English · Polski · Türkçe

Grindmeter Privacy Policy

Last updated: 6 November 2026

Grindmeter helps you keep a training schedule, check in to your workouts, record runs and rides, and share your progress. This page explains what personal data the app handles, why, who sees it, and the rights you have over it.

Who is responsible for your data

The controller of your personal data is Erdem Emre, an individual. For anything about your data, write to support@grindmeter.app.

What we collect, and why

• Account details — your email address, your password (stored by Firebase Authentication, never readable by us), your chosen username and your profile (photo, if you add one). We use these to create and run your account. You must be at least 16 to sign up; the date of birth you enter at sign-up is only used to check this and is not stored.
• Your training — your schedule and training programs, your daily check-ins and the answers you give, skipped workouts, time off, streaks, achievements and medals, and your strength training logs. We use these to run the app and to calculate your streaks, statistics, rankings and yearly wrap.
• Runs and rides — when you record a run or ride, your phone's location is used to draw the route and work out distance, pace and speed, and the motion sensor counts your steps. Location is only read while you are recording; the one other use is the weather on a share image (see "Who else handles your data"). We store the route, distance, time, steps and the activity's details.
• Health and fitness data — if you choose to import activities from your watch, Grindmeter reads your running, cycling, tennis and hiking workouts from Apple Health (iPhone) or Health Connect (Android): start and end time, distance, duration, route, heart rate, calories burned, steps and the name of the device that recorded it. See "Health data" below.
• Posts, comments and pictures — what you post, the pictures you choose to add (from your photo library) and the comments you write.
• Who you follow and who follows you, and the likes you give.
• Reports — if you report a post, we store that you reported it. If someone reports yours, we may review it.
• Notifications — a push token for your device and your notification settings, so we can send the reminders and alerts you turn on.
• Fair-play data — flags and counters our systems use to spot impossible or repeated results (for example an implausible pace). See "Rankings and fair play" below.

Our legal bases

• To provide the service you asked for (a contract): your account, schedule, check-ins, streaks, rankings, posts and sharing, and your Premium purchase.
• Your consent: location while recording and for the weather on a share image, reading Apple Health / Health Connect data, motion and step counting, photos you choose and push notifications. Each is switched on by a permission you grant on your phone, and you can withdraw it at any time in your phone's settings. Withdrawing does not affect what was done before.
• Our legitimate interests: keeping the app secure (including checking a new password against known data breaches), preventing cheating and abuse, and handling reports.

Health data

Importing is optional and starts only when you open "Import from your watch" and allow access. Grindmeter only reads workouts, heart rate, calories and steps. It never writes to Apple Health or Health Connect and reads nothing else (no sleep, weight or other health data). Health data is a special category of data, so we process it only with your explicit consent, given when you allow access on your phone.

Activities you import are saved to your account like a run you recorded in the app. They are used to show your history, fill in your check-ins, work out your statistics, records and medals, and place you on the rankings. Heart rate and calories are shown to you on the activity's details.

We do not sell this data, use it for advertising, or share it with data brokers, insurers or employers. You can withdraw access at any time in Apple Health (Settings → Health → Data Access & Devices) or in Health Connect (App permissions → Grindmeter), and you can delete imported activities or your whole account.

What other people can see

Your username, profile picture, achievements, rankings, streak and your posts and comments can be seen by other users of the app, and the pictures you attach to a post are visible to the people who can see that post. Your email address, date of birth, exact location and raw health data are not shown to other users. When you share an image outside the app (for example to Instagram), that image is then in the hands of the service you share it with.

Who you follow and who follows you can be seen by anyone if your profile is public, and only by the followers you approved if it is private. Even then, anyone can see your username, photo, name and your follower and following counts, and a private profile stays on the rankings under its username unless you hide it there. You can see who liked your own posts; nobody can see what other people have liked. A route is shown to others only when you share it, as a drawn design, never as raw location data.

Rankings and fair play

Results that look impossible (for example a pace or distance no one could hold) or that break the app's limits are checked automatically. An account that repeatedly triggers these checks can be removed from the rankings. This affects only your place on the leaderboards, and you can appeal in the app, which sends your case to a person.

