Privacy Policy

Grytt is a personalised workout-logging and fitness app. You can log workouts, track progress, get AI-assisted coaching, and — if you choose — connect with friends to share and compare workout logs. This policy explains what information we collect, how we use it, who we share it with, and the choices and rights you have.

By using Grytt, you agree to the practices described in this policy.

1. Information We Collect

We collect information in three ways: information you give us, information collected automatically when you use the app, and information we receive from third parties you choose to connect.

1.1 Information you provide

• •Account credentials — email address and password (for email/password sign-up), or the identifier returned when you sign in with Google or Apple.
• •Profile details — name, username, date of birth (or age), gender, bio, and (optionally) phone number.
• •Fitness profile — training mode/goal (e.g. strength, endurance, hypertrophy), workout frequency (days per week), experience level, available equipment, and body metrics such as height and weight.
• •Workout content — workout logs, exercises, sets, reps, weights, personal records, and any notes or feedback you enter.
• •Photos and images you upload — profile pictures, progress/physique photos, and any images you attach to the AI Coach. Physique and progress photos may reveal information about your body and physical condition; we treat these as sensitive (see Section 11).
• •AI Coach inputs — the free-text messages, goals, preferences, and injuries or physical limitations you share when using the AI Coach, plus any photos you attach.
• •Communications — messages you send to support and any requests you make to us.

1.2 Information collected automatically

• •Device and technical data — device type, operating system and version, app version, language, and similar technical identifiers.
• •Usage and analytics data — screens viewed, features used, and in-app events (for example: sign-up, login, viewing the Pro screen, AI Coach onboarding steps). Used to understand and improve the app.
• •Crash and diagnostic data — error reports, stack traces, and a short trail of recent in-app actions (“breadcrumbs”) captured when the app encounters a problem.
• •Push notification token — if you enable notifications, a device push token is generated and sent to our servers so we can deliver notifications. We also record whether notifications are enabled or disabled.
• •Local app storage — we store some data on your device (e.g. cached profile and settings) to make the app work offline and load faster.

1.3 Information from third parties

• •Sign-in providers — if you sign in with Google or Apple, we receive a limited set of account information (such as your email and a user identifier) needed to create and secure your account. We do not receive your Google or Apple password.

1.4 Device permissions we may request

We only access the following with your permission, and only for the stated purpose:

• •Photos / media library — to let you select images to upload (profile, progress, AI Coach) and to save shareable workout cards to your device.
• •Camera — to take photos you choose to upload.
• •Microphone / speech recognition — for voice workout logging. Speech is transcribed on your device; we send only the resulting text transcript (not raw audio) to our servers to interpret it into sets and reps.
• •Contacts — only if you tap “Sync Contacts,” to help you find friends already on Grytt. We send normalised phone numbers to our servers to check for matches. We do not sync your contacts automatically.
• •Notifications — to deliver reminders and social updates if you opt in.

You can change or revoke these permissions at any time in your device settings.

2. How We Use Your Information

We use your information to:

• •Provide, operate, and maintain the app and your account.
• •Log workouts and personalise training insights and recommendations.
• •Provide the AI Coach, including generating personalised programs and responses based on the information you share (see Section 4).
• •Enable social features — friend connections, friend matching via contacts, and sharing/comparison of workout logs you choose to share.
• •Send notifications you have opted into.
• •Understand how the app is used so we can improve features and performance (analytics).
• •Detect, diagnose, and fix crashes, bugs, and security issues.
• •Maintain the security and integrity of your account and our services.
• •Comply with legal obligations and enforce our terms.

3. AI Coach

The AI Coach is an optional feature. When you use it, the information you provide — your messages, fitness goals, experience level, available equipment, injuries or limitations, relevant workout history, and any photos you attach (including physique photos) — is sent to our servers and processed using third-party AI/LLM service providers to generate personalised coaching, programs, and responses.

• •AI processing happens only when you choose to use the AI Coach.
• •AI-generated programs and suggestions are for general fitness guidance and are not medical advice. Consult a qualified professional before acting on them, especially if you have an injury or health condition.
• •We share with our AI providers only what is needed to generate a response. We require these providers to protect your data and not to use it for their own unrelated purposes; however, their handling is also governed by their own terms.

4. Sharing of Information

We do not sell your personal data. We share information only as described below:

• •With your friends — if you connect with friends and choose to share, they can see your profile (name, username, picture, bio, stats) and the workout logs, personal records, and comparisons you make visible. You control your friend connections and what you share.
• •With service providers — companies that help us run Grytt, under contractual confidentiality and data-protection obligations, including:

• •For legal reasons — to comply with applicable law, regulation, legal process, or enforceable governmental request, or to protect the rights, property, or safety of Grytt, our users, or others.
• •In a business transfer — if Grytt is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to this policy.

