Privacy Policy

Grounded is a personalised lifestyle and routine application designed to help you work towards your chosen goals through personalised routines, coaching, wellbeing tracking, nutrition, journaling, focus tools and social features. Because Grounded provides personalised features, the information you choose to provide can include personal, lifestyle, health and wellbeing information.

Grounded is operated by Life Architect B.V., Herengracht 323-1, 1016 AW Amsterdam, Nederland. Life Architect B.V. acts as the controller of your personal data for the purposes described in this Privacy Policy.

Contact: contact@grndd.app

When you create a Grounded account, we store or process:

• username;
• email address;
• password, which is processed by the authentication layer in hashed form and is never stored by Grounded as a plain-text password;
• a four-digit verification code and its expiry time;
• your date of birth, used to verify that you meet the minimum age applicable in your country;
• your marketing communication opt-in, if provided.

When an account is created, Grounded automatically creates a user profile, a user role and a referral code associated with your account. The user role is used to manage access to the Services.

The following information is stored in your profile after onboarding, where provided:

• main goals, including weight-related goals and priority;
• date of birth;
• sex;
• height;
• weight and target weight;
• target date;
• activity level;
• cold-shower level and the derived cold-shower experience;
• available days;
• country, city and time zone;
• step goal;
• buddy preferences;
• coach settings.

Your weight is also stored as part of your weight history. Selected short activities, selected long activities and the minutes you have available are stored in your routine plan rather than your profile.

Information not stored from onboarding. Sleep hours, meditation experience, food preferences and allergies, occupation, hobbies, languages, energy level, agenda pressure, wake-up time and bedtime are not collected as onboarding answers. Some of these may be provided later through other features — for example food preferences, or wake-up and bedtime when you configure your alarm settings.

Based on the information available in your account, Grounded may generate a personalised routine blueprint, routine recommendations, personalised activity selections, daily targets and other personalised coaching content. Grounded may also calculate a daily calorie target using relevant profile information such as your goals, body measurements, activity level and available time.

6.1 Routines

• which routine steps you complete;
• when you complete them;
• information relating to your 21-day routine cycle;
• day-specific overrides or changes to your routine.

6.2 Check-ins

• mood;
• energy;
• pride score;
• whether you completed your “frog” task;
• notes.

Depending on the features you use, this may include:

• weight and weight history;
• sleep information;
• steps;
• heart rate;
• calories burned;
• workouts, exercises, sets, weights used and repetitions;
• manually recorded cardio;
• mood and energy;
• other wellbeing information you choose to record.

Some of this information qualifies as data concerning health under Article 9 of the GDPR. We process it on the basis of your separate, explicit consent, which we ask for in the app and record with the policy version and timestamp. You can withdraw that consent at any time under Account → Privacy & consent.

We do not sell your health or wellbeing information, do not use it for targeted advertising, and do not provide it to advertising networks or data brokers.

Device health data. On mobile devices, and only if you grant permission, Grounded may read steps, sleep and heart-rate information from your device's health service (such as Apple Health) to display and track these metrics. You can revoke this permission in your device settings at any time.

If you use Grounded's nutrition features, we may store or process meals, ingredients, calories, macronutrients, favourite foods or meals, recipes and meal photographs.

Where you use barcode or food-search functionality, Grounded may send the relevant barcode or search term to OpenFoodFacts to retrieve food information. In some browsers this request is relayed through a public proxy service (see section 15). Grounded does not send your nutrition history or profile for a barcode or food search.

This may include focus sessions, journal entries, evening journal entries, journal text and journal audio recordings. Journal content may contain personal or sensitive information because it is content you choose to write or record, so avoid entering information you do not want stored in your Grounded account.

If you use Grounded's agenda features we may store tasks, task times, calendar items and information necessary to organise your Grounded schedule. Wake-up time and bedtime may be stored when you configure your alarm settings.

If you choose to connect a Google or Microsoft Outlook calendar, Grounded receives the calendar events needed to display your schedule. You can disconnect the calendar at any time.

If you use social and group functionality, we may process:

• chat messages;
• voice messages or voice memos;
• media shared through chats or groups;
• group or crew memberships;
• buddy matching preferences and history;
• friendships;
• challenges;
• blocks and reports.

Information shared through social features may be visible to the people or groups with whom you choose to share it. If you block or report another user, we may retain that information to operate the feature, investigate misuse and maintain the safety of the Services.

