Version 1.15 — effective 8 October 2026. Changes from 1.14: our server no longer reads the meaning of what you write, or of what the AI answers, with fixed word lists; the AI model does that, under our instructions (§5 «The AI coach, in detail»). Concretely: the softer coach is switched on by the model when a message reads like food has become a struggle; the foods you do not eat and your allergies are given to the model with every request instead of being checked in its answer afterwards; the rule against medical advice, the rule about what may be remembered and the rule about what a conversation summary may contain are instructions to the model, not filters on our server; a larger model is chosen for a message that logs food or carries a link, not by word patterns. Amounts of food you state are read by the model too. No new recipient and no new category of data: the same messages go to the same providers as before.
Version 1.14 — effective 8 October 2026. Changes from 1.13: when a message you send to Grif contains a web link, our AI provider Google (Gemini API) opens that page itself, and may run Google Search queries, to answer from what the page says. The link is part of your message, which already goes to that provider; nothing else about you is added to the request for the page, and the site you linked sees a request from Google, not from you or from us (§6).
Version 1.13 — effective 8 October 2026. Changes from 1.12: the judgment model named in 1.12 — Jev, by TypeSafe AI, Inc. — gains one more task, for people who agree to it. The «AI coach» consent card has a new sentence (wording 2026-10-08-v5, shown by app versions released after 8 October 2026): to tell a message that logs food from any other, and so to pick which of our AI providers' models answers it, our server sends the text of the message you write to Grif — that message only: no earlier messages, no profile, no diary, no account identifier — to Jev, which answers with a probability and writes no text. If you agreed to an earlier wording of the card, nothing of what you write is sent to TypeSafe and the chat works as before; you are asked nothing new until you see the new card (§3, §4, §6).
Version 1.12 — effective 8 October 2026. Changes from 1.11: one more recipient in the web look-up of products our catalogue does not know (§2, §3, §6). Before the look-up and after it, our server asks a judgment model — Jev, by TypeSafe AI, Inc. — two yes-or-no questions: whether the name is a plain everyday food that needs no look-up at all, and whether the product a source found is the one that was named, so that the regular version of a sugar-free drink, or another brand, is not taken for yours. It receives the product name and, for the second question, the name and brand of the product found — no account identifier, no photo, no message, nothing else about you — and answers with a probability only. Nothing else changes.
Version 1.11 — effective 6 October 2026. Changes from 1.10: the text is brought into line with what the app and our server do since 4 October 2026. First, one way of working for the AI coach: the choice «What Grif may change» («Suggest and ask», «Only advise», «Change and tell me») and the separate «Change and tell me» consent are gone; Grif always changes and tells you — a change it makes on its own comes with a notification and a one-tap undo, within the same limits as before, and a lower calorie target is still only ever a proposal (§3, §4, §5). Second, no separate consent for the weekly check-in: the Sunday questions come with the weekly report, a line on the sheet says the answers are kept as health data for your weekly review and your targets, and answering is your choice each week; the answers are still kept no longer than 400 days and reach the coach's providers only under the «AI coach» consent (§3, §4, §5, §12). Third, the morning note no longer leaves at 07:00: it follows your answer to the morning journal, or comes at 09:30 your time if you have not answered by then; on Monday the same slot carries the weekly review, now written by the AI provider from the week's figures, always on, and able to change a target with a notification and undo (§2, §3, §5). The AI providers (Google Gemini and OpenAI) and dictation (sent to OpenAI, kept by neither us nor in our logs) are unchanged. The Consumer Health Data Privacy Policy is updated to 1.6 in step.
Version 1.10 — effective 2 October 2026. Changes from 1.9: the text is brought into line with what the app and our server do since 1–2 October 2026. First, a web look-up of products our catalogue does not know: when a food you log or scan carries a brand or a specific product name that is not in the catalogue, our server sends that product name — no account identifier, no photo — to Open Food Facts and to Google's Gemini API with Google Search, and keeps the answer (name, nutrition per 100 g, the source page) as a catalogue row shared by all accounts and linked to nobody (§2, §3, §5, §6). Second, corrections: barcode look-ups and nutrition-label photos were marked «upcoming» and are in fact live; Open Food Facts receives a product name as well as barcode digits (§3, §6). Third, the AI coach: every message you send now reaches the AI provider — the server-side check that answered some health questions with a fixed text is gone, and the rules against medical advice are instructions to the model; Grif now records what you ask it to record, including a dose you took, a side effect, a course your doctor set, a period day, a lab value, your profile and food exclusions, so the medication's name and dose can reach the provider when you bring them to Grif — §3 and §5 said they never did; the morning note is sent at 07:00 your time, regardless of quiet hours (§2, §3, §5, §6). Fourth, a connected assistant: you may connect your own Claude or ChatGPT to your diary; that assistant's provider then receives what you let it read (§2, §3, §6). Fifth, smaller items now named: a notifications master switch stored on our server, the email address from your sign-in token kept for letters from Grif and the mail provider that delivers them, and workouts from Apple Health / Health Connect saved to the server without a tap (§3, §6). The Consumer Health Data Privacy Policy is updated to 1.5 in step.
Version 1.9 — effective 1 October 2026. Changes from 1.8.6: the text is brought into line with five things the app already does. First, the optional weekly frames — two photos of your body a week, front and profile, kept encrypted for your own film roll — and the optional Body Scan, which sends the week's two frames with your sex and height to our AI providers for a body-fat range: §3 gains a row and a paragraph for each, §4 their two consents, §6 the recipients (Google Gemini, OpenAI as fallback; Cloudflare R2 holds the encrypted frames). Both are for adults only. Second, voice input: dictation sends the recording through our server to OpenAI to be turned into text, and we keep neither the recording nor the text; the scanner's voice sheet uses your phone's own speech recognition instead (§3, §6). Third, a correction: §3 said the photo library is never browsed — on iPhone, with your permission, the scanner shows your latest photos so you can pick a plate you already shot, and they stay on the phone until you tap Recognize; on Android the app uses the system photo picker and has no access to the library. Fourth, the picture you may attach to a dish you type in yourself is named (§3, §6), and the Android app no longer asks to read nutrition from Health Connect. Fifth, the App Clip's guest scan on iPhone — one meal photo analysed before you install the app, under a random guest key, the result kept for 7 days — is named (§3, §6). No new purpose beyond these features and no new recipient beyond those named. The Consumer Health Data Privacy Policy is updated to 1.4 in step.
Version 1.8.6 — effective 26 September 2026. Changes from 1.8.5: the app gains an optional weekly check-in behind its own separate consent. On Sunday, with the weekly report, Grif asks a few questions about the week — hunger, how the plan felt, training, rest, stress, whether you feel you are moving and, where they apply, whether your cycle affected the week and how a week on a GLP-1 medication went — answered by tap, no free text. §3 gains a «Weekly check-in» row and a paragraph on what the answers do: they feed the coach's weekly review and, for the first time, may move a target — calories, protein or steps — within your autonomy setting: on «Change and tell me» Grif may loosen a target by itself, with a notification and a one-tap undo, and tightening is always a proposal; nothing is tightened in the softer mode, nothing changes with fewer than three logged days, every number is computed by our code, and the ceilings are stated in §5. §4 gains the «Weekly check-in» consent, whose withdrawal deletes the answers; the «AI coach» consent gets a version that names the check-in. One new retention period: check-in records are kept while the consent stands and no longer than 400 days. No new recipient. The Sunday weekly report reminder now opens the check-in as well — one notification, not a second one. The Consumer Health Data Privacy Policy is updated to 1.3.6 in step.
Version 1.8.5 — effective 26 September 2026. Changes from 1.8.4: the app gains an optional morning journal behind its own separate consent. Three questions on the morning screen — when you went to bed and got up, how many cups of coffee or strong tea you had the day before and when the last one was, how many drinks of alcohol and when the last one was — and, if you switch that on, your sleep times from Apple Health / Health Connect, which for the first time reach our server rather than being shown on the phone only. §3 gains a «Morning journal» row and a paragraph on what the journal does and does not do: it shows you your own patterns (how your nights line up with your diary, weight and steps), feeds the coach's morning note and weekly review, never changes a target and never gives advice, and the alcohol question is hidden from anyone under 18. §4 gains the «Morning journal» consent, whose withdrawal deletes the answers and settings; the «AI coach» consent gets a version that names the journal figures. §3 also says that the journal is switched on for a random 90 % of accounts first and that the remaining 10 % see nothing until the trial ends — the draw uses no health fact. One new retention period: journal records are kept while the consent stands and no longer than 400 days. No new recipient. Two smaller additions ship in the same release: a saved meal line for an alcoholic drink (a beer scanned by its barcode, a glass of wine from the catalogue) now also keeps its grams of alcohol per 100 g, which count into its calories at 7 kcal per gram (§3); and §3 now names the Sunday weekly report reminder — a fixed text with its own switch that takes the place of the morning note when that week's report is still due. The Consumer Health Data Privacy Policy is updated to 1.3.5 in step.
Version 1.8.4 — effective 26 September 2026. Changes from 1.8.3: the optional medication tracker now also records a testosterone therapy course prescribed by a doctor, so the Medication data category in §3 names prescribed medication courses such as GLP-1 or testosterone therapy, says that the dose is kept exactly as you entered it with its unit, and says what the therapy diary computes — calendar dates only. §3 states plainly that a hormone therapy course may reveal sensitive information about you and that Grif never asks, records or infers why it was prescribed. The «Medication data» consent in §4 is re-worded to say the same and is shown in its new version only when you start a therapy course; people already using the GLP-1 tracker are not asked again. §12 names a testosterone therapy course among consumer health data. No new recipient, purpose or retention period. The Consumer Health Data Privacy Policy is updated to 1.3.4 in step.
Version 1.8.3 — effective 26 September 2026. Changes from 1.8.2: corrections that bring the text into line with what runs, and a stronger backup. No new category, purpose or retention period, and no new recipient — one existing processor, Cloudflare, now also holds an encrypted copy of our database backups. Server-side error reporting is on: errors on our servers go to the same Sentry account as the app's crash reports, scrubbed the same way — §3 and §6 said it was not yet enabled, which had stopped being true. Cloudflare R2 is our object store: the lab report files you upload rest there as ciphertext (encrypted by our server with a key Cloudflare never receives), in a private storage bucket of their own under random object names that say nothing about you, and so does a profile picture you set; the 1.6 sentence that a profile picture is «stored on our own server in Frankfurt» is superseded (§3, §6, §9). Backups are encrypted and kept in two places: the nightly database backup is encrypted on our server as it is written and kept on the same Frankfurt host for 30 days, and an encrypted copy goes to a private Cloudflare R2 bucket in the EU jurisdiction, where it is deleted after 30 days; the only key that can read a backup is held by us, off the server (§6, §7, §8, §9). Google Workspace hosts our support mailbox: what you write to support@grif.fit is processed by Google LLC as our mail processor, which §6 now names in place of the earlier «Cloudflare Email Routing» wording. Breach notification in §9 now states the deadline we hold ourselves to — the supervisory authority within 72 hours where the GDPR or UK GDPR applies, and you without undue delay when the risk to you is high. Account deletion in §8 now says precisely what it removes — your medication records, your push tokens and the lab files in storage among the rest — and that every consent is withdrawn with it. The Consumer Health Data Privacy Policy is updated to 1.3.3 in step.
Version 1.8.2 — effective 26 September 2026. Changes from 1.8.1, all about the AI coach. Grif may now write to you without a message from you in more ways than the two fixed-text notices: a morning note about the previous day, on by default for anyone who has accepted the «AI coach» consent, and a contextual note when you confirm a lab report, a weigh-in turns your weight trend or a dose day comes — both written by the AI provider from figures our code selects, so, while those switches are on, your data goes to the providers named in §6 on a day you have not written to Grif; and a quarterly vitamin D card, a fixed text with no model behind it. The pushes announcing all three are always the same neutral sentences. The policy also spells out what was implicit: the rolling summary of your conversations — written once a week by the provider, stored and read only while «Remember conversations» is on, deleted with «Delete all conversations»; a meal scan you attach in the chat (the dish name and the scanner's figures go to the provider, never the photo); that the coach's reads of your diary include the names of dishes, your 7-day Health totals only while the Health permission also stands, your weight trend, targets and programme; that two model sizes at the same providers serve different turns; and which analytics event codes the coach writes (§2, §3, §4, §6). No new category, no new recipient and no new retention period; the «AI coach» consent gets a new version that names the morning and contextual notes and is asked again before your next message. The Consumer Health Data Privacy Policy is updated to 1.3.2 in step.
