Last updated: 11 October 2026
GTAM Sculpt is operated by Robert Boyd, sole proprietor, trading as Greater Than Anything Me / GTAM Sculpt. Data Controller: Robert Boyd · Toppåsveien 25, 1352 Kolsås, Norway Contact: privacy@gtamsculpt.com
We collect the information you provide during onboarding including your name, age, fitness goals, and training preferences. We collect workout data including exercises, sets, reps, weight, and session notes. We collect nutrition data, sleep data, mood data, and body measurements that you log. If you enable Sun & UV tracking (a separate, opt-in feature you consent to explicitly), we also collect your sun exposure sessions, duration, UV index, skin type, and any SPF/protection details you log, so we can estimate your UV dose, give burn-risk and vitamin D guidance, and show your tanning history. We collect your date of birth to verify you are 16 or older. We collect your email address for account authentication and your payment and billing information when you purchase a membership.
In addition to data stored on our servers, some information is stored locally in your browser or device to make the app work smoothly, including your authentication session, display preferences, and a cached snapshot of today's tracked stats (e.g. steps, water) and recently searched foods. Some of this locally-stored information is health-adjacent, but it stays on your device and is not shared with third parties. See our Cookie & Local Storage Policy for the full technical breakdown.
We process your personal data under the following legal bases: • Account creation, authentication, core app functionality — Performance of a contract • Workout, nutrition, sleep, and body measurement data you log — Performance of a contract • Age verification (date of birth) — Legal obligation and contract performance • AI coaching, AI-generated plans and nutrition estimates, and workout-plan imports (logged metrics, daily habits, message text, transcribed voice text, pasted plan text, and plan photos/PDFs sent to Anthropic) — Your explicit consent, given in the app or on the website before any data is sent (withdrawable at any time in Settings) • Apple Health / Health Connect daily summaries, and the optional averages summary sent to Anthropic for the Coach — Your explicit consent (special-category data), given in the app (withdrawable at any time in Settings) • Lifestyle & Habit tracking (alcohol, smoking, substances, late nights) — Your explicit consent (special-category data) • Marketing emails, where you opt in — Your consent (withdrawable at any time) • Service improvement and debugging — Legitimate interest; never applied to special-category data You may withdraw consent-based processing at any time without affecting the lawfulness of processing carried out before withdrawal.
If you choose to connect, the GTAM Sculpt phone app reads three kinds of data from Apple Health (iPhone) or Health Connect (Android): daily step count, sleep duration and body weight. We only read. We never write anything to your health app. Reading happens when you open or return to the app, never in the background. On first connection we read up to the last 30 days. • What we store: one daily summary per day (steps, minutes of sleep, weight), the date, which health app it came from, and when it was synced. We do not store raw samples, heart rate, location or any other health type. • How we use it: to show these values in your Steps, Sleep and Weight trackers. Challenges and streaks still use what you log yourself. • AI Coach (optional): only if you turn on "Let Coach use my health app data" and have AI data processing turned on, the Coach receives a short summary of averages (for example average steps and sleep over 7 and 30 days, and your latest weight). The summary is sent to Anthropic (Claude AI) only to generate your Coach replies. Anthropic automatically deletes inputs and outputs within 30 days by default, unless the law requires them to be kept longer or the content is flagged for misuse. Anthropic does not use this data to train its models. No day-by-day values are sent, only averages and your latest weight. This switch is off by default. • Legal basis: your explicit consent (special-category health data), given in the app at Connect before your phone's permission request (18+ only), and separately when you turn on the Coach switch. You can withdraw either at any time in Settings → Privacy. • Sharing: health-app data is never sold, never used for advertising and never used to train AI models. It is not shared with friends, groups or challenge partners. • Retention: synced data is kept until you delete it in Settings or delete your account. • Deleting: "Delete synced data" in Settings removes all synced values immediately. Deleting your account removes them too. To stop access completely, also revoke GTAM Sculpt's access in Apple Health or Health Connect. • Use of information received from Health Connect follows the Health Connect Permissions policy, including the Limited Use requirements.
If you use Voice Logging, your device's built-in speech recognition converts your speech to text directly on your device. We do not record, upload, or store audio. Your voice audio never leaves your device and is never sent to our servers or to any third party. Only the resulting text transcript (for example "100kg, 8 reps") is used — to fill in your log and, only if you have given your explicit consent in the app's AI Data Privacy prompt, as an input to AI coaching processed by Anthropic (see "Third parties we share data with").
The nutrition tracker includes an optional barcode scanner. When you tap the barcode icon, the app requests access to your device's rear camera (video only — no audio) using your browser's standard camera API to read product barcodes. The camera feed is shown only while the scanner is open and is used solely to detect barcodes on screen. We do not record, store, upload, or transmit any camera images or video — barcode detection happens on your device in real time, and the camera stream is stopped as soon as you close the scanner. You can deny or revoke camera access at any time in your device or browser settings; the scanner is optional and you can always add foods manually. Once a barcode is detected, the barcode number is sent to Open Food Facts to look up the product's nutrition information. If no match is found, an AI estimate may be provided (clearly labelled).
