and, on the iPhone, imported workouts and the Apple Watch data of workouts you logged, which keep going to the AI in coach conversations and progress assessments until you delete the workout in the app (deleting a logged workout also deletes its sets). The numbers stored in a progress assessment, such as weight and the Apple Health averages, only go away when you delete the assessment or the account, and those the coach cited in a conversation, when you delete the conversation or the account.

Since app version 1.5.0, when you delete a weigh-in that came from the Health app, we keep on the server only its day and time, without any value, so that it is not imported again, not even after you reinstall the app. In the app, you cannot undo this or delete this record, which is deleted together with the account. The weigh-in stays in the Health app. The reverse also holds: a weigh-in or a night of sleep that you delete in the Health app stays in GainOS; to remove a weigh-in from GainOS, also delete it on the Pesagens (Weigh-ins) screen. If you shorten the fetch period, the Health app weigh-ins before the new start leave your history in GainOS and come back if you widen the period. A workout imported from Apple Watch that you delete can come back if you reconnect the card or change the period.

Apple Health data, and everything that comes from it, is used only to provide the service to you. It is never used for advertising, never sold and never used to improve the product. Usage events and technical records without content, such as opening a notice of new Health app data or the duration of a health analysis, carry none of this data and are part of the usage statistics, as the Improving the product section explains. Apple Health data reaches those who help us provide the service, such as the AI provider and the hosting.

It also reaches other people. Your friends (once either of you accepts the other's request) see your weight, even when it comes from the Health app, and your workouts, including those imported from Apple Watch, which count toward the weekly total and can appear as your latest workout. Imported workouts and weigh-ins also count toward badges, which are posted automatically on the wall, visible to all users, with your name. The message does not show your weight or other measurements, but it states the milestone reached, such as the third weigh-in or the fifteenth workout. These badges also count, without your name, in the community statistics shown in the app, as part of the service, and not to improve the product.

5. How we use your data

We use your data to:

• Create and protect your account, log you in and recover your password.
• Build and adjust your workout and meal plans and calculate your targets.
• Record and show workouts, meals, measurements, charts and badges.
• Produce estimates, analyses and coach answers with artificial intelligence and, if you turn on coach memory, take into account what you have already told it.
• Read and sync the Apple Health data you allow.
• Run the social features: friends, messages, shared workouts and the community wall.
• Send the reminders and notifications you turn on and announcements about the beta.
• Maintain security, prevent abuse, fix bugs and meet legal obligations.
• Produce aggregated or anonymized statistics, as the Improving the product section explains.
• Measure the time, cost and outcome of AI calls, to keep the service running and control its cost, and route your calls to another model when the current one answers poorly for you.
• Organize the waitlist, send the TestFlight invitations, notify those who chose Android if there is an Android version, and prove the consents you gave.

6. Artificial intelligence

GainOS's plans, coach answers (the coach is called Allday in the app), analyses, reading of photos and text, and estimates are made by artificial intelligence. For this, your data, including health data, is sent to Google, through the Gemini API, on the paid service.

Google acts as a processor, under its Data Processing Addendum, which has an appendix for the LGPD and the standard contractual clauses approved by the ANPD (Brazil's data protection authority). It processes the data to return the answer and, for up to 55 days, to detect abuse and meet legal obligations. Google does not use this content to train or improve its products.

Authorized Google personnel may review content flagged as possible abuse. The data may be processed in any country where Google has facilities. Today, only Google receives your data for AI. If we start using another AI provider, we will first update this policy and ask for your consent again.

What goes to the AI provider in each feature:

• Generate, resize or adjust the plan: your whole profile, including measurements, injuries and limitations, allergies, intolerances, sleep and stress, plus the current plan. Because the profile goes in full today, your name, your email and the account identifier also go. For an adjustment, these also go: the comment you wrote or dictated to adjust the plan, up to 5 earlier comments, the workouts logged in the last 28 days, with each set, including those imported from Apple Watch, and, if coach memory is on, the sentences it kept.
• Coach: your question and up to 20 earlier messages from the same conversation; other conversations do not go. Your profile: name, sex, age, height, weight, experience, goal, injuries, training location, equipment, dietary restrictions, intolerances and allergies. Your plans and targets, including the one from your dietitian. The whole history of workouts, meals and measurements, intake over the last 14 days and today's meals. A 7-day Apple Health summary, the estimates of expenditure and weight trend and, if coach memory is on, the sentences it kept.
• Progression analysis, which the app calls avaliação (assessment): the full profile, including your name, your email and the account identifier, the plans, the whole logged history, intake over the last 14 days, the 7-day Apple Health summary, the expenditure estimates, what GainOS's calculation, done without AI, suggests for your calorie target (keep or change, and to how much) and, if coach memory is on, the sentences it kept. It is done when you ask for it, in the app or in the conversation with the coach, and also automatically, every 4 weeks counted from your first workout. The automatic assessment comes switched on. To turn it off, use the Avaliação automática mensal (Automatic monthly assessment) option, in the coach's list of assessments. This choice is stored only on the iPhone: if you reinstall the app or use another device, it is switched on again.
• Coach memory, only if you turn on the Lembrar o que eu contar (Remember what I tell it) option: after the answer, the message you sent the coach, or the comment to adjust the plan, goes to the AI provider again, this time without your profile or your history, to pick sentences of yours to keep. This happens with messages in the Confessar (Confess) mode and with other messages that talk about you, for example about pain, injuries, routine, foods, pregnancy, illnesses, medication or goals. The kept sentences then go to the coach, the plan adjustment and the assessment.
• Health analysis: name, age, device name, steps, active energy, daily series of resting heart rate, sleep and HRV, respiratory rate, VO₂ max and up to 20 workouts with heart rate and calories.
• Compare progress photos: the two body photos you choose, the type of each one (front, side or back) and the days between them.
• Photo of a meal, label or packaging: the photo, the local time, the meal and its target, your weight, your nutrition goal and your dietary restrictions.
• Describe a meal by text or voice: the text, with the same context as the photo and the items already identified. The text may also go to a Google image model, which creates an illustration of the dish stored only on your device.
• Import a workout: the workout text, your experience, your limitations and the time per workout.
• Import a dietitian's plan: the full text of the plan.
• Suggest a menu: meals, times and targets, nutrition goal, restrictions, intolerances, allergies and preferences.
• Exercise details and substitutions: the exercise name, your training location and the text of your limitations. This text and the answer are kept in a shared cache for up to 30 days, without your account identifier. That is why we cannot delete them before that period, not even when the account is deleted.

7. Your consent for AI

Sending health data to the AI provider depends on your specific and highlighted consent (LGPD, art. 11, I). It is a condition for using the app (art. 9, § 3), because GainOS's core features depend on AI.

We ask for this consent in a box separate from accepting the terms, together with the consent for the international transfer (see its own section), at waitlist sign-up and, since app version 1.6.0, on the account creation screen, before the account exists. We record the date, the version of the text accepted and the version of these documents. Anyone who already had an account, including those who accepted on the waitlist, sees in the app, before any other screen, the O combinado (The deal) screen, with the same two boxes, and only keeps using the app after accepting. App versions before 1.6.0 do not ask for this consent and, in them, your data, including health data, keeps going to the AI provider; update the app through TestFlight. If you do not want to give this consent, delete the account in the app itself, under Você > Configurações > Excluir conta (You > Settings > Delete account): signing out does not delete your data.

Body photos and Apple Health data only go to the AI provider if you use the photo comparison or connect the Apple Health or Apple Watch cards. These features are optional: without them, the rest of the app works. Disconnecting a card stops the reading, but the workouts and weigh-ins already imported stay in your history and keep going to the AI until you delete them in the app; the Apple Health and Apple Watch section explains how to delete each one and what can come back. Deleting the account in the app, or asking for deletion at {{CONTACT_EMAIL}}, also stops this data from going to the AI.

You can refuse or withdraw this consent at any time, at no cost. Today the app has no mode without AI. So refusing means not using the app, and withdrawing means closing the account (art. 18, VIII). To withdraw, delete the account in the app itself, under Você > Configurações > Excluir conta (You > Settings > Delete account), or write to {{CONTACT_EMAIL}}.

When you delete the account in the app, you confirm with your password, and the deletion happens immediately and cannot be undone: the server ends the sessions and deletes your data, with the exceptions in the What remains after deletion section, and the iPhone where you made the deletion signs out of the account and deletes the account's data it kept. If the deletion does not finish, the app tells you: part of the data may already have been deleted, but the account still exists and you can try again. Another device signed in to the same account loses access within 30 minutes, and from then on none of your data is sent to the AI provider again, but the account's data stored on that device stays on it until you delete the app. If you ask by email, we end the sessions as soon as we confirm the request; within 30 minutes, the app can no longer talk to the server, and none of your data is sent to the AI provider again. In that case, the deletion follows the time limit in the How to exercise your rights section. The withdrawal does not affect what was done before it.