Version 1.8.1 — effective 25 September 2026. Changes from 1.8, two of them. First, the AI coach now also receives your profile as you filled it in — sex, your birthday (day and month) and your age, height, goal, target weight and pace, activity level, diet type, meals a day, cooking preference, food exclusions and allergies, how often and where you train, your time zone and language — so that it can answer questions about you and take them into account; never your name, email or payment details, and never your year of birth. No new recipient and no new retention period; the «AI coach» consent gets a new version and is asked again before your next message (§2, §3, §4, §6). Second, both apps now carry Google's Firebase Cloud Messaging SDK: on Android it is the push transport; on iOS it sits beside Apple's push service, which still delivers every notification. The SDK creates a Firebase installation ID and a messaging token on the phone and registers them with Google, which acts as our processor; what it receives is set out in §2, §3 «Devices and push», §6 and §10. No analytics, crash, advertising or tracking component of Firebase is included, so §2's «no advertising or tracking SDK» stays true. The Consumer Health Data Privacy Policy is updated to 1.3.1 in step.
Version 1.8 — effective 25 September 2026. Changes from 1.7: the app gains three optional features, each behind its own separate consent and each described in full. The AI coach «Grif» — what it reads, which AI providers receive it and for how long, that none of it is used to train models, what the coach may change on its own and what only with your approval (§2, §3, §4, §5, §6, §8); the sentence that no decision is made automatically is replaced by §5 «Automated suggestions, human control», which says precisely what is automated and how you undo it. Lab reports — the file you upload goes to the same providers to be transcribed, the encrypted original is kept for 12 months, and you review every value before it is saved (§3, §4, §6, §9). Cycle tracking — reproductive health data behind a separate consent, deleted whole the moment tracking is switched off, and our position on requests from authorities (§3, §4, §6, §12). The Consumer Health Data Privacy Policy is updated to 1.3 in step.
Version 1.7 — effective 22 September 2026. Changes from 1.6: the app gains an optional medication tracker for GLP-1 prescriptions, so a new Medication data category is named in §3 with its own separate consent in §4, the consumer-health notice in §12 says that medication data is consumer health data and is never shared, and §12 states plainly that a breach of health data, including an unauthorised disclosure, is notified under the FTC Health Breach Notification Rule.
Version 1.6 — effective 19 September 2026. Changes from 1.5: §3 now says plainly that a profile picture is a second image you may choose to give us, beside the meal photo. It is stored on our own server in Frankfurt, is never sent to the vision providers, and setting one is optional. The app also stopped asking Apple for a Search Ads attribution token: the feature was never switched on, so nothing was gained by collecting it.
Version 1.5 — effective 18 September 2026. Changes from 1.4: the first release of the app ships without exercise demonstration clips, so cdn.grif.fit serves recipe photographs only and nothing in a request to it says anything about your questionnaire answers (§6). No new recipient, no new data.
Version 1.4 — effective 17 September 2026. Changes from 1.3: recipe photographs and exercise demonstration clips moved from the app's own server to a second, public Cloudflare R2 bucket, cdn.grif.fit (§6). It carries no personal data — only pictures and clips we produce ourselves, the same for every account.
Version 1.3 — effective 17 September 2026. Changes from 1.2: the Cloudflare row (§6) is corrected from a planned, future item to what the app actually does — it fetches its configuration file from a Cloudflare R2 bucket on every run, over a plain request that carries no account token and no visitor key, so Cloudflare sees only an IP address and user agent, like any CDN.
Version 1.2 — effective 17 September 2026. Changes from 1.1: the app now uses Sentry for crash reports, named with its region and what it does and does not receive (§2, §3, §6); the server's own error reporting, described since 1.0 as a possible future EU-hosted use of Sentry, is corrected to the account's real hosting region, the United States (§3, §6).
Version 1.1 — effective 17 September 2026. Changes from 1.0: the operator is now 42 TAPS INC, a Delaware corporation (§1, §7, §12); the website moved to grif.fit; product analytics (PostHog, EU) is named in §3 and §6; checkout on the website is no longer offered and its payment processors are removed from §3 and §6; how to exercise your rights and where to complain is set out in §8; what PostHog receives, including your IP address in transit, is stated precisely, and that our server can link the analytics key to your account (§2, §3, §6, §8); subscription analytics in Apphud is named with its legal basis (§3, §6); purchase records rest on legitimate interest and are kept for as long as applicable tax and accounting laws require, instead of a fixed five years (§3, §8); the remaining references to website receipts, orders and charge references are removed; the website grif.fit no longer sets cookies or runs analytics scripts (§3, §8).
This policy explains what the Grif mobile app (iOS and Android), its backend, and the website grif.fit do with information about you. It is written to match what the software actually does.
Grif is a fitness and nutrition programme: it works out calorie and macronutrient targets from your body figures by formula, builds a training and meal programme around them, keeps a daily diary, and — each only if you switch it on — estimates the calories of a meal from a photograph, talks to you as an AI coach, transcribes your lab reports and tracks your cycle. Grif is not a medical device and does not diagnose, treat, cure or prevent any condition.
The data controller (the "operator", "we") is:
42 TAPS INC, a Delaware corporation, 200 Continental Dr Ste 401, Newark, Delaware 19713-4337, United States.
Contact for anything in this policy, including requests to exercise your rights (§8): support@grif.fit
The table lists every category the current build collects. "Basis" refers to GDPR Article 6 (and Article 9 for health data); the same categories apply outside the EU/UK under the laws named in section 12.
| Category | What exactly | Where it comes from | Why | Basis | Kept until |
|---|---|---|---|---|---|
| Account | Email address (also your username), first and last name as typed at registration, password (stored hashed by our sign-in service Keycloak), an internal account id | You, at registration | Sign you in, address you by name, contact you about your account. Since 2 October 2026 our server keeps, on your account record, the email address carried by your sign-in token, so that letters from Grif (confirming the address, reminders, account notices) can be sent to it through the mail provider named in §6; every reminder letter carries an unsubscribe link, and the notifications master switch stops them | Contract (6(1)(b)); legitimate interest (6(1)(f)) in reminding you of a service you subscribed to, for the reminder letters | Account deletion. The internal id is retained as a tombstone so that a stale sign-in token is refused rather than creating a new account (§8) |
| Questionnaire and body figures | Sex, date of birth / age, height, weight, activity level, goal, training experience, where you train, training days per week; optional neck, waist and hip circumferences; food exclusions (allergies and foods you do not eat); the frozen calculation (BMR, TDEE, targets, body-fat estimate) | You, in onboarding and Profile → Recalculate | Compute your targets by formula (US Navy body fat, Katch-McArdle or Mifflin-St Jeor, activity factor, goal correction), build the programme and menu; and, if you turn the AI coach on, let the coach read your profile (see «The AI coach, in detail») | Explicit consent for health data (9(2)(a)) — the "Health data processing" consent; sending it to the coach's providers rests on the separate "AI coach" consent | Until you erase your data, withdraw the health consent, or delete the account |
| Diary | Daily: weight, steps, workout (type, minutes, sets, RPE, estimated kcal), calories and macros eaten and where the figure came from; weekly: circumferences, body-fat %, average weight; exercise log (exercise, weight lifted); saved meals (name, grams, kcal, protein, fat, carbs, for an alcoholic drink its grams of alcohol per 100 g, counted into kcal at 7 kcal per gram, source: scan / manual / day total); programme enrolment (which programme, which week); the exercise you chose instead of a planned one in a given session (an exercise swap) | You, by hand, from a meal scan, or imported from Apple Health / Health Connect after you confirm it | Run the tracker, adjust targets week by week, show progress | Explicit consent (9(2)(a)) — the same health consent | Until erase / withdrawal / deletion. Programme enrolment (which week you are on) survives an erasure because it is the state of a paid service, not a health record |
| Health platform data (Apple HealthKit, Health Connect) | Read: steps, weight, body-fat %, nutrition (kcal, protein, fat, carbs — on iPhone only; the Android app does not ask to read nutrition), workouts, active energy; menstrual flow, only if you switch on reading it for cycle tracking (the «Cycle data» row); sleep (when you fell asleep and woke, and the time asleep), only if you switch on reading it for the morning journal. Written: weight and the kcal/protein/fat/carbs of a meal you confirmed in the diary; body-fat % computed from your own circumferences is being added | Your phone's health store, only after you grant the permission from Profile → Health | Pre-fill the diary with what you would otherwise type; keep your health store in step with the diary | Explicit consent, expressed by granting the OS permission, and the health consent above for what you then save | What you read is shown to you first and reaches our server only when you save the diary entry — with three exceptions: the coach's activity totals (below) and the night's sleep times for the morning journal (the «Morning journal» row), each of which you switch on separately; and, since 1 October 2026, workout sessions: once you have granted the workouts permission, the sessions your health store holds for the day you have open are saved to your diary on our server without a tap (type, start, minutes, energy, and the health sample's id so that a second read sends nothing; a session you removed is not sent again, and an entry you edited is not overwritten). What we write stays in your health store under your control |
| Meal photographs and the free text you type with them | One photo per scan (taken or picked), normalised on the phone (resized, EXIF and location removed); the optional hint typed before the scan and the correction typed over the result; the meal slot and your language | You, in the food tab | Recognise the food on the plate and estimate portions; the calories are then computed by our server from a food database, never by the model | Explicit consent for the transfer to named providers (9(2)(a)) — the "Food diary photographs" consent, given at a specific text version | We hold the photo only in memory for the duration of the request; the pending attempt's body on your phone is erased on the answer, after 24 h, or when you withdraw the consent. A working copy of the result (rows, grams — no image) lives in our cache for 24 h. The provider's retention is in §6 |
| App Clip guest scan (iPhone, before you install the app) | One meal photo per scan, a random guest key the App Clip creates on your phone, the scan's result (rows, grams — no image), the campaign link you came from, and your IP address for a per-address daily limit; no account, name or email | You, in the App Clip opened from a Grif link or code | Show you what is on the plate, and move the result into your diary if you then install Grif and sign in | Steps you ask for before a contract (6(1)(b)); our legitimate interest in preventing abuse (6(1)(f)) for the limits | The photo only in memory for the request, as for meal photos; the result for 7 days under the guest key, then deleted unless you moved it into your diary; the key's scan counter for 30 days after its last scan. The provider's retention is in §6 |
| Nutrition-label photographs | A photo of a packaged product's nutrition label, sent through the same pipeline as a meal photo | You | Read the label's serving size and per-100 g figures into your diary | Same consent as meal photographs | Same as meal photographs |
| Barcode lookups | The EAN/UPC number read by your phone's camera | Your phone reads it; only the digits are sent | Find the product in Open Food Facts | Contract (6(1)(b)) — no photo, no consent gate | The product record is cached for 30 days (7 days for "not found"); nothing about you is attached to it |
| Product look-ups on the web (since 1 October 2026) | The name of a product — the label text you typed or said, or the text the vision model read from your photo, and its English rendering — when it names a brand or a specific product our catalogue has no entry for. Nothing else: no account identifier, no photo, no portion, no meal, no date; the request leaves from our server, so the recipient sees our server's address, not yours | A food you log by photo, text or voice, or through Grif | Find that product's nutrition per 100 g (energy, protein, fat, carbohydrates, fibre, and micronutrients) so that your entry is priced from the real product rather than a generic one; our code checks the figures for plausibility before using them, and a judgment model (Jev, by TypeSafe — §6) is asked whether the name needs a look-up at all and whether the product found is the one named | Contract (6(1)(b)) — the product name is not sent together with anything that identifies you; the entry it prices is your diary, kept under the health consent | What comes back is stored as a catalogue row shared by all accounts: product name and brand, the nutrition figures, the name you used as a search alias, the source and the address of the page it was read from. The row carries no account id and is not linked to you, so it is not removed by an erasure or an account deletion; our logs record only the outcome, the source and the time taken — never the name. Because the name is free text, do not type personal details into a food name. The recipients' own retention is in §6 |
| Connected assistant (optional; since 1 October 2026) | That you connected an assistant (the sign-in and the access it was granted at our sign-in service); each call it makes under your account — a read of a day or week of your diary, or a write of what you told it to log (a meal, water, weight, a finished workout, a dose you took), with the words it hands over as yours — and the write's undo record | You, by adding Grif as a connector in your own Claude or ChatGPT and signing in to Grif there; then that assistant, at your instruction | Let you read and keep your diary from the assistant you already use | Contract (6(1)(b)) for the connection; the diary entries themselves rest on the health consent, and a dose can be logged only if you gave the medication consent in the app | The entries are diary entries and follow the diary's rules. The connection lasts until you remove the connector in the assistant or revoke its access; an active subscription is required. What the assistant's provider keeps of what it read is governed by its terms with you (§6) |
| Notification settings | Which reminders are on and their times; since 2 October 2026 also one master switch for all notifications and whether notifications are off at the system level on your phone | You, in Profile → Notifications; your phone reports the system permission | Send only what you asked for: with the master switch off our server sends no push, no coach notice, no Live Activity update and no reminder letter | Contract (6(1)(b)) | Until erase / deletion |
