Last updated: July 2026
GTAM Sculpt is operated by Robert Boyd, sole proprietor, trading as Greater Than Anything Me / GTAM Sculpt. Data Controller: Robert Boyd · Toppåsveien 25, 1352 Kolsås, Norway Contact: privacy@gtamsculpt.com
We collect the information you provide during onboarding including your name, age, fitness goals, and training preferences. We collect workout data including exercises, sets, reps, weight, and session notes. We collect nutrition data, sleep data, mood data, and body measurements that you log. If you enable Sun & UV tracking (a separate, opt-in feature you consent to explicitly), we also collect your sun exposure sessions, duration, UV index, skin type, and any SPF/protection details you log, so we can estimate your UV dose, give burn-risk and vitamin D guidance, and show your tanning history. We collect your date of birth to verify you are 16 or older. We collect your email address for account authentication and your payment and billing information when you purchase a membership.
In addition to data stored on our servers, some information is stored locally in your browser or device to make the app work smoothly, including your authentication session, display preferences, and a cached snapshot of today's tracked stats (e.g. steps, water) and recently searched foods. Some of this locally-stored information is health-adjacent, but it stays on your device and is not shared with third parties. See our Cookie & Local Storage Policy for the full technical breakdown.
We process your personal data under the following legal bases: • Account creation, authentication, core app functionality — Performance of a contract • Workout, nutrition, sleep, and body measurement data you log — Performance of a contract • Age verification (date of birth) — Legal obligation and contract performance • AI coaching responses (text sent to Anthropic) — Performance of a contract • Lifestyle & Habit tracking (alcohol, smoking, substances, late nights) — Your explicit consent (special-category data) • Marketing emails, where you opt in — Your consent (withdrawable at any time) • Service improvement and debugging — Legitimate interest; never applied to special-category data You may withdraw consent-based processing at any time without affecting the lawfulness of processing carried out before withdrawal.
If you use Voice Logging, your device's built-in speech recognition converts your speech to text directly on your device. We do not record, upload, or store audio. Only the resulting text (for example "100kg, 8 reps") is used to fill in your log. Your voice audio never leaves your device and is never sent to our servers or to any third party.
The nutrition tracker includes an optional barcode scanner. When you tap the barcode icon, the app requests access to your device's rear camera (video only — no audio) using your browser's standard camera API to read product barcodes. The camera feed is shown only while the scanner is open and is used solely to detect barcodes on screen. We do not record, store, upload, or transmit any camera images or video — barcode detection happens on your device in real time, and the camera stream is stopped as soon as you close the scanner. You can deny or revoke camera access at any time in your device or browser settings; the scanner is optional and you can always add foods manually. Once a barcode is detected, the barcode number is sent to Open Food Facts to look up the product's nutrition information. If no match is found, an AI estimate may be provided (clearly labelled).
We use your data to generate and update your AI training plan, provide coaching responses, process your membership purchase and billing, track your progress, and improve the app experience. We do not sell your data to anyone.
We share limited data with the following third parties, only as needed to operate the app: • Supabase — our database provider, which stores your account and app data. • Anthropic — processes the text of your messages to the AI coach to generate coaching responses (text only, never audio), and may generate AI-estimated nutrition information when a barcode has no match. • Shopify — processes your membership purchase, billing, and subscription management. Shopify receives your name, email, and payment information when you subscribe. Shopify's own privacy policy governs how they handle payment data; you can review it at shopify.com/legal/privacy. • Resend — sends transactional emails on our behalf (purchase confirmations, account notifications, coaching check-in alerts). Resend receives your email address and the content of the email sent to you. • Open Food Facts — provides nutrition information when you scan a barcode. • ZXing — an on-device barcode-reading library; no data is sent to ZXing or any external server as part of scanning. We do not sell your data to anyone, and we do not share your data with any third party for advertising purposes.
Your account data, health data, and app content are stored on servers located in the European Union (AWS eu-north-1, Stockholm, Sweden) and remain within the EEA. When you use the GTAM Coach feature, the text of your messages (never audio, and never Lifestyle & Habit data unless you have explicitly included it in a message) is sent to Anthropic, PBC, a company based in the United States, for the purpose of generating your coaching response. This constitutes a transfer of personal data outside the European Economic Area. This transfer is safeguarded by Standard Contractual Clauses approved by the European Commission, incorporated into our data processing agreement with Anthropic, which impose GDPR-equivalent obligations on how your data is handled. You may request a copy of the relevant safeguard documentation by emailing privacy@gtamsculpt.com.
If you use Friends, Groups, Group Challenges, or Head-to-Head features, other users you connect with may see your display name, workout activity, and performance stats relevant to that feature. You control who you connect with. Groups. Inside a group you have joined, the group comparison view shows other members of that group a summary of your daily nutrition (calories, protein, carbs, fat, sugar, and number of meals logged today), your weekly average calories and protein, your sleep hours, and your water intake, alongside your workout and activity stats. Only members of the same group can see this, and only for as long as you are a member of that group. If you do not want these stats shared, leave or do not join the group. Never shared. Your mood logs, Lifestyle & Habit data (alcohol, smoking, substances, late nights), Sun & UV logs, body measurements, individual food-log entries and food notes, coach conversations, and your journal/session notes are never shown to other users through any of these features.
