Privacy Policy

Last updated: 17 May 2026

GrappleIt ("we", "us", or "our") is a training journal and gym management app for grapplers. This policy explains what data we collect, how we use it, and your rights. By using GrappleIt you agree to this policy.

1. Who we are

GrappleIt is operated as a personal project. If you have questions about this policy, contact us at privacy@grappleit.app.

2. Data we collect

We only collect data you directly provide or that is necessary to run the service:

• Account data — email address and encrypted password (via Supabase Auth).
• Training journal — session dates, techniques, rounds, intensity ratings, notes, and any videos you attach.
• Profile data — optional display name and profile photo if you set one.
• Gym data — if you join a gym on GrappleIt, your membership role and any content you post to that gym's community or schedule.
• Uploaded images — logo images uploaded by gym admins, profile photos, and journal-attached images.
• Payment data — if you book a private session, payment is processed directly by Stripe. We do not store card numbers. We store a Stripe customer ID and session references.
• Usage data — basic request logs (IP address, timestamps) stored by our infrastructure providers (Supabase, Vercel). We do not use third-party analytics.

3. How we use your data

• To provide and improve the GrappleIt service.
• To authenticate you and enforce gym membership permissions.
• To send transactional emails (booking confirmations, password resets). We do not send marketing emails.
• To process payments for private coaching sessions via Stripe.

4. Data sharing

We do not sell your data. We share data only with the sub-processors required to operate the service:

• Supabase — database, authentication, and file storage (EU region).
• Vercel — web hosting and CDN.
• Stripe — payment processing.
• Expo / EAS — mobile build and update delivery.

Within a gym, gym admins and coaches can see member names and roles. Community posts are visible to all gym members. Your training journal is private — only you can see it.

5. Data retention

We keep your data for as long as your account is active. If you delete your account, your personal data and journal entries are deleted within 30 days. Anonymised aggregate statistics may be retained.

6. Your rights

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your account and associated data.
• Export your journal data (contact us and we will provide a CSV).
• Object to processing or restrict it in certain circumstances.

To exercise any of these rights, email privacy@grappleit.app. We will respond within 30 days.

7. Children

GrappleIt is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.

8. Security

All data is transmitted over HTTPS. Passwords are hashed and never stored in plain text. Supabase Row-Level Security (RLS) policies ensure users can only access their own data or data within gyms they are a member of. We take security seriously but no system is perfectly secure — please use a strong, unique password.

9. Cookies and local storage

The GrappleIt mobile app uses device storage (AsyncStorage) to remember your session and gym preference. The website does not use advertising or tracking cookies. Strictly necessary cookies may be set by our CDN.

10. Third-party links

The app may link to external sites (e.g., instructional videos). We are not responsible for the privacy practices of those sites.

11. Changes to this policy

We may update this policy from time to time. Material changes will be flagged in the app. The "last updated" date at the top of this page always reflects the current version.