| Subscription and purchases | Store product, original transaction id, purchase and expiry dates, storefront country, state (active, grace, expired, refunded…), environment | Apple, Google (via Apphud) | Grant and check access to the paid programme; keep purchase records; subscription analytics (conversions, renewals, refunds) in Apphud | Contract (6(1)(b)) for access; legitimate interest (6(1)(f)) in complying with the record-keeping and tax requirements of the United States for the purchase records; legitimate interest (6(1)(f)) in understanding how subscriptions convert, renew and are refunded, for subscription analytics | Purchase records are kept after erasure and deletion for as long as tax and accounting laws that apply to us require |
| Apphud identifiers | Before sign-in: a random install id generated by the app. After sign-in: a keyed hash of your internal account id (not your email, not your sign-in subject) | Generated by the app / our server | Let Apphud attribute the store transaction to your subscription | Contract (6(1)(b)) | Until account deletion (the mapping); Apphud's own retention is governed by its policy (https://apphud.com/privacy; data processed in the United States) |
| Devices and push | Platform, push token (Apple's APNs token on iOS, a Firebase Cloud Messaging token on Android), time zone, app version, last seen; on iOS, which of Apple's two push environments accepted the token. Separately, the Firebase SDK inside both apps generates a Firebase installation ID and a messaging token and registers them with Google (on iOS together with the APNs token) — Google holds these, not our server; the iOS messaging token is read by nothing in the app and never sent to us (§6, §10) | Your phone, when you turn on reminders — nothing is posted to our server before you are signed in and the permission is granted; the Firebase identifiers are created by the SDK at first launch | Send reminders about today's session and the weekly check-in; if you use those features, the coach's notices (headed «Grif · AI», naming the setting they concern — never a value — some with an «Undo» button), its evening check-in and Monday review, its morning note, contextual note and vitamin D card (each of those pushes always the same neutral sentence — the note itself is only in the chat), and a reminder to retest a lab marker (marker names only, behind a switch of its own); with a separate opt-in, news and offers | Consent (the "Push notifications" consent, recorded when you grant the system permission); marketing pushes only on the separate "News and offers" opt-in, off by default | Removed on sign-out (best effort), on erasure, and on deletion. The push token is never included in your export |
| Product usage events | Event type, onboarding step number and screen id, a random session id, permission results (granted/denied), API error codes, paywall rail/surface/storefront, purchased plan, which home-screen widget opened the app; added by the analytics library: app version and build, device model, operating system and version, screen size, language, time zone, network type and its own random device and session ids. Keyed by a random key issued at installation; our server can link this analytics key to your account. No measurement, no free text: a deny-list on the phone drops any event that carries those field names | The app, sent to PostHog (see Product analytics below) | Understand where people drop out of onboarding, whether the paywall works, whether a feature is used | Legitimate interest (6(1)(f)) in improving a product we operate, balanced by the deny-list and by storing no IP address or location with the events | Kept in our PostHog project without a fixed end date; the events carry no measurement and no name or email. Deleting your account does not delete them from PostHog: ask support@grif.fit to delete these events |
| Medication data (optional tracker for prescribed medication courses such as GLP-1 or testosterone therapy) | The medication or therapy you were prescribed, its form, its dose exactly as you entered it with its unit, your schedule, where the prescription came from (for a GLP-1: your doctor, an online clinic, a compounding pharmacy, or "prefer not to say"; a therapy course is always recorded as prescribed by a doctor), the dose entries you log with their date and time, the injection or application site, the side effects you record with their severity, your dose-day reminder settings, and whether the course is active | You, in onboarding and in the medication screens | Show your dose schedule, remind you on dose day, keep your dose log, and — for a GLP-1 only — raise your protein target | Explicit consent for health data (9(2)(a)) — the separate "Medication data" consent | Until you erase your data, withdraw the medication consent, end the course and delete the log, or delete the account |
| AI coach — conversations, memory and actions (optional) | What you write to Grif and what it answers, with the cards it shows; the facts you asked it to remember (short notes such as «no fish» or «travelling until Friday», at most 20); a rolling summary of your conversations (rewritten once a week by the AI provider from your last few dozen messages — what was discussed, what you prefer about food and routine, what is still open; no quotes, no numbers, nothing about illness, medication, lab results, your cycle or mood — written and read only while «Remember conversations» is on); a journal of every change the coach made or proposed to your settings (what, when, the reason as a code, whether you undid it); your coach settings (whether conversations are remembered, which notes it may write first); the meal and water reminders the coach set for you and the water you log through it; a record of which proactive notices were sent to you and when (type, day and the reason as a code — never text); and a time-limited flag our server sets when a message reads like disordered eating — restriction, compensation, fear of food, obsessive counting, concealment — under which the coach will not lower your calorie target and keeps a softer tone for 14 days after the last such signal. The flag is set by fixed word patterns on our server, not by the AI provider, and records neither the message nor which pattern matched. A photo or file you send in the chat follows the meal-photo or lab-report rules and is not stored as a message; a meal scan you attach from the chat's paperclip appears as a card with the dish name and the scanner's figures, and only those reach the coach | You, in the chat; the coach's own answers | Answer you, keep the thread of a conversation, act on your settings within the limits in §5, and let you see and undo what it did | Explicit consent for health data (9(2)(a)) — the "AI coach" consent; it also covers the changes the coach applies without asking, with a notification and undo — since 4 October 2026 there is no separate «Change and tell me» consent | Conversations: 90 days, then deleted by a scheduled job, or at once with «Delete all conversations», which deletes the rolling summary with them; the summary otherwise stands until its next weekly rewrite and is neither written nor read while «Remember conversations» is off; memory facts: until you delete them, one by one or all; the journal of changes: until you delete the account (it is the record of what was done to your settings, not the conversation); the disordered-eating flag: 14 days after the last signal; everything on withdrawal of the coach consent, erasure or account deletion |
| Health summaries for the coach (optional) | Daily totals for the last 7 days — steps, active energy, number and minutes of workouts, body-fat % — read from Apple Health / Health Connect when you open the app | Your phone's health store, only while the coach is on and the Health permission is granted; the app uploads the totals once a day, when you open it or return to it, at most 14 days per upload and never a day older than 90 days | Let the coach see your activity and adjust the step target within the limits in §5 | The "AI coach" consent together with the Health permission (row above) | 90 days, then deleted by a scheduled job; earlier on withdrawal of the coach consent, erasure or account deletion. This is the first time a Health value is stored on our server rather than only shown to you |
| Lab reports (optional) | The PDF or page photos of a laboratory report you upload (up to 20 pages or 10 images), exactly as you upload them — including whatever your laboratory printed on the form, usually your name, date of birth, a patient number and the laboratory's name; the values transcribed from it (marker, value, unit, the reference range printed by your laboratory, the collection date, where on the page the line was printed, and — for a hormone drawn twice in one day — the order of the draws), the corrections you make before saving, and whether the sex and age printed on the form matched your profile (only the answer, never the printed values); values you type in by hand (marker, value, unit, collection date and, if you add them, the laboratory and its range) — these go to no provider; a qualitative result («negative», «positive», «detected») stored as that fixed value; the note shown under a confirmed report, which our code assembles from fixed templates and the foods linked to the marker — no model is called for it; retest reminders (marker and date only, never a value) | You, from the Labs screen (upload or manual entry), the chat, or your phone's share sheet («Open in Grif» — the file is handed to the app and uploaded only after you confirm) | Transcribe the report, show each value against the range your laboratory printed, keep a history per marker, and — if the coach is on — explain the report and connect it to your food | Explicit consent for health data (9(2)(a)) — the "Lab reports" consent | The original file: 12 months after you confirm the report, then deleted; an upload you never confirmed: 7 days; the provider's raw transcription: 90 days (kept to settle a dispute about a value), then blanked; the confirmed values: until you delete the report, erase your data or delete the account. You can delete any report, with its file, at any time |
| Cycle data (optional, women's profiles only) | The dates your periods started and ended; flow on the days you mark (spotting, light, medium, heavy); symptoms from a fixed list; the tracking mode you chose (natural, hormonal, paused); your typical cycle length if you gave it; whether the tile is shown on the home screen; whether reading from your health store is on; the reminder setting; and your answer to the question whether you have had a period in the last three months. No free text, no method of contraception, no reason for a pause, no pregnancy record and no prediction is ever stored — the cycle day, the expected next period and the phase are computed each time you look and thrown away | You, in the cycle step of onboarding or Profile → Cycle; menstrual-flow entries from Apple Health / Health Connect, only if you switch that separate toggle on — the last 12 months on iOS, the last 30 days on Android (the most Health Connect allows without the history permission, which we do not ask for); an entry you logged yourself always outranks one read from the health store | Show your cycle day, mark water-weight days on the weight chart, hold the code back from a false calorie correction, and add a note to food and training | Explicit consent for health data (9(2)(a)) — the "Cycle tracking" consent | For as long as tracking is on — pausing keeps it. Deleted whole, with no retention period, the moment you switch tracking off in Profile → Cycle or withdraw the consent, change your sex in the profile, erase your data or delete the account |
| Morning journal (optional) | Per night: when you went to bed and got up (typed on the morning screen, or read from your health store if you switched that on, marked with its source), the time asleep our code derives from them; how many cups of coffee or strong tea you had the day before and the hour of the last one; how many drinks of alcohol and the hour of the last one; whether you answered «I don't drink — stop asking»; your journal settings (which questions to ask, not before what hour, whether you sleep in the daytime, whether the morning screen is on). No free text and no reason is ever asked. The alcohol question does not exist for a profile under 18 or while the coach is in its softer mode | You, on the morning screen; your phone's health store, only if you switch on reading sleep for the journal (Profile → Grif → Morning journal) | Show you your own patterns on the Progress screen — how your nights line up with your diary, weight and steps — as observations, never as advice; feed the figures of the night to the coach's morning note and weekly review (only if the coach is on); pre-fill tomorrow's question with today's answer | Explicit consent for health data (9(2)(a)) — the separate «Morning journal» consent; sending the figures to the coach's providers rests on the «AI coach» consent in the version that names them | While the «Morning journal» consent stands and no longer than 400 days per record (a nightly job deletes older ones). Deleted whole — answers and settings — when you withdraw the consent, erase your data or delete the account |
| Weekly check-in (optional) | Per week, answered by tap on Sunday with the weekly report: how hungry you were, how the plan felt, how training felt, how rested you are, how much stress there was, whether you feel you are moving; if you track your cycle, whether it affected the week; during a GLP-1 course, how the week on the medication went; chips for what got in the way this week or is coming next week (illness, travel, a holiday, a busy stretch); and the outcome our code drew from the answers — the rule that fired, the target it proposed or applied, or why it waited. No free text and no question about why. The cycle question exists only while cycle tracking is on, the medication question only during a course; nothing about a hormone therapy course is ever asked | You, on the Sunday sheet; the outcome is computed by our code | Feed the coach's weekly review; apply with a notification and undo a higher calorie or protein target or a lower step target, or propose a lower calorie target, within the limits in §5; put a note in the review about a hard week of training or stress | Explicit consent for health data (9(2)(a)), given by answering: the sheet says in one line that the answers are kept as health data for your weekly review and your targets, and every question may be left unanswered (the separate «Weekly check-in» consent was retired on 4 October 2026); sending the answers to the coach's providers rests on the «AI coach» consent | No longer than 400 days per record (a nightly job deletes older ones). Deleted whole when you erase your data or delete the account, or at your request to support@grif.fit; a target change already applied stays in the journal of the coach's changes with its undo |
| Weekly frames (optional, adults only) | Two photos a week — front and profile — taken with the app's camera, a small thumbnail of each, the week and pose they belong to, and when each was taken, replaced or deleted | You, in the app's camera, once a week | Show you how your body changes week to week in a private film roll, side by side and as a video at the end of the programme; the input for Body Scan if you run it | Explicit consent (9(2)(a)) — the «Weekly frames» consent (body_photos): a one-line notice on the frame screen, and taking a frame is the consent | While your account and the consent stand. A frame you delete leaves our storage within 24 hours; withdrawing the consent deletes every frame and every Body Scan estimate; erasure and account deletion delete them too |
