> For the complete documentation index, see [llms.txt](https://hoftware.gitbook.io/grit75/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hoftware.gitbook.io/grit75/page-1/privacy-policy.md).

# Privacy Policy

Last updated: 8 October 2026 Effective date: 8 October 2026

This policy explains what Grit75 collects, why, who else touches it, and how to get rid of it. Grit75 is made by Hoftware ("we", "us"), which is the data controller for the information described here.

Grit75 asks you to photograph your body every day. That is unusually sensitive, so we have written the photo section in full and put it first rather than burying it. If you read nothing else, read section 1.

Questions: <hello@hoftware.io>.

### 1. Your progress photos, in plain English

**What happens when you take a photo.**

The photo is saved to Grit75's own folder on your device first, before anything else. That is deliberate: a photo taken in a gym with no signal must never be lost. It is not written to your camera roll, and other apps cannot read it.

**What happens next is your choice.** Under **Profile → Photos** you pick one of two settings, and you can change it at any time.

*Synced (the default).* When you next have a connection and are signed in, the app uploads a copy to a **private storage bucket** run by Supabase. It is stored at a path built from your user id, the challenge id and the day number. Access rules on that bucket key off your user id, so an authenticated request can only ever reach files inside your own folder. The bucket is not public and the files are not reachable by URL guessing. A small database row records that the photo exists: your user id, the challenge id, the day number, the storage path, and when it was taken. This is what lets your photos come back if you lose or replace your phone.

*On this device only.* Nothing is stored on our servers. No file is uploaded, and no database row is written for the photo. The images stay in the app's own folder on your device, and if you delete the app or lose the phone, they are gone and we cannot recover them for you.

If you switch from synced to device-only, we offer to delete the copies already in the bucket, without deleting your account.

**One thing device-only does not mean.** It does not mean the images never leave the phone. Scoring still sends them, as described immediately below. The accurate statement, and the one the app itself makes, is that **nothing is retained by us** and the photos leave your phone only for the length of a single scoring request.

**What happens when a score is produced.**

Every five logged days, when you open the Progress tab, the app asks our server to score that period. The server then:

1. checks that the account and the challenge belong to you;
2. picks your Day 1 baseline photo plus your most recent photos, capped at **six photos in total** for that scoring run;
3. gets hold of those photos: on the synced setting it downloads them from the private bucket; on the device-only setting your phone sends them with the request, resized smaller first. Either way they are converted to base64, and
4. **sends them to OpenAI**, over HTTPS, to the GPT-4o vision model at `api.openai.com`. None of this happens unless you have agreed to it (see "Your face, and your consent" below).

We want to be plain about that last step, because it is the part people would be most annoyed to discover later. **Photographs of your body leave our systems and are processed by OpenAI.** There is no version of the Transformation Score that avoids this. If you are not comfortable with that, do not use the scoring feature, and be aware that scoring is the core of the product.

What we send OpenAI with the photos is the images themselves and a label saying which day each one is ("Day 1, Day 6, Day 11"). We do not send your name, your email, your user id, your account identifier, or anything else that identifies you. OpenAI receives the pictures, not your identity.

What comes back is a set of numbers (a headline score, four region scores, a confidence value) and at most one short factual sentence. That is stored against your account. The photos we sent are not stored by us a second time.

We use OpenAI's API under a **zero data retention** arrangement. OpenAI processes the photos to return the score and does not store them afterwards, and API inputs are not used to train OpenAI's models. We do not control OpenAI's systems and you should read their policies as well as ours.

**Your face, and your consent.**

Progress photos are framed head to knees, so they show your face. We treat a photo that shows your face as face data, and handle it as follows.

* **Your consent comes first.** The first time you open the camera, the app asks whether it may send your progress photos to OpenAI to produce your Transformation Score. Nothing is sent for scoring unless you agree. If you choose **Not now**, you can still take and keep progress photos and use every other part of the app; only scoring is turned off. You can change your answer at any time under **Profile → AI scoring**, or from the Progress tab.
* **What is collected.** The photos you take, and nothing derived from your face. The app does not use Face ID, the TrueDepth camera, ARKit face tracking, or any face detection or face recognition technology, on your device or on our servers. It never extracts facial measurements, facial landmarks, or any biometric template, and it never identifies or recognises anyone.
* **How it is used.** Only to produce your score and to show you your own photos. Your face is handled exactly like the rest of the photo and nothing more is done with it. The scoring model is instructed to ignore the face entirely: not to analyse, describe or mention it, and never to attempt to identify or recognise the person. Photos are never used for advertising, marketing, profiling or authentication, and are never sent to our analytics provider.
* **Who it is shared with.** Only OpenAI, only with your consent, and only for a single scoring request each time: up to six photos, under zero data retention, without your name, email or any identifier.
* **Where it is stored, and for how long.** As described above: on your phone, and in your private storage bucket on the synced setting. Photos are kept as described in section 6 and deleted as described in section 7. You can also remove the server copies at any time without deleting your account, by switching to **On this device only** under **Profile → Photos** and accepting the offer to delete them.

