Privacy

Privacy Policy

How Gravl Macros collects, uses and protects the nutrition and health data you entrust to it.

1. Summary

The short version, with the detail below:

  • We collect what the App needs to work: who you are, your body data, what you eat, and how you use it.
  • We do not sell your data and we do not use it for advertising.
  • Your meal photos and voice transcripts are sent to an AI provider to be identified — that is how photo and voice logging work.
  • Gravl Macros and Gravl Workouts share one account and some of your body data. That is why deleting your Macros account does not delete everything.
  • You can access, correct and delete your data.

2. Who We Are

Gravl Macros is provided by:
GAINS COACH PTY LTD
Australia

We are the data controller for the processing described here. You can reach us through the support page.

2.1. What This Notice Covers

This notice covers the Gravl Macros mobile app. It does not cover Gravl Workouts, which has its own privacy policy, nor third-party services you reach from the App, which have their own.

2.2. How Our Two Apps Work Together

Gravl Macros and Gravl Workouts are two apps from the same company, and you use both with a single account. Signing in to one signs you in to the other with the same identity.

Some of your data belongs to that shared account rather than to one app:

  • Shared — your account identity, your weight entries, your body measurements and your progress photos. Both apps can read and write these.
  • Macros only — everything about food: your meals, recipes, custom foods, daily summaries, targets and the photos you take of meals. Gravl Workouts has no access to any of it.

This is why deleting your Macros account leaves some data in place — see §6.1.

3. General Principles

We collect the data we need to run the App and no more. Nutrition and health data is sensitive, and we treat it as such: it is used to provide the features you asked for, and it is not sold.

  • Consent: when you agree to specific data processing (Art. 6(1)(a) GDPR) — for example connecting Apple Health, or submitting a food to the shared catalogue. Health data is processed on the basis of your explicit consent (Art. 9(2)(a) GDPR).
  • Contractual performance: data needed to deliver the App's services (Art. 6(1)(b) GDPR) — your account, your food log, your targets.
  • Legal obligation: where required by law (Art. 6(1)(c) GDPR).
  • Legitimate interests: where necessary for App functionality, security or business purposes, without overriding your rights (Art. 6(1)(f) GDPR) — for example crash reporting and preventing abuse of the AI features.

4. Data We Collect

4.1. Data You Provide in the App

To create your account and calculate your targets, we process the data you enter: your email address, and the body data and goal you supply during onboarding (such as height, weight, age, sex and activity level).

As you use the App we store what you log: meals and their nutritional values, weight and body measurements, and progress photos. This data is what the App shows back to you as your diary, your trends and your targets.

4.2. Photos and Voice Input

When you log a meal by photo, by voice or by scanning a nutrition label, the image or the transcribed text is sent to an AI provider that identifies the food and estimates its nutritional content, and the result is returned to the App. Speech is transcribed by your device's operating system — depending on your device and settings that may happen on Apple's or Google's servers — and only the resulting text ever reaches us or the AI provider; the audio does not. When you scan a barcode, the code is matched against a food database.

We keep the provider's raw response alongside the photo so we can investigate incorrect results and improve accuracy.

Progress photos are stored so you can compare them over time. You can delete them individually at any time. Note that they are shared with Gravl Workouts — see §6.1.

4.3. Targets We Generate for You

The App derives further data about you from what you log: your estimated energy expenditure, your weight trend, and your daily calorie and macronutrient targets. This derived data says something about your body, so we treat it with the same care as the data you entered yourself.

4.4. Apple Health and Health Connect

If you grant permission, the App reads from and writes to Apple Health (iOS) or Health Connect (Android) — for example weight entries and nutrition data. This access is optional, you control it in your device settings, and revoking it does not stop the rest of the App from working.

Health data obtained this way is used only to provide App features. It is not used for advertising and is not shared with third parties for their own purposes.

4.5. Catalog Contributions

If you choose to submit a food you created to the shared catalogue, the food's details and any photos you attach are reviewed by our team and may be published for all users. Once published, the entry is detached from your account and is no longer identifiable as yours — which also means it cannot be traced back or withdrawn individually afterwards. This is optional and never automatic.