We use your data to generate and update your AI training plan, provide coaching responses, process your membership purchase and billing, track your progress, and improve the app experience. We do not sell your data to anyone.
We share limited data with the following third parties, only as needed to operate the app: • Supabase — our database provider, which stores your account and app data. • Anthropic (Claude AI) — with your consent in the app, processes your logged metrics (workouts, sets, body measurements, nutrition, sleep, recovery), your daily habits, the text of your messages to the AI coach, and transcribed text from voice logging (never audio) to generate coaching insights, training and meal plans, and nutrition estimates. If you turn on the Coach health switch, a short summary of averages (steps and sleep) and your latest weight is also sent to Anthropic, never day-by-day values. It also processes workout-plan photos, PDFs, or pasted text you choose to import. Plan photos, PDFs, and pasted plan text are processed in memory to extract your plan and are never stored by us. Anthropic does not use API inputs to train its models. Anthropic automatically deletes inputs and outputs within 30 days by default, unless the law requires them to be kept longer or the content is flagged for misuse. • Lemon Squeezy — our membership billing provider and Merchant of Record. Lemon Squeezy hosts checkout, processes your payment, handles EU VAT/OSS, and manages your subscription lifecycle. Lemon Squeezy receives your name, email, and payment information when you subscribe; review their privacy policy at lemonsqueezy.com/legal/privacy. • Shopify — operates our merch store only (apparel and physical goods). When you buy merch, Shopify receives your name, email, and payment information for that order. Shopify's own privacy policy governs how it handles that data; review it at shopify.com/legal/privacy. • Resend — sends transactional emails on our behalf (purchase confirmations, account notifications, coaching check-in alerts). Resend receives your email address and the content of the email sent to you. • Sentry — error monitoring, EU-hosted, no personal data by default. Sentry receives technical crash and error diagnostics (error message, stack trace, page URL, browser and operating system type). We do not send your name, email, user ID, or any health or fitness data to Sentry. • Open Food Facts — provides nutrition information when you scan a barcode. • ZXing — an on-device barcode-reading library; no data is sent to ZXing or any external server as part of scanning. We do not sell your data to anyone, and we do not share your data with any third party for advertising purposes.
Your account data, health data, and app content are stored on servers located in the European Union (AWS eu-north-1, Stockholm, Sweden) and remain within the EEA. When you use the GTAM Coach feature, the text of your messages (never audio, and never Lifestyle & Habit data unless you have explicitly included it in a message) is sent to Anthropic, PBC, a company based in the United States, for the purpose of generating your coaching response. If you turn on the Coach health switch, a short summary of averages (steps and sleep) and your latest weight is also sent to Anthropic, never day-by-day values. The same applies when you import a workout plan: the photo, PDF, or pasted text you choose to submit is sent to Anthropic for one-time processing to extract your plan. We never store these files or images ourselves — only the extracted plan (exercises, sets, and reps) is saved to your account. Anthropic does not use API inputs to train its models. Anthropic automatically deletes inputs and outputs within 30 days by default, unless the law requires them to be kept longer or the content is flagged for misuse. This constitutes a transfer of personal data outside the European Economic Area. This transfer is safeguarded by Standard Contractual Clauses approved by the European Commission, incorporated into our data processing agreement with Anthropic, which impose GDPR-equivalent obligations on how your data is handled. You may request a copy of the relevant safeguard documentation by emailing privacy@gtamsculpt.com.
If you use Friends, Groups, Group Challenges, or Head-to-Head features, other users you connect with may see your display name, workout activity, and performance stats relevant to that feature. You control who you connect with. Groups. Inside a group you have joined, the group comparison view shows other members of that group a summary of your daily nutrition (calories, protein, carbs, fat, sugar, and number of meals logged today), your weekly average calories and protein, your sleep hours, and your water intake, alongside your workout and activity stats. Only members of the same group can see this, and only for as long as you are a member of that group. If you do not want these stats shared, leave or do not join the group. Never shared. Your mood logs, Lifestyle & Habit data (alcohol, smoking, substances, late nights), Sun & UV logs, body measurements, individual food-log entries and food notes, coach conversations, and your journal/session notes are never shown to other users through any of these features.