**Photographs of a person's body may count as sensitive or special-category personal data** under the GDPR, the UK GDPR and similar laws, depending on what they reveal. We treat them that way: private bucket, per-user access rules, no sharing with other users, no publication, no advertising use, no model training, and a deletion path that really deletes the files.

### 2. What we collect

**Account information.** You sign in with Google or Apple. We receive from them, and store, your email address, your display name and your profile picture URL where the provider gives us one (Apple often does not). We also mint a short internal customer id for your account. We never see or store your Google or Apple password.

**Progress photos.** As described in section 1.

**Challenge data.** Which mode you are running, its strictness, the start date, which tasks you have ticked each day, water logged in ounces, when a day was completed, your streak, and your history of past attempts including the day you reached, the outcome, and the reason you gave if you answered the post-mortem question.

**Transformation Scores.** The score, the four region scores, weak zones, period-on-period and against-baseline deltas, confidence and comparability values, the number of photos used, and two figures counted from your day log rather than from any photo: how much of the required work you completed in that period, and how many of its days you engaged with at all.

**Onboarding answers.** During onboarding we ask whether you have attempted a challenge before, why you are doing it, what usually stops you, and your current activity level. These are stored on your device and are also sent to our analytics provider as events.

**Usage and diagnostics.** Which screens you view and which actions you take (day completed, photo captured, score generated, paywall viewed, purchase completed, and similar), along with standard device and app information collected by the analytics SDK. Handled errors are also reported, including the error message and code, which for backend errors can contain database identifiers such as your user id or a storage path.

**Subscription status.** Whether you have the `grit75` entitlement, and the plan and renewal information RevenueCat receives from Apple.

**Notification permission.** Whether you granted permission for reminders. Reminders are scheduled on your device.

**What we do not collect.** We do not collect your location. We do not collect health or fitness data from Apple Health. We do not have a social feed, so nothing you record is visible to another user. We do not see your card number, and we run no advertising and no ad tracking.

### 3. Why we process it, and on what legal basis

For people in the UK, EU and other places with equivalent law, this is the framing we rely on. A lawyer should confirm it applies to your jurisdiction.

| What                                          | Why                                                                   | Legal basis                                                                                      |
| --------------------------------------------- | --------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------ |
| Account information                           | To create and maintain your account and let you sign back in          | Performance of a contract                                                                        |
| Progress photos, stored (synced setting only) | To show you your own progress and survive a lost or replaced phone    | Performance of a contract                                                                        |
| Progress photos, sent to OpenAI               | To produce the Transformation Score you subscribed for                | Performance of a contract, and where the photos are special-category data, your explicit consent |
| Challenge data and scores                     | To run the challenge and show your history                            | Performance of a contract                                                                        |
| Onboarding answers                            | To recommend a suitable mode, and to understand where people drop off | Performance of a contract, and legitimate interests in improving the app                         |
| Usage analytics and error reports             | To find bugs and understand which parts of the app work               | Legitimate interests in keeping the app working                                                  |
| Subscription status                           | To unlock paid features and manage billing                            | Performance of a contract                                                                        |

### 4. Who else processes your data

We use a small number of providers. Each gets only what it needs.

* **Supabase** hosts our database, authentication and the private photo storage bucket. Supabase holds your account record, your challenge data, your scores, and your photo files.
* **OpenAI** receives your progress photos, only if you agree to scoring, without identifying information and under zero data retention, to produce the Transformation Score. This is described in section 1.
* **PostHog** is our analytics, error tracking and feature flag provider. It receives usage events, screen views, error reports, your internal customer id, your email address and which sign-in provider you used. PostHog is also how we find crashes and bugs, so error reports go there too, and it is how we turn features on for a subset of users. Analytics are switched off entirely in development builds, so our own testing never lands in the same data.
* **RevenueCat** manages subscription state on our behalf. It receives your internal customer id and the purchase information Apple provides.
* **Apple** processes the payment itself and runs the App Store. Apple, not us, holds your payment details. We never receive your card number.
* **Google** and **Apple** provide sign-in. When you sign in, they tell us the profile information described in section 2. Our use of information from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

We may disclose information if we are legally required to, to enforce our Terms, or to protect someone's safety. If our business is sold or merged, your information may transfer with it, and we would tell you before that changes how it is handled.

