Privacy Policy

Who we are

ReelGainz is made by ReelGainz LLC, a Utah limited liability company, 7533 S Center View Ct R, West Jordan, UT 84084, United States. We are the controller of the personal data described on this page: we decide why and how it is used.

People and authorities in every country where ReelGainz is offered can reach us at privacy@reelgainz.com. Our legal representative is the manager of ReelGainz LLC, at the same address.

What we collect

This is everything that reaches us.

• An account — only if you create one. With Sign in with Apple we receive an Apple account ID and an email address (you can choose Hide My Email). With Sign in with Google we receive a Google account ID and your email address; Google also sends your name and picture, which our database discards on arrival. With an email code we receive the email address you type. We never receive a password. Our database gives every account a profile row with the display name "Athlete" and a plan row. If you ask for a code and never use it, the address is deleted after about 24 hours.
• Your age stays on your phone. The app asks your age, or reads the age range Apple or Google provides where the law requires it. The answer stays on your phone as "adult" and is never sent to us.
• Your agreements. When you create an account we record that you agreed to the account notice and the Terms (versions, language, whether you use iPhone or Android, app version, the time on your phone when you tapped, and the time it reached us), and later Terms updates and when you started or stopped sharing. The record carries your account ID and nothing about your workouts. Before you have an account, your I agree is kept only on your phone.
• Discover. When Discover opens, the app asks our database for the community list and which reels were removed; when you add a reel, it asks whether our database holds ready-made moves for it. The database sees your IP address and the reel links asked about; the request carries no account.
• Community sharing — optional, with an account. Only if you turn on Share with the community: the links of the Instagram reels you add, with the short label shown on their Discover card, and your star ratings (one 1–5 rating per reel, which you can change or remove), stored against your account. When you paste a reel into the iPhone app and Discover already holds a shared list of moves for it, the app also sends that same list back once, unchanged, so the shared copy stays current — it is Discover's list, never anything you typed. The Android app records only workouts you add from Discover. A reel you share into either app from Instagram, the sample workouts, routines you add from Discover and videos from your phone are never recorded. Without sharing, none of this is sent and your stars stay on your phone.
• Reports you send. The reel's link, the reason you picked and your account, so we can review it. Sending a report from the app needs an account; you can also email one to us.
• Sign-in codes. Our email provider, Resend, sends the code to your address and keeps the message and a delivery log for up to 30 days.
• Emails you send us. support@, privacy@ and copyright@ are Google Workspace mailboxes; we keep those emails and our replies for 3 years.
• A plan record, but nothing about your purchase. Apple or Google sell and bill the subscription, and the app checks it on your phone. The apps send us nothing about your purchase, we run no server that receives purchase notifications, and we never see your card number, billing address or payment details. Our database creates a plan row for every account: a plan label that starts as "trial", the time the account was created, a count of added reels that starts at zero, and an empty "Pro since" date. The apps never change that row, so it does not show whether you subscribed.
• A beta email address, only if you gave one to this website's beta sign-up, together with the time you pressed the button. To stop one connection signing up over and over, the sign-up also keeps, for about an hour, a hash of your IP address mixed with a secret value that only we hold, in a separate table that neither the app nor visitors to this website can read. We use it only to count sign-ups from one connection.
• Technical data. When the app talks to our database, it sees your IP address and what each request asked for, as any server does. Our database provider keeps request logs, including IP addresses, for up to 7 days, and uses them to run the service and stop abuse. We do not use them to build a picture of you.

Videos you add from your phone are copied into the app's own storage on your device and stay there. They are never uploaded to us or to anyone. They are left out of your iCloud backup on iPhone, and out of Google's backup and phone-to-phone transfer on Android — so a workout restored onto a phone arrives without its video and says so. They are deleted when you delete the workout or your account.

What we do not collect: your workout history. Sets, reps, weights, session logs, moves, notes, tags, routines and streaks are written to a file on your phone and are never sent to us; we cannot read them. No workout log reaches us — not what you lifted, how long you held a move or how hard it felt — and the app reads nothing from Apple Health or Health Connect. We also collect no location, no contacts, no photos, no advertising identifier, no date of birth and no phone number.

Your phone's own backup is a different matter. The app does not keep your workout library, your age answer or your agreements out of your phone's backup (iCloud on iPhone, Google on Android), so they can travel with that backup, which lives in your Apple or Google account, not ours. Videos you added from your phone are left out, and your sign-in never moves to another phone with it. A restored or reinstalled app is signed out; signing in again reconnects the same account.

Workout reminders are local notifications that your phone schedules for itself, at the days and time you pick. There is no push server: no reminder ever passes through us, and we never receive a device token.