| Body Scan estimates (optional, adults only, a paid add-on) | For each run: the body-fat range the model gave for the week's two frames, the range our code kept after cross-checking it with the US Navy formula from your height and the neck and waist you measured in the last 28 days, its midpoint and a confidence word, the method version and which provider answered — or the reason no estimate was given (framing, light, clothing, pose, policy) | Our server, from your two frames with your sex and height (sent to the provider) and your tape measurements (which stay on our server) | Give you a body-composition reference and its trend; if the coach is on, Grif can tell you the trend in words. It never feeds your calorie target and is not a medical measurement | Explicit consent (9(2)(a)) — the «Body Scan» consent (body_scan): a one-line notice on the Body Scan screen, and starting a scan is the consent | While both this consent and the «Weekly frames» consent stand; withdrawing either, erasure or account deletion deletes the estimates. If the model reports that the frames may show a minor, no estimate is given and both frames of that week are deleted |
| Voice recordings for dictation | The audio you record while the microphone is on — at most one minute a clip, a limited number of clips a day — and your Grif language as a hint | You, in the chat with Grif or when you describe a meal by voice | Turn what you say into text in the field you were typing in | Contract (6(1)(b)) — you ask for it each time you use the microphone | Not kept. Our server holds the clip in memory only for the request and passes it to OpenAI; neither the clip nor the text that comes back is stored or logged by us. The text is kept only if you then send it, under the rules for what you sent (a message to Grif, a meal description). We keep a counter of the day's clips and an event with the clip's length and outcome. OpenAI's retention is in §6 |
| Custom dish pictures (optional) | A picture you attach to a dish you type in yourself, stored as a JPEG without metadata, with a thumbnail | You, in the dish editor | Show the dish in «My dishes»; with the dish's name and note, estimate its micronutrients — the macros you typed are never changed | Contract (6(1)(b)) | Until you remove the picture or the dish, erase your data or delete the account |
| Preferences | Language, unit system (metric/imperial), time zone, notification toggles, referral code redemptions | You | Show the app in your language and units; schedule reminders at your local time | Contract (6(1)(b)) | Account deletion |
| Website visits (grif.fit) | The website sets no cookies and loads no analytics, advertising or tracking scripts. Like any web server, ours receives your IP address, the page requested, the referrer and your browser's user agent in order to answer the request | Your browser | Serve the page | Legitimate interest (6(1)(f)) | Web server log lines are kept like the server logs below. Visit records from the earlier website are detached from your person when you erase your data |
| Support | Whatever you write to us and the address you write from | You | Answer you | Legitimate interest (6(1)(f)) | 12 months after the request is closed |
| Server logs and error reports | Account id, event type, request path, timing, app version and platform. Error reports, if error reporting is enabled, carry the exception and stack, an allow-listed set of headers (User-Agent, Content-Type, Content-Length, Accept, Referer, X-Request-Id), and nothing else: no user object, no request body, no cookies, no query string, no Accept-Language | Our servers | Keep the service running and find faults | Legitimate interest (6(1)(f)) | Logs: 30 days. Error reports from our servers go to the same Sentry account as the app's crash reports (US-hosted, see the row below), with personal fields scrubbed the same way and performance traces dropped before sending; Sentry keeps an event for 90 days |
| App crash reports | Since 17 September 2026: an app crash's stack trace, device model, operating system and app version. No account id, no name or email, no body figure, no photo, no free text, no screen recording, no session or performance data — the app switches every automatic collector of the crash SDK off by name, and a build check fails if one is switched back on | The app, on a crash, sent to Sentry | Fix bugs before they reach more people | Legitimate interest (6(1)(f)) | Kept in our Sentry project under Sentry's own retention; write to support@grif.fit to ask for a report deleted sooner |
Medication data, in detail. The medication tracker is optional: nothing in it is collected unless you turn it on and give the separate consent. Grif is not a medical device, does not diagnose or treat anything, and never recommends, calculates, converts or escalates a dose — it records the dose your own prescriber set. It shows no missed-dose window and no step length; where it warns that a dose is logged sooner than the label's minimum interval or above the highest dose in the label, those figures come from the medication's FDA-approved label, the app names the label and its revision date on the screen, and whether to take, skip or change a dose is left to your prescriber. Medication data is shared with nobody, with one exception you control: when you ask Grif, the AI coach, to record, correct or show a dose, a side effect or your course (§3 «The AI coach, in detail»), what you stated and the record Grif writes go to the coach's AI provider for that conversation; and if you log a dose from an assistant you connected yourself (§6), that assistant's provider has what you told it. Beyond that it is not sent to the vision providers, not sent to analytics, crash reporting or push services, not used for advertising or any other use-based purpose, and is not written to Apple Health or Health Connect. It is stored on our own server in Frankfurt and in the app's local store on your phone; it is never stored in iCloud. Our staff cannot see it: it is excluded from the support cabinet and from its exports. Withdrawing the consent, erasing your data or deleting your account deletes the medication, the dose log and the side effects at once and cancels the reminders; the dated record that you gave and withdrew the consent stays, because it is the proof that we asked. As with everything else, an encrypted nightly database backup is kept for 30 days, so a deleted row can persist in a backup for up to 30 days; backups are used only to restore the whole database, never one person (§8).
A testosterone therapy course, in the same diary. If your doctor prescribed testosterone therapy, the same optional tracker can keep its diary: the form (injection, gel, patch or pellets), the dose exactly as written in your prescription, in the unit your doctor used, your schedule, the last dose, the doses you log and the side effects you note. Grif computes only calendar dates — the next dose day and a local reminder whose text never names the therapy or the dose. It never converts a dose (for example milligrams to millilitres), never suggests, adjusts or escalates one, shows no target level and no titration, and the five laboratory markers you may upload with it (total and free testosterone, estradiol, hematocrit, PSA) are shown against your laboratory's own printed range with a «discuss with your doctor» line and are never interpreted. A hormone therapy course may reveal sensitive information about you — about your health, or about a therapy you would rather keep private; Grif never asks, records or infers why it was prescribed, keeps the course only for this diary, and treats it exactly as the rest of your medication data: shared with nobody except as the previous paragraph says, never in analytics, never used for offers or pricing, never visible to our staff, and deleted at once when you withdraw the consent, end the course and delete the log, erase your data or delete the account. Unless you bring it to the chat, the AI coach is told only that a course exists and that today is a dose day; if you ask it to record a dose you took or the course your doctor set, it records what you state (the previous paragraph) and is instructed to leave any question of whether a dose or a value is right to your doctor. This part of the tracker is offered to adult men's profiles outside Russia.
The AI coach, in detail. Grif the coach is optional and off until you accept the «AI coach» consent; declining changes nothing else in the app. The label «AI · not medical advice» stands in the chat header, and «AI» in every notification the coach sends. What it reads is the list on the consent card and nothing beyond it: your profile as you filled it in — sex, your birthday (day and month) and your age, height, goal, target weight and pace, activity level, diet type, meals a day, cooking preference, food exclusions and allergies, how often and where you train — and your time zone and language (never your name, email or year of birth); your food diary — the meals by slot with the names of dishes as you or the scanner entered them — and its nutrient totals, your weight and its trend over the last two to twelve weeks, measurements, workouts and the training programme, your targets and the week's balance, your reminder and balance settings, the facts you asked it to remember, the health summaries above (the last 7 days) if you granted Health access and only while that permission stands, and the fact that you are on a medication course and whether today is a dose day. Medication details reach the model when you bring them to Grif (since 1 October 2026; before that they never did): if you ask Grif to record, correct or delete a dose you took, a side effect, or the dose and schedule your doctor set, your message and the record Grif writes and reads back — the medication's name, the amount and unit, the injection site, the time — go to the provider as part of that conversation. Grif records what you state and nothing else; it is instructed never to judge or suggest a dose. If cycle tracking and the coach are both on, it also receives your cycle day, phase and today's symptoms (and, only when you ask about them, the symptoms of the last 30 days — never the dates of your periods); if lab reports and the coach are both on, your confirmed results — never the file or an unconfirmed draft. Every message you send reaches the model (since 1 October 2026; earlier versions answered questions about medication, doses, symptoms and diagnoses with a fixed text of ours and did not send them to the provider). The rules now sit in the model's instructions: it records what you ask it to record; it is instructed never to recommend, choose, start, stop, continue or compare a medication or a supplement and never to say whether a dose, a schedule or a lab value is right — it says that this is a question for the doctor who manages your treatment; and, when a message reads like a crisis, to urge you to contact local emergency services or a crisis line and to do nothing else in that turn. These are instructions to a model, not a guarantee of what it writes; Grif is a reference, not a medical device and not treatment. A softer coach for 14 days. If a message reads like disordered eating — since 8 October 2026 the AI model itself notices this while answering you, under our instruction, and tells our server; no fixed word list is involved any more — the coach stops proposing any cut to your calorie target, drops the «over target» cards and keeps a supportive tone for 14 days after the last such message, and shows a card with where to find help when the wording is explicit; nothing about it is said to you as a verdict, and the flag records no text. A nutrient norm after a lab result is the one thing the coach may propose on the strength of a report: only upwards, only after a value below your laboratory's range, computed by our code from that result (never above the upper limit, for 90 days, at most once per 30 days per nutrient), and the card shows the result it rests on. Memory is written only when you tap «Yes» on «Remember this?», never silently; the model is instructed to keep health conditions, medications and cycle details out of it, and since 8 October 2026 a fact you type yourself on the memory screen is stored as you typed it; you see every fact, with its date, in Profile → Grif and can delete any of them. A rolling summary of your conversations is kept beside the memory: once a week our server hands your last few dozen messages to the AI provider, which writes a short paraphrase — what was discussed, what you prefer about food and routine, what is still open — with no quotes, no numbers and nothing about illness, medication, lab results, your cycle or mood; since 8 October 2026 that rule is an instruction to the model and our server only strips markup and bounds the length. It is written and read only while «Remember conversations» is on, goes to the provider as context with your next messages, and is deleted with «Delete all conversations». A meal scan you attach from the chat's paperclip goes to the provider as the dish name (as the scanner read it) and the scanner's calories, protein, fat and carbohydrates — never the photo, which follows the meal-photo rules; the coach's comment quotes those figures and not its own. Two model sizes at the same providers, chosen by our code and never by a model: most turns go to a small model; the Monday review, the reasoning behind a proposal, a message that logs food and a message with a link go to a larger one while it stays within a fixed share of your day's budget, then to the small one. Logs and analytics carry event codes, durations and the model tier — never the text of a message: that a message was sent and its length band, a reply's latency, tier, tool count and whether a number was rejected, the category of a fixed-list check, a proposal shown, accepted or declined, a change applied or undone and how long it stood, a proactive notice sent or held back with the reason as a code and whether its text came from the model or a template, a settings change, a lab or cycle read; nothing the coach reads from Apple Health or Health Connect is ever sent to analytics, crash reporting or an advertiser. When Grif writes first. Six kinds of notice; all of them can be paused and all but the weekly review switched off in Profile → Grif, and for all of them our code, never a model, decides whether and when to write. One is a fixed text with a link to the chat: an evening check-in at the time you set (20:00 your time by default), sent only on a day when a nutrient of your week is below its norm. Three are written by the AI provider from figures our code selects, and only after our code has found a reason. The morning note — while the «Morning message» switch is on (it is on by default once you accept the coach), one note each morning, after you answer the morning journal, or at 09:30 your time if you have not answered by then (since 4 October 2026; from 2 October it was a fixed 07:00, before that a time you set), about the previous day: our code reads the meals logged and their calorie, protein and fibre totals against your targets, the week's low nutrients, whether a food you asked to avoid appeared in the diary, your steps against the target if Health is granted, the direction of your weight trend, whether today is a dose day, your cycle phase, your logging streak and — if you keep the morning journal — the night's sleep and the previous day's alcohol, picks a single reason in a fixed order, and only then asks the provider to write two or three sentences from those figures and, when you are short of something, from one to three food suggestions our code picked from a fixed table, leaving out the foods you exclude. Nothing is sent when there is nothing to say: a day with nothing to review gets a short note with a question instead of a review; no diary entries for 14 days means no morning notes; while the softer coach of the previous paragraph is on, the only reason left is a food you asked to avoid — not a word about weight, calories or shortfalls. A note for which the provider fails or