AI results are estimates and may contain errors. No AI result is applied to your plan, your targets or your logs without your approval. When the AI does not respond, GainOS's own calculation, without AI, takes over, and the app flags the result, for example with the 'Versão básica' (Basic version) label. In the coach, the basic-answer notice only appears until you close the app: when you reopen the conversation later, or on another device, the answer appears without the notice.

The AI proposes and you decide. Even so, you can ask for a review of any result and for information about the criteria used (art. 20).

8. Improving the product

Aggregated or anonymized statistics. We may use aggregated numbers, such as how many estimates are corrected or how long an answer takes, to improve GainOS. Anonymizing means removing everything that links the data to you, and that is in itself a processing of personal data. We do this only with usage events and technical data, without health data, based on legitimate interest (art. 7, IX).

You are informed of this collection at waitlist sign-up and in this policy. You can object at any time by writing to {{CONTACT_EMAIL}}, and the app keeps working.

Identified data, with optional consent. Using your identified data, such as profile, logs and conversations, to improve features only happens if you give a separate consent. It is optional: refusing or withdrawing it changes nothing in your access to the app. Health data only goes into product statistics with this consent.

Today the app does not offer this option yet. Until it does, we do not use your profile, your logs or your conversations to improve features, or to test or compare AI models. There are three exceptions. Usage events are linked to your account identifier, but only go into aggregated numbers. The server records each call to the AI provider without the request or the answer, only with technical data, such as the feature, the model, the response time, the size of the request and of the answer, the cost and how the call ended; the record may carry a pseudonymous code derived from your account identifier and also only goes into aggregated numbers. And we use the feedback you send us and the usage and crash data that Apple passes on to us through TestFlight to fix bugs and improve GainOS.

Apple Health data, and everything that comes from it, such as imported workouts and weigh-ins and summaries and analyses made with it, is used only to provide the service to you and is not used to improve the product, not even with your consent. In the usage statistics, what concerns the Health app is limited to usage events and technical records without content, such as opening a notice of new Health app data or the duration of a health analysis, which carry no value from the Health app.

The AI provider does not use any of your data to train models. Feedback sent through TestFlight is used only to improve GainOS and only reaches service providers that process it on our behalf and cannot use it for any other purpose.

9. Legal bases

Each use of data has a basis in the LGPD:

• Performance of the contract and preliminary procedures at your request (art. 7, V): account, login, password recovery, notifications, social features, waitlist and TestFlight invitation, with data that is not health data.
• Specific and highlighted consent, a condition of use (art. 11, I; art. 9, § 3): health data, photos and Apple Health data, and sending them to the AI provider.
• Specific and optional consent (art. 11, I): showing your weight, its trend and your workouts, including those from Apple Health, to a friend. You give it when you send or accept a friend request. It is not a condition of use: without friends, none of this is shared, and you can remove a friend at any time.
• Specific and optional consent (art. 11, I): coach memory. While it is on, your messages to the coach and comments to adjust the plan go to the AI provider again, which picks sentences of yours to keep, including about health; GainOS stores these sentences and uses them in the coach's answers, workout adjustments and assessments. You give it by turning on the Lembrar o que eu contar (Remember what I tell it) option and withdraw it by turning the option off, which deletes everything that was kept. It is not a condition of use: the memory comes switched off.
• Consent (art. 11, I): automatic posting of your badges on the wall, with your name, including those earned with workouts and weigh-ins from Apple Health. Until the app offers an option to turn it off, it is included in the consent to use the app.
• Dictation: from app version 1.3.0, the audio is transcribed on your iPhone and reaches neither us nor Apple. The transcribed text follows the basis of the feature you use it in, like typed text.
• Separate and optional consent (arts. 7, I, and 11, I): use of identified data to improve the product.
• Legal obligation (art. 7, II): complying with court orders and requests from authorities.
• Legitimate interest (art. 7, IX): security, abuse prevention, usage events, technical records of AI calls, routing your calls to another AI model when the current one answers poorly for you, statistics without health data, announcements about the beta and TestFlight data about sessions, crashes and device, with the feedback you send, to fix bugs. If a screenshot shows health data, we use it only to understand the reported problem. You can object.
• Regular exercise of rights (arts. 7, VI, and 11, II, d): defense in judicial or administrative proceedings and proof of the consents you gave.
• International transfer: see its own section.