How we use it, and the legal basis

We use personal data for six purposes: Discover's community reads, your account, community sharing, keeping Discover safe (reports, moderation, the word filter, blocks and rate limits), keeping records of what you agreed to and of blocks, and answering your emails and rights requests. The laws of the countries where ReelGainz is offered each ask for a legal basis for these uses. Here is ours, country by country.

Costa Rica (Ley 8968)

• Discover's community reads (your IP address): your consent, given when you tap I agree in the app (art. 5).
• Your account: your consent on the sign-in step (art. 5).
• Community sharing: your consent.
• Reports, moderation, the word filter, blocks and rate limits: your consent on the sign-in step.
• Records of what you agreed to, and block hashes: your consent on the sign-in step.
• Answering your emails and rights requests: your consent (you wrote to us).

Panama (Ley 81 and Executive Decree 285)

• Discover's community reads: necessary for the service you asked for (Ley 81 art. 6.2).
• Your account: our contract with you (Ley 81 art. 6.2).
• Community sharing: your consent (DE 285 arts. 17.1, 18).
• Reports, moderation, the word filter, blocks and rate limits: legitimate interest (DE 285 art. 17.7).
• Records of what you agreed to, and block hashes: legitimate interest (DE 285 art. 17.7).
• Answering your emails and rights requests: legitimate interest.

Chile until 30 November 2026 (Ley 19.628)

• Every purpose above: your consent (art. 4) — for Discover's community reads, the consent you give with I agree; for the account, reports, moderation and records, the consent on the sign-in step; for community sharing, the consent you give when you turn it on; for emails, the consent of writing to us.

Chile from 1 December 2026 (Ley 21.719)

• Discover's community reads: our contract with you (art. 13(c)).
• Your account: our contract with you (art. 13(c)).
• Community sharing: your consent (art. 12).
• Reports, moderation, the word filter, blocks and rate limits: legitimate interest (art. 13(d)).
• Records of what you agreed to, and block hashes: legitimate interest and the defence of claims (art. 13(d), (e)).
• Answering your emails and rights requests: legitimate interest, and our legal duty to answer (art. 11).

United States, Honduras and Bolivia. We apply the same bases and the same protections as above.

The legitimate interests we rely on are keeping Discover free of abuse, enforcing blocks, proving what people agreed to, and defending claims. We weighed them against your rights and keep a written note of that assessment.

Automatic decisions: two, and nothing else. A block we placed after reviewing reports is applied again to a new account that uses the same Apple, Google or email identity. Text containing a word on our blocked list isn't shown to others. Ask for a person to review either at support@reelgainz.com.

We do no profiling. We do not sell personal data, we do not share it with data brokers, and we do not use it for advertising. The beta list is used only to send the invite you asked for, with your consent, which you can withdraw by replying to any email or writing to privacy@reelgainz.com.

Who processes it for us

These providers process data on our instructions, under data-processing agreements, and may not use it for their own purposes — except Apple, Google and Meta, which act under their own terms, as described.

• Supabase — our database, authentication and request logs; United States; processor. Holds your account, its email address and sign-in identities, your profile and plan rows, your agreement records, any reports, what you share with the community, the beta list and its short-lived IP hashes, and the records of any block we placed.
• Resend — sends sign-in codes and our own moderation alerts; United States; processor; keeps messages and delivery logs for up to 30 days.
• Google Workspace — the support@, privacy@ and copyright@ mailboxes; United States; processor.
• Cloudflare — hosts this website and serves its pages. Sees your IP address and the pages you request, as any web host does; it sets no cookies here and we have its analytics switched off.
• Apple and Google — sell and bill the subscription and, when you choose them, let you sign in; each is its own controller under its own privacy policy. They send us neither your payment details nor a record of your purchase.
• Meta — the Instagram embed that plays reels; an independent controller (see Instagram content below).

Supabase and Resend run on Amazon Web Services in the United States, which acts as their sub-processor. No AI service is involved.

We will disclose personal data if the law requires it, or to protect the rights and safety of our users or ourselves. If ReelGainz is ever acquired or merged, your data would transfer with it, and this policy would continue to apply until changed as described under Changes.

How we protect it

The apps talk to our database only over HTTPS. Your sign-in session is kept in the iPhone's keychain, locked to that phone, and on Android in storage encrypted with a key held in the Android Keystore that never leaves the phone. Our database's access rules let an account change only its own rows, refuse community writes without the agreements they need, let an account read only its own agreement records, and keep reports, block records and beta emails where no app can read them. The key built into the apps and this website is the public one; the key that can read everything is in neither.

Ratings & community

Discover shows totals: how many people added a reel and the average of its ratings, worked out afresh each time the list loads. Your individual rating is never shown to anyone else, and no other person's is shown to you. A reel's title and creator label are shown only when at least two accounts gave the same one. Your account ID and email address are not displayed anywhere in the app — there are no public profiles, followers or messages.

