Privacy Policy

Last Updated: October 2026

This policy applies to all users of the GritFit application, including users in the United States, European Union, United Kingdom, and California.

1. Introduction

GRIT Technologies LLC ("we," "us," or "our") operates GritFit. We respect your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information. We are not a healthcare provider. Health and fitness data you share with us is used solely to operate and personalize the Service, not for medical diagnosis or treatment.

2. Information We Collect

Account Data: Name, email address, birthdate and sex provided during registration, and a phone number if you choose to add one.
Health & Fitness Data: Height, weight, body measurements, health metrics, sleep data, mood check-ins, medication you choose to track (such as GLP-1 mode), and workout/nutrition logs. This data is used to generate fitness suggestions only — it is not used for medical diagnosis.
GritFit Health Team Data: Symptom reports, injury history, illness status, and AI consultation transcripts/summaries. This information is used to adapt your training schedule to your current health status and to provide longitudinal health tracking.
Location: Only with your permission: the GPS route, distance and pace of an outdoor workout you record, routes you plan, your position while you share a live run link (deleted when the share ends), and your location when you look for events near you. While an outdoor workout you started is recording, GritFit keeps recording its route with the screen locked or the app in the background, and your phone shows that it is (a notification on Android, the location indicator on iPhone). It stops when you pause or end the workout. GritFit does not track your location in the background at any other time.
Media: Progress photos, food photos, photos of workout plans or body-scan reports you ask the app to read, profile pictures, photos you post or send, and still frames from a form check.
Social Content: Posts, comments, reactions, direct messages and circle chat, and the profile name and bio other people see.
Microphone and speech: Voice commands and dictation (for example saying a meal into the food log bar) use the microphone only after you tap the mic and allow access. Your phone's own speech recognition turns what you say into text. GritFit asks for this to happen on the phone where the phone supports it for your language; otherwise the audio is processed by your phone's speech service (Apple's on iPhone, Google's or your device maker's on Android; in a web browser, the browser's speech service) under that provider's privacy terms. GritFit does not record or store audio, never uploads it, and never sends audio to Gemini. Dictated words appear as text in the box; only what you choose to log is kept and, like typed text, sent to the AI food parser (Section 4).
Device & Usage Data: App usage patterns, a push-notification token, device type and OS version, and crash reports collected automatically to improve the Service (see Section 5).
Support Requests: Bug reports and feedback you send from the app.
Third-Party Data: If you connect Strava or COROS, we collect activity type, duration, distance, heart rate and calories from those platforms. If you connect a Sleep Number bed, we collect your sleep sessions, sleep score, heart rate, HRV and breathing rate from it.
Health Connect & Apple Health: Only with your permission, GritFit reads steps, active calories, total calories, heart rate, resting heart rate, heart rate variability, sleep, weight, and blood glucose. If you turn on "Save workouts" in Settings, GritFit also writes each workout you finish in the app (its sport, start and end time, active calories and distance) to Apple Health or Health Connect; it writes nothing else. You can turn access off at any time in your phone's settings.
Payment Data: Payment is processed by Stripe, Apple App Store, or Google Play. We do not store your full card number — only a transaction reference provided by the payment processor.

3. How We Use Your Information

Generate personalized workout and meal suggestions using AI — these are not medical prescriptions or professional dietary advice
Adapt training volume and intensity based on reported injuries or illnesses via the GritFit Health Team
Track your self-reported progress toward fitness goals
Facilitate social features like "Circles," leaderboards, and friend connections
Connect you with personal trainers on the platform (if you opt-in)
Process payments for subscriptions and programs
Send account emails, your weekly report, and occasional emails about GritFit features (every one has an unsubscribe link, or turn them off in Settings › Notifications › Marketing emails)
Check content shared with other people for safety, and act on reports
Improve the performance and relevance of our AI models (using anonymized data only)
Comply with applicable laws and regulations

4. AI Features & Third-Party AI Disclosure

GritFit uses Google Gemini models (a third-party AI service provided by Google LLC) to power the following features: AI workout generation, AI meal planning and recipes, schedule creation and adjustment (including automatic overnight updates to your plan), the Coach chat, the Health Team synthesis, food, menu, workout-plan and body-scan photo reading, form checks, sleep and recovery insights, and safety checks on content you share with other people.