10. Who we share with

Some terms in this section: a processor is whoever processes data on our behalf and can only follow our instructions. An independent controller decides on its own how it uses the data, under its own policy. Standard contractual clauses are a model contract approved by the ANPD that obliges whoever receives the data abroad to protect it as the LGPD requires.

We share data only with those who help us provide the service, with the people you choose in the app or when the law requires it. We do not sell data.

Processors process the data to provide the service GainOS contracted, under their contracts and terms. We are still formalizing, with some of them, specific data protection clauses compatible with the LGPD. Apple and Open Food Facts process the data they receive under their own policies. jsDelivr receives only the IP address.

• Google, Gemini API (processor): artificial intelligence, as described in its own section.
• Railway (processor): hosting of the app server. It receives all the data the app sends, including health data, and keeps the technical logs.
• MongoDB Atlas (processor): the database where your data is stored.
• Resend (processor): sending the password recovery email, with your email, your name and the code.
• Expo (processor): forwarding push notifications to Apple's service. It receives the device token and the notification content.
• Apple: in TestFlight, when the invitation is sent by email, it receives your email only to send the invitation on our behalf, and it passes the beta data on to us. In delivering notifications (APNs), it is an independent controller and processes the data under its own privacy policy.
• Open Food Facts (independent controller): the app queries this database directly from your iPhone when you scan a barcode or search for a product. It receives the IP address and the code or text searched.
• jsDelivr: a network that delivers the exercise images directly to your iPhone. It receives the IP address.
• Google, Sheets and Apps Script (processor): stores the waitlist and the record of your consents. It also receives the IP address and technical connection data when you fill in the waitlist form.
• Vercel (processor): hosting of this site. It receives technical data from visits, such as the IP address.
• Other users: what you choose to show friends and what goes on the wall, as the What other people see section explains.
• Authorities: when the law or a court order requires it.

11. International transfer

Part of your data is processed outside Brazil. This notice meets ANPD Resolution CD/ANPD No. 19/2024. For each recipient, we state the role, the purpose, the data, the country and the mechanism that authorizes the transfer. The transfers last as long as the service is provided, subject to the time limits in the How long we keep data section.

The countries where the app's server and database are located are: {{DATA_HOSTING_COUNTRIES_EN}}. Railway, which hosts the server, has no region in Brazil and provides support from the United States.

For Railway and MongoDB Atlas, which store health data and do not offer standard clauses, the transfer relies on your specific and highlighted consent (LGPD, art. 33, VIII). It is asked for in the same box as the consent for AI, separate from accepting the terms, in a sentence of its own that says your data will be stored outside Brazil, at waitlist sign-up and, since app version 1.6.0, when you create the account. Anyone who created the account before, or uses an earlier version, had their data stored with these providers since the account was created, without this acceptance, as the Your consent for AI section explains. Without this consent you cannot stay in the beta, because the app depends on these providers. Withdrawing this consent also means closing the account, which you can do in the app itself, under Você > Configurações > Excluir conta (You > Settings > Delete account).

From app version 1.3.0, dictating involves no transfer: the transcription is done on your iPhone, as the Voice section explains.

• Google, Gemini API (processor): generating plans, answers, analyses and estimates. Profile, health, log, photo and text data, as described in Artificial intelligence. United States and other countries where Google has facilities. Mechanism: the ANPD's standard contractual clauses, in Google's data processing addendum (art. 33, II, b).
• Railway (processor): hosting the app server. All the data the app sends. Countries: the server region, among those listed above, and the United States, where Railway is headquartered. Mechanism: your specific and highlighted consent (art. 33, VIII).
• MongoDB Atlas (processor): storing the account data. All the data stored on the server. Country: the database region, among those listed above. Mechanism: your specific and highlighted consent (art. 33, VIII).
• Resend (processor): password recovery email. Email, name and code. United States. Mechanism: necessary to perform the contract with you (art. 33, IX, with art. 7, V).
• Expo (processor): forwarding push notifications. Device token, sender's name, start of the message and notification data. United States. Mechanism: necessary to perform the contract with you (art. 33, IX, with art. 7, V).
• Apple, TestFlight and notifications: sending the invitation and delivering notifications. Invitation email, when the invitation is by email, TestFlight data and notification content. United States and other countries. Mechanism: necessary to meet your request to join the beta and to perform the contract (art. 33, IX, with art. 7, V).
• Google, Sheets and Apps Script (processor): waitlist. Name, email, state, country, type of phone, date, version accepted and consents given, plus the IP address and technical connection data. United States and other countries. Mechanism: necessary to meet your request to join the beta (art. 33, IX, with art. 7, V).
• Vercel (processor): hosting this site. IP address and technical visit data. United States and other countries. Mechanism: necessary to deliver the page you requested (art. 33, IX, with art. 7, V).
• Open Food Facts and jsDelivr: there is no transfer made by us. Your iPhone connects directly to these services, which receive the IP address and, in the case of Open Food Facts, the code or text searched. Open Food Facts is based in France, a European Union country, which the ANPD recognizes as providing adequate protection (ANPD Resolution CD/ANPD No. 32/2026). jsDelivr has servers in several countries.