Who else handles your data

• Google Firebase (Google Ireland Limited, Google LLC) — sign-in, database, file storage, server code and device checks (App Check). Firebase processes your data on our behalf. Your data may be processed in the EU or in other countries, including the United States, under safeguards such as the European Commission's standard contractual clauses.
• Expo — delivers push notifications through its push service, together with Apple's and Google's own notification systems. They receive your push token and the notification text. Expo is based in the United States; data may be transferred there under safeguards such as the European Commission's standard contractual clauses or the EU-US Data Privacy Framework.
• Open-Meteo (weather service) — when a share image shows the weather where you are, your phone sends your current coordinates to Open-Meteo to get the temperature. The city name comes from your phone's own map service (Apple or Google). We do not store these coordinates for this.
• Mapbox (maps) — the maps in the app are drawn by Mapbox. To show a map, your phone asks Mapbox for the map pieces of the area you are looking at, so Mapbox receives your IP address and the area shown. When you draw a route with "Snap to roads" switched on, the points you drew are sent to Mapbox, which sends back a line that follows the roads. A run or ride you recorded is never sent for this. Mapbox is based in the United States; data may be transferred there under the same kind of safeguards.
• Have I Been Pwned (Pwned Passwords) — when you choose a password, your phone checks whether it has appeared in a known data breach. Your password never leaves your phone: only the first five characters of a scrambled (hashed) copy are sent, which cannot be traced back to you or your password.
• Apple and Google — if you buy Premium, the payment is handled entirely by the App Store or Google Play. We never see your card details; we only learn whether you have an active Premium.
• RevenueCat — passes your Premium purchase from the App Store or Google Play to us. It receives your account's random id and the purchase details (plan, dates), and tells us whether your Premium is active. RevenueCat is also based in the United States; data may be transferred there under the same kind of safeguards.
• Google Firebase Analytics and Crashlytics — see "Usage statistics and crash reports" below.

Usage statistics and crash reports

Two optional tools help us keep the app working and improve it. Both are under your control in the app, in Settings → Privacy → Usage data.

• Usage statistics (Firebase Analytics) — which screens and features are used, for example that a workout was completed or a profile was followed. They never include what you type, your workout details, your pictures or your location. They are off until you say yes (the app asks once), and turning them off stops the collection and deletes what was gathered on your phone. What was already sent to Google is kept for a limited time (at most 14 months) and then deleted automatically. Legal basis: your consent.
• Crash reports (Firebase Crashlytics) — when the app crashes, technical details about the phone and the error, and your account's random id, so we can fix the fault. They are off until you say yes (the same one-time question covers both tools) and you can switch them off at any time. Legal basis: your consent. Crash reports are kept for 90 days.

We have no advertising trackers in the app, and we do not sell your data.

How long we keep it

We keep your data for as long as your account exists. When you delete your account (Settings → Account → Delete account), we delete your profile and everything under it: your training data, imported activities and health data, routes, statistics, settings, notifications and push tokens; your posts with their likes and comments; the comments and likes you left on other people's posts; who you follow and who follows you; and your photos. A report you made about someone else's post, comment or profile stays, without any link to you, so that report counts cannot be reset by deleting an account. We may keep what the law requires us to keep (for example records of a payment, held by Apple or Google).

Some data has its own limit:

• Backups: technical copies are overwritten within 30 days at most after the original is deleted.
• Usage statistics: at Google, at most 14 months, then deleted automatically.
• Crash reports: 90 days.
• Push tokens: removed when you sign out on that phone, when the notification service says the phone no longer exists, or when you delete your account.
• Fair-play counters and flags, and appeals: kept while your account exists and deleted with it.

Your rights

You have the right to:

• get a copy of your data and ask what we do with it (access);
• have wrong data corrected (rectification);
• have your data deleted (erasure);
• restrict or object to some of our processing, and withdraw your consent at any time;
• receive the data you gave us in a common, machine-readable format (portability).

To use any of these, write to support@grindmeter.app. We answer within one month. You can also delete your account yourself in the app (Settings → Account → Delete account). If you think we handle your data unlawfully, you can complain to the Polish data protection authority, the President of the Personal Data Protection Office (UODO), uodo.gov.pl, or to the authority in your own country.

Children

Grindmeter is for people aged 16 and over. We do not knowingly collect data from anyone younger. If you believe a younger person has an account, write to us and we will delete it.

Security

Your data is stored with Google Firebase behind access rules that let each person reach only what they are meant to, and the app checks that requests come from the genuine app. No system is perfectly secure; if a breach affects you, we will tell you and the authority as the law requires.

Changes

If this policy changes in a way that matters, we will tell you in the app and update the date at the top of this page.

Contact

support@grindmeter.app

ul. Kaszubska 11/22, 50-214 Wrocław, Poland