Get The Work Done Privacy Policy

Last updated: 27 October 2026

Who we are

Get The Work Done (GTWD) is a workout planning, tracking and analytics app for iPhone. For the purposes of the EU and UK General Data Protection Regulation (GDPR), the data controller is GTWD, the publisher of this app.

You can reach us about anything in this policy at gtwdapp@gmail.com. A postal address is available on request from that address.

At a glance

• We do not track you. There is no advertising, no third-party analytics, no data broker and no cross-app or cross-site tracking in GTWD.
• We do not collect your name or email address. Sign in with Apple is configured to ask for neither.
• Your workouts stay on your device and in your own private iCloud account. We, the developers, cannot read them.
• The only code in the app that is not Apple's or ours is GRDB.swift, an open-source local database library. It sends nothing anywhere.
• The one thing we operate ourselves is a small account service that exists so that you can delete your account and revoke Sign in with Apple. It stores an opaque identifier and a token, nothing about your training.

What we process, why, and on what legal basis

Each item below names the data, what it is used for, and the legal basis under GDPR Article 6.

• Workout and fitness data — the sets, reps, weights, reps-in-reserve, rest times, durations and sessions you log. Used to run the app: logging, progression and your history and analytics. Basis: performance of our contract with you (Art. 6(1)(b)).
• Names you type — routine, program and custom exercise names. Used to show you your own plan. Basis: contract (Art. 6(1)(b)).
• Sign in with Apple identifier — an opaque, app-specific user ID that Apple issues; it is not your Apple ID email. Used to sign you in and to keep your data yours. Basis: contract (Art. 6(1)(b)).
• Account-service token — a refresh token that Apple issues at sign-in, held by our account service so that it can revoke Sign in with Apple when you delete your account, as Apple requires. Basis: contract (Art. 6(1)(b)).
• IP address — seen by our account service when you sign in or delete your account, and counted for sixty seconds to limit abuse to five attempts per minute. Basis: our legitimate interest in keeping the service available and abuse-free (Art. 6(1)(f)).
• App preferences — your unit (kg or lb) and whether reps-in-reserve is shown. Stored only on your device. Basis: contract (Art. 6(1)(b)).
• Apple Health — completed workouts written to Health if, and only if, you allow it. Basis: your consent (Art. 6(1)(a)), which you can withdraw in iOS Settings at any time.
• Notifications — a local rest-timer alert if you allow notifications. Basis: your consent (Art. 6(1)(a)).

We do not profile you and we make no automated decisions about you that have legal or similarly significant effects (Art. 22).

Where your data is stored

• On your device. GTWD keeps your data in a local SQLite database inside the app's own container, so the app works fully offline and a logged set is saved before anything else happens.
• In your private iCloud database. Your data syncs to the private database of your iCloud account through Apple's CloudKit service. It is tied to your Apple Account, protected by Apple's account security, and we have no access to it. Apple's handling of iCloud is described in Apple's Privacy Policy.
• The built-in exercise library ships inside the app. It is reference content and contains no personal data.

Sign in with Apple and the account service

GTWD uses Sign in with Apple and nothing else to sign you in. We request neither the name nor the email scope, so Apple shares neither with us.

When you sign in, the app sends the one-time authorization Apple issued to our account service, which exchanges it with Apple for a refresh token. The service stores that token, keyed by your Sign in with Apple identifier, for exactly one purpose: when you delete your account, it asks Apple to revoke your sign-in, so that GTWD disappears from your Apple Account's list of apps using Sign in with Apple.

The service records your identifier in its logs when you sign in or delete your account. It never logs the token. It counts sign-in attempts per IP address for sixty seconds to limit abuse; those counters expire on their own.

The service is hosted on Cloudflare's platform (see "Who receives your data").

Apple Health

If you allow it, GTWD writes each completed workout to Apple Health: the workout type, its duration and, when the app has it, active energy. The app only writes; it never reads anything from Health. Health data is governed by Apple Health and your device settings, not by us, and you can withdraw access at any time in iOS Settings, under Privacy & Security, then Health.

Notifications

• Rest-timer alert. If you allow notifications, the app schedules a local notification on your device when a rest period ends. It is created and shown by your iPhone and never leaves it.
• Silent sync pushes. Apple's servers send the app silent background pushes to tell it that your iCloud data changed. They contain no content, are shown to nobody, and only prompt the app to sync.

Who receives your data

We do not sell, rent or share your personal data. Two companies process data on our behalf, as our processors, to provide the app:

• Apple — Sign in with Apple, CloudKit (your private iCloud database), Apple Health and push notifications. See Apple's Privacy Policy.
• Cloudflare — hosting and key-value storage for our account service. See Cloudflare's Privacy Policy.

There are no advertising or analytics providers.

International transfers

Our account service runs on Cloudflare's global network, so your Sign in with Apple identifier, the refresh token and your IP address may be processed in a country other than your own, including outside the European Economic Area and the United Kingdom. Those transfers are covered by Cloudflare's Data Processing Addendum, which incorporates the European Commission's Standard Contractual Clauses and the UK Addendum. Where your iCloud data is stored is governed by Apple and your Apple Account.

How long we keep your data

• Your workouts, plans and preferences — on your device and in your iCloud until you delete them, either item by item in the app or all at once by deleting your account.
• The refresh token — until you delete your account, when it is used to revoke your sign-in and then removed.
• IP address counters — sixty seconds.
• Account-service logs — for a short period under Cloudflare's standard log retention, after which they are discarded.

Security

Everything the app sends travels over TLS. The database on your device is protected by your iPhone's device encryption and by the app's private container; your iCloud data is protected by Apple's account security. The private key that lets our account service talk to Apple's Sign in with Apple servers is held only on that service and never ships inside the app.

Your rights

Under GDPR you have the right to access your personal data, to have it corrected, to have it erased, to restrict or object to its processing, to receive it in a portable form, and to withdraw consent at any time without affecting what was done before. Because your data lives on your own device and in your own iCloud account, most of these you exercise directly:

• Access and portability — everything you have logged is on your device and in your iCloud, readable in the app.
• Correction — every set, session, routine, program and custom exercise can be edited in the app.
• Erasure — delete any item in the app, or delete everything with Settings, then Delete Account, which erases the local database, your private iCloud data for this app, and revokes Sign in with Apple.
• Withdraw consent — turn off Apple Health or notifications for GTWD in iOS Settings.
• The account service holds only your identifier and the refresh token. Write to gtwdapp@gmail.com to receive a copy of that record, to have it erased, or to object to its processing, and we will respond within one month.

You also have the right to lodge a complaint with your local data protection authority.

Children

GTWD is not directed at children under 13 and, in the European Union and the United Kingdom, not at anyone below the age of digital consent in their country, which ranges from 13 to 16. We do not knowingly collect personal data from children. If you believe a child has created an account, write to gtwdapp@gmail.com and we will delete it.

Changes and contact

When this policy changes, the "Last updated" line at the top changes with it, and material changes are announced in the app. Questions, requests and complaints go to gtwdapp@gmail.com; a postal address is available on request.