12. Your rights in the transfer

You can ask for a copy of the clauses used in the transfers, and we send it within 15 days. You have all the rights in the Your rights section, including the right to petition Brazil's National Data Protection Authority (ANPD).

Responsibilities. GainOS LLC, as controller, is answerable to you for all the transfers in the International transfer section. Processors can only process your data according to our instructions and are liable together with GainOS if they breach the LGPD or those instructions (LGPD, art. 42, § 1, I). Apple and Open Food Facts are independent controllers and are answerable for the processing they carry out, under their own policies.

Controller responsible for the transfers: GainOS LLC. Contact: {{CONTACT_EMAIL}}. The security measures are in the Security section.

13. What other people see

Friends: you add friends by email, and the friendship only takes effect after it is accepted. Anyone who sends a request to your email sees your name and your email before acceptance. When you look up an email, the app tells you whether an account exists with it.

After acceptance, each friend sees your name, your email, your weight trend, how many workouts you did in the week and your latest workout. The friend's app also receives the exact value of your current weight, even when the screen shows only the trend. The weight may come from the Health app, and workouts imported from Apple Watch also count and can appear as your latest workout.

This sharing is optional. It only happens with those who accept your friend request or whom you accept. You can remove a friend at any time, and that person stops receiving this data.

Messages with friends are private. They are kept on GainOS servers, with no time limit, until you or the friend deletes their account, which deletes the whole conversation from the server. Today a message cannot be deleted in the app, and removing the friend does not delete the conversation, which reappears if you become friends again.

An automatic filter flags messages with offensive words, but they are delivered anyway, and the flag is recorded. The GainOS team only reads a message when someone in the conversation reports it and sends it to us, or by court order (Marco Civil da Internet, Brazil's Internet Civil Rights Framework, art. 7, III).

Shared workouts: when you send a workout day to a friend, we keep a copy with your name, the exercises, the sets and the plan's instructions, which may reflect the limitations you entered. The sender finds out whether the friend accepted, declined or completed the workout. This copy stays on the server until you or the friend deletes their account. If the friend accepted the workout, their device keeps the workout with your name; if they put the workout in their own plan, the exercises also stay in their plan, on the server, without your name. The workout on the friend's device and the exercises in their plan remain even after you delete your account.

Community wall: it is visible to all users of the app, with the sender's name. Each user's app also receives the internal identifier of the sender's account, which does not appear on screen. The wall keeps only the most recent messages, and older ones leave on their own. Messages with offensive words are rejected and not stored. A wall message cannot be deleted in the app: yours leave when newer ones replace them or when you delete the account.

When you earn a badge, the app automatically posts a message about it on the wall, with your name, for example about a weigh-in, the water target or a conversation with the coach. The message does not show your weight or other measurements, but it states the milestone reached, such as the third weigh-in or the fifteenth workout. Workouts and weigh-ins imported from Apple Health also count toward badges. Today these posts cannot be turned off or deleted in the app: they leave when newer ones replace them or when you delete the account.

Your badges are also stored on the server and go into community statistics shown in the app, without your name.

14. Notifications

Push notifications go through Expo and Apple's notification service (APNs). They can show the sender's name and the beginning of a friend's message, up to 80 characters, as well as names of shared workouts. Messages flagged by the filter go without the excerpt. Badges and progress assessments do not trigger a push. Badges and the month's automatic assessment are recorded in the app's Central de Comunicação (Communication Center).

