Privacy Policy

1. Information We Collect

Account Information

When you create a GritLeanPulse account, we collect:

• Email address
• Display name (optional)
• Password (stored as a cryptographic hash; we never store plaintext passwords)
• Date of account creation and last login
• Subscription status and purchase history (managed via RevenueCat)

Health and Body Composition Data

The core function of GritLeanPulse requires collecting sensitive health data, which may include:

• Body weight, body fat percentage, lean mass, BMI, and bone mass readings
• Historical body composition trends and logs
• Height, age, and biological sex (used for metabolic calculations)
• Activity level and fitness goals you provide

Food and Nutrition Logs

• Meal entries, including food items, portion sizes, and timestamps
• Macronutrient and micronutrient data (calories, protein, fat, carbohydrates, fiber)
• Water intake logs
• Custom foods and recipes you create

GLP-1 Medication Data

• Medication name (e.g., semaglutide, tirzepatide)
• Brand (e.g., Ozempic, Wegovy, Mounjaro, Zepbound)
• Dose amount and injection dates you log
• Titration schedule and dose history

This information is used solely within the app to personalize your nutrition targets and tracking experience. It is never sold or shared with pharmaceutical companies, insurers, or healthcare networks.

Device and Wearable Health Data

With your explicit permission, we receive data from connected services:

• Apple HealthKit: Weight, body fat, lean body mass, activity, heart rate, steps, sleep, and other health categories you authorize. Per Apple's guidelines, HealthKit data is never used for advertising or shared with third parties without your consent.
• Withings: Scale measurements and body composition readings from Withings devices.
• Renpho and HumeHealth: Body composition data from connected smart scales.
• Google Fit (Android): Similar health categories as HealthKit, subject to the permissions you grant.

Notification Preferences

• Your notification opt-in/opt-out status
• Custom reminder times for water, meals, and weigh-ins
• Push notification device tokens (used only to deliver notifications)

Usage and Technical Data

• App version, device type, and operating system version
• Crash reports and error logs (anonymized)
• Feature usage patterns (e.g., which screens you visit) — used to improve the app
• IP address (used for fraud prevention and approximate region detection)

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the GritLeanPulse app and its features
• Calculate and adapt your personalized nutrition targets (protein goals, calorie ranges, macro splits) based on your body composition, medication dose, and activity level
• Power the AI Nutrition Coach feature using your logged data as context (processed through Anthropic's API — see Section 3)
• Sync data between connected devices and services you authorize
• Send notifications you have requested (reminders, weigh-in prompts)
• Process subscription payments and manage your account status
• Respond to your support requests
• Improve app features, fix bugs, and understand aggregate usage patterns
• Comply with legal obligations

We do not use your health data for advertising, profiling for marketing purposes, or sale to any third party.

3. Third-Party Services

GritLeanPulse integrates with the following third-party services. Each has its own privacy policy, and we encourage you to review them.

Supabase (Database and Authentication)

We use Supabase to store your account information and health data securely. Supabase data is encrypted at rest and in transit. Supabase is SOC 2 Type II compliant. Data is stored in the United States. Supabase Privacy Policy.

RevenueCat (Subscription Management)

RevenueCat processes and manages in-app purchase and subscription data. RevenueCat receives your anonymized user ID and subscription status. No payment card data passes through RevenueCat — transactions are processed directly by Apple or Google. RevenueCat Privacy Policy.

Anthropic (AI Nutrition Coach)

When you use the AI Nutrition Coach feature, relevant portions of your logged data (food entries, macro targets, body composition context) are sent to Anthropic's API to generate responses. We do not send your name, email, or account identifiers to Anthropic. Anthropic does not use API inputs to train its models without consent under its API usage policies. Anthropic Privacy Policy.

Withings

If you connect a Withings account, we receive body composition data from Withings via their OAuth API. We store only the measurement values and timestamps, not your Withings credentials. Withings Privacy Policy.

Apple HealthKit

Data accessed from Apple HealthKit is governed by Apple's privacy framework. We access only the categories you explicitly authorize. HealthKit data is not shared with any advertising network or data broker. Apple Privacy Policy.