An account owner can add other individuals — for example family members — to their account as sub-profiles on a Joint Account. Each person on a Joint Account is treated as a separate data subject with their own profile and their own consent record. Minors (16-17). When a sub-profile for a 16- or 17-year-old is created, the account owner must confirm that they are that person's parent or legal guardian and give consent on the minor's behalf at the moment the profile is created. This is recorded as guardian consent, with a timestamp and the identity of the consenting owner, against the minor's own profile. Adults (18 or over). An owner may add an adult to the account, but the owner cannot consent on that adult's behalf. The profile is created in a pending state and only becomes active once that individual completes their own onboarding and gives their own consent. Under 16. Sub-profiles for anyone under 16 years of age cannot be created and are not permitted. Separate consent records. Every consent — guardian consent for a minor, or an adult's own consent — is recorded separately and tied to that individual's profile, not to the account owner's profile. Legal basis. Processing of personal data for a sub-profile is based on consent under GDPR Article 6(1)(a) — given by the individual themselves, or by their parent/guardian where the individual is 16 or 17. Health and other special-category data is processed on the basis of explicit consent under GDPR Article 9(2)(a). Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal. Your rights. The rights described in this policy — access, correction, deletion, export, withdrawal of consent, and the right to lodge a complaint with Datatilsynet or your own national supervisory authority — apply individually to every person on a Joint Account, not only to the account owner. A minor's rights may be exercised by them or by their parent/guardian. Deletion. If the account owner deletes the Joint Account, every sub-profile on it is deleted, together with all data logged under those profiles (workouts, nutrition, body measurements, trackers and related records). This happens immediately, is permanent, and cannot be undone. Removing a single sub-profile deletes that person's profile and their logged data in the same way. The owner's own profile and data are unaffected. Records of consent are retained as an audit log, no longer linked to a deleted profile. If you are on someone else's Joint Account and want your data deleted, or want it deleted before the owner acts, contact privacy@gtamsculpt.com
You have the right to access your data, correct inaccurate data, delete your data, export your data, and withdraw consent at any time. To exercise these rights go to Settings > Privacy or email privacy@gtamsculpt.com
If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with a supervisory authority. In Norway, this is: Datatilsynet (The Norwegian Data Protection Authority) · Postboks 458 Sentrum, 0105 Oslo, Norway · www.datatilsynet.no If you are located in another EU/EEA country, you may also lodge a complaint with your own country's data protection authority. We would welcome the opportunity to address your concerns directly first, at privacy@gtamsculpt.com.
Data processing is handled by Lovable Labs Inc. in accordance with GDPR requirements. Your data is stored on servers located in Stockholm, Sweden (AWS eu-north-1), within the European Economic Area. Active accounts. Your data is retained for as long as your account remains active. We do not automatically delete accounts for inactivity — your data stays until you delete it or ask us to. Account deletion. When you delete your account via Settings > Privacy > Delete My Account, your personal data is deleted immediately upon confirmation, except where we are legally required to retain certain records for longer, such as billing records required under Norwegian accounting law (typically 5 years). Backups. Deleted data may persist in encrypted backups for up to 30 days before being permanently purged, consistent with our backup rotation schedule.
You can delete your account and all associated data at any time from Settings > Privacy > Delete My Account. Deletion happens immediately upon confirmation, is permanent, and cannot be undone. Note that Shopify may retain transaction records as required by financial and tax law even after account deletion, in accordance with Shopify's own data retention policies. Purchase records. Your purchase and order records (order number, amount, date, and the email used at checkout) are kept by us as accounting records required under Norwegian accounting law (typically 5 years). They are unlinked from your profile at deletion, so they can no longer be associated with your account, and Shopify separately retains transaction records under its own retention policies.
This app uses essential cookies only for authentication and session management. No advertising or tracking cookies are used. See our Cookie Policy for details.
Barcode scanning powered by ZXing. Product data from Open Food Facts. When Open Food Facts has no usable match, an AI estimate (Anthropic Claude) may be generated from the food name you entered — clearly labeled as an estimate and editable before saving.
If you choose to enable Lifestyle tracking, you may log daily entries about alcohol, smoking/vaping, an 'other substance use' yes/no flag, caffeine, and late nights. This is GDPR Article 9 special-category health data. It is collected only when you explicitly opt in (off by default), stored per-account and protected by row-level security, used only to surface your personal correlations with sleep, recovery, and training, and never shared with third parties, other users, or used for advertising. It is included in your data export and is permanently deleted when you turn lifestyle tracking off or delete your account.
GTAM Sculpt is not directed at, and may not be used by, anyone under 16 years of age. We do not knowingly collect personal information from anyone under 16. If we learn that we have collected personal information from someone under 16, we will delete it promptly. If you believe a user under 16 has provided us with personal information, please contact privacy@gtamsculpt.com.
We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification before they take effect.
privacy@gtamsculpt.com Greater Than Anything Me Norway