Your permission comes first. When you set up your account, GritFit asks you, in a separate checkbox, whether it may send your data to Google Gemini as described below. Nothing is sent to Gemini before you agree. You can withdraw permission by deleting your account in Settings or by emailing help@grit.bot.

Your trainer's tools are agreed separately. If you accept a trainer, the Accept screen tells you that their AI tools send the data you share with them to Gemini. This applies even if you declined AI for yourself, and it stops when you remove the trainer.

What data is sent to Google Gemini:

Feature	Data sent to Gemini
Workout / Schedule Generation	Fitness goals, experience level, available equipment, injury flags, preferred workout duration
AI Meal Planner	Dietary preferences, calorie targets, macro goals, food restrictions, body weight, and the day's planned training (session type, length and time) to size carbs for each meal. For meal plans, grocery lists and the nutrition coach, the names and amounts of what is in your fridge and pantry, including a household fridge you share. If you are on a household and its members choose to share their food allergies, diet and dislikes, those foods (never their names) are sent for dinners so the family meal suits everyone
Life Coach / Chat	Your chat messages and relevant fitness context you choose to share
Health Team / Insights	Self-reported symptoms, recent workout logs, sleep summaries, recovery metrics
Sleep & Recovery Insights	Summary values such as last night's sleep hours and sleep stages (time in deep, REM, light sleep and awake), your sleep need and sleep debt, heart rate variability and its 7-day baseline, resting heart rate, readiness score, recent training load and an average of your recent mood ratings, plus the question you ask and the recent messages of that conversation. These may come from Apple Health, Health Connect or a connected device.
Food Log Text	The words of a meal you log in the food bar ("2 eggs and toast"), whether typed or dictated, with your remaining calories and macros for the day. Text only: never audio
Nutrition Photo Logging	The food photo you upload (no location metadata is read from the image), plus any restaurant name or meal context you type in yourself
Photo Import & Form Check	Photos of a workout plan, menu, recipe or body-scan report you ask the app to read, and still frames from a form check
Safety Checks (moderation)	Posts, comments, direct and circle messages, photos you share, and your public profile name and bio, checked before other people see them
Your trainer's tools (only if you accept a trainer)	When your trainer uses an AI tool on your account (check-in drafts, weekly reviews, progress reports, questions about their clients, workouts), the training data you share with them (see Section 6): workouts, plan, exercise history, goals, body measurements, injuries and any illness you have logged, training settings, nutrition targets and food restrictions, the last two weeks of food you logged, plus sleep, heart-rate, mood and cycle data only if you share raw health with them. Never your name, email or messages.

What is NEVER sent to any AI system:

Your email address (your name only as part of the public profile safety check above)
Payment or billing information
Your Apple Health or Health Connect history: only the summary values listed above, never the full record of samples
Your precise GPS location or route history
Any data from connected wearables (COROS, Strava, Sleep Number) in raw form

Additional notes:

No medical use: AI-generated content is fitness suggestions only — not medical diagnosis, treatment, or prescriptions.
Google's data handling: Data sent to Gemini is subject to Google's Privacy Policy and their AI data use terms. Google does not use this data to train their public models by default under our API agreement.
Anonymized improvement: We may use anonymized, aggregated fitness patterns (never linked to your identity) to improve our own prompt engineering and feature quality.
What runs without AI: Manual workout logging, tracking, and program access work without AI processing.

5. Tracking, Analytics & Cookies

We use the following tracking technologies:

Firebase Analytics: Collects anonymous usage events (e.g., which screens you visit) to help us understand how the app is used. No personally identifiable information is sent.
App Sessions: When the app opens we record a session (start and end time, platform, app build) linked to your account, to measure stability and retention.
Firebase App Check: Uses device attestation (via Google Play Integrity on Android or App Attest on iOS) to verify that requests to our backend come from legitimate app installs. This does not track your location or personal behavior.
Crash & Error Reporting: When the app hits an error we record what happened and the last few actions you took beforehand (screens opened, buttons tapped, requests made), along with device type, OS version and app build. If you are signed in, this is linked to your account and email address, so we can tell how many people a bug affects. If an error happens while you are signing up or signing in, the email address you entered is recorded with it, even though you are not signed in yet. Passwords and authentication tokens are never recorded. Error records are deleted after 30 days, and immediately if you delete your account.
No Advertising Trackers: We do not use third-party advertising networks or tracking pixels. We do not serve personalized ads.