Meal, water, workout and check-in reminders, the end-of-rest alert and the notice of new Health app data are created on the iPhone itself and do not go through the server. They can show data from your plan on the lock screen, such as calories and protein, and how many workouts, weigh-ins, nights of sleep or days of steps arrived from the Health app. With the Suplementos junto da refeição (Supplements with meals) option on, as it comes, the first meal reminder of the day reminds you about your supplements without saying which ones (up to app version 1.6.0, it named them). Reminders that an earlier version had already scheduled with the names are replaced the first time you open the updated app.

Besides notices about friends and shared workouts, GainOS uses push only for announcements about the beta, such as a new version, changes to these documents or the end of the beta, at most 2 per month. We do not send advertising by push. You can turn off each notification category in Configurações > Notificações (Settings > Notifications), and iOS lets you turn them all off.

15. Data on your device

The app keeps a copy of your account on the iPhone, including health data, so that it works without internet. Session tokens are kept in the iOS Keychain. The rest is kept in the app's storage, protected by iOS, without additional encryption from GainOS.

These stay only on the device: progress photos and their analyses, meal thumbnails and generated illustrations, water and supplements, workout drafts and the list of comments you applied to the plan. If coach memory is on, excerpts of the comments you send to adjust the plan, applied or not, may also be kept on the server, as the Data we collect section explains.

Signing out does not delete this data from the device. Deleting the app removes almost everything, but the session stays in the iOS Keychain even after that. If you share the iPhone with someone, sign out and then delete the app.

Deleting the account in the app, under Você > Configurações > Excluir conta (You > Settings > Delete account), deletes its data stored on the iPhone where you made the deletion, including progress photos, thumbnails and the session in the Keychain. That iPhone keeps the internal code of the deleted account, without name or email, until you delete the app, so that the app deletes whatever still arrives later. Temporary copies of the photos you took or chose in the app may stay in its cache folder until iOS clears it or until you delete the app. On another iPhone signed in to the same account, the app signs out the next time it connects to the server, but the copy of the account stored on it, including health data and progress photos, stays until you delete the app on that device.

16. Voice

From app version 1.3.0, dictation uses iOS speech recognition only in the mode that works on the device itself: the transcription is done on your iPhone, and the audio is not sent to Apple or to GainOS. Only the transcribed text goes to GainOS, handled like typed text, with an indication that it was dictated. In earlier versions, iOS could process the audio on Apple's servers: update the app through TestFlight before dictating.

Dictating is optional: you can type. Before the first time, iOS asks for your permission for the microphone and speech recognition. If your iPhone cannot transcribe on the device, dictation is unavailable and you type. You can revoke it in Settings > Privacy & Security > Speech Recognition.

The transcribed text follows the rules of this policy, including being sent to the AI provider when you use an AI feature.

17. Waitlist, TestFlight and this site

Waitlist: we store name, email, state, country, type of phone (iPhone or Android), the date and source of the sign-up, the version of the documents you accepted and the consents you gave. To organize the invitations, we also store the invitation status, the invitation date and internal notes. The data is kept in a Google spreadsheet, written by a script in Google Apps Script.

We use this data to organize the batches and send the invitation. When the invitation is sent by email through TestFlight, we pass your email to Apple, which uses it only to send the invitation on our behalf. If you ask not to be contacted again, we stop. The waitlist is separate from the app account: deleting the account in the app does not delete your sign-up on it. To ask for removal, write to {{CONTACT_EMAIL}}.

Through TestFlight, Apple sends us: name and email of those invited by email, invitation status, device model, iOS version, usage sessions, crashes and how many pieces of feedback each person sent.

The feedback you send through TestFlight carries your comments, screenshots and device data: app version, time since launch, model, iOS version, battery, carrier, time zone, processor architecture, connection type, free space and screen resolution.

This site uses no cookies or trackers. The hosting, on Vercel, logs technical visit data, such as the IP address, to deliver the pages and maintain security. When you start filling in the waitlist form, even before sending it, your browser connects directly to Google (Apps Script) to prepare the submission. In this connection, Google receives technical data, such as the IP address, but not yet what you typed.

18. How long we keep data

We keep your data while your account exists, except for the time limits below. When the account is deleted, we delete the data, except what the law requires us to keep and what the What remains after deletion section describes.

