Last updated: 2 November 2026
Simple Gym (“the app”, “we”, “us”) is a workout-tracking app published by ThinkWorks SIA, which trades as King Digital. This policy explains what data the app collects, how it is used, and the choices you have.
ThinkWorks SIA, a company registered in Latvia and trading as King Digital, is the data controller for the personal data described in this policy. You can reach us about anything in it at thinkworkssia@gmail.com.
We do not use third-party crash reporters. Crash and performance diagnostics are handled by Apple’s on-device MetricKit only.
| What we do | Legal basis (GDPR Art. 6, and Art. 9 where marked) |
|---|---|
| Create and secure your account, store and sync your training history, and provide Premium | Performance of our contract with you (Art. 6(1)(b)) |
| Store fitness, body-weight and body-measurement data, which can be health-related | Your explicit consent (Art. 9(2)(a)), which you can withdraw by deleting the data or your account |
| Show and measure ads in the free version, and personalise them where allowed | Your consent (Art. 6(1)(a)), collected through Google’s consent form and, on iOS, App Tracking Transparency |
| Product analytics (Amplitude) | Your consent (Art. 6(1)(a)) |
| Send local reminders and progress nudges (notifications you can turn off in your device settings) | Your consent, given through the notification permission (Art. 6(1)(a)) |
| Anonymous tap map, used to improve the layout of screens | Not personal data once stored, since it is aggregated on arrival and holds no identifiers |
| Keep the service secure, prevent abuse, and troubleshoot faults (server logs) | Our legitimate interest in running a secure service (Art. 6(1)(f)) |
The free version of the app displays ads served by Google AdMob. Google acts as an independent controller of the advertising data it collects. Ads may be personalized (based on your advertising identifier and inferred interests) or non-personalized, depending on your choices:
Who receives advertising data. Ads are not served by Google alone. If you consent, Google and the advertising partners listed in the consent form may store and read identifiers on your device and use them to select, deliver and measure ads. The full list of those partners, and a per-purpose and per-partner choice, is inside the form itself under “Manage options”. If you decline, ads are non-personalised and that sharing does not happen.
Learn how Google uses data from apps that use its services: policies.google.com/technologies/partner-sites. Google’s privacy policy: policies.google.com/privacy.
On iPhone we use Amplitude as our product-analytics provider, to see which parts of the app people actually use. Amplitude acts as our processor and stores this data in its European Union region.
Amplitude’s privacy policy: amplitude.com/privacy.
Our server and our Amplitude project are both in the European Union. Google may process advertising data outside the EEA, including in the United States, under the European Commission’s Standard Contractual Clauses and its own transfer safeguards, as set out in Google’s privacy policy.
We keep your account and fitness data for as long as your account exists. You can delete your account from within the app at any time; this permanently removes your account, the fitness data stored on our server, and your server-stored profile photo. You can also request deletion at kingdigital.lv/apps/simple-gym/delete-account without installing the app.
Progress photos live only on your device and are removed when you delete them or uninstall the app, unless you turned on iCloud or Google Drive photo backup, in which case a copy stays in your private iCloud or Google Drive until you delete it (in the app, from your iCloud storage in iOS Settings, or under Manage apps in Google Drive’s settings). Server access logs are kept for up to one month and then rotated away. Analytics and advertising data held by Amplitude and Google is retained under their own policies.
Under the EU and UK GDPR you have the right to access your personal data, to correct it, to receive a copy in a portable format, to have it deleted, and to object to or restrict certain processing. Where we rely on your consent, you can withdraw it at any time without affecting what was done before you did.
If you think we have handled your data badly, you can complain to your local data protection authority. In Latvia, where we are based, that is the Data State Inspectorate (Datu valsts inspekcija), www.dvi.gov.lv.
Account access uses token-based authentication. Progress photos and custom-exercise images are encrypted on your device. Data in transit is protected with HTTPS.
The app is not directed to children under 13 (or the minimum age required in your country, for example 16 in parts of the EEA), and we do not knowingly collect their data. If you believe a child has given us personal data, email us and we will delete it.
We may update this policy from time to time. Material changes will be reflected by the “Last updated” date above.
Questions about this policy or your data? Email us at thinkworkssia@gmail.com.
If you use Simple Gym in the Republic of Korea, the Personal Information Protection Act (PIPA) and the Act on Promotion of Information and Communications Network Utilization and Information Protection also apply. This section adds what they require. Where it differs from the sections above, it is what applies to you.
