Privacy Policy.

1. Data Controller

The controller of your personal data is:

Tomasz Guziak
ul. Sandomierska 13/120, 26-611 Radom, Poland
Tax ID (NIP): 9482630105
Email: support@gryndapp.com

2. Information We Collect

To provide our services, we collect the following data:

• Account: Email address and authentication data. If you use external login options (Apple, Google), we receive your identifier and email address (which may be a proxy address if you use Apple's "Hide My Email" feature).
• Training data: Activities, training plans, exercises, sets, repetitions, body weight, measurements, and notes that you enter into the application.
• Outdoor activity data (optional): When you record an outdoor workout (e.g., running, cycling, walking), we record the route and movement parameters (GPS location, distance, pace, elevation gain). This data is collected only for the duration of the recorded session, after you start it, including while the screen is off, and is used to present the course of your workout (map, segments, records) and — in a processed, summarized form — for optional analysis by AI features (see Section 5). We store the route recording as part of your workout history; you can delete it together with the workout or your account.
• Nutrition data: The meals and products you log, their nutritional values, your nutrition goals, and water intake. To make logging easier, the application allows, among other things, analysis of a meal photo, barcode scanning (product lookup in the public Open Food Facts database), and product search in our product database. Nutrition data may be processed by AI features (see Section 5). We do not store meal photos — we process them in real time solely for analysis.
• Health and activity data (optional): If you choose to connect the app to your system health store (Apple Health on iOS / Health Connect on Android) or directly to a measurement device (e.g., a watch or heart-rate strap via Bluetooth), we read selected recovery and effort indicators such as heart rate, heart rate variability (HRV), respiration, oxygen saturation (SpO2), sleep, and steps. Given their nature, we treat them as a special category of data (health data). The connection is entirely voluntary, requires a separate permission in the Apple/Google system prompt, and you can disable it at any time. These indicators are used solely to present a general overview of your activity and well-being and for an optional, informational and motivational AI analysis — they are not used for medical, diagnostic, treatment, or health-monitoring purposes.
• Content submitted for analysis (optional): Photos or short videos that you choose to upload for analysis by AI features (e.g., exercise technique, posture, equipment). We do not store them — we process them in real time solely to generate the analysis.
• AI Interactions: Your chat messages and conversation logs with the AI assistant, and the generated analyses (see Section 5).
• Subscription data: User identifier and purchase history necessary to manage access to premium features.
• Diagnostic data: Application crash reports and performance data, in anonymized form.
• Push notifications: Device token required to send notifications about workouts and analyses.

3. Legal Basis for Processing

We process your data based on the following legal grounds (GDPR):

• Account and authentication data: Art. 6(1)(b) — necessary for the performance of a contract (providing the service).
• Training data: Art. 6(1)(b) — necessary for the performance of a contract (training personalization).
• Outdoor activity data (location): Art. 6(1)(b) — performance of a contract (workout recording); and where, combined with heart rate, it reveals information about health — Art. 9(2)(a) (explicit consent).
• Nutrition data: Art. 6(1)(b) — performance of a contract (keeping a nutrition diary); processing by AI features — Art. 6(1)(a) (consent to AI features).
• Health data: Art. 9(2)(a) — explicit consent (given its classification as a special category of data). We process it only after you voluntarily connect a device, and for the optional AI analysis under the same consent to AI features. You may withdraw consent at any time.
• Content submitted for analysis and AI Interactions: Art. 6(1)(a) — explicit consent to AI features (in-app opt-in before first use).
• Subscription data: Art. 6(1)(b) — necessary for the performance of a contract (providing premium features).
• Diagnostic data: Art. 6(1)(f) — legitimate interest of the controller (ensuring application stability).
• Push notifications: Art. 6(1)(a) — user consent (system permission prompt).

