Last updated October 26, 2026

Privacy Policy

How Gravl collects, uses, and protects your personal data, and the rights you have over it.

1. Who We Are

Controller:
Gains Coach PTY LTD
ABN: 78671000801
5/45 Sir Thomas Mitchell, Bondi Beach, 2026, NSW, Australia
Email: support@gravl.ai

EU Representative (GDPR Article 27):
Matias Bruno
Calle de Viloria de la Rioja, Madrid, 28050, Spain
Email: support@gravl.ai

If you have any questions regarding this Privacy Policy or your personal data, you can contact us at the above email addresses.

2. General Principles

We process personal data in a minimal and lawful manner, only as necessary to provide our services, comply with legal obligations, or improve the app experience.

Legal bases for processing:

  • Consent: When you agree to specific data processing (Art. 6(1)(a) GDPR).
  • Contractual performance: Data needed to deliver the app's services (Art. 6(1)(b) GDPR).
  • Legal obligation: Required by law (Art. 6(1)(c) GDPR).
  • Legitimate interests: When necessary for app functionality, security, or business purposes, without overriding your rights (Art. 6(1)(f) GDPR).

Data retention: We delete or anonymize personal data once it is no longer necessary, unless retention is required by law or to fulfill contractual obligations.

3. Data We Collect

3.1 Data You Provide in the App

Includes:

  • Gender, training experience, bodyweight
  • Fitness goals, preferred muscle split, training duration, available equipment
  • Email and password (if registering)
  • Training progress data (exercises, sets, reps, weight)

Purpose: To create personalized workout plans, track progress, provide recommendations, and respond to inquiries.

Legal basis: Contractual performance (Art. 6(1)(b) GDPR).

Retention: Deleted when no longer needed or when the account is deleted.

3.2 Apple HealthKit

With your explicit consent, we access HealthKit data such as activity energy, weight, body fat percentage, and exercise.

Purpose: To display data in the app for tracking workouts and bodyweight calculations.

Retention: Deleted from our app if you delete it in Apple Health or within our app.

Legal basis: Consent (Art. 6(1)(a) GDPR).

3.3 App Usage & Log Data

We collect technical data automatically, including:

  • Device identifiers, anonymized IP, timestamps, app pages accessed, usage events

Purpose: Ensure app functionality, stability, and security.

Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).

Retention: Log files deleted after 7 days; device identifiers anonymized afterward.

3.4 Third-Party Services

We use trusted third-party service providers ("Sub-processors") to support the operation and improvement of the Gravl app.

These services include, but are not limited to: Firebase, Google Analytics, Mixpanel, RevenueCat, Facebook Ads SDK, Singular SDK, Sendgrid, Sentry, Intercom, Microsoft Azure, Expo, Supabase, Customer.io, Google Gemini (Google LLC) and OpenAI.

AI Data Processing (Google Gemini)

We use third-party AI services to analyze user-submitted video content for exercise technique assessment. Specifically, Google Gemini is used to process exercise footage in order to provide automated form correction, performance analysis, and exercise scoring.

  • Data shared: Video footage, audio (if present), and derived biomechanical or movement-related data.
  • Purpose: To generate automated feedback, technique evaluation, and performance scores within the app.
  • Safeguards: Data is processed under a Data Processing Agreement (DPA) with Google, ensuring strict confidentiality, appropriate technical and organizational security measures, and compliance with applicable data protection laws. Google processes such data solely on our documented instructions and acts as a data processor. User data submitted via Gravl is not used to train or improve Google's general-purpose AI models.

General purposes of third-party services: Analytics, AI-powered feedback, push notifications, app functionality and improvements, marketing, payments and subscriptions, and customer support.

Legal basis: Legitimate interests (Art. 6(1)(f) GDPR), performance of a contract (Art. 6(1)(b) GDPR), or user consent where required (Art. 6(1)(a) GDPR).

International data transfers: Personal data may be transferred outside the EU/EEA (e.g., to the United States or Australia). Where applicable, we ensure that such transfers are protected through appropriate safeguards, such as Standard Contractual Clauses (SCCs) or reliance on the EU-U.S. Data Privacy Framework.

3.5 Newsletter

When subscribing, we collect your email, IP address, and registration timestamp.

Purpose: Deliver newsletters and prevent misuse.

Legal basis: Consent (Art. 6(1)(a) GDPR) or as allowed by applicable law.

Retention: As long as the subscription is active; other data deleted after 7 days.

Withdrawal: You can unsubscribe at any time via links in the newsletter.

3.6 Website Services

  • Google Fonts and social media platforms for communication
  • Log files: browser, OS, ISP, IP, timestamps

Legal basis: Legitimate interests (Art. 6(1)(f) GDPR).

Retention: Log files deleted after 7 days or anonymized.

3.7 Connected AI Assistants

You can choose to connect your Gravl account to AI assistants such as ChatGPT (OpenAI) and Claude (Anthropic). You start the connection in the assistant and approve it by signing in with your Gravl login. Sign-in and authorization for these connections are handled by WorkOS, which stores your email address and Gravl account identifier for this purpose. The connection service runs on Cloudflare.