Grounded may store profile avatars, progress or body photographs, chat media, journal audio, meal photographs and photographs of your activities. These files are stored in private storage buckets and are not publicly accessible by default. Progress or body photographs and journals may be protected by an additional PIN.

If you enable notifications, Grounded may process your push notification token, device type, device language, time zone, notification preferences and notification sending logs.

Grounded does not track your location in the background and does not run a live location tracker.

Where you use the route planner or add a location to an agenda item, and only after you grant permission, the app may request your device's current position once to centre the map or estimate travel time. Route coordinates that you draw or provide yourself may be sent to the routing and geocoding services listed in section 15. Your profile also stores the city and country you enter yourself.

• 15.1 Supabase. Supabase provides the database, authentication and file storage that host your account, profile, wellbeing, nutrition, social and media data.
• 15.2 Cloudflare. Cloudflare hosts and delivers the application and processes technical request data such as your IP address.
• 15.3 Lovable AI Gateway. Where you use AI-powered features, Grounded may send the information necessary for that feature — such as relevant prompt context — for personalised coaching text, meal analysis and image-related functionality. Grounded does not send unrelated information simply because it exists in your account.
• 15.4 OneSignal. Push token, notification message content and device-related notification information.
• 15.5 Email delivery provider. Your email address, name and message content are processed to send verification codes, password resets, account notices and — with your consent — marketing emails.
• 15.6 OpenFoodFacts and food-lookup proxies. A barcode or food search term may be sent to OpenFoodFacts. When a browser blocks the direct request, it may be relayed through a public proxy service (such as AllOrigins, corsproxy.io or r.jina.ai). Only the barcode or search term is sent.
• 15.7 OSRM and Nominatim (OpenStreetMap). Route coordinates that you draw or provide yourself may be sent to OSRM for route-related functionality, and a place name or address you enter may be sent to Nominatim to look up its coordinates. No background GPS location is sent.
• 15.8 Google Fonts. Typefaces are loaded from Google Fonts, which receives your IP address and basic browser information.
• 15.9 Payment providers. All memberships and in-app purchases are processed by the Apple App Store or Google Play. Grounded may process a transaction amount and a store transaction identifier. Full payment card details are handled by the app store and never pass through or get stored by Grounded.

Grounded may process your subscription status, trial-period information, purchases of meditation content and promotional-code usage. Grounded does not receive or store your full payment card details.

Based on the current Services, Grounded does not send:

• background GPS location;
• your contacts list;
• browsing history outside Grounded;
• search history outside Grounded;
• advertising IDs;
• crash reports through a crash-reporting SDK;
• payment card details.

• create, authenticate and manage your account, and verify your email address;
• provide the Services, personalised routines, targets, coaching and recommendations;
• track routines and progress and provide check-ins;
• provide nutrition, journaling, focus, social and buddy features;
• provide notifications;
• process subscriptions, purchases and promotional codes;
• provide customer support;
• protect users against fraud, abuse and misuse and investigate reports;
• maintain and secure our systems and improve the Services;
• comply with legal obligations and establish, exercise or defend legal claims.

Performance of a contract

To provide the Services you requested, including account management, personalised routines and subscriptions.

Consent

For health and wellbeing data (GDPR art. 9), marketing emails, optional device permissions such as location, notifications and health data, and any optional connected service. You can withdraw consent at any time.

Legal obligation and legitimate interests

To comply with law, and to keep the Services secure, prevent abuse and improve the product, where these interests are not overridden by your rights and freedoms.

We only send marketing or promotional emails if you have given explicit consent. This is never required to use Grounded and is switched off by default. You can give or withdraw consent under Account → Privacy & consent or via the unsubscribe link in any marketing email. We record the date and time of each decision (GDPR art. 7). Withdrawal does not affect essential account emails.

Grounded uses artificial intelligence to generate or assist with coaching text, personalised recommendations, routine-related content, meal analysis and image-related functionality. The information provided depends on the feature you use. AI-generated content is not medical advice.

We share personal data with the service providers listed in section 15 and on our Subprocessors page (https://grndd.app/subprocessors), where required by law, and in connection with a merger, acquisition, restructuring or sale of all or part of our business. We do not sell your personal data.

Some providers may process personal data outside the European Economic Area. Where that happens we use appropriate safeguards such as European Commission Standard Contractual Clauses, adequacy decisions or other legally recognised transfer mechanisms.

We use technical and organisational measures to protect personal data, including row-level access controls on the database, private storage buckets and encrypted transport. Passwords are processed through the authentication layer in hashed form. No method of electronic storage or transmission can be guaranteed to be completely secure.