4. Use of Data

Your data is used exclusively for the following purposes:

• Ensuring proper application functionality and maintaining your account.
• Personalizing your training and nutrition experience, including artificial intelligence features.
• Presenting a general overview of your activity and well-being and periodic AI analyses (after you connect a device and give consent).
• Sending notifications related to your workouts and analyses.
• Processing and managing subscription purchases.
• Diagnosing and fixing technical issues.
• Providing technical support.

Your data is not used to train artificial intelligence models.

5. Artificial Intelligence (AI) Features

The Application offers optional AI features that operate in two modes:

• In-chat assistant — answers your questions and, at your instruction, performs tasks in the application (e.g., logs meals, goals, workouts, checks your data).
• Automated overviews and summaries — periodically prepares an overview of a selected area of your activity (e.g., sleep, nutrition, workouts, or overall) for a given period and presents it as a summary.

AI features may also analyze photos or videos that you upload. The scope, frequency, and subject matter of the analyses may change and evolve over time.

Use of AI features requires explicit consent, which you may grant or withdraw at any time in the Settings. Features that do not use AI operate independently of this consent.

After granting consent, the relevant data (the content of your messages, selected training, nutrition, and health data, and uploaded media) is transmitted to external artificial intelligence model providers based in the United States (see Sections 6 and 8), solely to deliver those features. These providers are contractually obligated to: (a) not process your data for purposes other than providing the service, (b) not use it to train models, and (c) not retain the content of your queries longer than necessary — some providers apply a zero-retention principle, while others may retain content for a short period solely to detect abuse, after which it is deleted. We do not store uploaded photos or videos.

AI features are based on your data (profiling within the meaning of Art. 4(4) GDPR) and are advisory and informational in nature only — we do not make automated decisions producing legal effects concerning you or similarly significantly affecting you within the meaning of Art. 22 GDPR. Final decisions always remain yours.

AI-generated suggestions and analyses are not medical advice, a diagnosis, or an assessment of your health and do not replace consultation with a physician (see Section 10). You may report concerns or an erroneous AI response at any time using the "Report" button available next to AI responses, or by contacting us at support@gryndapp.com — your report will be reviewed by a human.

6. Data Recipients (Sub-Processors)

We entrust your data to the following categories of sub-processors, acting under data processing agreements:

• Cloud infrastructure and email providers — data storage (database in the European Union region), handling of support requests and data exports.
• Artificial intelligence model providers — processing of content, data, and media (text, image, voice) through AI features; based in the United States (see Section 8). Only after consent is granted and without using your data to train models.
• Food product database providers — product recognition in the nutrition module (we transmit only the product code or search term, without your personal data).
• Payment and subscription service providers — handling of premium purchases.
• Diagnostic tool and push notification providers — ensuring application stability and delivering notifications.
• Mobile platform providers (Apple, Google) — login, app distribution, in-app payments, and notification delivery.

We provide the current list of specific sub-processors on request and update it as changes occur — every new sub-processor is bound by equivalent safeguards and processes data solely on our behalf and in accordance with this Policy. We may change AI models and service providers from time to time (e.g., to improve quality or reduce cost); material changes will be announced in the application and via the "Last updated" date of this Policy.

7. Data Security

Your primary data (account, workouts, chat history, nutrition, health, routes) is stored on cloud infrastructure located in the European Union. We apply rigorous access policies (Row Level Security), ensuring that only you have access to your personal data. All communication between the application and servers is encrypted using the HTTPS/TLS protocol.

We do not sell, rent, or share your data with third parties for marketing purposes.

We do not display in-app advertisements and do not use advertising identifiers. On iOS devices, solely to measure the effectiveness of our own advertising campaigns run outside the application, we use Apple's SKAdNetwork framework. It provides the advertising platform (Meta Platforms Ireland Ltd.) only with aggregated, non-identifying statistical data (e.g., the fact that the app was installed from a given campaign) — without advertising identifiers, without a tracking prompt (ATT), and without tracking you across other apps and services. On Android devices we do not transmit any such data. We do not use health, fitness, or camera/gallery data for advertising purposes.