• Session tokens: 60 days from the last use.
• Password recovery code: 15 minutes.
• Notification tokens: 180 days without use, or until you sign out on that device.
• Notification delivery receipts: 7 days.
• Central de Comunicação (Communication Center): each notice is deleted 90 days after its last update. The notice for a conversation with a friend is updated with each message you receive in it, so it is only deleted 90 days after the last one.
• Meal thumbnails and generated illustrations, on the device: the 60 most recent are kept, up to 30 days old. The cleanup only happens when a new thumbnail is saved; until then, older ones stay on the device.
• Meal log on the device: 90 days or 1,500 entries. The copy on the server remains.
• Exercise details cache, with the text of your limitations: up to 30 days.
• Coach memory, if you turn it on: each kept sentence is deleted on its own after 60 days (how the plan was followed), 180 days (pain and injuries, restrictions and goals) or 365 days (preferences and foods you avoid). If you repeat the sentence, the time limit starts over. At most 40 sentences are kept, and the oldest go when there are more. You can delete them earlier, one by one or all at once. Deleting the conversation the sentence came from does not delete the sentence.
• AI provider: up to 55 days, to monitor abuse.
• Routing of your AI calls to a specific model: until the date set, at most 90 days.
• Recovery emails at Resend: 30 days.
• Server technical logs: the address of each request, which contains your account identifier, with the result and the time; your email, when we send a password recovery code; and technical notices about AI answers, which may carry a calorie target or a short excerpt of the answer. The hosting keeps them for a limited period, of at most 90 days depending on the plan contracted, and then deletes them automatically.
• Waitlist: while the beta lasts, or until you ask for removal.
• Record of your acceptance on the waitlist (date, version of the documents and consents given): while you are on the waitlist and, afterwards, for as long as needed for us to prove the consent (LGPD, arts. 8, § 2, and 7, VI).
• Record of the acceptances given in the app: while the account exists; it is deleted together with it.
• Open Food Facts: keeps the IP addresses of queries for 3 years, under its own policy.

19. What has no automatic time limit yet

There is no automatic deletion yet for profile, logs, plans, Apple Health data, coach conversations, progress assessments, friendships, messages with friends, shared workouts, badges and usage events, including the technical records of each AI call, which do not keep what was asked or answered. The list of Health app weigh-ins you deleted in GainOS has no time limit either; it keeps only the date and time of each one, without values, so that they are not imported again. All of this stays while the account exists and is deleted when the account is deleted, except usage events, which lose the link to you and remain stored.

End of the beta: the beta data may be migrated to the final version of GainOS or deleted. We will let you know beforehand, with time for you to ask for a copy or for deletion before the migration.

20. What remains after deletion

Some items remain after the account is deleted:

• Usage events, without any content, such as the type of input used, whether an estimate was corrected, the response time and the technical records of each AI call. They lose the link to your account and remain stored, with no time limit.
• Workouts you shared and that a friend has already accepted. If they put them in their plan, they stay in their plan, without your name, with the exercises and the instructions, which may reflect your limitations. Their iPhone also keeps a record with your name, which appears on the workout of the week in which they accepted it.
• Push notifications already delivered to friends' iPhones, with your name and the beginning of the message, until they clear them. And the copy of the Central de Comunicação (Communication Center) kept on their device, until their app loads the notices again. On the server, the notices about you in friends' Central de Comunicação are deleted together with the account.
• The text of your limitations in the exercise cache, for up to 30 days.
• The data stored on another iPhone where you signed in with the same account, such as progress photos, history and coach conversations. Deletion clears only the iPhone where it was done: the other one loses access to the account but keeps this data until you delete the app on it. On the iPhone where you made the deletion, what stays is: temporary copies of photos in the app's cache folder, until iOS clears it or you delete the app, and the internal code of the deleted account, without name or email.
• Your friend card stored on each friend's iPhone, with your name, your email, your weight and its trend, how many workouts you did in the week and your latest workout, until their app refreshes the account. And what other people saved on their own, such as screenshots of your messages or of your friend card. We cannot delete what is on other people's devices.
• What the AI provider, the hosting, Resend, Expo, Apple and Open Food Facts have already received, which follows their own time limits. Deletion does not ask these providers to delete anything.
• Your waitlist sign-up and the record of your acceptance, which are kept outside the app: deleting the account in the app does not delete them. The acceptance record follows the time limit in the How long we keep data section. To ask for removal of your waitlist sign-up, write to {{CONTACT_EMAIL}}.