returns numbers of its own is replaced by a fixed template with our figures or dropped. The weekly review — on Monday the morning slot carries, instead of a note about Sunday, a review of the week that closed, written the same way from the week's figures our code reads and, if you answered them, your Sunday check-in answers; it is always on (the «Weekly review» switch was retired on 4 October 2026), and in it Grif may change a target as §5 describes, with a notification and undo. If the provider fails, a fixed template with our figures is sent instead. The contextual note — while the «Tips when something changes» switch is on, one or two sentences when you have just confirmed a lab report (an invitation to ask; no value is passed), when today's weigh-in has turned the direction of your weekly weight trend, or on a dose day (food only). And one is a fixed text from our code with no model behind it: the vitamin D card, under the same switch, at most once in 90 days, when four closed weeks in a row have read vitamin D as hard to get from food — it says only that most vitamin D comes from sunlight, with no number, no test and no supplement. The weekly report reminder is a fixed text too: while its own «Weekly report reminder» switch is on (on by default), on a Sunday when that week's report is still due you get a line asking you to log the week's measurements, with a push that opens the report, no number and no advice; nothing is sent to the AI provider for it. Before any of them leaves, our server checks the notifications master switch, your switches, a pause, the quiet hours (22:00–08:00 by default; the morning note is the one exception — it follows your journal answer whatever the quiet hours are), that no notice of that kind went out today and — for all but the morning note and the weekly review — the weekly cap (5 by default, 7 at most) and that you have not written to Grif in the last 12 hours; the send is then written to the record named in the table and the push leaves — for the morning note, the contextual note and the vitamin D card always the same neutral sentence, otherwise with a setting's name where one is named, never a number. No note Grif writes first names a medication, a dose or a period date, and every number in them is our code's, checked the same way as in a chat answer. Two fixed lines from code, not from the model: if a vitamin B12 result — from a report or from your diary — is below range while you are on a medication course, the coach says only that it is worth mentioning to your doctor — no reason, no interval, no supplement and no dose; and, if cycle tracking is on and you ask for it in the chat, the coach can switch the period reminder in Profile → Cycle on or off for you — the same switch, journaled and undoable like any reminder change, the notification itself still scheduled on your phone. The two or three short follow-up questions offered under a reply are written by the model, checked by our server for length only, shown once and not stored. Our staff do not see your conversations: they are excluded from the support cabinet and from its exports.
Lab reports, in detail. Uploading is optional and needs the separate «Lab reports» consent, shown before your first upload. Grif is not a medical device. The AI provider transcribes what is printed; our own code then matches each line to a catalogue of markers, converts units, and compares the value with the reference range your laboratory printed — a catalogue range is used only where the form printed none, and the screen says so. Grif does not diagnose, does not name a condition, does not recommend a supplement, a dose or a medication, and does not touch a medication you track; a value your laboratory flagged as critical gets one message — contact your doctor today — and so does a value of one of seven markers (potassium, sodium, glucose, total calcium, haemoglobin, platelets, white blood cells) at or beyond a published adult critical limit even when the form carried no flag: the limits are the medians of a 2024 survey of US medical centres (Shah et al., Diagnostics 2025;15(5):604), the screen then says the value «has reached the level at which laboratories alert a doctor urgently» rather than that your laboratory marked it, and the limit does nothing but escalate — no diagnosis, no food advice, and a value our checks suspect of being misread is not escalated. Two derived figures (non-HDL cholesterol and transferrin saturation) are arithmetic on printed numbers and are marked as derived; Grif computes no clinical index — no HOMA-IR, no eGFR, no albumin-corrected calcium, no calculated free testosterone — and where your laboratory printed one, it is shown exactly as printed, against the printed range. For three markers (apolipoprotein B, lipoprotein(a), hs-CRP) the screen also shows the bands a named, dated guideline uses, as a reference beside your laboratory's range; Grif does not place your value in a band or grade your risk. A value you type in by hand is checked by the same rules as an edited one, is stored like any other value, and is sent to no provider. You review every value before it is saved; nothing reaches your history or the coach before you confirm it. The file is sent to the provider as you uploaded it, so whatever the laboratory printed — usually your name, date of birth and a patient number — is seen by the provider for as long as it keeps the request; we do not blank it out, and we store none of it: the model reports the sex and age printed on the form, our code compares them with your profile and keeps only «matched» or «did not match» — if they differ, we ask whether the report is yours, and «no» deletes the upload and the file. Only your own reports: Grif has no family or shared profiles. The original is encrypted on our side with a key that never leaves our server before it is written under a random object name to a private storage bucket in our object store (Cloudflare R2 — Cloudflare holds only ciphertext it cannot read, §6), is never stored in iCloud or in a device backup, and is served back to you through a five-minute link the browser is told not to cache. Our staff cannot see reports or values: they are excluded from the support cabinet and its exports. A notification about a report («Your results are ready to check», «Time to retest: iron, vitamin D» — sent 7 days before a retest date you set on the marker's screen; Grif proposes no date of its own) names at most a marker, never a value, and shows a neutral preview on the lock screen; retest reminders have a switch of their own in Profile → Notifications («Lab retest reminders», on by default) and are sent only while both it and the general «Reminders» switch are on. On iOS, a report you share into Grif from another app waits in the app group's cache — excluded from backup, under the strongest file protection — until the app reads and deletes it, which happens the moment Grif opens; the share extension itself sends nothing anywhere. On Android, a page you photograph for a report is held in the app's cache and deleted as soon as it is read. Analytics events about labs carry no value, no marker and not even the category of test.
Cycle data, in detail. Cycle tracking exists only for profiles that answered «female» in the questionnaire, is off until you accept the separate «Cycle tracking» consent, and is a step of onboarding you can skip. Grif is not a medical device and does not predict ovulation or fertility: it computes your cycle day, a calendar estimate of the next period and the phases it needs for its own notes, nothing more, and it never diagnoses a cycle disorder, a pregnancy or menopause — those are for your doctor. The data does not change your targets: it explains noise on the scale and stops the code from reacting to it; any change of a target goes through the coach with your approval, as in §5. Two cards come from fixed rules in code, not from a model and not as a diagnosis: if you answer that you have had no period for three months, the app holds your calorie deficit where it is rather than deepening it and suggests seeing a doctor (the card can be put away for 30 days; the date you put it away is kept on your phone only); if you mark heavy flow on three days running in most of your recent periods, it suggests mentioning this to your doctor at your next visit and, while the cycle tile is on your home screen, lists iron first in the week's nutrients. Like the cycle day, these notes are computed each time you look and are not stored. The period reminder, if you switch it on, is scheduled on your phone about two days before the expected start and is not sent by our server; its text is neutral («A reminder from Grif») unless you choose to show the reason; if the coach is on and you ask it to in the chat, Grif flips that same switch for you (journaled, undoable) and your phone still schedules the notification. If you are on a women's profile and have not switched tracking on, the home screen may show a «Track your cycle?» card once, a week after the app first opened the home screen on that phone; «Yes, track it» shows the consent text right there, and the day of that first opening and whether you closed the card are kept on your phone only and never sent. The tables hold only what §3 lists; nothing about your cycle is written to the append-only event journal, no analytics event exists for it (not even the onboarding step), no crash report or log carries it, it is never written to iCloud, and our staff cannot see it — it is excluded from the support cabinet and its exports. What you yourself write to the coach in the chat is kept under the coach's rules above, not as cycle data. Deletion is whole and immediate on any of the triggers in §3, with no retention period; as everywhere, an encrypted nightly database backup is kept for 30 days, so a deleted row can persist in a backup for up to 30 days, and backups are used only to restore the whole database, never one person (§8). Requests from authorities: see §6 — we hold the minimum, we disclose cycle data only on a legally binding request addressed to 42 TAPS INC and reviewed by us, and we tell you where the law lets us.
The morning journal, in detail. The journal is optional and off until you accept the separate «Morning journal» consent, shown on the first morning the screen would appear; «Not now» leaves a row in Grif's settings and nothing else. Every question is answered with a tap on a number or an hour; there is no free text and no question about why. What it does: once enough mornings are in, the Progress screen shows how your nights line up with your own diary, weight and steps — for example how many of the nights with alcohol were followed by a heavier day, or how your time asleep compares on nights with a late cup — always as positional observations computed by our code from your own records, never as a cause and never as advice; the coach's morning note and Monday review may name the night's figures in the same way; and the journal never changes your calorie or protein target, your programme or a reminder. Grif is not a medical device and the journal is not a sleep, alcohol or caffeine assessment. Who sees it: you, and — only if the coach is on and you accepted the version of the «AI coach» consent that names the journal — the coach's AI providers, for the note, the review and a question you ask about it, under the same zero-training terms as everything else the coach reads; nobody at Grif — the support cabinet does not show the journal; no answer ever goes into analytics (the events say only that a morning screen was shown, answered or skipped), into a push, a widget or a lock-screen surface, and nothing in the journal is used for ads, offers, pricing or profiling. Sleep from your health store: if you switch it on, the night's sleep start and end are read from Apple Health / Health Connect and stored with the journal — this is the second case, after the coach's activity totals, in which a value from your health store is kept on our server rather than only shown to you; the entry you type always outranks the one read from the store. Under 18: the alcohol question is hidden from any profile under 18, so nothing about alcohol is ever asked or stored for a minor (onboarding refuses under-18s anyway, §11). Softer coach: while the 14-day softer mode is on, the alcohol question is hidden too and the journal contributes nothing to the coach's messages. Trial rollout: to see whether the journal helps people log the next day and keeps them weighing themselves, it is switched on for a random 90 % of accounts first; the remaining 10 % see neither the screen nor the consent until the trial ends. The draw is a random number attached to your account — no answer, no measurement and no health fact plays any part in it, and the comparison is made on aggregates of at least 50 people. Deletion: withdrawing the consent — in Profile → Consents or by switching the journal off in Grif's settings, one and the same operation — deletes every answer and every journal setting in the same nightly pass as the other withdrawals; a record older than 400 days is deleted whether or not you withdraw; the encrypted backup rule in §8 applies as everywhere. The weekly check-in, in detail. The check-in has no consent screen of its own since 4 October 2026: the questions sit in the Sunday sheet with the weekly report, a line there says the answers are kept as health data for your weekly review and your targets, and answering is your choice — any question may be left unanswered, and the weekly report works without them. One notification: the Sunday weekly report reminder, whose switch you already have, opens the sheet with the report and the questions together — there is no second push. Every question is answered with a tap; there is no free text and no question about why. What it does: the coach's weekly review reads the answers, and — this is what makes it different from the morning journal — the answers may move a target. The decision is a fixed table in our code, not the model: it looks at the week's answers, the previous week's, your weight trend, how many days you logged, your training load, a GLP-1 dose change, a cycle window, the softer-coach flag and the cooldowns, and either keeps everything, proposes one change, applies one change, or waits and says why. It may loosen by itself — raise calories, raise protein, lower steps — with a notification and a one-tap undo (§5). Tightening — a lower calorie target — is only ever a proposal, never applied by itself, and never offered while the softer mode stands or in a cycle, illness, travel or dose-change window. With fewer than three logged days nothing changes and Grif asks you to log three. A week you said was exhausting or highly stressful changes no number: it becomes a note in the review and, for stress, a seven-day block on any lowering. The ceilings are in §5. Who sees it: you, and — only if the coach is on and your «AI coach» consent stands — the coach's AI providers, for the review and a question you ask about it, under the same zero-training terms as everything else the coach reads; nobody at Grif — the support cabinet does not show the answers; no answer ever goes into analytics (the events say only that a check-in was shown, answered or skipped and which rule fired, never the answer), into a push or a widget, and nothing in it is used for ads, offers, pricing or profiling; internal dashboards use aggregates of at least 50 people. Medication and therapy: during a GLP-1 course one question asks how the week on the medication went, as a feeling, never a dose or a reason; a testosterone therapy course is never asked about in the check-in, and the answers never change a medication, a dose or a reminder. Deletion: erasing your data or deleting the account deletes every answer, and so does a request to support@grif.fit; a record older than 400 days is deleted in any case; a target change already applied stays in force and in the journal of the coach's changes until you undo it there; the encrypted backup rule in §8 applies as everywhere.
