Privacy Policy.

1. Data Controller

The controller of your personal data is:

Tomasz Guziak
ul. Sandomierska 13/120, 26-611 Radom, Poland
Tax ID (NIP): 9482630105
Email: support@gryndapp.com

2. Information We Collect

To provide our services, we collect the following data:

• Account: Email address and authentication data. If you use external login options (Apple, Google), we receive your identifier and email address (which may be a proxy address if you use Apple's "Hide My Email" feature).
• Training data: Training plans, exercises, sets, repetitions, body weight, and measurements that you manually enter into the application.
• AI Interactions: Your chat messages and conversation logs with the AI assistant (see Section 5).
• Subscription data: Anonymous user identifier and purchase history necessary to manage access to premium features.
• Diagnostic data: Application crash reports and performance data, in anonymized form.
• Push notifications: Device token required to send training reminders.

3. Legal Basis for Processing

We process your data based on the following legal grounds (GDPR):

• Account and authentication data: Art. 6(1)(b) — necessary for the performance of a contract (providing the service).
• Training data: Art. 6(1)(b) — necessary for the performance of a contract (training personalization).
• AI Interactions: Art. 6(1)(a) — explicit user consent (in-app opt-in before first use of AI chat).
• Subscription data: Art. 6(1)(b) — necessary for the performance of a contract (providing premium features).
• Diagnostic data: Art. 6(1)(f) — legitimate interest of the controller (ensuring application stability).
• Push notifications: Art. 6(1)(a) — user consent (system permission prompt).

4. Use of Data

Your data is used exclusively for the following purposes:

• Ensuring proper application functionality and maintaining your account.
• Personalizing your training experience, including artificial intelligence features.
• Sending notifications related to your training schedule.
• Processing and managing subscription purchases.
• Diagnosing and fixing technical issues.
• Providing technical support.

Your data is not used to train artificial intelligence models.

5. Artificial Intelligence (AI) Features

The Application offers an optional AI assistant that generates personalized suggestions and analyses based on your data, as well as automated content moderation. Use of this feature requires explicit consent, which you may grant or withdraw at any time in the Settings.

After granting consent, the content of your messages is transmitted to external AI service providers for the purpose of generating responses and automated content moderation. These providers operate under data processing agreements (Art. 28 GDPR) and are obligated not to process your data for purposes other than providing the service.

AI-generated suggestions are informational only and do not replace professional medical advice (see Section 10). You may report concerns or errors regarding AI responses at any time using the "Report" button available next to each AI message in the chat, or by contacting us at support@gryndapp.com — your report will be reviewed by a human.

6. Data Recipients (Sub-Processors)

Your data is shared with the following sub-processors acting under data processing agreements:

• Supabase Inc. — cloud infrastructure (EU-region database): account, training data, chat history.
• RevenueCat Inc. — premium subscription management.
• OpenRouter Inc. — gateway providing access to artificial intelligence models (only after consent is granted).
• OpenAI OpCo LLC — automated moderation of content sent to AI (only after consent is granted).
• Functional Software Inc. dba Sentry — application error and performance diagnostics.
• Apple Inc. — App Store, Sign in with Apple, and push notification delivery (APNs).
• Google LLC — Sign in with Google, Google Play, and semantic embeddings for exercise search (Gemini API).

AI models accessed via OpenRouter may be hosted in various jurisdictions outside the European Union — see Section 8 for details. The current list of specific data processors may change — material changes will be announced in the application and via the "Last updated" date of this Policy.

7. Data Security

Your primary data (account, training, chat history) is stored on cloud infrastructure located in the European Union. We apply rigorous access policies (Row Level Security), ensuring that only you have access to your personal training data. All communication between the application and servers is encrypted using HTTPS/TLS protocol.

We do not sell, rent, or share your data with third parties for marketing purposes.

8. International Data Transfers

Your data may be transferred to third countries outside the European Union / European Economic Area. Such transfers are conducted pursuant to Standard Contractual Clauses (SCCs) approved by the European Commission under Art. 46(2)(c) GDPR, ensuring an adequate level of data protection.

When using AI features, the content of your messages may be processed in various countries depending on the AI model selected through OpenRouter. To the extent that data may be transferred to countries not covered by a European Commission adequacy decision, the transfer is based on your explicit consent (Art. 49(1)(a) GDPR) given in the application before first use of the AI chat. You acknowledge that the level of data protection in those countries may be lower than in the EU. You may withdraw your consent at any time in the application Settings.

9. Data Retention Period

• Account and training data: Retained for the duration of your use of the application.
• AI chat history: Retained for the duration of your use of the application; you can delete it manually at any time.
• Content moderation logs: Retained for 90 days for safety purposes.
• Diagnostic data: Retained for up to 90 days for application stability analysis.
• After account deletion: All personal data is permanently deleted within 30 days, except for information required by tax and accounting laws (regarding subscription purchases), retained according to applicable legal requirements.

10. Medical Disclaimer (AI Disclaimer)

The AI coach features generate training suggestions based solely on the data you provide. They are educational and informational in nature only. They do not constitute professional medical advice, diagnosis, or treatment. Always consult a physician before starting a new diet or training plan. You use the application at your own risk.

11. Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the following rights:

• Right of access — you may obtain information about your processed data (Art. 15).
• Right to rectification — you may correct inaccurate data (Art. 16).
• Right to erasure — "right to be forgotten" (Art. 17).
• Right to restriction of processing (Art. 18).
• Right to data portability — you may receive your data in a machine-readable format (Art. 20) — available from within the application Settings.
• Right to object to processing (Art. 21).
• Right to withdraw consent for AI data processing at any time (Settings → AI Consent in the application).
• Right to lodge a complaint — you may file a complaint with the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl, or with the supervisory authority in your country of residence (if you reside in another EU member state).

To exercise any of these rights, contact us at: support@gryndapp.com. We will respond within 30 days.

12. Account Deletion

You have full control over your data. You can permanently delete your account and all associated training logs and AI conversations directly from within the application (Profile → Settings → Delete Account). Deletion is irreversible.

13. Children and Minors

The Application is intended for users who are at least 13 years old. If you reside in the European Economic Area and are under 16, parental or legal guardian consent is required to use the Application (Art. 8 GDPR). If we discover that an account has been created by a person below the applicable age without the required consent, it will be deleted.

14. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy. We will notify you of material changes (e.g., expansion of data processing scope, new processing purposes, new categories of recipients) via in-app notification or the email address associated with your account, with reasonable advance notice. Editorial or clarifying changes take effect upon publication of the updated version on this page with a new update date. Continued use of the Application after changes are published constitutes acceptance of those changes.

15. Governing Law

This Privacy Policy is governed by the laws of the Republic of Poland and the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).