Privacy Policy

Grytt is a personalised workout-logging and fitness app. You can log workouts, track progress, get AI-assisted coaching, and — if you choose — connect with friends to share and compare workout logs. This policy explains what information we collect, how we use it, who we share it with, and the choices and rights you have.

By using Grytt, you agree to the practices described in this policy.

1. Information We Collect

We collect information in three ways: information you give us, information collected automatically when you use the app, and information we receive from third parties you choose to connect.

1.1 Information you provide

• •Account credentials — email address and password (for email/password sign-up), or the identifier returned when you sign in with Google or Apple.
• •Profile details — name, username, date of birth (or age), gender, bio, and (optionally) phone number.
• •Fitness profile — training mode/goal (e.g. strength, endurance, hypertrophy), workout frequency (days per week), experience level, available equipment, and body metrics such as height and weight.
• •Workout content — workout logs, exercises, sets, reps, weights, personal records, and any notes or feedback you enter.
• •Photos and images you upload — profile pictures, progress/physique photos, and any images you attach to the AI Coach. Physique and progress photos may reveal information about your body and physical condition; we treat these as sensitive (see Section 13).
• •AI Coach inputs — the free-text messages, goals, preferences, and injuries or physical limitations you share when using the AI Coach, plus any photos you attach.
• •Readiness Check answers — daily 1 to 5 ratings of energy, stress, sleep, soreness, or motivation, if a connected trainer has enabled this. See Section 3.
• •Communications — messages you send to support and any requests you make to us.

1.2 Information collected automatically

• •Device and technical data — device type, operating system and version, app version, language, and similar technical identifiers.
• •Usage and analytics data — screens viewed, features used, and in-app events (for example: sign-up, login, viewing the Pro screen, AI Coach onboarding steps). Used to understand and improve the app.
• •Crash and diagnostic data — error reports, stack traces, and a short trail of recent in-app actions (“breadcrumbs”) captured when the app encounters a problem.
• •Push notification token — if you enable notifications, a device push token is generated and sent to our servers so we can deliver notifications. We also record whether notifications are enabled or disabled.
• •Local app storage — we store some data on your device (e.g. cached profile and settings) to make the app work offline and load faster.

1.3 Information from third parties

• •Sign-in providers — if you sign in with Google or Apple, we receive a limited set of account information (such as your email and a user identifier) needed to create and secure your account. We do not receive your Google or Apple password.
• •Health and fitness data from Apple Health or Health Connect — only if you choose to connect them. Grytt requests read access only and never writes anything back. See Section 2 for exactly what we read and what we do with it.

1.4 Device permissions we may request

We only access the following with your permission, and only for the stated purpose:

• •Photos / media library — to let you select images to upload (profile, progress, AI Coach) and to save shareable workout cards to your device.
• •Camera — to take photos you choose to upload.
• •Microphone / speech recognition — for voice workout logging. Speech is transcribed on your device; we send only the resulting text transcript (not raw audio) to our servers to interpret it into sets and reps.
• •Contacts — only if you tap “Sync Contacts,” to help you find friends already on Grytt. We send normalised phone numbers to our servers to check for matches. We do not sync your contacts automatically.
• •Notifications — to deliver reminders and social updates if you opt in.
• •Apple Health (iOS) / Health Connect (Android) — only if you connect them, and only to read the categories listed in Section 2. Grytt never writes to, changes, or deletes anything in Apple Health or Health Connect. You can disconnect at any time.

You can change or revoke these permissions at any time in your device settings.

2. Health and Fitness Data from Apple Health and Health Connect

Connecting Apple Health (iOS) or Health Connect (Android) is entirely optional. Grytt works fully without it, and you are only asked when you open the Health screen in Settings and choose to connect.

2.1 What we read

If you connect, Grytt reads the following from your device, and nothing else:

Workouts recorded in other apps or on your watch are imported as a daily summary only. Grytt does not add them to your workout history, your streaks, your personal records, or any leaderboard.

Apart from the daily resting heart rate above, we do not read continuous or workout heart-rate monitoring, blood pressure, blood glucose, body temperature, reproductive or menstrual health, mental health, medications, medical records, or any other health category.

2.2 How it works

Apple and Google do not provide any way for our servers to read your health data directly. Apple Health and Health Connect are stores that live on your device. The Grytt app on your device reads from them and sends a daily summary to our servers.

