Strong privacy has a cost, and it is fair to say it plainly. GymAI uses no key escrow: it keeps no recovery copy of your key and no operator key. That is what makes your sealed data unreadable to us. It also means we cannot open it for you if you lose access.
GymAI is not open yet. We are explaining the trade-off now, so you can weigh it before you sign up.
What key escrow is, and why we left it out
Key escrow means someone other than you keeps a copy of the key that unlocks your data, usually so they can restore it when you forget a password. It is convenient. It also means that someone can open your data, and so can anyone who gets hold of their copy.
For most settings that trade is acceptable. For notes about your pain and your body, we decided it was not.
What it protects
Your body measurements, pain history, reasons for missing a session and custom activities are sealed with your key. Nobody at GymAI, and nobody at your gym, can read them. If our servers were ever breached, those fields would be unreadable too.
Only those four kinds of data are sealed. Your training history, the sets and weights you log, is protected by access control in our code rather than by your key. We do not claim we cannot read it.
What you could lose, and what you would not
- If you lost every device and every recovery code, the sealed data would be gone for good.
- Your training history is not in that sealed set, so it would come back at your next sign-in.
How recovery codes help
Recovery codes are there for a lost device. Keep them somewhere safe, away from your phone, and losing a phone becomes an inconvenience instead of a loss. We think that trade is worth it for data about your pain and your body.
Simple habits that keep you safe
- Store your recovery codes when you first get them, not later.
- Keep them away from the device they are meant to replace, for example on paper at home or in a password manager you trust.
- If you replace a phone, sign in on the new one before you wipe the old one.
Frequently asked questions
Can GymAI support reset my sealed data?
No. With no key escrow and no operator key, there is nothing for us to unlock it with. Your recovery codes are the way back.
Will I lose my workouts if I lose everything?
No. Training history is not in the sealed set, so it comes back at your next sign-in.
Do other fitness apps work this way?
Of the 41 competitors we checked, not one declares end-to-end encryption.
Want a fitness app that takes this seriously? Join the GymAI waiting list.
No comments yet
Nobody has written anything here. You can be the first.