Privacy Policy

Last updated 7 August 2026

Grindz is a training log. It stores the workouts you enter so they can be shown back to you on your other devices. It is run by one person as a personal project, it carries no advertising, and it has no analytics or tracking of any kind.

What is collected

Data	Where it comes from	Why
Email address, name, profile picture	Your Google account, when you sign in	To identify your account and show who is signed in
Workout sessions and sets — exercise, weight, reps, RPE, duration, distance, notes	You, as you log them	The purpose of the app
Weekly plan, saved templates, favourite exercises	You	To rebuild your setup on any device
Bodyweight and body-fat entries	You, if you choose to enter them	The progress charts. Entirely optional
Custom exercises you create, including any photo you attach	You	To add movements the built-in catalogue is missing
An optional Groq API key	You, only if you paste one in Settings	AI-assisted exercise authoring. Never used for anything else

Grindz requests only three permissions from Google — email, profile and openid. It cannot read your Gmail, your Drive, your contacts or your calendar, and it never asks to.

Custom exercises are public

Please read this one. When you create a custom exercise, it is visible to every other Grindz user by default — including its name, the notes and form cues you write, and any photo you upload.

This is deliberate: it means the exercise catalogue grows for everybody. But it does mean you should not put anything private into a custom exercise. Do not use the name or notes field for personal information.

Nothing else is shared. Your sessions, sets, plan, templates, bodyweight history and favourites are visible only to you, enforced in the database itself rather than only in the app.

Where it is stored

Your data lives in a Postgres database and file storage hosted by Supabase. Every table has row-level security enabled, so one account cannot read another's rows.
The websites are served by Vercel, and the exercise illustrations by Cloudflare. Both receive ordinary web request information such as your IP address, as any web host does.
Your sign-in session is kept in your own browser's local storage — on the Android app, in its local app storage. It is not a cookie sent to anyone.

Cookies

Grindz sets exactly one cookie, gz_hint, on .grindz.dev. Its entire contents are the number 1. It records only that somebody signed in on this browser, so that returning to grindz.dev sends you to the app instead of a marketing page you have already read.

It contains no token, no user id and no email, and it cannot be used to access your account. Signing out deletes it. There are no advertising or analytics cookies.

What is never done

Your data is not sold, rented, or shared with advertisers — there are none.
There is no analytics, telemetry or tracking in either the website or the Android app.
Your training data is not used to train any AI model.
No email is sent to you other than what Google itself sends during sign-in.

Getting your data out, or deleting it

Export: Settings → Export data downloads your workout history as a file, at any time, without asking anyone.
Delete individual items: sessions, custom exercises and body-metric entries can each be deleted from within the app.
Delete everything: email the address below asking for account deletion. Your account and all rows belonging to it will be removed. Custom exercises you made public may be retained without your name attached, since other people's catalogues reference them — say so in your message if you want those removed too.

Data is kept for as long as your account exists. There is no automatic expiry, because a training log is only useful if it goes back years.

Children

Grindz is not directed at children under 13, and accounts are not knowingly created for them. If you believe a child has an account, email the address below and it will be removed.

Changes

If this policy changes materially, the date at the top of this page changes with it. There is no mailing list to notify, by design.

Contact

Questions, data requests, or anything that looks wrong: roguecaltrop@gmail.com.