This means two things worth knowing:

• •Your history survives reinstalling the app, because we hold a copy.
• •If you delete Grytt, we stop receiving anything new. We cannot read your health data without the app running on your device.

2.3 What we use it for

• •To show you your sleep and daily activity inside Grytt.
• •If you use the AI Coach, to factor your recent sleep and activity into the guidance it gives you — for example, taking into account that you have slept poorly for several nights.

That is the complete list.

2.4 What we never do with it

• •We never sell it. Not to anyone, in any form.
• •We never use it for advertising, ad targeting, or building marketing profiles.
• •We never show it to other Grytt members. It does not appear in the feed, on your profile, in leaderboards, or anywhere else other people can see. The single exception is your own trainer, and only if you switch that on yourself — see below.
• •We never share it with data brokers.
• •We never write it back to Apple Health or Health Connect, or to any other health service.
• •We do not store it in iCloud.

Outside of the trainer sharing described below, it is shared only with the cloud-hosting provider that runs our backend, and — if you use the AI Coach — with the AI provider that powers it, in both cases solely to deliver the feature to you and under contractual confidentiality and data-protection obligations.

2.5 Sharing it with your trainer

If you are connected to a trainer, you can choose to share your health data with them. This is a separate switch from connecting Apple Health or Health Connect, it is off unless you turn it on, and Grytt works normally if you never do. Connecting a health source does not share anything with your trainer by itself.

If you turn it on, your trainer can see the same daily summary described above — your sleep, steps, active energy, exercise minutes, resting heart rate, and external workout totals — for the days they look at, in their client view. They cannot see anything we do not read in the first place.

You can turn it off at any time, which stops your trainer seeing any of it. Their access also ends immediately if your connection with that trainer ends, whoever ends it. The permission applies to the trainer you are connected to, and to no one else.

We keep a record of when you granted and withdrew this sharing permission. Like the record described below, it contains no health values — only the dates.

2.6 Your consent, and withdrawing it

Health data is treated as sensitive personal data (special category data under GDPR Article 9). We process it only on the basis of your explicit consent, which you give by connecting a health source — and, separately, by choosing to share it with your trainer. You can withdraw either at any time, independently of the other.

We keep a record of when you gave and withdrew this permission and which categories it covered. That record contains no health values — only the dates and the categories.

2.7 Deleting it

You can delete your health data without deleting your account: Account Settings → Apple Health (iPhone) or Health data (Android) → Disconnect.

This permanently deletes every day of sleep and activity we hold for you, immediately — not within 30 days. It also stops Grytt reading anything further.

One thing this does not do: Apple and Google do not allow an app to revoke its own health permission. To stop sharing entirely, also turn Grytt off inside Apple Health or Health Connect. The app tells you this and links you there when you disconnect.

Your health data is also deleted when you delete your Grytt account.

3. Readiness Check

If you are connected to a trainer and they turn on Readiness Check, Grytt shows you a short daily card with one to three questions your trainer chooses, each answered on a 1 to 5 scale. The questions come from a fixed set:

There is no free-text field. Your answer is a number and nothing else.

If you are not connected to a trainer, or your trainer has not turned this on, none of this applies and no readiness data is collected. The card has no decline button because you can simply leave it unanswered — nothing is sent unless you tap a rating.

3.1 What we collect

The questions you were shown, the rating you gave each one, the date, and the time you answered. A question you were shown but left blank is recorded as unanswered, so your trainer can tell the difference between a question you chose not to answer and one you were never asked. Your answers are linked to the workout you log that day, so they can be shown alongside that session.

3.2 Who sees it

The trainer who assigned the check-in, in their client view. That is the purpose of the feature. Readiness answers are not shown to your friends, do not appear in any social, feed, or leaderboard feature, are never sold, are never shared with data brokers, and are never used for advertising or ad targeting.

Your most recent day’s answers are also kept on your device so the card can show you what you entered.

3.3 Keeping it, and deleting it

Readiness answers are retained while your account exists. If the connection with your trainer ends, that trainer immediately loses access to your readiness answers and is no longer shown them. Your answers themselves are kept rather than deleted, so that if you later reconnect to the same trainer, the history from your earlier period together becomes visible to them again.

To delete readiness answers permanently, delete your Grytt account — this removes every readiness answer we hold for you. There is currently no way to delete readiness answers on their own while keeping your account.