Weekly frames and Body Scan, in detail. Both exist only for profiles aged 18 or over; a profile without a date of birth is treated as younger, and the server refuses the upload or the scan. A frame is uploaded to our server, encrypted there with a key that stays on our server, and kept in a private storage bucket of its own (§6); it has no public address, not even a temporary one — it comes back to your phone only through our server, and only to you. Frames never go to analytics, advertising or model training, and only you can share a frame or the film. Nothing leaves our server when you take a frame; the frames reach an AI provider only when you start a Body Scan. The provider receives the week's two frames, your sex and your height, and nothing else about you — no name, email, age or tape measurements; our code then cross-checks the model's range with the circumference formula and shows you the corridor that holds both. At most three runs a week. Body Scan is a reference for you, not a measurement or a diagnosis, and it never changes a target. Withdraw either consent in Profile → Consents.
Voice input, in detail. There are two ways to speak instead of typing. Dictation — the microphone in the chat with Grif and the push-to-talk microphone where you describe a meal — records only while the microphone is on, sends the clip to our server, and our server sends it to OpenAI to be turned into text, with your Grif language as a hint. The text comes back into the field; nothing is sent onward until you send it. Neither the clip nor the text is stored, cached or logged on our server; only the clip's length, the outcome and the day's count are. The scanner's voice sheet («Voice log») uses your phone's own speech recognition: on iPhone, Apple's speech recognition — on the device where your iPhone supports it for your language, otherwise Apple processes the audio under its own privacy policy; on Android, the speech recognition service set on your phone (usually Google's). The app receives only the recognised text, and the text you then send is a meal description like one you typed.
What we deliberately do not collect: precise or coarse location, contacts, your photo library as such — on Android the app has no photo permission at all: you pick one picture at a time in the system photo picker, and only that picture reaches the app; on iPhone, if you allow it (all photos or only the ones you select), the scanner shows your latest photos so you can pick a plate you already shot — they are read and shown on the phone only, and nothing leaves it until you tap Recognize, when only the one photo you chose is sent (a profile picture or a dish picture is likewise one picture you choose); the separate «add only» permission lets the app save a weekly frame to your library only when you tap «Save to phone gallery», payment card details, advertising identifiers, device fingerprints for tracking, browsing or search history. The app links no advertising or attribution SDK, and a build check fails if one appears. The analytics library (PostHog) ships with its own crash reporter; our code switches it off, so it collects none — Sentry (the row above) is the app's only crash reporter, and it too collects nothing beyond a crash's stack trace, device model, and OS and app version.
Free text about your food is treated like a measurement. The hint you type before a scan and the correction you type after it reach only the vision provider and our server — with one exception: a product name among them that our catalogue does not know is looked up as described in the «Product look-ups on the web» row; they are on the same deny-list that keeps weights out of analytics and error reports.
Product analytics. The product usage events are sent from the app directly to PostHog, in its EU cloud (PostHog Cloud EU, servers in Frankfurt, Germany), which processes them for us; they are not copied to our own server. The app sends a fixed set of event types and nothing else: opening the app (including from a home-screen widget); starting and finishing sign-in; seeing the paywall; starting, completing or restoring a purchase, or a purchase left pending by the store; viewing, completing or going back from an onboarding step; the answer to the Apple Health / Health Connect and notification permission dialogs; building your programme (started, completed, or failed with an error code) and seeing its summary. Before sending, the app checks every event and drops it whole if it carries a body figure, calories or macros, steps, email, phone number, date of birth, age, free text about food, or any field not allowed for that event type. IP address and location: PostHog receives your IP address in transit, like any server; our app replaces it with 0.0.0.0 in stored events, and no location is stored with events or profiles. PostHog's feature-flag service may use the request IP to evaluate flags for that request; we do not use feature flags. Automatic collection by the analytics library — screen views, taps, session recordings, surveys, push tokens, crash reports, device logs — is switched off in our code. The person in the analytics is the random key issued when the app is installed, not your name or email; our server can link this analytics key to your account. You can object to this processing by writing to us (§8).
Grif records a separate consent for each of the processing activities below; the ones for medication data, the AI coach, lab reports and cycle tracking appear only if you use that optional feature. Each is a dated, versioned entry; a new wording is a new entry, and a withdrawal stamps the old one. The history is your record and is included in your data export.
| Consent | What it covers | Where you give it | Where you withdraw it | What withdrawal does |
|---|---|---|---|---|
Health data processing (health) | Storing and processing the questionnaire, body figures and diary | Onboarding, before your figures are saved; Profile → Consents | Profile → Consents → "Withdraw consent and erase data" | Erases the questionnaire, measurements, diary, reports, targets and devices (the same as "Erase my data", §8). There is no basis to keep health data without it, so we do not keep it for a grace period |
Food diary photographs (diary_photo) | Sending a meal or label photo and your typed hint to the vision providers named on the consent card, for the retention stated there | The food tab, the first time you scan; Profile → Consents | Profile → Consents → toggle off | Stops every further scan (the server refuses with consent_required) and deletes the cached scan results. Meals you already saved stay in the diary under the health consent. If the providers or the retention change, the consent text gets a new version and the app asks again before the next scan |
Medication data (medication) | Storing and processing the medication or hormone therapy you were prescribed, its form, its dose as you entered it, your schedule, the source of the prescription, your dose log and the side effects you record — data that may reveal sensitive information about you | The medication step of onboarding or the therapy step, before anything about the medication is saved; Profile → Consents. A new wording of this consent is shown again only when you start a therapy course; a GLP-1 course you already keep is not re-asked | Profile → Consents → Medication data → off | Deletes every medication course — GLP-1 and therapy alike — with the dose log and the side effects, cancels the dose reminders and returns your protein target to the usual level. Declining at onboarding is a normal path: the rest of the app works without the tracker |
AI coach (ai_coach) | Sending the categories listed on the consent card — your profile as you filled it in (never your name or email), your diary and nutrient totals, weight, workouts and programme, targets and settings, the fact of a medication course, health summaries if Health is granted, and, in the versions that add them, your cycle context, confirmed lab results and the figures of your morning journal (the night's sleep, cups and drinks with the hours of the last, and the patterns our code found) — to the AI providers named there; letting the coach change the settings listed in §5 within their limits | Before your first message to Grif; Profile → Consents | Profile → Consents → AI coach → off, or Profile → Grif → «Grif is off» | The chat closes, proactive messages stop, and the conversations, memory facts, proposals still waiting for your answer, health summaries, the softer-coach flag, the reminders the coach set, the water it logged for you, the record of its proactive notices and your coach settings are deleted. The journal of changes already applied and the proposals you already answered stay until you delete the account, and the changes themselves stay until you undo them. If the providers, the list of categories or the occasions on which your data is sent change, the consent gets a new version and the app asks again before the next message — as it does for the morning and contextual notes, which send your data without a message from you, and as it did for anyone who accepted the first, shorter wording |
Lab reports (lab_upload) | Sending the report you upload to the AI providers named on the consent card for transcription, storing the encrypted original and the values — including values you type in by hand, which go to no provider — and letting the coach read confirmed results | Before your first upload — from the Labs screen or the chat; Profile → Consents | Profile → Consents → Lab reports → off | Uploads stop (the server refuses with consent_required) and the coach loses access to your results. Saved reports stay readable until you delete them, one by one or with «Erase my data» |
Cycle tracking (cycle) | Storing your period dates, flow and symptoms; reading menstrual-flow entries from your health store if you switch that on; and — only if the coach is on — sending your cycle context to its provider | The cycle step of onboarding, or Profile → Cycle; women's profiles only | Profile → Cycle → «Turn tracking off», or Profile → Consents → Cycle tracking → off — one and the same operation | Deletes all cycle data at once and cancels the period reminder. Changing your sex in the profile does the same |
Morning journal (journal) | Storing your answers on the morning screen — bed and wake times, cups of coffee or strong tea and the hour of the last, drinks of alcohol and the hour of the last — with your journal settings; reading your sleep times from your health store if you switch that on; showing you the patterns our code finds in them; and — only if the coach is on, in the version of the «AI coach» consent that names the journal — sending the night's figures to its provider | The first morning the screen would appear, inside the morning screen; Profile → Consents; Profile → Grif → Morning journal. Not offered to the 10 % of accounts held out of the trial, nor before the trial reaches your account | Profile → Consents → Morning journal → off, or Profile → Grif → Morning journal → off — one and the same operation | Deletes every answer and every journal setting; the Progress patterns and the journal lines in the coach's notes disappear with them. The server refuses a new answer after withdrawal. Declining is a normal path: the rest of the app, the coach included, works without the journal |
Weekly frames (body_photos) | Storing the two weekly photos of your body, encrypted, for your film roll | A one-line notice on the frame screen; taking a frame is the consent (adults only) | Profile → Consents | Deletes every frame and every Body Scan estimate; the frame screen stops saving |
Body Scan (body_scan) | Sending the week's two frames, your sex and your height to the AI providers named on the notice for a body-fat range, and storing the estimates | A one-line notice on the Body Scan screen; starting a scan is the consent (adults only) | Profile → Consents | Deletes the estimates; no scan runs until you start one again |
Push notifications (push) | Reminders about the day's session and the weekly check-in; if you use those features, the coach's notices (some carry an «Undo» button that reverts the change from the notification), its evening check-in and Monday review, and the lab retest reminders you set, which also have a switch of their own in Profile → Notifications | The system permission dialog, opened from a screen that explains why | Profile → Notifications → Reminders toggle, or the OS settings | Pushes stop. The device record stays so that turning reminders back on works without re-registering |
Under-18s cannot pass onboarding (§11), so no consent is ever collected from a minor by design.
