Legal
Privacy Policy
Last updated: 1 August 2026
1. Who We Are
GrabGains, a Dutch general partnership (vennootschap onder firma), is established in the Netherlands. We decide what happens with your personal data, which makes us the controller under the GDPR. For privacy matters you can reach us at [email protected]. Our full company details, including our Chamber of Commerce and VAT numbers, are in the legal notice.
Supervisory authority: Autoriteit Persoonsgegevens (Netherlands), Postbus 93374, 2509 AJ Den Haag, autoriteitpersoonsgegevens.nl. If you are in the United Kingdom you can also contact the ICO.
2. Information We Collect
2.1 Information you provide directly
Account data: name, email address, username, password, the age range you pick during onboarding, and optionally a profile photo and gender. We ask for an age range and not a date of birth: we need to know that you are 16 or over and that you train with a plan that suits your age, and a range answers both.
Fitness and health data: height, weight, body fat percentage, fitness goals, experience level, available equipment, muscle groups you would rather not train, workout history, sets, weights, repetitions, personal records, and how heavy a workout felt.
Content you create: posts, photos, comments, likes, who you follow, workout notes, custom exercises and routines.
Communication data: support messages, conversations with the AI coach, survey responses and feedback.
2.2 Information collected automatically
Device token: a push notification identifier, so we can send you training reminders and social notifications.
IP address: processed by our hosting and security providers to keep the service available and to prevent abuse.
2.3 Information from third parties
If you sign in with Google or Apple, we receive your name and email address from them. Apple lets you hide your email address, in which case we only receive a relay address.
2.4 Sensitive data
Your weight and body fat percentage are health data, a special category under Article 9 of the GDPR. What your training log implies about what your body can handle can also become health data, and that is exactly what happens when it goes to the AI coach: there it runs on your separate coach permission, not on the contract. For the app itself we treat a set log as a performance record, we draw no medical conclusion from it, and the generator uses it only to pick your next weight. We only process these because you enter them yourself and give explicit consent for it. You can withdraw that consent at any time by deleting the data or your account. Withdrawing does not affect processing that already took place.
3. Legal Basis for Processing
- Explicit consent: health and body data, marketing emails.
- Performance of a contract: creating your account, generating workouts, saving your progress, running your subscription.
- Legitimate interests: security, abuse prevention, aggregated analytics and product development.
- Legal obligations: retention and disclosure where the law requires it.
4. How We Use Your Information
- To create and manage your account.
- To generate personalised workout plans and adjust them to your progress, equipment and preferences.
- To track your performance and show you statistics, records and leaderboards.
- To deliver exercise videos, images and instructions.
- To let you post, follow other users and interact with them.
- To run the AI coach and to send you check-ins about your training.
- To send push notifications and service messages.
- To provide support.
- To keep the app secure and to prevent fraud and abuse.
- To send marketing, only with your consent and only until you withdraw it.
We do not use your personal data to train our own AI models, and we do not sell your data.
5. How We Share Your Information
We do not sell your personal data. We use the following processors, each under a data processing agreement:
- Supabase (database, authentication, storage): hosted in the European Union, region Frankfurt. This is where your account and training data live.
- Cloudflare (R2 storage and network security): stores your photos and protects the service against abuse.
- Google Gemini (AI coach): see section 6.
- Firebase Cloud Messaging (Google): delivers push notifications to your device.
- Resend: sends transactional email, such as confirmation, password reset and account deletion codes.
- RevenueCat: keeps track of whether you have a subscription. They receive your user id and the status of that subscription, never your payment details.
- Umami: privacy-friendly website analytics.
- Apple and Google: if you buy a subscription, the payment runs through the App Store or Google Play. We never see your payment details.
We may also share data to comply with the law, a court order, or to protect rights and safety, and in the event of a merger, acquisition or sale of the business. In that last case you will be informed beforehand.
What other users can see. Your username, profile photo, posts and your position in leaderboards are visible to other users. Your weight, your body fat percentage and your coach conversations are private and are never shown to anyone else.