Information we process, why, and for how long. We process the information below without separate consent where it is needed to provide the service you asked for (PIPA Art. 15(1)4), and only for these purposes:
| Information | Purpose | Kept until |
|---|---|---|
| Email address, Apple or Google sign-in identifier, display name, @username, profile photo | Creating and protecting your account; showing your profile to friends you connect with | You delete your account |
| Age, sex, height, training goal and days, units, notification choices, device region, language and time zone | Setting up your program; sending notices at the right time, in your language | You delete your account |
| Workouts, exercises, sets, repetitions and weights | Keeping your training log and progress on all your devices | You delete them or your account |
| Push notification token | Sending the notifications you allowed | You sign out or delete your account |
| IP address and request details in server logs | Security and fixing problems | 1 month |
Sensitive information. Body weight and body measurements can be information about health, which PIPA treats as sensitive. We keep them in your account only with your separate consent. The app asks for it when you sign in and tells you what they are used for (showing your progress and syncing it across your devices) and how long they are kept (until you delete them or your account). You can refuse: without an account, they stay on your device. You can withdraw your consent by deleting the data or your account.
Children. In Korea, Simple Gym is for people aged 14 and over, and the app asks your age when you start. We don’t knowingly process the personal information of a child under 14 without a legal guardian’s consent. If you believe a child under 14 has given us information, email us and we’ll delete it.
Processing we entrust to others. These companies process personal information for us, only on our instructions: Hetzner Online GmbH (hosting our servers), Apple Inc. (delivering notifications on iPhone), Google LLC (delivering notifications on Android through Firebase Cloud Messaging) and Amplitude, Inc. (product analytics on iPhone, only once you allow tracking).
Transfers outside Korea. Simple Gym is run from Latvia, so your information is processed outside Korea. We transfer it as needed to provide the service, as set out here:
| Recipient (contact) | Country | Information | When and how | Purpose | Kept until |
|---|---|---|---|---|---|
| Hetzner Online GmbH (data-protection@hetzner.com) | Finland (servers); company in Germany | Account, profile, workout and body data, push token, server logs | When you sign in and each time the app syncs, over an encrypted connection | Storing your data on our servers | You delete your account (logs: 1 month) |
| Apple Inc. (apple.com/legal/privacy/contact) | United States | Push token and notification text | When we send a notification, over an encrypted connection | Delivering notifications on iPhone | Under Apple’s policy |
| Google LLC (policies.google.com/privacy) | United States | Push token and notification text; in the free version, the advertising ID and the device and usage information Google’s ad SDK collects | When we send a notification; when the free version shows ads | Delivering notifications on Android; showing and measuring ads | Under Google’s policy |
| Amplitude, Inc. (privacy@amplitude.com) | United States (data stored in the EU) | App events, device and app version | While you use the app, on iPhone, once you allow tracking | Understanding how the app is used | Under Amplitude’s policy |
To refuse a transfer, don’t use the feature it serves: use the app without an account, turn notifications off in your device settings, refuse or turn off tracking on iPhone (Settings › Privacy & Security › Tracking), or buy Premium, which removes ads. The rest of the app keeps working.
Automatically collected information. The app doesn’t use web cookies. In the free version, Google’s AdMob SDK reads your device’s advertising ID and collects information about your app use and ad interactions (behavioral information) to show and measure ads, and to personalise them where allowed. To refuse: on iPhone, turn off Settings › Privacy & Security › Tracking; on Android, delete your advertising ID in Settings › Google › Ads. Premium removes ads and the ad SDK entirely.
App permissions. The app needs no permission to work. It asks for these optional ones only when you use the feature, and works without them. On iPhone: camera (progress photos), adding to Photos (saving images), notifications (reminders) and tracking (personalised ads). On Android: notifications (reminders) and access to the app’s own hidden folder in your Google Drive (photo backup).
Advertising messages. We don’t send advertising push notifications to users in Korea. Notifications about your own training (workout reminders, progress check-ins, streaks and the like) are service notices. You can turn each kind off in Profile › Notifications, or all of them in your device settings.
Destroying information. When information is no longer needed, or when you delete it or your account, we delete it without delay in a way that can’t be restored.
Security. Access to our servers is limited to the people who run Simple Gym and uses key-based logins. Data travels over encrypted connections (HTTPS), passwords are stored only as one-way hashes, and progress photos are encrypted on your device and never reach our servers.
Your rights. You, your legal representative or someone you authorize can ask to see, correct or delete your personal information or to stop its processing, and can withdraw consent at any time, in the app or by email at thinkworkssia@gmail.com. We reply within 10 days.
Privacy officer. Our privacy officer, who also handles complaints: ThinkWorks SIA, thinkworkssia@gmail.com.
Getting help. For help with a privacy problem you can also contact the Personal Information Dispute Mediation Committee (1833-6972, www.kopico.go.kr), KISA’s Personal Information Infringement Report Center (118, privacy.kisa.or.kr), the Supreme Prosecutors’ Office (1301, www.spo.go.kr) or the Korean National Police Agency (182, ecrm.police.go.kr).