• access your personal data;
• correct inaccurate or incomplete information;
• request deletion of your personal data;
• request restriction of processing;
• object to certain processing;
• withdraw consent where processing is based on consent;
• receive a portable copy of your data;
• lodge a complaint with a supervisory authority.

You can exercise several of these rights directly in the app: Account → Privacy & consent lets you download a machine-readable copy of your data (art. 15 and 20), manage your consents, and delete your account. For anything else, contact contact@grndd.app.

We retain your personal data for as long as your account exists. When you delete your account we delete or anonymise your profile, routine, wellbeing, nutrition, social information and uploaded files, except where information must be retained for legal obligations, accounting or tax requirements, fraud prevention, security, dispute resolution or legal claims.

How to delete your account inside the app.

• open Grounded and go to Account (profile) settings;
• select “Delete account”;
• confirm the deletion request.

Deletion removes your account and associated personal data; it cannot be undone. You can also request deletion by emailing contact@grndd.app, and you can export a copy of your data from the same settings screen before deleting. Purchases and subscriptions bought through the App Store are managed by Apple; deleting your account does not automatically cancel an active App Store subscription.

Grounded only asks for a device permission when a feature needs it, and each feature keeps working in a limited form if you decline. On iOS you can review or withdraw any permission at any time in Settings › Grounded; on Android in Settings › Apps › Grounded › Permissions.

• Camera — Grounded uses your camera to take progress photos, snap pictures of meals, scan barcodes to look up food and set your profile avatar. For example, after a workout you can take a front-facing photo to visually track your body changes over time. Your photos and videos are stored privately in your account and are never shared.
• Photo library — Grounded uses your photo library to let you choose progress photos, meal photos, or a profile avatar. Selected photos are stored privately in your account and are never shared.
• Microphone — voice memos, journal audio and buddy calls;
• Notifications — routine reminders, buddy messages and streak reminders;
• Motion & fitness / health data — step counts and activity data, only when you connect it, used to fill your daily step and activity totals;
• Location — requested once when you use the route planner or add a location to an agenda item; there is no background location tracking.

Health and fitness data read from your device is used only to show and calculate your own progress inside Grounded. It is never used for advertising and is never sold or shared with data brokers.

Grounded does not track you across apps or websites owned by other companies as defined by Apple's App Tracking Transparency framework. We do not use the advertising identifier (IDFA), we do not show advertising, we do not build advertising profiles, and we do not share your data with data brokers.

We do not sell your personal information and we do not share it for cross-context behavioural advertising within the meaning of US state privacy laws.

The categories below match the privacy information published on our App Store product page. Data in these categories is linked to your account and is used for app functionality and personalisation only — not for tracking or advertising.

• Contact info — email address, username;
• Health & fitness — routines, check-ins, weight, sleep, steps, workouts, nutrition;
• User content — photographs, journals, voice memos, chat messages, notes;
• Identifiers — user ID, push notification token;
• Usage data — in-app activity needed to run and improve features;
• Purchases — subscription and purchase status;
• Location — coarse location entered by you, plus a one-time position when you use the route planner;
• Diagnostics — none collected through a crash-reporting or analytics SDK.

We require every service provider listed in section 15 to protect your data to a standard at least equivalent to the standard described in this Policy, through written data-processing agreements that limit them to processing your data on our instructions and prohibit using it for their own purposes.

Grounded is not intended for individuals below the minimum age required to use the Services under applicable law without parental or guardian consent. We check your date of birth against the minimum age that applies in your country during registration. If we learn that we have collected data from a child below that age without the required consent, we will delete it.

Grounded uses only strictly necessary storage such as your authentication session and app preferences. See our Cookie Policy for details. We use no advertising or cross-site tracking technologies.

Depending on applicable law, you may have rights to know or access, correct, delete, obtain a portable copy of your personal information, opt out of certain sales or sharing or of targeted advertising, and appeal certain privacy decisions. We do not sell personal information and do not use it for targeted advertising. We will not discriminate against you for exercising your privacy rights.

For users in the Netherlands, the relevant supervisory authority is the Autoriteit Persoonsgegevens. We would appreciate the opportunity to address your concerns first.

We may update this Privacy Policy. Material changes will be communicated in the Services, and where the change affects processing based on your consent we will ask for your consent again.

Life Architect B.V., Herengracht 323-1, 1016 AW Amsterdam, Nederland — contact@grndd.app