We share data with the following recipients and with nobody else. None of them is permitted to use your data for its own advertising.
| Recipient | What it receives | Why | Role and location |
|---|---|---|---|
| Google (Gemini API) — primary vision provider | The normalised meal or label photo (also from the App Clip's guest scan), your typed hint, the meal slot, your language, and our food catalogue ids | Recognise the food on the plate | Processor. United States. May keep the photo for up to 55 days for abuse monitoring; under the paid API terms it is not used to train models. Google is certified under the EU-US Data Privacy Framework; transfers rely on that certification and on Google's data-processing terms for the Gemini API |
| OpenAI — fallback vision provider | The same as Google, only when the primary provider fails or returns an unusable answer | Same | Processor. United States. May keep the photo for up to 30 days for abuse monitoring. OpenAI is certified under the EU-US Data Privacy Framework; transfers rely on that certification and on OpenAI's data-processing addendum |
| Google (Gemini API) and OpenAI — AI coach providers | What is needed to answer one message — or, while the morning or contextual notes are on, to write one without a message from you: your message and the last few turns (for a note, instead, the figures our code selected and the reason it picked), the rolling summary of your conversations if «Remember conversations» is on, a meal scan you attached (dish name and the scanner's figures, never the photo), the coach's own instructions, and the categories listed on the consent card (§3 «AI coach»: your profile as you filled it in — sex, birthday (day and month) and age, height, goal, target weight and pace, activity level, diet type, meals a day, cooking preference, food exclusions and allergies, how often and where you train, time zone and language; your day and week — the meals by slot with the names of dishes and their totals — weight and its trend, nutrient totals, workouts and programme, targets, settings, memory facts, the fact of a medication course; cycle context and confirmed lab values only if those features are on). Two model sizes of the same providers, picked by our code by the kind of turn. Never your name or email, your year of birth, a lab file or an unconfirmed draft; the medication's name and dose and your period dates only as described at the end of this cell. Which of the two answers a given message is chosen by our code by the kind of task; the consent card names every provider we actually send to Since 1 October 2026: every message you send (no message is held back by a server-side check any more), and — when you ask Grif to record or show them — the medication's name, dose, site and time, period days and lab values as you stated them If your message contains a web link, Google opens that page with its URL-context tool and may issue Google Search queries drawn from your message to answer it (since 8 October 2026); the linked site receives a request from Google | Generate the coach's answer and its proposals, and call the tools that record what you asked for | Processors. United States. Each may keep a request for up to 55 days (Google) or 30 days (OpenAI) for abuse monitoring; neither uses it to train models — a condition of the API terms we buy under and of our choice of provider. Both are certified under the EU-US Data Privacy Framework; transfers rely on that certification and on their data-processing terms |
| Google (Gemini API) — primary, OpenAI — fallback — lab report transcription | The report file exactly as you uploaded it (PDF or page images, with whatever your laboratory printed on it, see §3), our transcription instructions, the list of marker names in our catalogue, and a hint about the form's language. Nothing else about you: no profile, no earlier results | Transcribe the printed lines | Processors. United States. Retention and training as in the row above; the fallback receives the file only when the primary fails or returns an unusable answer |
| Google (Gemini API) — primary, OpenAI — fallback — Body Scan | The week's two frames, your sex and your height, and our instructions. Nothing else about you: no name, email, age or tape measurements | Estimate a body-fat range from the frames | Processors. United States. Retention and training as for meal photos above (kept for abuse monitoring for up to 55 / 30 days, never used to train models); the fallback receives the frames only when the primary fails or returns an unusable answer |
| OpenAI — dictation | The voice clip you recorded and your Grif language as a hint; no account id, name or email | Turn speech into text | Processor. United States. May keep the request for up to 30 days for abuse monitoring; under the API terms it is not used to train models; transfers as in the OpenAI row above |
| Google (Gemini API) — primary, OpenAI — fallback — dishes you type in yourself | The dish's name, your note and the picture if you attached one | Estimate the dish's micronutrients | Processors. United States. As for meal photos above |
| Apple (speech recognition on iPhone) and your Android phone's speech recognition service (usually Google) — the scanner's voice sheet | What you say while the voice sheet listens, when your phone does not recognise it on the device | Turn speech into text for the scanner | Services of your phone's platform, under their own privacy terms; we receive only the text |
| Apple (App Store, StoreKit, APNs) | Purchases: handled entirely by Apple on your Apple ID. Push: your APNs token and the notification text (title, body, a deep link into the app) — a reminder, a lab retest reminder (marker names only), or, if the coach is on, its short notice of what it changed or proposes (the setting's name, never a value), its evening check-in or Monday review, headed «Grif · AI», with a notification category that lets iOS show an «Undo» button and the id of the change it refers to. If Apple's server rejects the token as unknown, we try Apple's other push environment once and remember which one accepted it | Billing; delivering reminders | Independent controller for billing; processor for push delivery. See Apple's privacy policy |
| Google (Google Play, Play Billing, Firebase Cloud Messaging) | Purchases: handled entirely by Google on your Google account. Push on Android: your Firebase Cloud Messaging token and the notification text, as for Apple; a coach notice with an «Undo» button travels as a data message and the app draws the notification itself. On both platforms the Firebase SDK in the app registers the installation with Google: a Firebase installation ID it generates, the messaging token, on iOS the APNs token it is handed, the app's identifier and version, the operating system version and, in transit, your IP address. Only the Core and Messaging parts of Firebase are included — no Firebase Analytics, Crashlytics, advertising or remote-config component — and on iOS the SDK's app-delegate proxy is off, so it observes nothing else in the app; delivery-metrics export is off. Google keeps these identifiers under its own Firebase retention; the token our server holds goes with the device record (§3) | Billing; delivering reminders on Android; keeping the app reachable by push | Independent controller for billing; processor for push delivery and Firebase installation data under the Firebase Data Processing and Security Terms. Google LLC, United States; certified under the EU-US Data Privacy Framework. Policies: https://policies.google.com/privacy and https://firebase.google.com/support/privacy |
| PostHog (product analytics) | The product usage events described in §3: event type and its allowed properties, the random install key, app version, device model, operating system, screen size, language, time zone, network type. No body figure, no free text, no name or email. PostHog receives your IP address in transit, like any server; our app replaces it with 0.0.0.0 in stored events, and no location is stored with events or profiles. PostHog's feature-flag service may use the request IP to evaluate flags for that request; we do not use feature flags. | Understand how the app is used and where onboarding and the paywall lose people | Processor. PostHog Cloud EU, Frankfurt, Germany |
| Apphud (subscription infrastructure) | The store transaction and receipt, your install id or hashed account id, device and app version as collected by its SDK, storefront | Verify store purchases and tell our server when a subscription starts, renews, lapses or is refunded; subscription analytics (conversions, renewals, refunds) | Processor. United States; policy: https://apphud.com/privacy |
| Open Food Facts — barcode and product-name look-up | For a barcode: the barcode digits only. For a product our catalogue does not know (§3 «Product look-ups on the web»): the product's name as search terms. Both with a User-Agent naming the app, its version and our support address. No account identifier, no photo, nothing else about you; the request is made by our server, not your phone, so it carries our server's IP address | Look up a packaged product's nutrition | Independent database operated by a French non-profit (Open Food Facts, France), which handles requests under its own terms and privacy policy — an independent recipient, not our processor. Data returned is under the ODbL (see Third-party notices) |
| Google (Gemini API with Grounding with Google Search) — product look-up by name | The same product name, inside our instruction to find that product's nutrition facts; the model issues Google Search queries from it and returns the figures and the address of the page it read. No account identifier, no photo, no portion, nothing else about you; sent only when Open Food Facts has no usable answer, and to fill in micronutrients an Open Food Facts record lacks | Find the nutrition of a product our catalogue does not know | Processor for the API request. United States. Retention as in the Gemini rows above (up to 55 days for abuse monitoring; not used to train models under the paid API terms); the search queries are handled by Google Search under Google's terms for Grounding with Google Search. Certified under the EU-US Data Privacy Framework |
| TypeSafe AI, Inc. (Jev) — checking a product look-up (since 8 October 2026) | The same product name and its English rendering and, once a source has answered, the name and brand of the product it found. No account identifier, no photo, no portion, no message, nothing else about you; the request is made by our server, so it carries our server's IP address. The model writes no text: it returns a probability for each of two yes-or-no questions | Skip the look-up for a plain food that has no product page, and refuse a found product that is not the one named | Processor under TypeSafe's Data Processing Addendum. United States; transfers under the EU Standard Contractual Clauses and the UK Addendum in that addendum. TypeSafe does not train or fine-tune models on what we send and discloses it to nobody but its own service providers; it keeps it for as long as it needs to provide the service — its terms name no fixed period. Messages to Grif (since wording 2026-10-08-v5 of the «AI coach» consent, and only if you accepted that wording or a later one): the text of the one message you have just written — which may concern your health — with no earlier messages, no profile, no diary and no account identifier, to tell a message that logs food from any other; the same terms apply |
| The assistant you connect yourself — Anthropic (Claude) or OpenAI (ChatGPT), whichever you chose | Only what that assistant asks our server for under your sign-in: a day or a week of your diary (meals and their totals, your targets, water, weight, workouts) and the result of each entry you told it to log, including a dose if you log one. We send nothing to it on our own initiative, and none of our own models is called for it | Let you read and keep your diary from your own assistant | Not our processor: an independent recipient you chose, acting under your account and its own terms and privacy policy with you — including how long it keeps the conversation and whether it uses it to improve its models. You end the sharing by removing the connector in the assistant or revoking its access; what it already received stays under its terms |
| Mailgun (Mailgun Technologies, Inc., part of Sinch) — letters from Grif | Your email address and the letter itself (confirmation of the address, a reminder, an account notice); whether the letter was delivered, bounced or marked as spam comes back to us so that we stop writing to an address that refuses mail | Deliver the letters | Processor. United States |
| DigitalOcean (hosting) | Everything stored on our servers, encrypted in transit; the API, database (PostgreSQL), cache (Redis), sign-in service (Keycloak) and the website run on our own server in Frankfurt, Germany; the nightly database backups, encrypted, rest on the same host | Hosting | Processor (infrastructure). The database, cache and sign-in service are all in the same Frankfurt region. The nightly database backup is encrypted on the server as it is written — no unencrypted copy touches a disk — with a public key whose private half is held only by us, off the server; it is kept on the Frankfurt host for 30 days, and an encrypted copy goes to Cloudflare R2 (next row) |
| Cloudflare, Inc. | DNS for grif.fit and our former domain; no web traffic is proxied through Cloudflare. The app's configuration file (which servers to use, which country and flags apply — no personal data) is fetched from a Cloudflare R2 bucket over a plain, unauthenticated request: Cloudflare sees only your IP address and user agent, the same as any content delivery network, and receives no account token, no visitor key, and nothing else the app knows about you. Since 17 September 2026, a second, public Cloudflare R2 bucket (cdn.grif.fit) holds the recipe photographs the app displays — content we produce ourselves, the same picture for every account, with no personal data of any kind in the file itself and nothing in the address that says anything about you. Cloudflare R2 is also our object store (since 17 September 2026 for pictures, since the launch of lab reports for their files): it holds the lab report file you upload — in a private storage bucket of its own, separate from the public picture buckets, encrypted by our server before it is written, with a key that stays on our server, so what rests with Cloudflare is ciphertext it cannot read (§9) — and a profile picture you set. Cloudflare R2 also holds your weekly frames and their thumbnails, in a private bucket of their own, separate from the lab files and the picture buckets, each encrypted by our server with a key of its own before it is written, so here too Cloudflare holds ciphertext; a frame is never served by a link, only through our server and only to you. The picture you attach to a dish you type in yourself is stored the same way as a profile picture. A lab file is served back only through a five-minute link our server issues, and only to you; its object name is random and carries nothing about you — no name, email, account id or health term. Since 26 September 2026 Cloudflare R2 also holds an encrypted copy of our nightly database backups, in a further private bucket in Cloudflare's EU jurisdiction (the copy does not leave the EU), deleted after 30 days; each copy is encrypted on our server before it leaves it, and the only key that can read it is held by us, off the server, so here too Cloudflare holds ciphertext | DNS; serving the app's configuration file; serving recipe photographs; storing the encrypted lab report files and weekly frames, profile pictures and dish pictures; holding an encrypted copy of the nightly database backups | Processor. United States (Cloudflare's Data Processing Addendum; certified under the EU-US Data Privacy Framework); policy: https://www.cloudflare.com/privacypolicy/ |
| Sentry (Functional Software, Inc.) — crash reporting | The app's crash reports since 17 September 2026: stack trace, device model, OS and app version, scrubbed of any user object, request body, cookies or query string (§3). Errors on our servers (API, worker, scheduled jobs): the exception, the stack, the allow-listed headers and the request id named in §3, scrubbed the same way — no user object, no request body, no cookies, no query string; performance traces are dropped and never sent | Find and fix bugs before they reach more people | Processor. United States (the project's ingest host is *.ingest.us.sentry.io); policy: https://sentry.io/privacy/ |
| Google LLC (Google Workspace) — support mailbox | What you write to support@grif.fit, the address you write from, and our replies — including anything about your health you choose to put in a message. Nothing is forwarded to this mailbox by the app itself: it receives only mail people send | Host the mailbox we answer you from; keep the thread for the 12 months named in §3 | Processor (Google Workspace, Cloud Data Processing Addendum). United States; certified under the EU-US Data Privacy Framework |
| Our staff | Support staff can look up a customer card (read-only) in the owner's cabinet; every search and view is written to an audit log, and body figures are behind a second, separately logged click. Medication data, conversations with the coach, lab reports and cycle data are not in the cabinet or in its exports | Support, re-sending access | Under the operator's authority |
| Authorities | Only what a legally binding request, addressed to 42 TAPS INC and reviewed by us, obliges us to disclose. We keep medication, lab and cycle data to the minimum described in §3 and delete it on your command, so that there is little to hand over, and — where the law allows — we tell you about the request | Legal obligation | 42 TAPS INC is a Delaware corporation and answers to United States legal process regardless of where the data is stored; our protection is what we do not hold, not the location of the server |
We do not share with data brokers, advertising networks, or "partners". We have no affiliates.