6. The AI Coach
Our AI coach runs on Google Gemini. Google acts as our processor for this and does not use your data to train its models.
What we send to Google. When you ask the coach something, we send your question, the recent conversation, your first name and your training profile: your goal, experience level, available equipment, preferred split, days per week, number of completed workouts, streak, focus areas and your active workout plan. Your last five workouts go along as well: the exercises, the sets with weight and repetitions, how heavy it felt, the duration and any records. Without those the coach cannot say anything useful about your training.
What we do not send. We do not send your email address, your surname, your age range, your weight or your body fat percentage.
We also use Gemini to write the periodic check-in messages about your training. Those are based on your training statistics. You can turn them off in your notification settings.
Anything you type into the coach yourself does go to Google as part of your question. So if you tell the coach about an injury or a complaint, that text is part of the conversation.
The coach is off until you turn it on. Because this is the only place where your training data leaves our own systems, we ask your permission separately before your first conversation. Saying no costs you nothing but the coach: everything else in the app keeps working. You can withdraw that permission at any time under Settings, and from that moment no new coach data goes to Google.
You are talking to a language model, not to a person. The coach gives advice, never a binding decision, and you can change or ignore every suggestion.
7. Your Rights
Under the GDPR and the UK GDPR you have the right to:
- Access your data. You can export everything yourself in the app: Profile, Settings, Export data.
- Correct your data.
- Delete your data. See section 8.
- Restrict or object to processing.
- Data portability.
- Withdraw consent at any time.
- Not be subject to a decision based solely on automated processing. Our workout suggestions are advice, never a binding decision.
- Lodge a complaint with your supervisory authority.
To exercise a right, mail [email protected]. We respond within one month. We do not charge for this and we will never treat you differently for using a right.
8. Deleting Your Account and Your Data
You can delete your account yourself at any time, in two ways:
- In the app: Profile, Settings, and then Delete account at the bottom.
- On our website: grabgains.com/delete-account. You do not need the app for this. You enter your email address and confirm with a code we send you.
We ask for that code because we have to be certain it is you. Without the code, nothing happens to your account.
Deletion is immediate and permanent. We remove your profile, username and profile photo, all your workouts, sets, personal records and progress, your weight and body fat history, your posts, photos, comments, likes and follows, your coach conversations and your notification settings. Your active sessions are revoked, so you are no longer signed in anywhere.
Two things remain for a short while. Our encrypted database backups can still contain your data for up to seven days, after which they expire automatically. Your photos are not in those backups: they live outside the database and are gone straight away. Notifications that other users received from you are removed along with your account, including the name shown in them.
Your newsletter subscription is separate from this. Use the unsubscribe link in any of our emails to opt out.
No longer have access to the email address of your account? Mail [email protected] and we will help you.
9. Data Security
- Encryption in transit and at rest.
- Row level security on every table, so your data is only accessible to you.
- Exercise video files are stored encrypted.
- Access controls and authentication for our own staff.
- Regular security reviews.
No system is completely secure, but we take every reasonable step to protect your data. If a breach occurs that is likely to affect your rights, we will inform you and the supervisory authority as required by law.
10. International Data Transfers
Your account and training data are stored in the European Union (Frankfurt). Some of our processors are established in the United States, including Google, Resend and RevenueCat. Supabase and Cloudflare are US companies too: your data is stored in the European Union, but their support and administration can reach it from the United States. Those transfers take place under the European Commission Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.
11. Data Retention
- Account and training data: removed at the moment you delete your account.
- Backups: our encrypted database backups can still contain your data for up to seven days after deletion, after which they expire automatically. Photos and other stored files are not part of them.
- Notifications other users received from you: removed when your account is deleted.
- Support communications: 3 years.
- Website statistics: collected without cookies by Umami, aggregated and not traceable to you. Nothing is kept about your use of the app itself, because we do not measure it.
Some data may be retained longer where the law requires it, for example for tax purposes.
12. Children's Privacy
Our services are intended for users aged 16 or older. We do not knowingly collect personal data from children under 16. If we discover that we have, we delete it immediately. Parents and guardians can contact us to request deletion of a minor's data.