If our database holds an exercise list for a reel's link, the app can use it to pre-fill that reel when you add it. A list you build yourself is never sent to us.

Moderation

Discover starts with a library of workouts we picked, and shows the most-added and top-rated reels from other members as the community grows. That second part is user-generated content, and we moderate it. We filter blocked words and review reports within 24 hours.

• Only an Instagram link, with at most a short title and creator label, can reach Discover: the apps accept nothing but a link to an Instagram post, and our database rejects any other link, any over-long label and any label containing a word on our blocked list. There are no photos, comments, messages or profiles to post, and how much one account can add, rate or report in an hour is capped.
• Every workout card in Discover has a button that lets you hide the workout, or report it as inappropriate, spam, a broken video, or something else.
• Hiding is instant on your phone — the reel leaves your Discover, whatever we decide. The hidden list is kept on your phone only, and deleting your account clears it, so a reel you hid can reappear.
• Reporting also hides the reel and, if you are signed in, sends it to us with your account. Without an account you can email the reel's link to support@reelgainz.com. We review every report within 24 hours and either remove the reel from Discover for everyone or keep it.
• Reports are kept after review so repeat problems are visible — except those filed by an account we blocked, which are deleted with its other contributions. If you delete your account, your reports stay in the queue with nothing linking them to you.
• We can block an account that breaks the rules. A blocked account can no longer add, rate or report anything; its adds, ratings, reports and shared exercise lists are deleted. To stop the same person signing up again, we keep the blocked account's ID, the date, a short reason, and a keyed hash of each Apple or Google account ID and email address it used — pseudonymised data, which still counts as personal data even though it cannot be read back — for up to 5 years unless we lift the block earlier, including after the account is deleted.
• Our own notes on a moderation case say what the problem was, never who reported it, and are deleted 5 years after the decision.

Instagram content

ReelGainz never copies, downloads or re-hosts a reel. Reels play through Instagram's own embed, served by Instagram, inside the app. That means watching a reel in ReelGainz involves Meta the same way watching it in a web browser does: Instagram's servers see that the reel was requested, and Instagram may set cookies inside the app's isolated web view, exactly as a browser would allow. We do not control what Meta does with that information; it is governed by Meta's privacy policy. Meta is an independent controller of that data, not our processor.

The app clears every cookie, cache and stored item the embed left behind when you delete your account, so none of it is left behind.

We never read a reel — not its caption, not its video, not the page it sits on — and we ask Meta nothing about it. The app stores the link you gave it and plays the post through Instagram's own embed, which carries the creator's name, picture and a tap through to their profile exactly as Instagram draws them. If you type a creator's handle onto a workout yourself, your phone keeps it so the credit stays with the workout; it is not sent to us.

Building a workout

The exercises, sets and reps in a workout are the ones you typed or picked from the app's built-in list of common moves, or the ones we wrote for a workout from our starter library. Nothing reads the reel's caption and nothing analyses its video — not on your phone, not on our servers, and no AI service is involved at any point. Your moves are written to a file on your phone and are never sent to us.

The one thing that can come the other way: if our database holds an exercise list for a reel you add, the app uses it as a starting point, as described under Ratings & community.

Cookies & tracking

This website sets no cookies and uses no analytics, no advertising pixels, no social-media buttons and no third-party fonts or scripts. Nothing on it tracks you, which is why you see no cookie banner: there is nothing to consent to. The only request the page makes beyond loading itself is when you press the beta button, which sends your email to our database.

The apps use no analytics or advertising SDKs. The Instagram embed inside the player may set Meta's cookies within the app's isolated web storage, as described above; those are kept in the app's own web storage, separate from your phone's browser, and are wiped on account deletion. If we ever add advertising or analytics, we will update this page first, ask for the permission your platform requires (including Apple's App Tracking Transparency prompt), and update the App Store and Google Play data disclosures to match.

Your choices and withdrawing consent

• An account is optional. Without one, everything but rating reels for everyone and sending reports works, and nothing reaches us but Discover's reads and, when you add a reel, the check for ready-made moves.
• Sharing is optional. Settings → My account → Stop sharing (in both modes) stops it at once and deletes what you shared: the reels you added to Discover's counts, your stars and any move lists you shared.
• Signing out stops everything tied to your account; deleting the account removes it.
• Withdrawing is free, as easy as agreeing, and does not affect processing already done (Costa Rica Ley 8968 art. 5.2; Panama DE 285 art. 19; Chile Ley 21.719 art. 12).
• Not agreeing to the Terms in the app sends nothing and saves nothing; the app can't be used without them.

Keeping & deleting data

You can delete your account and everything attached to it from inside the app, without asking anyone:

• iPhone or Android, either mode: Settings → My account → Delete my account (at the bottom), then Delete my account on the next screen, and confirm with Delete everything.
• If you are signed out: the same screen asks you to sign in first so it can find your account; if you never made one, Erase this phone only erases what is on the phone.
• If you aren't subscribed (your subscription ended, or you never started one): the subscription screen the app shows you has Delete my account and everything saved.

