This draft describes what the DNA Gym AI app does with information, based on the current product. It has not been legally reviewed.
Information you provide
The app can store the email address and password you use to create an account, your name, date of birth, sex, training goal, units, and body measurements you enter (such as weight, height, body fat and related measurements). Workout sessions, sets, reps, loads, exercise notes, custom workouts, programs and cardio sessions you log are stored for your account.
Sign-in providers
Email and password accounts are handled by Supabase Auth. On iPhone the app can also offer Sign in with Apple. Google sign-in is offered where that provider is configured. The app receives the identity those providers return so it can keep your account and training data together.
Health data
On iPhone, if you connect Apple Health, DNA Gym AI can read body weight, body fat percentage, height, heart rate, active energy and workouts. On Android, if you connect Health Connect, it can read weight, body fat, height, heart rate, active calories and exercise sessions. The app uses those reads to fill measurements you choose to import and to attach energy or cardio to training when the data is available. Health data is stored with your account in Supabase and on the device. It is not sold and it is not used for advertising. It is not sent to a separate AI service. Programs are generated on the device from the exercise library.
Invitations and email
An invitation administrator can prepare an account for an email address. A newly prepared account receives a temporary password in an email sent from DNA Gym AI by a server-side Resend function. That password is not stored in the app's database. Existing accounts are not given a new password. Password reset and signup confirmation emails are sent by Supabase Auth through its configured mail provider.
Where data is processed
Account and training data are stored in Supabase. Exercise demonstration media may be loaded from a Cloudflare R2 address configured for the app. Invitation email is sent through Resend from the server, not from the phone. The app does not include a third-party analytics or advertising SDK in the current source.
Retention and deletion
Data remains until you delete it in the app or delete your account. Delete account, in the signed-in Account section, asks the server to delete the signed-in Auth user. Related profile, workout, program, measurement, cardio, health-connection and entitlement rows are removed by database cascade. A copy can remain on a device until that device signs out and clears local data, which the delete action also requests. Invitation records created for other people are not a copy of your workouts.
Your choices
You can sign out, disconnect Apple Health or Health Connect, decline those permissions, and delete your account. You can choose not to enter optional measurements.
Contact
For privacy questions, email support@dnagymai.com. Do not send personal information to noreply@dnagymai.com.