13. Cookies and Tracking
Our website uses essential cookies, needed for the site to work and for form security, and preference cookies such as your language choice.
Our analytics are cookieless. We use Umami, which does not use cookies, does not store full IP addresses and does not track you across websites. Umami records page views, device type and an approximate location at country or region level, derived from Cloudflare security headers. No profiles are built and no advertising data is collected.
One exception: if you play a YouTube video on an exercise page, YouTube places storage on your device. As long as you do not press play, that does not happen. There is more about this under Third-Party Services below.
The app itself does not use cookies. It stores your login securely on your own device, in the iOS Keychain or Android encrypted storage. We do not track you across other apps or websites and we do not use advertising identifiers.
14. Third-Party Services
We use Google reCAPTCHA v3 on the forms on our website to keep out spam and bots. It analyses technical data about your interaction, such as IP address, browser details and usage patterns, to tell people apart from bots.
Google is not our processor here. For reCAPTCHA, Google decides for itself what it does with that data, which makes it an independent controller: Google's own privacy policy and terms apply, and any transfer to servers outside the European Economic Area happens under their arrangements. Our own basis for placing it is our legitimate interest in forms that are not abused.
reCAPTCHA runs only on the website and only on pages with a form, never in the app. Because it is a security measure it cannot be switched off, but you are never tied to it: mail [email protected] instead and you reach us just as well.
Some exercise pages carry an instructional video from YouTube, a Google service. The video does not load on its own. You first see a still image with a play button, and only when you click it is the video fetched from YouTube. If you never click, nothing plays and YouTube stores nothing on your device.
Two things you should know. The still image is served from Google's servers, so your IP address reaches them as soon as you open the page; no cookies are set in the process. And once you press play we use the YouTube variant without tracking cookies, but from that moment Google does process data about your viewing, acts as an independent controller for it, and may process that data outside the European Economic Area. Pressing play is your consent for that.
The app has no player. An exercise with an instructional video shows a card with that same still image, which is served from Google's servers there too, as soon as the exercise comes into view. Tap it and your own YouTube app or browser opens and takes over.
We encourage you to read the privacy statements of these parties.
15. United States Privacy Rights
This section applies if you live in California or in another US state with its own privacy law, such as Virginia, Colorado, Connecticut, Utah or Texas.
If you live in Washington or Nevada, those states have a separate law for health data. How we handle it is set out in our Consumer Health Data Privacy Policy.
Categories we collect. Identifiers (name, email, username, device identifiers), health and fitness information, commercial information (your subscription), internet and app activity, approximate location at country or region level, and content you create yourself.
We do not sell your personal information and we do not share it for cross-context behavioural advertising. We have never done so, including in the twelve months before the date of this policy. We do not use or disclose sensitive personal information for any purpose other than providing the service you asked for.
Your rights. You have the right to know what we collect and why, to receive a copy of your data, to correct it, to delete it, and to not be discriminated against for using those rights. California residents also have the right to limit the use of sensitive personal information; because we only use it to provide the service, no further limitation applies.
How to use them. Export your data in the app under Profile, Settings, Export data. Delete your account in the app or at grabgains.com/delete-account. For anything else, mail [email protected]. We answer within 45 days and may extend that once where the law allows. If we refuse a request, you can appeal by replying to our answer; we respond to an appeal within 45 days and explain the reasons, and if we refuse the appeal we tell you how to complain to your state Attorney General. You may use an authorised agent, in which case we will ask for proof of their authority.
Children. We do not knowingly sell or share the personal information of anyone under 16, because we do not sell or share personal information at all.
16. Changes to This Policy
We may update this policy to reflect changes in the law or in our services. If the changes are significant we will notify you by email, post a notice in the app, and update the date at the top of this page.
17. Contact Us
GrabGains
Netherlands
[email protected]
www.grabgains.com
Supervisory authority: Autoriteit Persoonsgegevens (Netherlands), Postbus 93374, 2509 AJ Den Haag, autoriteitpersoonsgegevens.nl