You may opt out of Firebase Analytics by contacting us at help@grit.bot. Note that opting out may affect the personalization of your experience.

6. Sharing Your Information

With your trainer: Only if you accept a trainer's invite, and only one trainer at a time. Before you accept, the app shows what they will see. Your trainer sees your workouts, exercise history and personal records; your training plan, programs and goals; your body measurements and training settings; your calorie and macro targets, allergies and food restrictions; and the plans, notes and instructions they set for you. They see your sleep, heart rate, HRV and readiness only if you turn on "Share raw health with my trainer" (Settings › Sharing & Privacy). They never see your messages with anyone else, your AI Coach conversations, your journal or mood, GLP-1 notes, progress photos, recipes, your fridge or grocery lists. Their AI tools may send what they can see to Google Gemini (Section 4). You can remove your trainer on My Trainer at any time, and their access ends then. GritFit does not verify trainer credentials.
With your household: Only if you join or create a shared grocery list. Everyone on it sees the list, the family cookbook (the recipes members add, with the first name of whoever added them), the household fridge and the family dinner plan (who cooks which night, the dish and its nutrition per serving, and whether each member logged or skipped it). Recipes you keep private are not shared. Joining puts what is in your fridge into the household fridge. If you turn on "Share my food restrictions with my household", members also see your food allergies, diet and dislikes (never any health data), and family dinners avoid them. When you leave, you keep a copy of the family recipes and the fridge; your shared restrictions and the nights you cook come off the household.
With Friends/Circles: Activity and leaderboard status may be visible to friends and circle members.
Service Providers: We use the following third-party service providers, each bound by their own privacy policies:
- Firebase / Google Cloud — hosting, authentication, realtime database, analytics, and cloud functions
- Google Gemini AI — processes fitness data to generate workout and meal plan suggestions (see Section 4)
- Stripe — payment processing for web-based subscriptions and program purchases
- RevenueCat — manages in-app subscriptions on iOS and Android; receives your anonymous user ID and purchase records to verify entitlements
- Mapbox — provides map rendering for event discovery and outdoor workout tracking; may receive approximate location data when you use map features
- Twilio SendGrid — sends account, report and product emails to your email address
- Google Cloud Text-to-Speech — reads sleep stories aloud; receives the story text only
- USDA FoodData Central and Open Food Facts — food databases; receive the food you search for or the barcode you scan, never your identity
- Instacart — only when you tap "Shop on Instacart"; our server sends the names and quantities of the unchecked items on your grocery list to Instacart to build the cart page, never your identity
- Zippopotam.us and OpenStreetMap Nominatim — only when you type a ZIP code or place to find events near you; they receive that ZIP or place name (and, like any website, your device's IP address), never your identity. A location you choose is remembered on your device only
- US National Weather Service (weather.gov) — shows the forecast for a US race in the week before it; receives the race's location only (and your device's IP address), never your identity
- RunSignup, HYROX and Spartan race listings — we read public race calendars to list events; nothing about you is sent to them. Registration links take you to the organizer's own site
- Strava, COROS and Sleep Number — only if you connect them; we hold the access needed to import your activities or sleep and delete it with your account (Strava and COROS access is also revoked with them)
Legal Requirements: We may disclose your information if required by law or valid legal process.
We do NOT sell your personal data to any third party. Ever.

7. Data Security

We use Firebase Authentication, server-side security rules, and encrypted transport (HTTPS/TLS) to protect your data. However, no internet transmission is 100% secure. You use the Service and transmit data at your own risk. Notify us immediately at help@grit.bot if you suspect unauthorized access to your account.

8. Health Data Disclaimer

GritFit is NOT a covered entity under HIPAA. The health and fitness data you provide is not Protected Health Information (PHI) under HIPAA. Do not use GritFit to store medically sensitive information or as a substitute for professional medical records or care.