There is also a path that needs no app: reelgainz.app/delete-account.

Deleting removes your account and its sign-in identities, your profile and plan rows, the reels you added, your ratings and the move lists you shared from our database straight away. Reports you filed stay, with nothing linking them to you. On your phone it erases your library, routines, history, the videos you added from your phone, your ratings, hidden reels, the embedded player's storage and your reminders; your settings, such as mode and appearance, stay. The app does not create a new account afterwards. Deleting your account does not cancel a subscription: cancel it in your App Store or Google Play subscription settings.

How long we keep things:

• Account data (your account, email address, profile and plan rows, and what you shared): until you delete the account. Nothing deletes an account you stop using, so it stays until you delete it or ask us to.
• Addresses typed for a code and never used: 24 hours.
• Records of what you agreed to: while you have an account and 3 years after you delete it.
• Block records and their hashes: up to 5 years.
• Reports: kept so repeat problems stay visible, with nothing linking them to you once you delete your account; deleted if we block the account that filed them.
• Moderation case notes: 5 years after the decision.
• Counts and ratings averages: Discover works them out from the rows above each time, so once your sharing stops they no longer include you.
• Exercise lists we wrote for the starter reels: indefinitely; they hold nothing about you.
• Database backups: up to 7 days. Backups are never used to restore an individual account.
• Request logs, including IP addresses: up to 7 days.
• Sign-in code emails at Resend: up to 30 days.
• Support and privacy emails, and our replies: 3 years.
• Beta emails: until you ask us to remove yours. The beta sign-up's IP hashes: about an hour.

Where data is stored — international transfers

All of it is stored in the United States by our processors. Costa Rica: Supabase, Resend and Google are processors acting on our instructions, not transfers to third parties (Reglamento art. 40). Panama: the transfer is necessary for our relationship with you and protected by our processors' data-processing agreements (Ley 81 art. 33; DE 285 arts. 51, 53). Chile: protected by those agreements' contractual clauses (Ley 19.628 arts. 27–28). You can ask us for a copy of the relevant safeguards.

Your rights and how to use them

You have the right to access your personal data, to correct it, to have it deleted, to object to its use, to receive it in a portable format, to withdraw any consent you gave, and in Chile to blocking (bloqueo — we suspend processing while we decide on your request). Deleting your account and stopping sharing are built into the app; everything else is by email to privacy@reelgainz.com, free of charge. Write from the email address on your account so we can find it, or tell us how you signed in.

• Costa Rica: we answer within 5 business days (Ley 8968 art. 7). You can complain to PRODHAB (Agencia de Protección de Datos de los Habitantes).
• Panama: we give you the information within 10 business days and make a correction within 5 (Ley 81 arts. 16–17). You can complain to ANTAI (Autoridad Nacional de Transparencia y Acceso a la Información).
• Chile: until 30 November 2026, we answer within 2 business days (Ley 19.628 art. 16), and if we don't, you can take your request to the civil courts. From 1 December 2026, we answer within 30 calendar days, extendable once, and act on a blocking request within 2 business days (Ley 21.719 arts. 8 ter, 11); you can then complain to the Agencia de Protección de Datos Personales.
• Honduras, Bolivia and the United States: we apply the same rights and answer within 5 business days.

We keep a copy of each request and our reply for 3 years. We answer even when we hold nothing about you.

If you are in California (or another US state with a comprehensive privacy law), you also have the right to know what we collect and how it is used, and to be free from discrimination for exercising your rights. We do not sell personal information and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of. We do not use sensitive personal information other than to provide the service. You may designate an authorised agent to make a request on your behalf; we will verify the request the same way.

Children and age

ReelGainz is only for adults: 18 or older, or 21 or older in Puerto Rico. The app stops anyone younger before anything is sent, and never creates an account for them. It is not directed to children, and we do not knowingly collect personal information from anyone under 13 (COPPA) or under the minimum age. If you believe a minor has an account, write to privacy@reelgainz.com and we'll delete it.

If something goes wrong

If a security breach puts your data at risk, we tell the people affected and the authorities where the law requires it — in Panama within 72 hours, in Costa Rica within 5 business days, in Chile without undue delay.

Changes

Material changes are shown in the app, and you're asked to agree before they apply to you; earlier versions are linked below.

• Version 2026-10-11, in effect from 11 October 2026 (this version): reelgainz.app/privacy/v/2026-10-11

Contact us

Privacy questions and requests: privacy@reelgainz.com. Anything else: support@reelgainz.com or reelgainz.app/support.

Post: ReelGainz LLC, 7533 S Center View Ct R, West Jordan, UT 84084, United States.