Legal
Privacy policy
Last updated 4 November 2026
IronGrit logs your training. This page says what that data is, where it lives, who else touches it and how you get it back or wipe it. Short version: we keep what you put in so the app works, we don't sell it, and you can export or delete it from the app at any time.
Who runs IronGrit
IronGrit is run by [Full name], a sole trader (OSVČ) registered in the Czech Republic, IČO [IČO], business address [Business address]. In this policy that's "we" or "us". We are the controller of your personal data under the EU General Data Protection Regulation (GDPR).
Questions or requests about your data: [privacy@irongrit.app]. We answer within 30 days, usually much faster.
What we collect
| Data | Why | Legal basis |
|---|---|---|
| Account: email, password (stored hashed by our auth provider, we never see it), the name you sign up with, sign-up date | To give you an account, sign you in and send account emails (confirm email, reset password) | Contract (Art. 6(1)(b)) |
| Training: workouts, exercises, sets, weights, reps, rest, effort ratings, notes, routines you build or pick, records, rank, imported history (Strong, Hevy, CSV, backups) | That's the app: logging, history, ranks, stats and the Coach | Contract (Art. 6(1)(b)) |
| Setup: training goal, training days, workout length, gear and gear places, plates, units, appearance, sound and reminder settings | To build workouts that fit you and remember your settings | Contract (Art. 6(1)(b)) |
| Body data: bodyweight, body fat, height, goal weight, tape measurements (waist, chest, arm, thigh), injuries, priority muscles, loved and hated exercises | Bodyweight trend, BMI, strength standards, and keeping moves that load an injury out of your workouts | Your explicit consent (Art. 9(2)(a)), given by entering it. All of it is optional |
| Profile photo (optional) | Shown on your Profile, only to you | Consent (Art. 6(1)(a)) |
| Subscription status: whether you have Pro, plan, trial and renewal dates, a purchase token from Google Play | To unlock Pro and check it's still active | Contract (Art. 6(1)(b)) |
| Technical: IP address and request logs kept by our hosting providers, app version | Keeping the service running and secure | Legitimate interest (Art. 6(1)(f)) |
| Feedback you send: what you write, plus the app version, Android version and phone model the Send feedback email fills in. You see all of it before you hit send | To fix bugs and answer you | Legitimate interest (Art. 6(1)(f)) |
Body data and injuries count as data about your health under GDPR. You choose whether to enter them, the app works without them, and you can delete any check-in or clear your injuries at any time, which withdraws consent for that data.
We don't run ads, we don't use advertising IDs, and there are no analytics or tracking SDKs in the app. We don't sell or rent your data, and we don't use it to train AI models.
Where it's stored
Our database (Supabase)
Your account and everything you save live in a database run by Supabase, Inc., which acts as our processor under a data processing agreement. Data is stored in [Supabase region, e.g. EU (Frankfurt)]. Every table is locked to its owner: your account can read and write only your own rows, and your profile photo sits in a private storage bucket only you can open.
On your phone
IronGrit works without signal. To do that it keeps a copy of what you've loaded and a queue of saves that haven't reached our database yet. These stay on your phone in the app's private storage. Saves are sent and removed from the queue as soon as you're back online. Logging out clears the loaded copy. Uninstalling the app or clearing its storage removes everything on the phone, including any saves that never got sent, so sync before you do that.
Workout reminders are scheduled on your phone. No push server is involved.
Health Connect
On Android you can sync IronGrit with Health Connect. It's off until you switch it on in App Settings and grant permission in Android. When it's on, IronGrit writes each finished workout as an exercise session (name, start and end time, marked as strength training) and reads your weight readings so they show up as bodyweight check-ins. That's all it asks for. Health Connect data is used only for this sync, never for ads, and never shared with anyone else. Switch it off in App Settings, or revoke access in Android settings, at any time.
Who else gets data
- Supabase, Inc.: database, sign-in, file storage and account emails. Processor.
- Google (Google Play): handles subscriptions and payments. You pay Google, not us. We never see your card. Google tells us whether a subscription is active. Google's own privacy policy covers what it does with your payment data. Google also shows the optional "rate the app" prompt.
- GitHub: some exercises without a 3D demo load a photo from a public exercise database hosted on GitHub. Your phone requests the image directly, so GitHub sees your IP address. No account data is sent.
- Authorities, only if the law requires it.
Some of these providers are based in the United States. Where data leaves the EU we rely on the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
How long we keep it
As long as you have an account. Delete a workout, check-in or photo and it's gone from our database straight away. Delete your account and everything is deleted straight away, apart from copies in our provider's rolling backups, which expire within [7] days. Records we must keep by law, such as tax records of payments, are kept for the period the law sets. Google keeps its own purchase records.
Your rights
Under GDPR you can:
- Get a copy of your data: Profile, Account, Export my data (CSV or a full JSON backup).
- Fix it: edit anything in the app, or ask us.
- Delete it: Profile, Account, Delete account. Or see how to delete your account without the app.
- Take it elsewhere (portability): the JSON backup and CSV are for exactly that.
- Withdraw consent for body data or your photo by deleting them. It doesn't affect anything before.
- Object to or restrict processing based on legitimate interest.
- Complain to the Czech data protection authority, Úřad pro ochranu osobních údajů (uoou.gov.cz), or the authority where you live. We'd rather you tell us first so we can fix it.
Security
Traffic between the app and our database is encrypted (HTTPS). Passwords are hashed by our auth provider. Database access is limited by row level security so one account can't read another's data. No system is perfectly safe. If a breach puts your data at risk, we'll tell you and the authority as GDPR requires.
Age
IronGrit is for people 16 and older. We don't knowingly collect data from anyone younger. If you think a child has an account, write to us and we'll delete it.
Changes
When this policy changes we update the date at the top. If a change matters, for example a new kind of data or a new provider, we'll tell you in the app before it applies.