4.6. App Usage & Log Data

We collect technical data needed to operate and improve the App, such as crash reports, error logs and aggregate usage of features. We also record technical details of each AI request — which provider answered, how long it took and whether it failed — so we can keep the feature reliable.

4.7. Third-Party Services

We use third-party providers to deliver the service. They process data on our behalf and are bound to use it only for that purpose:

  • AI providers — your meal photos, the text you type alongside them, your voice transcript and photos of nutrition labels are sent to Google (Gemini) to be identified. If that service is unavailable, the same request may be sent to OpenAI instead.
  • Authentication — Google Firebase holds your sign-in credentials. The same account signs you into Gravl Workouts.
  • Storage and sync — Supabase and PowerSync store your data and keep the copy on your phone in sync with ours.
  • Food databases — barcodes and searches are matched first against our own catalogue, built from public databases (USDA, Open Food Facts, AUSNUT); when there is no local match, the barcode or search term is looked up live against Open Food Facts and USDA FoodData Central.
  • Error monitoring — Sentry receives crash reports. We configure it to strip your email address and IP address before they are stored.
  • Email — SendGrid delivers your verification code.
  • Subscriptions — RevenueCat records your purchase status; payment itself is handled by the App Store or the Play Store, which we never see card details from.
  • Recipe import — when you paste a recipe link, the address you pasted is sent to Firecrawl to read that page. No personal data is included.

Before you create an account, the App lets you try a limited number of photo analyses. Those photos are sent to the AI provider like any other; a randomly generated device identifier and your IP address are recorded on our servers — never sent to the provider — and used only to limit how often the trial can be run.

5. International Transfers

Several of the providers above operate outside the European Economic Area, including in the United States. Where your data is transferred there, we rely on the safeguards the law provides for such transfers — an adequacy decision where one applies, or standard contractual clauses.

6. Your Rights

You have the right to:

  • know what data we hold about you and access a copy of it;
  • have inaccurate data corrected;
  • have your data deleted;
  • restrict how we process it;
  • object to processing based on our legitimate interests;
  • receive your data in a portable format;
  • withdraw consent at any time, without affecting processing already carried out.

6.1. What Deleting Your Account Covers

Because Gravl Macros and Gravl Workouts share one account (see §2.2), deleting your Macros account does not remove everything.

Deleting your Macros account from within the App removes:

  • everything you logged about food — meals, recipes, custom foods, daily summaries, water, streaks and achievements
  • the photos you took of meals
  • your nutrition targets and their history

It does not remove your weight entries, body measurements, progress photos, or the account identity itself (your id and email). Those are shared with Gravl Workouts, which reads and writes them too — deleting them from here would remove them from that app as well.

To delete that shared data, or your Gravl account entirely, contact us through the support page and we will handle it.

6.2. How to Exercise Your Rights

Reach us through the support page. We may need to confirm your identity before acting on a request, so that nobody else can obtain or delete your data. We aim to respond within one month; if a request is complex we may need longer, and we will tell you if that is the case.

7. How Long We Keep Your Data

We keep your data for as long as your account exists, because the App's value depends on your history: your weight trend and your expenditure estimate are computed from it.

When you delete your account, the data listed in §6.1 is deleted. Progress photos you delete individually are removed from our storage shortly afterwards rather than immediately, so that an accidental deletion can be recovered. Beyond that, we delete or anonymise personal data once it is no longer necessary, unless retention is required by law or to fulfil contractual obligations.

8. Security

We take appropriate technical and organisational measures to protect your data, including encryption in transit, access controls on our systems, and restricting internal access to what is needed to operate the service. No system is completely secure, but we work to keep the risk low and to respond quickly if something goes wrong.

9. Children

The App is for adults aged 18 or older and is not directed at children. We do not knowingly collect data from anyone under that age. If you believe a minor has created an account, contact us through the support page and we will delete it.

10. Right to Lodge a Complaint

If you believe we have handled your data unlawfully, you have the right to complain to a data protection supervisory authority — in the EU, the one in the country where you live, work, or where the issue occurred. We would appreciate the chance to address it first.

11. Changes to This Privacy Policy

We may update this policy as the App changes. If we make a material change, we will inform you in an appropriate manner.