Privacy Policy

01The short version

• We collect only what we need to run the Service — your account, the activity you log, and basic technical data.
• We do not sell your personal data, and we do not use it for third-party advertising.
• Body measurements, progress photos and health-related data are private to you and only shared when you choose to share them.
• We collect precise location only while you use a feature that needs it — recording an outdoor workout, finding routes or gyms near you, or automatic gym check-ins. Automatic check-ins are the only feature that uses location in the background, and they are off until you turn them on.
• You can export or permanently delete your account and data from inside the app at any time.

02Information we collect

We collect the categories of information below. Some are provided directly by you; some are generated as you use the Service.

The app requests camera access only when you scan a barcode or add a photo, and access to your photo library only when you choose a picture. It requests location access when you start an outdoor workout, look for routes or gyms near you, or add a gym, and — separately and optionally — background location if you turn on automatic gym check-ins; see “Location data” below. With your explicit permission, the app can also read activity, heart, sleep and body data from Apple Health (HealthKit) on iOS or Android Health Connect — see “Health & fitness data” below. We do not collect your contacts. You can decline or revoke any of these permissions at any time in iOS Settings or Android Settings, the Apple Health app, or the Health Connect app.

03How we use your information

• Provide, maintain and personalize the Service — including your targets, charts, streaks and recovery estimates.
• Detect personal records, compute rollups, and generate the analytics you see in-app.
• Map, measure and display your outdoor workouts — route path, distance, pace, splits and elevation — and show you saved routes and gyms near you.
• Count your gym visits, and contribute to a gym’s anonymous busy-hours counts, if you have turned automatic check-ins on.
• Operate optional social, leaderboard and coaching features at your direction.
• Authenticate you, prevent fraud and abuse, and keep accounts secure.
• Diagnose crashes, monitor performance and improve the product.
• Send transactional messages (for example, verification codes, security and account notices). We do not send marketing email without your consent.
• Comply with law and enforce our Terms.

We rely on the following legal bases where GDPR applies: performance of our contract with you, your consent (for optional features and any marketing), our legitimate interests in securing and improving the Service, and compliance with legal obligations.

04Health & fitness data

Body measurements, body-fat estimates and progress photos can reveal information about your health. We treat them as sensitive: they are visible only to you by default, are never used for advertising, and are only shared with another person when you explicitly share them (for example, by linking a trainer or posting publicly). You can delete any measurement or photo at any time.

If you connect Apple Health (HealthKit) on iOS, the app reads only the data types you approve — which may include steps, distance, active and resting energy, heart rate, resting heart rate, heart-rate variability, VO₂ max, respiratory rate, blood-oxygen, sleep, workouts, body weight and body fat.On Android, Health Connect access is narrower, and limited to what a feature in the app actually shows you: steps, distance, floors climbed, active and total energy, exercise sessions, heart rate, heart-rate variability, sleep, body weight and body fat. The app does not request resting heart rate, VO₂ max, respiratory rate or blood-oxygen through Health Connect.On either platform we use this data solely to provide in-app features: computing your recovery and readiness score, energy balance, and your activity, sleep and heart-rate trends. The analysis runs on our servers and the results are shown only to you in the app.

Health data obtained through Apple Health or Health Connect is never used for advertising or marketing, is never sold, and is never disclosed to third parties. It is used only to deliver the features described above, consistent with Apple’s HealthKit terms and the Google Health Connect Permissions policy. You can review or revoke our access at any time in the Apple Health app (Sharing) or the Health Connect app (App permissions); revoking access stops further reads but does not erase data already synced — delete your account or contact us to remove it. We keep hour-by-hour intraday detail for about 48 hours and a technical sync log for about 30 days; daily summaries persist until you delete them or your account.

05Location data

Several features need to know where your device is. We ask for location permission only at the point you use one of them, and the app explains what will be collected and why before the system permission prompt appears. We do not use location for advertising, we do not sell it, and we do not use it to build a profile of your movements.

• Outdoor workouts. When you start a run, walk, ride or similar GPS activity, the app records your precise coordinates for the length of that session to draw the route and compute distance, pace, splits and elevation. Recording continues while the screen is off or the app is in the background so the route is not lost when you pocket your phone, and it stops when you finish or discard the session.
• Photos along a route. If you add a photo during an outdoor workout, the coordinates where it was taken are stored with it so it can be pinned to the route.
• Routes and gyms near you. When you open a “nearby” list, the app sends your current coordinates to our servers to find results in your area. They are used to answer that request; we do not build a history of these lookups against your account.
• Adding a gym. If you tap “use my location” while adding or editing a gym, the coordinates become that gym’s pin and are used to look up its street address. This describes the gym, not you, and is visible to anyone who sees the gym.
• Automatic gym check-ins — optional, and off unless you turn it on. If you enable it and grant background location, the app watches a short list of gyms you have joined or searched for and records an arrival and a departure when you visit one, including while the app is closed or not in use. It stores which gym and when — not a continuous trail of where you go — and only counts a visit after about ten minutes on site.