21. Security

We adopt technical and administrative measures to protect your data (LGPD, art. 46). Among them: encrypted connection (HTTPS); passwords stored only as a hash, with the argon2id algorithm (older passwords, stored with bcrypt, move to argon2id at the next login); access tokens valid for 30 minutes, with the session token replaced on each use; temporary lockout after wrong login attempts; request limits; the password asked for again to delete the account; and each account's access only to its own data.

GainOS team members with technical access can see data only when necessary for support, security, fixing bugs, reviewing a report or meeting your requests. No system is completely immune to incidents.

22. Security incidents

If there is an incident that may bring you relevant risk or harm, we notify the ANPD and you within 3 business days, counted from when we learn that personal data was affected (ANPD Resolution CD/ANPD No. 15/2024).

We will say what happened, which data was affected, the risks, the measures we took, what you can do and how to reach the data protection officer.

23. Your rights

The LGPD (art. 18) grants you, at any time, the right to:

• Confirm whether we process your data.
• Access your data.
• Correct incomplete, inaccurate or outdated data.
• Ask for the anonymization, blocking or deletion of data that is unnecessary, excessive or processed in breach of the law.
• Ask for the portability of your data to another provider.
• Ask for the deletion of the data processed based on your consent.
• Know who we share your data with.
• Know that you can refuse consent and what happens if you refuse.
• Withdraw consent.
• Ask for the review of decisions made solely on the basis of automated processing (art. 20).
• Object to processing carried out without consent, if it does not comply with the law.

24. How to exercise your rights

Write to {{CONTACT_EMAIL}}, preferably from your account's email. We may ask for a confirmation to make sure it is you. We charge nothing.

Time limits: confirmation and simplified access are immediate, and the complete statement is issued within 15 days (art. 19). We handle other requests in the shortest time possible. If we cannot fulfill a request, we explain why.

Account deletion: in the app, go to Você > Configurações > Excluir conta (You > Settings > Delete account). The app shows what will be deleted and asks for your password and one last confirmation. Deletion happens immediately and cannot be undone: we delete the account and the data the server keeps about you, including friendships, conversations with friends, shared workouts and wall messages, and the app deletes the data stored on the iPhone where you made the deletion, with the exceptions in the What remains after deletion section. Deleting the account also withdraws your consent for the AI and for the international transfer.

When the deletion in the app finishes, the app returns to the start screen, and we do not send a confirmation email. If the server cannot complete it, the app tells you that the account still exists and that part of the data may already have been deleted; just try again. You can also ask for deletion at {{CONTACT_EMAIL}}, for example if you cannot use the app: we confirm it is you, end the sessions, delete the account and the data within 15 days and let you know when it is done.

Some records can also be deleted one by one in the app: workouts, meals, weigh-ins, coach conversations (the whole conversation, not a single message), progress assessments and coach memory sentences. Without a connection, the deletion of a record reaches the server when the app reconnects; memory sentences can only be deleted with a connection. Workouts, meals and coach conversations deleted on one iPhone stay on another iPhone with the same account and can go to the AI from it; a conversation comes back to the server if you write in it on that device, and a meal does if you change it there. A deleted weigh-in leaves the screen of that other iPhone when the app is opened again on it, but that iPhone keeps a hidden copy of it until you delete the app on it or delete the account from it. Deleting a record does not change progress assessments made before, which keep the numbers from that time, and a workout imported from Apple Watch can come back if you change the period or reconnect the card.

If you are not satisfied, you can petition Brazil's National Data Protection Authority (ANPD) and contact consumer protection agencies.

25. Minors

GainOS is only for people aged 18 or over. The app does not verify age. The statement that you are 18 or over is made by ticking the box accepting the terms: at waitlist sign-up or, since app version 1.6.0, when creating the account or, for those who already had an account, on the O combinado (The deal) screen.

If we learn that an account belongs to someone under 18, we close the account and delete the data. If you know of such a case, write to {{CONTACT_EMAIL}}.

26. Changes to this policy

Each version of this policy has a number, shown at the top. When we change something relevant, we let you know in the app or by email before the change takes effect.

If the change affects a consent, we will ask again and you will be able to refuse (art. 8, § 6). The waitlist sign-up and, since version 1.6.0, the app record the version you accepted, and we keep the previous versions.

27. Contact

Controller: GainOS LLC. Data protection officer: {{DPO_NAME}}. Email: {{CONTACT_EMAIL}}.