Data the assistant can access: When you ask it to, a connected assistant can read your workouts, workout templates, training splits, custom exercises, personal records, training summaries, strength scores, body measurements, gym equipment profiles, and training settings, together with your name, username, subscription status, and the gender, height, and bodyweight in your profile. It can create and change workouts, templates, splits, custom exercises, and settings, and delete workouts, templates, and splits after you confirm. If you turn on AI Coach, it can also read your upcoming workout plan and add, change, and remove workouts in it.

Assistant memory: Gravl's AI assistants, including a connected assistant and the AI chat in the Gravl app, share one memory: short notes about your training preferences, goals, and schedule, so you do not have to repeat yourself. An assistant can read, add, change, and delete these notes. Assistants are instructed never to save health or medical details or credentials in them. Ask any Gravl assistant to forget a note, and it deletes it permanently. We keep the notes until they are deleted or you delete your Gravl account.

Gravl Macros: If you also use Gravl Macros, the same connection gives the assistant access to your Gravl Macros data. The Gravl Macros privacy policy describes what it can access.

Data it cannot access: Your email address, password, payment details, and other users' data.

Data sharing: Data the assistant reads is sent to the assistant's provider to answer your request, and the provider's own privacy policy applies to it. We do not sell this data or use it for advertising.

Purpose: To let you view and manage your training from an AI assistant of your choice.

Legal basis: Consent (Art. 6(1)(a) GDPR) and contractual performance (Art. 6(1)(b) GDPR).

Retention: We keep a record of each connection (the assistant account identifier, your email address, and connection dates) until you ask us to delete it or you delete your Gravl account.

Withdrawal: Remove Gravl in the assistant's settings to stop access at any time. To delete the connection record, contact support@gravl.ai.

3.8 Google Health (Fitbit)

If you connect Google Health in the app's Connected apps settings, Gravl reads your nightly heart rate variability (HRV) from your Google Account. We use it only to calculate your Readiness score in the app.

Data we access: Daily heart rate variability, read-only. We do not read other Google Health data, and we never change or write your Google data.

Where it is processed: Only on your device. The app connects to Google directly. Your Google Health data is never sent to or stored on Gravl servers.

Storage: The access token is kept in your device's secure keychain. The last 60 nights of HRV are cached on your device.

Sharing: We do not sell, share, or transfer your Google Health data to anyone. We do not use it for advertising, and we do not use it to train AI models.

Retention and deletion: When you disconnect Google Health in the app, we revoke our access and delete the cached data from your device. You can also remove Gravl's access at any time at myaccount.google.com/permissions.

Legal basis: Consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR). You can withdraw it at any time by disconnecting.

Gravl's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3.9 Garmin Connect

If you connect Garmin Connect in the app's Connected apps settings, you choose in Garmin's consent screen what you share with Gravl. You can change this at any time in the Garmin Connect app, under Connected Apps.

Data we receive: If you share health data ("Daily Health Stats"), Garmin sends us, for each night, your heart rate variability (HRV, last night's average), your resting heart rate, your sleep duration and your average breathing rate during sleep. We also store your Garmin user ID and the access tokens Garmin issues to us. We do not receive your Garmin activities, location or other Garmin data.

Data we send to Garmin: If you turn on Garmin Connect Sync, we send your Gravl workouts to Garmin Connect, so they appear there and on your watch.

Purpose: We use your Garmin data only to show it to you and to calculate your Readiness score in the app. Every value that comes from Garmin is labelled "Garmin".

Storage: Your Garmin data is stored on our servers, hosted by Microsoft Azure, in our database, hosted by Supabase. Both act only as our data processors. The app also keeps a copy on your device.

Sharing and AI: By default, your Garmin data is not shared with anyone, including AI services. We do not sell or rent it, and we do not use it for advertising or to train AI models. We do not share it with Google Gemini or with the AI assistants you connect to Gravl (section 3.7). It reaches an AI service only if you choose to use Gravl's in-app AI chat: when you ask the AI coach about your readiness, recovery, sleep or how hard to train, the app sends last night's values and your normal range to OpenAI to answer that question. OpenAI processes this data only on our behalf and does not use it to train its models. If you do not use the AI chat, your Garmin data is never sent to an AI service.

Retention and deletion: We keep your Garmin data while you are connected and share health data. We delete it when you disconnect Garmin in the app, when you remove Gravl in Garmin Connect, or when you turn off health data sharing for Gravl.

Legal basis: Consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR). You can withdraw it at any time as described above.

4. Your Rights

Under the GDPR, EU users have the following rights:

  • Access: Request confirmation and details of your personal data processing.
  • Rectification: Correct inaccurate or incomplete data.
  • Erasure: Delete personal data where legally permitted.
  • Restriction: Limit processing in certain circumstances.
  • Data portability: Receive your data in a structured, machine-readable format.
  • Objection: Object to processing based on legitimate interests or for marketing.
  • Consent withdrawal: Revoke consent at any time.
  • Automated decisions & profiling: Right not to be subject to automated decisions without safeguards.
  • Complaint: Lodge a complaint with a supervisory authority in your EU country.

To exercise your rights, contact support@gravl.ai or our EU representative, Matias Bruno.

5. Changes to This Privacy Policy

We may update this policy at any time to comply with legal obligations or improve clarity. The last update was September 27, 2026.