4. How We Use Your Information

We use your information to:

• •Provide, operate, and maintain the app and your account.
• •Log workouts and personalise training insights and recommendations.
• •Provide the AI Coach, including generating personalised programs and responses based on the information you share (see Section 5).
• •Enable social features — friend connections, friend matching via contacts, and sharing/comparison of workout logs you choose to share.
• •Show your trainer how you were feeling alongside the workout you logged that day, if you are connected to one and they have enabled Readiness Check.
• •Send notifications you have opted into.
• •Understand how the app is used so we can improve features and performance (analytics).
• •Detect, diagnose, and fix crashes, bugs, and security issues.
• •Maintain the security and integrity of your account and our services.
• •Comply with legal obligations and enforce our terms.

5. AI Coach

The AI Coach is an optional feature. When you use it, the information you provide — your messages, fitness goals, experience level, available equipment, injuries or limitations, relevant workout history, any photos you attach (including physique photos), and — if you have connected Apple Health or Health Connect, a summary of your recent sleep and activity — is sent to our servers and processed using third-party AI/LLM service providers to generate personalised coaching, programs, and responses.

• •AI processing happens only when you choose to use the AI Coach.
• •AI-generated programs and suggestions are for general fitness guidance and are not medical advice. Consult a qualified professional before acting on them, especially if you have an injury or health condition.
• •We share with our AI providers only what is needed to generate a response. We require these providers to protect your data and not to use it for their own unrelated purposes; however, their handling is also governed by their own terms.

6. Sharing of Information

We do not sell your personal data. We share information only as described below:

• •With your friends — if you connect with friends and choose to share, they can see your profile (name, username, picture, bio, stats) and the workout logs, personal records, and comparisons you make visible. You control your friend connections and what you share.
• •With your trainer — if you are connected to a trainer, that trainer can see your training and check-in data in their client view. This includes the workouts you log and their details, your progress and consistency over time, your progress/physique photos, any habits, food diary entries, or check-ins they have set up for you, your Readiness Check answers where they have enabled that, and the messages you exchange with them. Connecting to a trainer is what grants this access, and it applies only to the trainer you are connected to. When the connection ends, their access ends immediately. Your Apple Health / Health Connect data is the exception: it is not included unless you switch on trainer sharing yourself, and you can switch it off again at any time (see Section 2).
• •With service providers — companies that help us run Grytt, under contractual confidentiality and data-protection obligations, including:

• •For legal reasons — to comply with applicable law, regulation, legal process, or enforceable governmental request, or to protect the rights, property, or safety of Grytt, our users, or others.
• •In a business transfer — if Grytt is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to this policy.

Health data is treated more strictly than anything else in this policy. Data read from Apple Health or Health Connect is never sold, never given to data brokers, and never used for advertising or ad targeting — by us or by anyone acting for us. It does not appear anywhere in the social features, and it is never shown to other Grytt members, with one exception: if you are connected to a trainer, you can separately choose to share it with that trainer, and you can turn that off again at any time (see Section 2). Otherwise it is shared only with the cloud-hosting provider that runs our backend, and — if you use the AI Coach — with the AI provider that powers it, in both cases solely to deliver the feature to you.

7. Analytics and Crash Reporting

We use PostHog for product analytics and Sentry for crash and diagnostic reporting to understand usage and keep the app stable. These tools collect the usage, device, crash, and identifier data described in Section 1.2 and may associate it with your account identifier and email. Analytics and crash reporting are enabled in our production app and disabled in development builds.

8. International Data Transfers

Grytt operates globally, and some of our service providers — including our analytics (PostHog) and crash-reporting (Sentry) providers — process data in the United States. This means your information may be transferred to, stored, and processed in countries that may have different data-protection laws than your own. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for these transfers.

9. Data Retention

We keep your information only as long as needed for the purposes in this policy:

• •Account & profile data (email, date of birth, gender, training mode, frequency, height, weight, profile details): retained while your account is active.
• •Workout & exercise data (logs, exercises, sets, reps, personal records): retained while your account is active; deleted within 30 days of account deletion.
• •Uploaded images (profile, progress/physique, AI Coach attachments): retained while your account is active; deleted within 30 days of account deletion.
• •AI Coach conversations and inputs: retained while your account is active to provide continuity, and deleted within 30 days of account deletion.
• •Device & usage (analytics) data: retained in anonymised/aggregated form for up to 12 months to improve the app.
• •Crash & diagnostic data: retained for up to 90 days.
• •Readiness Check answers: retained while your account exists. A trainer loses access as soon as your connection with them ends, but the answers themselves are kept so that reconnecting to the same trainer restores their view of that history. They are deleted when you delete your account.
• •Health data from Apple Health / Health Connect: retained while the connection is active. Disconnecting deletes it immediately, not within 30 days. It is also deleted when you delete your account. The permission records described in Section 2 — both the health-source consent and the trainer-sharing grant — contain no health values and are kept until you delete your account.

