Privacy Policy
Please read this Policy carefully. By using the App you confirm that you have read it.
1. Who we are
This Policy explains how the GrekFit app for iPhone and Apple Watch (the “App”) processes personal data.
Data controller: Roman Hrekul (Hrekul Roman Yuriiovych), sole proprietor (FOP), taxpayer ID (RNOKPP) 3503209173, registered address: apt. 4, 41 Shkrumeliaka St., Kolomyia, Ukraine. Contact: support@grekfit.com.
This Policy covers only the iOS App and the grekfit.com website.
2. Summary
- We collect only what is needed for training, nutrition, progress and the club.
- Apple Health data is never used for advertising, never sold and never shared with third parties for marketing.
- The App has no ads, no advertising trackers and no third-party analytics.
- Payments are handled by Apple — we never see your card details.
- AI features work only after separate consent.
- You can delete your account right in the App.
3. Data we process and why
3.1. Account
Sign-in is via Sign in with Apple. We receive a user identifier from Apple and, if you choose to share them, your name and email. If you choose “Hide My Email”, we receive an Apple relay address and use it only for service emails (support, account deletion). Purpose: to create and secure your account and sync data across devices.
3.2. Profile, workouts, nutrition
Data you enter: club display name, sex, age, goal, level, training schedule, body measurements, weight; workouts (exercises, weight, reps, duration, perceived exertion), exercise notes; nutrition (foods, portions, calories and macros), target weight. Purpose: to build your program and track load, progress and calories.
3.3. Apple Health
Only with your permission, which you can change at any time.
| We read | steps, active energy, sleep, heart rate, resting heart rate, heart rate variability (HRV), weight, height, biological sex, date of birth |
|---|---|
| We write | workouts, weight |
| Why | to show activity and sleep, estimate training readiness, account for activity in calories, prefill weight, height, sex and age in your profile, and save your workouts to Health |
Heart rate, heart rate variability and sleep are processed on your device and are not sent to our server. Weight, height, sex and age taken from Health are stored in your profile the same way as values entered manually. We write to Health only what you entered or performed yourself.
Health data is not used for advertising, marketing or sale, is not shared with third parties without your permission and is not stored in iCloud. To revoke access: Settings → Health → Data Access & Devices → GrekFit.
3.4. Club and leaderboard
If you take part in the club, other members can see your name, profile photo (avatar), points and workout streak, status (for the top 3), and your city, country, gym or Instagram — only if you filled them in. Your profile photo is stored at a link accessible to club members. You can turn off club visibility in Profile → Privacy → Show in community.
3.5. Artificial intelligence (separate consent)
Food recognition from photos or voice, and voice notes for exercises, use OpenAI. Before first use the App asks for separate consent. What is sent: the meal photo, audio recording or text you dictated or typed — only at the moment you use the feature. We do not keep photos or audio after processing; the result (a list of foods or note text) is saved in your log. Without consent these features are unavailable; the rest of the App works. You can withdraw consent in Profile → Privacy.
3.6. Subscriptions
Payment is made through the App Store. From Apple we receive only the subscription status, plan, dates and transaction identifier — to unlock access. We do not receive card details.
3.7. Camera, microphone, photos
Access is requested only when you tap the related action (profile photo, meal photo, voice input, saving a workout image).
3.8. Technical data
When the App contacts our server we process IP address, device type, iOS and App version — to operate the service, keep it secure and fix bugs. The grekfit.com website uses no cookies or trackers.
3.9. On your device
Some data is stored locally on your device (cache, widget, Apple Watch). During a workout the exercise name and rest timer may be visible on the Lock Screen.
4. Legal bases
- Contract (Art. 6(1)(b) GDPR) — account, program, workout logging, subscription.
- Consent (Art. 6(1)(a) and 9(2)(a) GDPR) — health data (Apple Health, measurements, weight), club participation, AI features. You may withdraw consent at any time without affecting prior processing.
- Legitimate interests (Art. 6(1)(f) GDPR) — security, abuse prevention, bug fixing.
- Legal obligation (Art. 6(1)(c) GDPR) — record keeping and responding to lawful requests.
Processing also complies with the Law of Ukraine “On Personal Data Protection”.
5. Who receives data
We do not sell personal data. Data is processed only by providers the App cannot work without, under agreements that require data protection:
| Provider | Purpose | Data |
|---|---|---|
| Supabase | server, database, file storage (avatars) | account, profile, workout, nutrition and club data |
| Apple | sign-in, App Store, Apple Health, notifications | under Apple’s terms; Health data stays on device |
| OpenAI | food and voice recognition — with consent only | photo, audio or text at the moment of use |
| Bunny.net | exercise videos | IP address and request data |
| Open Food Facts | food search | search query text, IP address |
| Cloudflare | grekfit.com website and support email | visitor IP address, support emails |
Some providers are located outside the EU (including the United States). Transfers rely on the EU Standard Contractual Clauses or other lawful mechanisms. We may disclose data when required by law.
6. Retention
We keep data while your account exists. After account deletion we delete personal data within 30 days, and from backups during their scheduled rotation. Data we are legally required to keep is retained as long as the law requires.
7. Security
Data is transmitted over encrypted connections (HTTPS/TLS). Database access is restricted by row-level security: each user can access only their own data, except what they choose to show in the club. No method is perfectly secure, but we take reasonable measures and will notify you of an incident where the law requires.
8. Account deletion
In the App: Profile → Privacy → Delete Account. This deletes your account and associated data: profile, workouts, nutrition, measurements, notes, profile photo and club participation, and revokes Sign in with Apple. Records the App wrote to Apple Health remain in Health under your control — you can delete them in the Health app.
⚠️ Deleting your account does not cancel your App Store subscription — cancel it in Apple settings: apps.apple.com/account/subscriptions.
9. Your rights
You have the right to access your data and get a copy (Profile → Privacy → Download my data), to rectify, erase, restrict or object to processing, to data portability and to withdraw consent. Email support@grekfit.com — we reply within 30 days.
You may also lodge a complaint with a supervisory authority: in Ukraine — the Ukrainian Parliament Commissioner for Human Rights; in the EU — the data protection authority of your country.
10. Children
The App is intended for people aged 18 and over. We do not knowingly collect children’s data. If you believe a child has provided us data, email support@grekfit.com and we will delete it.
11. Changes to this Policy
We may update this Policy. We will notify you in the App about material changes before they take effect. The date of the current version is shown at the top.
12. Contact
Roman Hrekul (Hrekul Roman Yuriiovych), sole proprietor (FOP), taxpayer ID (RNOKPP) 3503209173, registered address: apt. 4, 41 Shkrumeliaka St., Kolomyia, Ukraine.
Email: support@grekfit.com