### 5. International transfers

We are based in the United States and our providers are largely United States based. Supabase, OpenAI, PostHog, RevenueCat, Apple and Google process data in the United States and, in some cases, in other countries.

If you use Grit75 from the UK, the EEA or Switzerland, your personal information, including your progress photos, is transferred outside your country. Where that transfer needs a legal mechanism, we rely on the Standard Contractual Clauses or an equivalent approved mechanism in our agreements with those providers.

### 6. How long we keep it

* **Photos, challenge data and scores** stay for as long as your account exists. We do not delete them when your subscription lapses. That is a deliberate policy: a cancelled subscriber keeps read-only access to their photos, history and scores indefinitely, and can still ask us for a copy of them. In-app export is not switched on yet, so a copy is requested by email (see section 8).
* **The copy on your device** stays until you delete the app or delete your account. Deleting the app removes it from the device.
* **Analytics and error reports** are kept according to our provider's retention settings.
* **Server logs** from the scoring and deletion functions include identifiers such as storage paths, which contain your user id. They are kept for our hosting provider's standard log retention period and then discarded.
* **Backups** may hold copies for a short period after deletion, until they expire on their normal cycle.

### 7. Deleting your account, and what that actually does

There is a **Delete account** option in the Profile tab. It is not a soft delete. When you confirm it:

1. Our server lists every file under your folder in the private photo bucket, walking into each challenge subfolder, and deletes them all.
2. Our server deletes your authentication record. Every table cascades from it, so your profile, your challenges, your day logs, your photo rows and your scores are removed with it.
3. The app then wipes the photo files and the photo manifest held on your device, and clears the local challenge record.

This is immediate and irreversible. We cannot restore an account after this. Your photos are the one thing in the app that cannot be regenerated, so ask us for a copy first if you want to keep them (see section 8).

Deleting your account does **not** cancel your subscription. Cancel that separately through the App Store, as described in the Terms.

Two things survive deletion, and we would rather say so than let you find out:

* Analytics events already recorded are pseudonymous and are held on our analytics provider's own retention schedule. Ask us and we will submit a deletion request for your identifier.
* RevenueCat and Apple keep purchase records for their own accounting and legal obligations.

### 8. Your rights

Depending on where you live, you have some or all of these rights over your personal information:

* to know what we hold and get a copy of it;
* to correct it;
* to delete it;
* to restrict or object to how we use it;
* to portability;
* to withdraw consent where we relied on consent, including consent to AI processing of your photos, without affecting what was lawful before you withdrew it;
* not to be discriminated against for exercising any of these.

You can delete everything yourself from the Profile tab.

**Getting a copy of your data.** There is no in-app export button yet. Email <hello@hoftware.io> from the address on your account and we will send you your photos, your day history and your scores. This is free, it does not require an active subscription, and we will not ask you why you want it. If you use the device-only photo setting, note that we have no copy of your photos to send: they are on your phone and nowhere else, so that part of a request is one only you can fulfil.

For anything else, email the same address and we will act within the time the applicable law allows. We may need to confirm you are the account holder before we act.

If you are in the UK or the EEA and you think we have handled your information unlawfully, you can complain to your national data protection authority. In Switzerland, that is the Federal Data Protection and Information Commissioner. If you are in a US state with a privacy law and we decline your request, you can appeal by replying to our decision, and then complain to your state attorney general.

**Automated processing.** The Transformation Score is produced automatically by an AI model. It has no legal or similarly significant effect on you: it does not decide anything about your access, your price, or your account. It is information about your own photos, shown only to you. If you want a human to look at a score you think is wrong, email us.

### 9. Children

Grit75 is for adults. You must be at least 17 to use it, and we do not knowingly collect information from anyone under 13. If you believe a child has created an account, email <hello@hoftware.io> and we will delete it and its photos.

### 10. Security

Photos are held in a private bucket with per-user access rules, so an authenticated request cannot reach another user's folder. Traffic to our backend and to OpenAI is encrypted in transit. Scoring runs server-side under a key that is never present in the app. Sign-in is delegated to Google and Apple, so we hold no passwords.

No system is perfectly secure and we will not pretend otherwise. If a breach affects your personal information, we will notify you and the relevant regulator where the law requires it.

We describe our practices here rather than claiming any certification. Grit75 is not certified under any security or privacy standard.

### 11. Changes to this policy

We will update this page when our practices change, and change the date at the top. If a change materially affects how your photos are handled, we will tell you in the app before it takes effect.

### 12. Contact

Hoftware Email: <hello@hoftware.io>