8. International Data Transfers

Your data may be transferred to third countries outside the European Union / European Economic Area. Such transfers are conducted pursuant to Standard Contractual Clauses (SCCs) approved by the European Commission under Art. 46(2)(c) GDPR, ensuring an adequate level of data protection.

For AI features, the content of your queries — and, in the case of optional analyses, selected training, nutrition, and health data, as well as uploaded media — is transferred to trusted artificial intelligence service providers in the United States (see Section 6). This transfer is carried out on the basis of EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and, for providers covered by an adequacy decision (the EU-US Data Privacy Framework), on that basis (Art. 45 GDPR), supplemented by the providers' contractual commitments regarding limited data retention (some providers apply a zero-retention principle, while others retain content for a short period solely to detect abuse) and a prohibition on using the data to train models. Regardless of the transfer mechanism, processing of your data by AI takes place only after you have given your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR), which you may withdraw at any time in the application Settings.

9. Data Retention Period

• Account and training data: Retained for the duration of your use of the application.
• Nutrition data and outdoor activity routes: Retained for the duration of your use of the application, deleted together with your account.
• AI chat history: Retained for the duration of your use of the application; you can delete it manually at any time.
• Health data and AI analysis results: Retained for the duration of your use of these features and deleted together with your account; you can disable the device connection at any time.
• Content moderation logs: Retained for 90 days for safety purposes.
• Diagnostic data: Retained for up to 90 days for application stability analysis.
• After account deletion: All personal data is permanently deleted within 30 days, except for information required by tax and accounting laws (regarding subscription purchases), retained according to applicable legal requirements.

10. Medical Disclaimer (AI Disclaimer)

The AI features — including training suggestions, the periodic overview of your activity and well-being, and the visual analysis of uploaded photos and videos — are generated solely from the available data and are educational, informational, and motivational in nature only. They do not constitute professional medical advice, diagnosis, treatment, or health monitoring, and should not be the basis for any health-related decisions. Device indicators (e.g., HRV, heart rate, sleep) are shown for general reference and may differ from measurements taken with medical-grade equipment. Always consult a physician before starting a new diet or training plan. You use the application at your own risk.

11. Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the following rights:

• Right of access — you may obtain information about your processed data (Art. 15).
• Right to rectification — you may correct inaccurate data (Art. 16).
• Right to erasure — "right to be forgotten" (Art. 17).
• Right to restriction of processing (Art. 18).
• Right to data portability — you may receive your data in a machine-readable format (Art. 20) — available from within the application Settings.
• Right to object to processing (Art. 21).
• Right to withdraw consent for AI data processing at any time (Settings → AI Consent in the application).
• Right to lodge a complaint — you may file a complaint with the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl, or with the supervisory authority in your country of residence (if you reside in another EU member state).

To exercise any of these rights, contact us at: support@gryndapp.com. We will respond within 30 days.

12. Account Deletion

You have full control over your data. You can permanently delete your account and all associated data (including training logs, nutrition, health data, routes, and AI conversations) directly from within the application (Profile → Settings → Delete Account). Deletion is irreversible.

13. Children and Minors

The Application is intended for users who are at least 13 years old. If you reside in the European Economic Area and are under 16, parental or legal guardian consent is required to use the Application (Art. 8 GDPR). If we discover that an account has been created by a person below the applicable age without the required consent, it will be deleted.

14. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy. We will notify you of material changes (e.g., expansion of data processing scope, new processing purposes, new categories of recipients) via in-app notification or the email address associated with your account, with reasonable advance notice. Editorial or clarifying changes take effect upon publication of the updated version on this page with a new update date. Continued use of the Application after changes are published constitutes acceptance of those changes.

15. Governing Law

This Privacy Policy is governed by the laws of the Republic of Poland and the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).