The operator, 42 TAPS INC, is a company established in the United States. For people in the EU/EEA and the UK, the GDPR and the UK GDPR apply to our processing of their data because we offer the Service to them (GDPR Art. 3(2)), wherever that data is stored.
Our servers are in Germany (EU), and product analytics stays in the EU (PostHog Cloud EU, Frankfurt). The encrypted copy of our nightly database backups rests with Cloudflare in its EU jurisdiction and does not leave the EU; Cloudflare, a United States company, holds it under its Data Processing Addendum and cannot read it, because the only key is ours (§6, §9). Meal and label photographs, and the text typed with them, are transferred to Google and OpenAI in the United States when you use the photo feature; Apphud, Apple and Google (including Firebase Cloud Messaging) process purchase and push data in the countries in which they operate. When you use the AI coach or upload a lab report, the categories named for those features in §6 are transferred to the same two providers in the United States.
For people in the EU/EEA, the UK and Switzerland, transfers to processors in the United States rely on the EU-US Data Privacy Framework (with its UK extension and the Swiss-US DPF) where the recipient is certified — Google and OpenAI are — and otherwise, where applicable, on the European Commission's Standard Contractual Clauses concluded with the processor (in the UK, the IDTA or the UK Addendum). You can ask us for a copy of the relevant safeguards at support@grif.fit.
Most rights are one tap away and need no email:
| What you want | Where |
|---|---|
| See and download everything we hold about you | Profile → Data and privacy → Export my data. One JSON file with your identity, questionnaire and frozen calculation, targets, daily and weekly reports, exercise log, every saved meal, consents with their full history, your morning journal (every answer with its source and your journal settings) and your weekly check-in (every answer with the outcome our code drew from it) if you use them, devices (platform and dates, never the push token), notification settings, subscriptions and store purchases; if you use them, your medication data, your exercise swaps, everything of the coach's (its settings, your conversations, its memory facts, its proposals and the journal of its changes, the softer-coach flag, the reminders it set, the water logged through it, the health summaries, the record of its proactive notices and the notes it assembled under your lab reports), your lab reports (the values, the retest reminders, and the original files as links valid for 24 hours) and your cycle data while its consent is on; plus the processing notice in your language. The sign-in subject is deliberately not included |
| Correct something | Profile → Recalculate (questionnaire), the diary itself (entries), the account page of the sign-in service (email, name) |
| Erase your data but keep the account | Profile → Erase my data. Deletes the questionnaire, measurements, diary, reports, targets, exclusions and push tokens, and, if you used them, the medication data, the coach's conversations, memory, health summaries, reminders, water log and flags, your exercise swaps, the lab reports with their files, notes and retest reminders, the cycle data, the morning journal with its settings and the weekly check-in answers; cancels scheduled messages; detaches website visits; withdraws all consents. Your purchases and access remain, and you can start again by giving consent anew |
| Delete the account | Profile → Delete account, or by email from the address on the account (see grif.fit/delete-account). Does everything an erasure does — deletes your questionnaire, measurements, diary, reports and targets, your medication records, your push tokens, the lab reports with their files in storage, the coach's data, the cycle data, the morning journal and the weekly check-in answers, and withdraws every consent — then removes your email and name, deletes the account at the sign-in service, and refuses any further sign-in. Product usage events in PostHog are not deleted by this; ask support@grif.fit to delete these events. A store subscription is not cancelled by this — cancel it in the App Store or Google Play first if you no longer want to be charged |
| Withdraw a consent | Profile → Consents (see §4). Withdrawal does not affect processing that happened before it |
| Object to processing based on legitimate interest, or restrict it | Email support@grif.fit. Note that the product-usage events carry no measurement |
| Portability | The export above is machine-readable JSON |
| Complain | You may lodge a complaint with the data protection supervisory authority of the country where you live or work, or where you believe the infringement took place (in the EU/EEA, the authority of that member state; in the UK, the ICO; in Switzerland, the FDPIC). Complaining to us first is not required, though we would rather hear from you |
Any right in this section, including those the app does not cover, can be exercised by writing to support@grif.fit. We answer within one month (GDPR, UK GDPR) or the shorter period your local law sets. We may ask you to confirm your identity by writing from the account's email address.
What survives erasure and deletion, and why: purchase records (tax and accounting law, see §3), product usage events in PostHog (deleted on request, see §3), granted entitlements (the proof of what you paid for), programme enrolment state, the append-only event and audit journals (they carry ids and event types, not measurements), the consent history with its withdrawal stamps (proof that consent was given and withdrawn), the journal of changes the coach applied to your settings and the journal rows saying that the coach read your lab or cycle context on a given date (never the values themselves — both go with the account), and the tombstoned account id. Backups: a nightly, encrypted dump of the database is kept for 30 days on our server in Frankfurt and, as an encrypted copy, in a private Cloudflare R2 bucket in the EU jurisdiction, deleted there after the same 30 days; only we hold the key that can read either, so an erased row can persist in a backup for up to 30 days and nowhere longer; backups are used only to restore the whole database, never one person.
No system is perfectly secure. If we learn of a personal-data breach, we notify the competent supervisory authority within 72 hours of becoming aware of it where the GDPR or the UK GDPR applies (Art. 33), tell you without undue delay when the breach is likely to put your rights and freedoms at high risk (Art. 34), and follow the United States rules in §12 — the FTC Health Breach Notification Rule and the state breach laws that apply to you. Every incident, whether or not it had to be notified, is entered in our incident register with what happened, its effects and what we did.
The app keeps a local copy of your diary and programme so it works offline, your sign-in tokens, the Firebase installation ID and messaging token the Firebase SDK keeps for itself (they go with the app when you uninstall it), your consent and preference choices, a pending meal-scan attempt (removed within 24 h), the labs screen's cache, the unit you last used per marker, and any temporary copy of a report — including a file shared into Grif from another app on iOS, or a page photographed on Android — (in the app's cache, excluded from device backup and iCloud, under the strongest file protection, deleted once read), the day you put away the cycle «see a doctor» card, the day the home screen was first opened on this phone and whether you closed the «Track your cycle?» card (all in the app's secure store, wiped on sign-out), a local copy of your cycle data (likewise never written to iCloud), and — on iOS — a small snapshot for the home-screen widgets in the app group container (the widgets have no network access). Deleting the account clears this phone as well; uninstalling the app removes it too. Data in Apple Health or Health Connect is yours and is managed there, not by us; revoking our permission stops us reading it but does not delete what your health store already holds.
Grif is for adults. Onboarding asks your date of birth and stops for anyone under 18; the server refuses to store a profile outside 18–75 years. We do not knowingly collect data from anyone under 18; if you believe we have, write to us and we will delete it. As a second guard, the morning journal's alcohol question does not exist for any profile whose date of birth says under 18.
EU/EEA, UK, Switzerland. The legal bases are given in §3; health data is processed on explicit consent (GDPR Art. 9(2)(a)). Your rights are in §8.
United States — consumer health data. For residents of Washington (My Health My Data Act), Nevada (SB 370) and Connecticut (CTDPA as amended), the diary, body figures, meal photographs, conversations with the coach and its memory, lab reports, cycle data, the morning journal (sleep times, caffeine and alcohol intake with the hour of the last) and the weekly check-in (hunger, energy, stress, how the plan and the training went, the effect of a cycle or of a medication week; stress is mental-health information) — for both, «bodily functions, vital signs, symptoms, or measurements» and «behavioral … interventions» in Washington's definition, and in any case information from which a health status may be derived — are "consumer health data". Our separate Consumer Health Data Privacy Policy sets out the categories collected, the sources, the purposes, the categories shared, the specific third parties who receive them, and how to exercise and appeal your rights. We obtain your separate, specific consent before sharing consumer health data with an AI provider — a meal photo (the "Food diary photographs" consent), a lab report (the "Lab reports" consent), your diary summary and coach context (the "AI coach" consent), your cycle context (the "Cycle tracking" consent together with the "AI coach" consent), the figures of your morning journal (the "Morning journal" consent together with the "AI coach" consent), your weekly check-in answers (given by answering the check-in, with the "AI coach" consent) — and never sell consumer health data. New York's Health Information Privacy Act (S929/A2141) was vetoed on 19 December 2025 and is not in force; should it be enacted, its 24-hour rule for authorisation requests and its «strictly necessary» standard will be reviewed against this policy before it takes effect.
United States — medication data. Where the medication tracker is used, the medication or therapy course (including a testosterone therapy course), its form and dose, the prescription source, the dose log and the side effects are "consumer health data" under the Washington My Health My Data Act, Nevada SB 370 and Connecticut's provisions, and are treated as such everywhere. We collect them on your separate consent, we do not share or sell them with anyone, and we do not use them for advertising or any other use-based purpose. The categories, sources, purposes and the request and appeal procedure are set out in the Consumer Health Data Privacy Policy.
United States — reproductive health data. Cycle data is "reproductive or sexual health information" under the Washington My Health My Data Act and the corresponding provisions of Nevada and Connecticut law. We collect it only on the separate "Cycle tracking" consent, we never sell it, we share it with nobody except — only if you turned the coach on — the coach's AI provider in the scope stated in §6, and we do not use it for advertising, for profiling or for any inference we store. We collect no location of any kind, so nothing in our systems can place you near a clinic or anywhere else. Our position on requests from authorities is in §6.
United States — breach notification. Grif is a vendor of personal health records under the FTC Health Breach Notification Rule. If health data — including body figures, the diary, meal photographs, medication data, conversations with the coach, lab reports or cycle data — is acquired or disclosed without your authorisation, we notify the people affected without unreasonable delay and no later than 60 days after we discover it, notify the FTC on the Rule's schedule, and notify media where 500 or more residents of one state are affected.
California. We do not sell or share personal information for cross-context behavioural advertising and do not use sensitive personal information for anything beyond providing the service you asked for. California residents have the rights listed in section 8.
Brazil, Canada, Australia and elsewhere. We apply the same practices everywhere; where local law grants you additional rights, write to us.
When we change what we collect, whom we share it with, or how long we keep it, we update this page and the version at the top, and — where the change concerns a consent — the consent text in the app gets a new version and the app asks you again before the affected feature is used. Material changes are announced in the app.
Terms · Privacy · Health data · Subscriptions · Third-party notices · Delete account · Home