Privacy Policy
GRAVTY is a workout tracker. This policy explains what personal data the app handles, why, who sees it, and the rights you have over it. The short version: your training data lives on your device first, it is only copied to our servers if you sign in, and we do not run ads, analytics or trackers.
1. Who is responsible
The controller of your personal data is Ionut Cristian Banica, based in Romania ("we", "us"). You can reach us at gravty.app@gmail.com for anything in this policy.
2. What we handle
Which data exists depends on whether you sign in.
- Without an account: everything you log (workouts, sets, routines, custom exercises, bodyweight, settings) stays on your device. We never receive it.
- Account data: when you sign in with Apple or Google we receive your sign-in identifier and the email address (or Apple private relay address) that provider shares with us. We do not receive your password.
- Training data: workouts, sets, reps, weights, notes, routines, custom exercises, personal records and session feedback you log.
- Body data you choose to enter: bodyweight entries, sex, birth year and an optional maximum heart rate. These are used only to calculate strength scores, heart rate zones and progress in the app.
- Heart rate and energy data: if you use the Apple Watch companion or Apple Health on iPhone, average and maximum heart rate, heart rate zones, a heart rate trace for the workout and active calories. On Android, if you turn on the Health Connect import, average and maximum heart rate, heart rate zones and a heart rate trace for the workout, taken from heart rate readings your watch app saved to Health Connect.
- Preferences: unit, progression settings, sound and reminder options.
3. Health data
Heart rate, bodyweight, sex and birth year are treated as health data, a special category under the GDPR. We handle them only to show you your own stats and coaching inside the app.
On iOS the app asks permission before it reads heart rate from Apple Health or saves a finished workout to it. You can change that any time in Settings, Health. On Android the app asks permission before it reads heart rate from Health Connect. It reads heart rate only, never writes to Health Connect, and only reads the readings that fall inside a workout you logged. You can withdraw the permission any time in Health Connect settings or by switching the import off in GRAVTY. We never use Health data for advertising, marketing or data brokering, and we never share it with third parties other than the hosting provider that stores your synced account.
Heart rate data is stored in the cloud only if you are signed in. Signed out, it stays on your device.
4. Why we use it and our legal basis
- To provide the app, keep your account and sync your data across devices: performance of a contract (GDPR Art. 6(1)(b)).
- To process health data: your explicit consent (Art. 9(2)(a)), given when you grant the Health or Health Connect permission or enter body data. You can withdraw it at any time by revoking the permission, deleting the entries or deleting your account.
- To keep the service secure and prevent abuse: our legitimate interest (Art. 6(1)(f)).
- To manage subscriptions and meet tax and accounting duties: contract and legal obligation (Art. 6(1)(b) and (c)). Payments are handled by Apple or Google, not by us.
5. Who else is involved
We do not sell your data. These providers process data on our behalf or when you use them:
- Supabase: hosts the database and sign-in for signed-in users. Data is stored in the European Union.
- Apple and Google: provide sign-in, the App Store and Google Play, and handle payments and subscriptions. Their own privacy policies apply to what they collect.
- RevenueCat: may be used to check subscription status. It would receive an anonymous app user identifier and your purchase status, not your workouts.
- jsDelivr: a content delivery network that serves some exercise illustrations. Loading an image reveals your IP address to it, as with any web request.
- Hosting for this website: the public pages are served by GitHub Pages, which may keep standard server logs including IP addresses.
6. Cookies, local storage and tracking
GRAVTY does not use cookies, advertising identifiers, analytics or crash-reporting services, and it does not track you across apps or websites.
The app stores information on your device (IndexedDB and local storage) so it works offline: your workouts, settings and sign-in session. This is strictly necessary for the app to function and is the data you asked it to keep, so no consent banner is needed. Deleting the app or using Reset all data removes it.
If we ever add analytics or similar tools, we will ask for your consent first and update this policy.
7. International transfers
Your synced data is stored in the EU. Apple, Google and RevenueCat may process data outside the EU or EEA. Where they do, they rely on safeguards recognised by EU law such as the EU-US Data Privacy Framework or Standard Contractual Clauses.
8. How long we keep it
Signed-in data is kept until you delete it or your account. When you delete your account in the app (Profile, Delete account) your account and all its data are removed from our servers and from your device. Encrypted backups made by our hosting provider may take a short time to age out. We keep no copy of your data after that.
Data that only exists on your device is under your control and is removed when you delete the app or use Reset all data.
9. Your rights
Under the GDPR you have the right to access your data, correct it, have it erased, restrict or object to its use, receive it in a portable format, and withdraw consent at any time. Most of this you can do directly in the app: edit or delete entries, and delete your account. For anything else, write to gravty.app@gmail.com and we will answer within one month.
You also have the right to complain to your local data protection authority. In the EU you can find yours at edpb.europa.eu.
10. Children
GRAVTY is not intended for children under 16 and we do not knowingly collect their data. If you think a child has created an account, contact us and we will delete it.
11. Security
Data is sent over encrypted connections and each account can only read and write its own rows in the database. No system is perfectly secure. If a breach affects you we will tell you and the authorities as the law requires.
12. Changes
We may update this policy. The date at the top shows the latest version, and we will flag significant changes in the app.