Location-derived information reaches other people only if you choose it. A saved route is private by default; only a route you switch to public can appear in another member’s “nearby” results or be opened through a share link. Gym check-ins are not shown to other members by default — a gym’s busy-hours chart shows counts only, and appearing in a gym’s live member count is a separate setting that starts off.

You stay in control. Automatic check-ins can be turned off at any time in Settings → Gym presence, and any location permission can be revoked in Android Settings or iOS Settings; collection stops immediately and the rest of the app keeps working — outdoor workouts can still be logged manually, and check-ins fall back to when the app is open or when you start a workout. Deleting a workout, route or route photo deletes the coordinates stored with it, and deleting your account removes them all.

06Sign-in & authentication

You can create an account with email and password, a phone number with a one-time code, or by using Sign in with Apple, Google or Facebook. When you use a third-party sign-in we receive a basic identifier and, depending on your settings, your name and email; we do not receive your social password. Sign in with Apple lets you hide your email via Apple’s private relay, and we support that.

07Subscriptions & purchases

Premium features are sold as auto-renewable subscriptions through the Apple App Store on iOS and Google Play on Android. Apple or Google processes the payment and manages billing and renewals under its own privacy policy; we receive your subscription and entitlement status but never your full payment-card details. You manage or cancel a subscription in your Apple ID settings or your Google Play subscriptions.

08How we share information

We do not sell your personal data. We share it only in these limited ways:

• With service providers who process data on our behalf under contract — cloud hosting, database, crash/diagnostics, SMS and email delivery, and food-database lookups. They may only use the data to provide their service to us.
• With people you choose — trainers, gyms, followers or the public — when you use sharing, social or coaching features. This includes a saved route you switch from private to public, which then shows its path and any photos pinned to it.
• For legal reasons — to comply with law, respond to lawful requests, or protect the rights, safety and security of users, the public or the Service.
• In a business transfer — if the Service is involved in a merger, acquisition or asset sale, subject to this Policy.

Food and barcode lookups may query third-party databases such as the USDA FoodData Central and Open Food Facts; those queries are not tied to your identity.

09Data retention

We keep your information for as long as your account is active and as needed to provide the Service. When you delete your account, we delete or irreversibly anonymize your personal data within 30 days, except where we must retain limited records to comply with legal, tax or security obligations or to resolve disputes. Backups are purged on a rolling schedule.

Location data follows the record it belongs to: route coordinates and geo-tagged route photos are kept until you delete that workout, route or photo, or your account. Gym check-in events are kept while your account is active so your visit history stays accurate. Coordinates sent only to answer a “nearby” search are used for that request and are not stored against your account.

10Your rights & choices

Depending on where you live, you have some or all of these rights:

• Access and obtain a copy of your data, and export your logged data.
• Correct inaccurate data — most fields are editable directly in the app.
• Delete your account and personal data.
• Object to or restrict certain processing, and withdraw consent at any time.
• For California residents: to know, delete, correct, and to opt out of “sale” or “sharing” — note we do not sell or share personal information as those terms are defined. We will not discriminate against you for exercising these rights.

To exercise any right, use the in-app controls or email privacy@grindtrack.co. You may also have the right to lodge a complaint with your local data-protection authority.

11Deleting your account & data

You can permanently delete your account from inside the app: open Settings, then Account, then Delete Account, and confirm. This removes your profile and your logged training, nutrition, body and social data as described in “Data retention.” If you cannot access the app, email privacy@grindtrack.co from your registered address and we will process the deletion.

12Security

We protect your data with encryption in transit, hashed passwords, access controls and routine security practices. No method of transmission or storage is perfectly secure, but we work to safeguard your information and will notify you and the authorities of a material breach as required by law.

13Children’s privacy

The Service is not directed to children under 13 (or the minimum age of digital consent in your country, which may be higher). We do not knowingly collect personal data from children. If you believe a child has provided us data, contact privacy@grindtrack.co and we will delete it.

14International transfers

We may process and store information in countries other than yours, including where our service providers operate. Where required, we use appropriate safeguards (such as Standard Contractual Clauses) for cross-border transfers.

15Changes to this Policy

We may update this Policy as the Service evolves. We will post the new version here with a revised effective date and, for material changes, notify you in the app or by email. Continued use after an update means you accept it.

16Contact us

Questions or requests about privacy? Email privacy@grindtrack.co. For general support, support@grindtrack.co.