5. Analytics and Crash Reporting

We use PostHog for product analytics and Sentry for crash and diagnostic reporting to understand usage and keep the app stable. These tools collect the usage, device, crash, and identifier data described in Section 1.2 and may associate it with your account identifier and email. Analytics and crash reporting are enabled in our production app and disabled in development builds.

6. International Data Transfers

Grytt operates globally, and some of our service providers — including our analytics (PostHog) and crash-reporting (Sentry) providers — process data in the United States. This means your information may be transferred to, stored, and processed in countries that may have different data-protection laws than your own. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for these transfers.

7. Data Retention

We keep your information only as long as needed for the purposes in this policy:

• •Account & profile data (email, date of birth, gender, training mode, frequency, height, weight, profile details): retained while your account is active.
• •Workout & exercise data (logs, exercises, sets, reps, personal records): retained while your account is active; deleted within 30 days of account deletion.
• •Uploaded images (profile, progress/physique, AI Coach attachments): retained while your account is active; deleted within 30 days of account deletion.
• •AI Coach conversations and inputs: retained while your account is active to provide continuity, and deleted within 30 days of account deletion.
• •Device & usage (analytics) data: retained in anonymised/aggregated form for up to 12 months to improve the app.
• •Crash & diagnostic data: retained for up to 90 days.

Some data may be retained longer where required by law or to resolve disputes and enforce our agreements.

8. Data Deletion

You can delete your account and associated personal data at any time:

• •In-app: Go to Account Settings → Delete Account.
• •Email: Send a request to gryttfitnes@gmail.com with the subject “Delete My Account”.

Upon receiving your request, we will permanently delete your personal data within 30 days. Some data may be retained longer if required by applicable law (for example, financial or legal obligations) or held in anonymised form. After deletion, your data cannot be recovered.

When you sign out, we also remove your device’s push notification token from our servers.

9. Your Rights

Depending on where you live, you may have some or all of the following rights regarding your personal data:

• •Access — request a copy of the personal data we hold about you.
• •Correction — update or correct your details (most fields can be edited in-app).
• •Deletion — request deletion of your account and data (see Section 8).
• •Portability — request your data in a portable format.
• •Restriction / Objection — restrict or object to certain processing.
• •Withdraw consent — withdraw consent at any time where processing is based on consent (e.g. notifications, contacts sync, AI Coach, sensitive data), without affecting prior processing.
• •Opt out — control workout-log visibility, disable notifications, and revoke device permissions (camera, photos, microphone, contacts) in your device settings.

If you are in the European Economic Area or the UK, you may also lodge a complaint with your local data protection authority. If you are in California or another US state with privacy laws, you have the right to know what we collect, to request deletion, and not to be discriminated against for exercising your rights; note that we do not sell your personal data.

To exercise any of these rights, contact us at gryttfitnes@gmail.com. We may need to verify your identity before responding.

10. Legal Bases for Processing (EEA / UK)

Where the GDPR or UK GDPR applies, we process your personal data on the following legal bases:

• •Performance of a contract — to provide the app and the features you request (e.g. logging workouts, your account).
• •Consent — for optional features such as notifications, contacts sync, the AI Coach, and processing of sensitive data (see Section 11). You can withdraw consent at any time.
• •Legitimate interests — to operate, secure, analyse, and improve the app, balanced against your rights.
• •Legal obligation — to comply with applicable laws.

11. Sensitive Information

Some data you may provide is sensitive — including fitness and health-related information (such as injuries or limitations shared with the AI Coach) and physique/progress photos. Where required by law, we process this information only with your explicit consent, which you provide by choosing to enter it or upload it. You can withdraw this consent at any time by deleting the relevant content or your account.

12. Security

We use reasonable technical and organisational safeguards to protect your information, including encryption in transit (HTTPS). However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

13. Children’s Privacy

Grytt is not intended for children under 13, or under the higher minimum age required in your country (for example, 16 in parts of the European Union). We do not knowingly collect personal data from children below the applicable age. If you believe a child has provided us with personal data, contact us and we will delete it.

14. Changes to This Policy

We may update this policy from time to time. When we make changes, we will revise the “Last updated” date above and, where appropriate, notify you in the app. Your continued use of Grytt after changes take effect constitutes acceptance of the updated policy.

15. Contact

If you have questions, concerns, or requests regarding this policy or your data, contact us at:

gryttfitnes@gmail.com