Privacy Policy

Effective October 21, 2026

Gritvana is a fitness app for training with your crew. This policy explains what we collect, why, who we share it with, and how to delete it. "We" means Chris Treece, who runs Gritvana.

The short version: we don't sell your data, we don't show ads, and we don't use third-party ad or analytics trackers. You can delete your account in the app at any time, and everything is gone within 30 days.

What we collect

Data	Why
Email address and password (the password is handled by Amazon Cognito; we never see it), or your Google or Apple sign-in	To create and secure your account
Age band: "teen" (13–17) or "adult". We check your birth date once and keep only the band, never the date.	To apply the right protections for teens
Profile: handle, name, bio, avatar, skin, Top 8, status, profile song, and (adults only, if you add it) your city	To show your page to the people you choose
Training: sessions, sets, personal records, streaks, challenges, programs, and the gear you track (such as shoes and bikes)	To track your progress
Routes (GPS), only while you record a run, ride or walk	To map the activity. The first and last 200 m are always hidden from others.
Health summaries from Apple Health or Health Connect, only if you turn them on: one daily summary of sleep, resting heart rate, heart-rate variability, steps and active energy. Raw samples stay on your phone. Body weight only for adults who opt in.	To show your readiness. Never shown on your page unless you share it.
Food log, water, nutrition targets (adults only), barcodes and food searches	To run Fuel
Photos you post or scan	To share with your crew, or to read a plate, menu or label
Posts, comments, reactions, hype wall notes, messages, crew and team activity, reports	The social features you use
Purchases (which item, when, refunds). Card details stay with Apple or Google.	To unlock what you bought
Creators and coaches only: what you've earned and been paid. Payout details (legal name, date of birth, tax ID, address and bank account) go straight to Stripe; we keep only your Stripe account ID and its status.	To pay you your share and meet tax reporting rules
Push notification token and notification settings	To send the notifications you've turned on
Server logs (request time, IP address, errors), kept 14 days	To keep the service running and secure

How we use your information

We use the information above only to provide and improve Gritvana:

to create your account, sign you in and keep it secure;
to log and show your training, food, water and progress, and work out streaks, personal records and challenge scores;
to show your profile, posts and activity to the people you choose, and to run crews, teams, messages and live rooms;
to send the notifications you've turned on;
to process purchases and unlock what you bought;
to keep the community safe: moderating photos, handling reports, and enforcing teen protections;
to fix bugs and keep the service running.

We do not sell your personal information, use it for advertising, build advertising profiles, or let third parties track you. We don't use your data to train AI models.

Who can see what

You choose who sees each post: just you, your Top 8, your crew, or (adults only) public.
Adults can make their page public. A public page can be opened by anyone with its link or Grit Code.
Teen accounts are always private: only accepted crew can see them, and they can't be found by people outside their age band.
Blocking someone hides you from each other.

Photos

We remove location and other metadata from photos before anyone else sees them.
Posted photos are checked by automated moderation (Amazon Rekognition), with stricter rules for teens.
Photos taken for AI food scans are read by Amazon Bedrock and deleted within 24 hours. AI scans are not available to teens.

How we share information

We share information only with the people you choose inside Gritvana, and with these service providers, who process it only to run Gritvana for us:

Amazon Web Services (United States): hosting, database, file storage, sign-in (Cognito), photo moderation (Rekognition) and food scans (Bedrock).
Google and Apple: sign-in, if you choose it; app store purchases.
RevenueCat: manages purchases and subscriptions. It receives an anonymous account id and purchase records, not your name or email.
Stripe (United States): pays creators and coaches. If you set up payouts, Stripe collects your identity, tax and bank details under its own privacy policy, verifies them, and keeps them for its legal and tax records even after you delete your Gritvana account.
Sentry (United States): crash reports from the app. A report has the error, the device model and system version, the app version, and the screens and taps that led to the crash. It never includes your name, email, IP address, training, food or messages.
Firebase Cloud Messaging (Google) and Apple Push Notification service: deliver push notifications. They receive a device token and the notification text.
Open Food Facts and USDA FoodData Central: food lookups. They receive the barcode or search words, never who you are.

We may also disclose data if the law requires it, or to protect someone from serious harm.

Google user data (Sign in with Google)

If you choose "Continue with Google", Google shares your basic profile with us after you agree on Google's screen. Here is exactly what happens with that data:

What we receive: your name, email address, whether Google has verified that email, and a Google account ID. We ask only for the openid, email and profile permissions. We never get your Google password, and we don't access Gmail, Drive, Contacts, Calendar or any other Google service.
How we use it: only to create your Gritvana account, sign you in, and keep one account per email (if you already have a Gritvana account with the same verified email, we link them). Your name stays with your sign-in record; your Gritvana profile shows the name and handle you choose.
Where it's stored: in Amazon Cognito (our sign-in service) and our database on Amazon Web Services in the United States, encrypted in transit and at rest.
Sharing: we don't sell, rent or share Google user data with anyone, and we don't use it for advertising or to train AI models. Only the service providers that run Gritvana for us, listed below, process it.
Deleting it: deleting your Gritvana account removes your Google sign-in link and everything we received from Google, within 30 days. You can also remove Gritvana's access at any time from your Google Account's "Third-party apps and services" page.

Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

Teens (13–17)

Gritvana is not for children under 13, and we delete accounts we learn belong to someone under 13. Teen accounts get extra protections:

Private, crew-only pages; no public posts; no links with adult accounts outside teams.
No calorie, macro or body targets, and no AI scans.
No direct messages, forums or photo avatars, and quick-chat only in live rooms.
Teens on a team need a linked parent or guardian. The parent chooses what a coach may see, and every option starts off. Coach notes are deleted after 30 days.

To link accounts we store a one-way hash of the parent's email address, not the address itself.

How long we keep data

Your data stays while your account is open, unless a shorter limit is listed here.
Scan photos: deleted within 24 hours.
Coach notes: 30 days.
"Lifting now" status: 2 hours.
Server logs: 14 days.
When you delete your account, we remove your profile, training, food, health summaries, photos, posts, comments, reactions, messages and crew links right away. Anything that fails is retried daily until done, and everything is gone within 30 days. Backups age out within 28 days.

Your choices and rights

Edit your profile, privacy and notification settings in the app.
Turn health sync, location and notifications off at any time in your phone's settings.
Delete your account in the app: My page → Customize my page → Delete my account.
Download a copy of your data any time: My page → Customize my page → Download my data. It is one file (JSON) with everything stored under your account and links to your photos.
Ask us for a copy of your data, a correction, or deletion by writing to chris@gritvana.app.

Depending on where you live (for example California, the EU or the UK), you may have further rights, such as the right to object or to complain to a data protection authority. We honor these requests for everyone. We do not sell or "share" personal information for advertising, as those terms are defined in California law.

Data security

Data is encrypted in transit and at rest. Access to production systems is limited and logged. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.

Where data is stored

Gritvana runs in the United States (AWS us-east-1). If you use it from elsewhere, your data is transferred to and processed in the US.

Changes

If we make a material change, we'll tell you in the app before it takes effect. The date at the top shows when this policy last changed.

Contact

Chris Treece, Gritvana
chris@gritvana.app