All health-related data you enter is used solely for generating personalized fitness and nutrition suggestions. By entering this data, you consent to its use for this purpose as described in this Policy.

Apple Health and Health Connect: data GritFit reads from Apple Health (HealthKit) or Health Connect is used only to provide and improve your health and fitness features in GritFit. It is never used for advertising, marketing or data mining, never sold, and never shared with third parties except the summary values sent to Google Gemini with your permission (Section 4). It is not stored in iCloud. GritFit writes to Apple Health or Health Connect only the workouts you finish in the app, and only when you turn that on in Settings.

9. Your Rights (General)

Depending on your location, you may have the right to:

Request access to the personal data we hold about you
Request correction or deletion of your account and associated data
Opt-out of marketing communications
Request a portable copy of your data (where technically feasible)
Withdraw consent for data processing at any time (this may affect Service functionality)

To exercise any of these rights, contact us at help@grit.bot. We will respond within 30 days. You may also delete your account directly from the Settings page, which will initiate deletion of your personal data.

🏴 10. California Residents — CCPA Rights

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you specific rights regarding your personal information:

Right to Know: You may request that we disclose what personal information we have collected about you, where it came from, how we use it, and with whom we share it.
Right to Delete: You may request the deletion of personal information we have collected from you, subject to certain exceptions.
Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.
Right to Opt-Out of Sale: We do not sell personal information. No opt-out is required, but you may confirm this at any time by contacting us.
Right to Correct: You may request correction of inaccurate personal information we hold about you.

Categories of personal information collected in the past 12 months: Identifiers (name, email, phone), health/fitness data, precise location (workout routes), photos and messages you post or send, commercial information (payment records), device identifiers, and usage data.

To submit a verifiable CCPA request, email help@grit.bot with subject line "CCPA Request." We will respond within 45 days.

🇪🇺 11. EU & UK Residents — GDPR Rights

If you are located in the European Economic Area (EEA) or United Kingdom, the General Data Protection Regulation (GDPR) or UK GDPR provides you with additional rights.

Legal Basis for Processing: We process your personal data under the following lawful bases:

Consent: For health/fitness data, AI features, and optional analytics. You may withdraw consent at any time.
Contract: For account registration, payments, and core Service delivery.
Legitimate Interests: For fraud prevention, security, and app stability (crash reports).
Legal Obligation: Where required by applicable EU/UK law.

Your GDPR Rights:

Right of Access (Art. 15): Request a copy of your personal data.
Right to Rectification (Art. 16): Request correction of inaccurate data.
Right to Erasure / "Right to be Forgotten" (Art. 17): Request deletion of your personal data.
Right to Restrict Processing (Art. 18): Request that we limit processing of your data.
Right to Data Portability (Art. 20): Request your data in a structured, machine-readable format.
Right to Object (Art. 21): Object to processing based on legitimate interests.

International Data Transfers: Your data is processed and stored on servers operated by Google Firebase, which may be located in the United States. These transfers are made under Google's Standard Contractual Clauses (SCCs) as approved by the European Commission.

Data Retention: We retain your personal data for as long as your account is active. If you have not used GritFit for 24 months, we email the address on your account and delete the account 30 days later unless you sign in during that time. If you delete your account yourself, or we delete a dormant one, we erase your personal data straight away — workouts, nutrition, health data, photos, posts and messages — and routine backups age out within 90 days. We keep only what the law requires us to keep, such as payment records.

To exercise your GDPR rights or to lodge a complaint, contact us at help@grit.bot. You also have the right to lodge a complaint with your local data protection authority (e.g., the ICO in the UK or your Member State's supervisory authority).

12. Children's Privacy

The App is not intended for use by children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, contact us at help@grit.bot and we will delete it promptly.

13. Changes to This Privacy Policy

We may update this Privacy Policy periodically. We will notify you of material changes by updating the "Last Updated" date and, where required by law, by sending a notification through the App or by email. Your continued use of the Service after changes constitutes your acceptance of the revised Policy.

14. Contact Us

For any privacy-related questions, data requests, or concerns, contact:
GRIT Technologies LLC
help@grit.bot — Delaware, USA