Google Fit (Android)

With your permission, we read health data from Google Fit. We use this data only to display and track your progress within GritLeanPulse. Google Privacy Policy.

4. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information. We share information only in these limited circumstances:

• Service providers: The third parties listed in Section 3 who help us operate the app, bound by confidentiality obligations.
• Legal compliance: When required by law, court order, or governmental authority, or to protect the rights, safety, or property of SJK & Sons LLC® or others.
• Business transfers: In connection with a merger, acquisition, or sale of assets, your data may be transferred to a successor entity. You will be notified of any such change.
• With your explicit consent: For any use not described in this policy, we will ask for your permission first.

We will never share your GLP-1 medication data, body composition data, or food logs with insurance companies, employers, pharmaceutical companies, or data brokers.

5. Data Storage and Security

Your data is stored on Supabase-managed infrastructure, encrypted at rest using AES-256 and in transit using TLS 1.2 or higher. Access to production data is restricted to authorized personnel on a need-to-know basis.

We implement reasonable administrative, technical, and physical safeguards to protect your information from unauthorized access, disclosure, alteration, or destruction. However, no method of transmission over the internet or electronic storage is 100% secure.

If we become aware of a data breach that affects your personal information, we will notify you in accordance with applicable law.

6. Data Retention

We retain your data for as long as your account is active or as needed to provide you with services. Specific retention practices:

• Account and health data: Retained for the lifetime of your account plus 30 days after deletion (to allow for recovery requests), then permanently deleted.
• Food and medication logs: Retained for the lifetime of your account, permanently deleted upon account deletion.
• Crash logs and diagnostic data: Retained for up to 90 days, then automatically purged.
• Subscription and billing records: Retained for 7 years as required by financial record-keeping laws.
• Support communications: Retained for 2 years after your last interaction, then deleted.

7. Your Rights and Choices

Regardless of your location, we extend the following rights to all GritLeanPulse users:

Access and Portability

You may request a complete export of all personal data we hold about you, in machine-readable format, by emailing support@gritleanpulse.com. We will fulfill export requests within 30 days.

Correction

You may update most account information directly in the app. For corrections you cannot make yourself, contact us and we will update your record within 14 days.

Deletion ("Right to Be Forgotten")

You may delete your account and all associated data at any time from the app's Settings screen, or by emailing support@gritleanpulse.com. Deletion is permanent and irreversible, except for data we are legally required to retain (see Section 6). Deletion is processed within 30 days of your request.

Opt Out of AI Coach Processing

You may disable the AI Nutrition Coach feature at any time in Settings. When disabled, no data is sent to Anthropic's API.

Connected Device Revocation

You may disconnect any integrated device or service (Withings, Apple Health, etc.) at any time in the app's Connected Devices settings. Upon disconnection, we stop receiving new data from that source. Previously synced data is retained unless you delete your account.

Notification Opt-Out

You may disable push notifications at any time in the app or via your device's system settings.

California Residents (CCPA)

California residents have the right to know what personal information is collected, to request deletion, to opt out of the sale of personal information (we do not sell personal information), and not to be discriminated against for exercising these rights. To exercise these rights, contact support@gritleanpulse.com.

European / UK Residents (GDPR / UK GDPR)

If you are located in the European Economic Area or United Kingdom, your data controller is SJK & Sons LLC®. Our legal basis for processing is: (a) performance of contract (to provide the app); (b) legitimate interests (to improve the app, prevent fraud); and (c) your consent (for health data and third-party integrations). You have the right to lodge a complaint with your local supervisory authority.

8. Children's Privacy

GritLeanPulse is not intended for users under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that a child under 18 has provided us with personal information, we will delete that information promptly. If you believe a child under 18 has created an account, please contact us at support@gritleanpulse.com.

9. International Users

GritLeanPulse is operated from the United States. If you access the app from outside the United States, your information may be transferred to and processed in the United States, where data protection laws may differ from those in your country. By using the app, you consent to this transfer.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you via in-app notification and by updating the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Your continued use of GritLeanPulse after changes take effect constitutes your acceptance of the updated policy.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

• Email: support@gritleanpulse.com
• Company: SJK & Sons LLC®
• App: GritLeanPulse

We aim to respond to all privacy-related inquiries within 5 business days.