An account owner can add other individuals — for example family members — to their account as sub-profiles on a Joint Account. Each person on a Joint Account is treated as a separate data subject with their own profile and their own consent record. Minors (16-17). When a sub-profile for a 16- or 17-year-old is created, the account owner must confirm that they are that person's parent or legal guardian and give consent on the minor's behalf at the moment the profile is created. This is recorded as guardian consent, with a timestamp and the identity of the consenting owner, against the minor's own profile. Adults (18 or over). An owner may add an adult to the account, but the owner cannot consent on that adult's behalf. The profile is created in a pending state and only becomes active once that individual completes their own onboarding and gives their own consent. Under 16. Sub-profiles for anyone under 16 years of age cannot be created and are not permitted. Separate consent records. Every consent — guardian consent for a minor, or an adult's own consent — is recorded separately and tied to that individual's profile, not to the account owner's profile. Legal basis. Processing of personal data for a sub-profile is based on consent under GDPR Article 6(1)(a) — given by the individual themselves, or by their parent/guardian where the individual is 16 or 17. Health and other special-category data is processed on the basis of explicit consent under GDPR Article 9(2)(a). Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal. Your rights. The rights described in this policy — access, correction, deletion, export, withdrawal of consent, and the right to lodge a complaint with Datatilsynet or your own national supervisory authority — apply individually to every person on a Joint Account, not only to the account owner. A minor's rights may be exercised by them or by their parent/guardian. Deletion. If the account owner deletes the Joint Account, every sub-profile on it is deleted, together with all data logged under those profiles (workouts, nutrition, body measurements, trackers and related records). This happens immediately, is permanent, and cannot be undone. Removing a single sub-profile deletes that person's profile and their logged data in the same way. The owner's own profile and data are unaffected. Records of consent are retained as an audit log, no longer linked to a deleted profile. If you are on someone else's Joint Account and want your data deleted, or want it deleted before the owner acts, contact privacy@gtamsculpt.com
You have the right to access your data, correct inaccurate data, delete your data, export your data, and withdraw consent at any time. To exercise these rights go to Settings > Privacy or email privacy@gtamsculpt.com
If you believe we have not handled your personal data in accordance with GDPR, you have the right to lodge a complaint with a supervisory authority. In Norway, this is: Datatilsynet (The Norwegian Data Protection Authority) · Postboks 458 Sentrum, 0105 Oslo, Norway · www.datatilsynet.no If you are located in another EU/EEA country, you may also lodge a complaint with your own country's data protection authority. We would welcome the opportunity to address your concerns directly first, at privacy@gtamsculpt.com.
Data processing is handled by Lovable Labs Inc. in accordance with GDPR requirements. Your data is stored on servers located in Stockholm, Sweden (AWS eu-north-1), within the European Economic Area. Active accounts. Your data is retained for as long as your account remains active. We do not automatically delete accounts for inactivity — your data stays until you delete it or ask us to. Account deletion. When you delete your account via Settings > Privacy > Delete My Account, your personal data is deleted immediately upon confirmation, except where we are legally required to retain certain records for longer, such as billing records required under Norwegian accounting law (typically 5 years). Backups. Deleted data may persist in encrypted backups for up to 30 days before being permanently purged, consistent with our backup rotation schedule.
You can delete your account and all associated data at any time from Settings > Privacy > Delete My Account. Deletion happens immediately upon confirmation, is permanent, and cannot be undone. Note that Lemon Squeezy may retain membership transaction records as required by financial and tax law even after account deletion, in accordance with Lemon Squeezy's own data retention policies, and Shopify may retain merch-order transaction records under its own policies. Purchase records. Your purchase and order records (order number, amount, date, and the email used at checkout) are kept by us as accounting records required under Norwegian accounting law (typically 5 years). They are unlinked from your profile at deletion, so they can no longer be associated with your account. Lemon Squeezy separately retains membership transaction records under its own retention policies, and Shopify retains merch-order transaction records under its own policies.
This app uses essential cookies only for authentication and session management. No advertising or tracking cookies are used. See our Cookie Policy for details.
Barcode scanning powered by ZXing. Product data from Open Food Facts. When Open Food Facts has no usable match, an AI estimate (Anthropic Claude) may be generated from the food name you entered — clearly labeled as an estimate and editable before saving.
If you choose to enable Lifestyle tracking, you may log daily entries about alcohol, smoking/vaping, an 'other substance use' yes/no flag, caffeine, and late nights. This is GDPR Article 9 special-category health data. It is collected only when you explicitly opt in (off by default), stored per-account and protected by row-level security, used only to surface your personal correlations with sleep, recovery, and training, and never shared with third parties, other users, or used for advertising. It is included in your data export and is permanently deleted when you turn lifestyle tracking off or delete your account.
GTAM Sculpt is not directed at, and may not be used by, anyone under 16 years of age. We do not knowingly collect personal information from anyone under 16. If we learn that we have collected personal information from someone under 16, we will delete it promptly. If you believe a user under 16 has provided us with personal information, please contact privacy@gtamsculpt.com.
We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification before they take effect.
privacy@gtamsculpt.com Greater Than Anything Me Norway