Some data may be retained longer where required by law or to resolve disputes and enforce our agreements.

10. Data Deletion

You can request deletion of your account and associated personal data at any time:

• •In-app: Go to Account Settings → Request account deletion. You are signed out straight away.
• •Email: Send a request to gryttfitnes@gmail.com with the subject “Delete My Account”.

We review every request, then permanently delete your personal data within 30 days at the latest. Your data stays in place until the request is actioned.

You can change your mind. Sign back into Grytt before the request is actioned and cancel it from Account Settings — nothing is lost. Once the request has been actioned, deletion is permanent and your data cannot be recovered.

Some data may be retained longer if required by applicable law (for example, financial or legal obligations) or held in anonymised form that cannot identify you.

You can also delete only your health data, without deleting your account: go to Account Settings → Apple Health (iPhone) or Health data (Android) → Disconnect. This permanently deletes every day of sleep and activity we have stored for you, immediately.

Note that this stops Grytt from reading further data and removes what we hold, but it does not change the permission itself — Apple and Google do not allow an app to revoke its own health access. To stop sharing entirely, also turn Grytt off inside Apple Health or Health Connect.

When you sign out, we also remove your device’s push notification token from our servers.

11. Your Rights

Depending on where you live, you may have some or all of the following rights regarding your personal data:

• •Access — request a copy of the personal data we hold about you.
• •Correction — update or correct your details (most fields can be edited in-app).
• •Deletion — request deletion of your account and data (see Section 10).
• •Portability — request your data in a portable format.
• •Restriction / Objection — restrict or object to certain processing.
• •Withdraw consent — withdraw consent at any time where processing is based on consent (e.g. notifications, contacts sync, AI Coach, connected health sources, sensitive data), without affecting prior processing.
• •Opt out — control workout-log visibility, disable notifications, and revoke device permissions (camera, photos, microphone, contacts) in your device settings.

If you are in the European Economic Area or the UK, you may also lodge a complaint with your local data protection authority. If you are in California or another US state with privacy laws, you have the right to know what we collect, to request deletion, and not to be discriminated against for exercising your rights; note that we do not sell your personal data.

To exercise any of these rights, contact us at gryttfitnes@gmail.com. We may need to verify your identity before responding.

12. Legal Bases for Processing (EEA / UK)

Where the GDPR or UK GDPR applies, we process your personal data on the following legal bases:

• •Performance of a contract — to provide the app and the features you request (e.g. logging workouts, your account).
• •Consent — for optional features such as notifications, contacts sync, the AI Coach, connecting Apple Health or Health Connect, and processing of sensitive data (see Section 13). You can withdraw consent at any time.
• •Legitimate interests — to operate, secure, analyse, and improve the app, balanced against your rights.
• •Legal obligation — to comply with applicable laws.

13. Sensitive Information

Some data you may provide is sensitive — including fitness and health-related information (such as injuries or limitations shared with the AI Coach), physique/progress photos, sleep and activity data read from Apple Health or Health Connect, and your stress and soreness ratings if a trainer has enabled Readiness Check. Where required by law, we process this information only with your explicit consent, which you provide by choosing to enter it, upload it, or connect a health source. You can withdraw this consent at any time by deleting the relevant content, disconnecting the health source, or deleting your account.

14. Security

We use reasonable technical and organisational safeguards to protect your information, including encryption in transit (HTTPS). However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

15. Children’s Privacy

Grytt is not intended for children under 13, or under the higher minimum age required in your country (for example, 16 in parts of the European Union). We do not knowingly collect personal data from children below the applicable age. If you believe a child has provided us with personal data, contact us and we will delete it.

16. Changes to This Policy

We may update this policy from time to time. When we make changes, we will revise the “Last updated” date above and, where appropriate, notify you in the app. Your continued use of Grytt after changes take effect constitutes acceptance of the updated policy.

17. Contact

If you have questions, concerns, or requests regarding this policy or your data, contact us at:

gryttfitnes@gmail.com