GRITSAGA ← Back to GritSaga

Privacy Policy

Last updated: June 30, 2026

1. Introduction

GritSaga ("we", "us", "our") is a fitness application that transforms your real-world fitness progress into a pixel-art RPG character. This Privacy Policy explains what information we collect, how we use it, and the choices you have.

By using GritSaga, you agree to the collection and use of information as described in this policy.

2. Information We Collect

2.1 Information You Provide

  • Account information: email address, username, authentication data (via Apple Sign In or Google Sign In)
  • Body scan photos: weekly/monthly photos you take for AI muscle analysis
  • Selfie photo: used once to generate your pixel art avatar
  • Fitness data: workout logs (muscle groups trained), fuel/food logs (clean/mixed/cheat ratings), optional meal photos
  • Recovery data (if used): sleep, water intake, stress level, supplements
  • Goal preferences: bulk/cut/maintain selection, training split preferences
  • Communications: messages sent to the AI Coach feature
  • Payment information: processed by Apple App Store, Google Play, or RevenueCat — GritSaga does not directly store your card details

2.2 Information Collected Automatically

  • Device information: device type, operating system, app version
  • Usage data: features used, session length, in-app actions (via Mixpanel analytics)
  • Push notification tokens: to deliver reminders and alerts

3. How We Use Your Information

We use your information to:

  • Analyze your body scan photos via AI (Claude Vision API) to generate muscle group scores
  • Generate and evolve your pixel art avatar (via PixelLab.ai) based on your physique and selfie
  • Calculate XP, levels, streaks, and other gamification mechanics
  • Power the AI Coach feature with context about your fitness history
  • Send you notifications about scans, streaks, and weekly bosses
  • Process subscriptions and manage your Free or Pro tier access
  • Improve the app through aggregated, anonymized usage analytics
  • Detect and prevent fraud or abuse

4. Body Photos — Special Handling

We recognize body photos are sensitive. Here is exactly how they are handled:

  • Your body scan photos are sent to Claude Vision API for AI analysis. The resulting muscle scores (numbers only) are stored; the AI does not retain the image after analysis.
  • Your photos are stored securely on our infrastructure (Cloudflare R2) and are never displayed publicly, never shared with other users, and never used in marketing without your explicit separate consent.
  • Your selfie used to generate your avatar is processed by PixelLab.ai solely to create your pixel art character. The character avatar (not your real photo) is what may appear on leaderboards or shareable cards.
  • You may delete your body scan photos and account at any time from Settings, or by contacting us (see Section 11).

5. How We Share Information

We do not sell your personal information. We share data only with:

  • Service providers who help us operate the app:
    • Supabase (database, authentication, storage)
    • Anthropic (Claude API — body scan analysis, AI Coach)
    • PixelLab.ai (avatar generation)
    • RevenueCat (subscription management)
    • Cloudflare (file storage)
    • Mixpanel (analytics)
    • Expo (push notifications)
  • Legal requirements: if required by law, regulation, legal process, or government request
  • Business transfers: in connection with a merger, acquisition, or sale of assets, with notice to you

6. Your Choices and Rights

Depending on your location, you may have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate data
  • Delete your account and associated data
  • Export your data
  • Withdraw consent for specific processing (e.g. meal photo recognition)
  • Opt out of non-essential push notifications and marketing communications

To exercise these rights, go to Settings → Account → Privacy in the app, or contact us at the email below.

EU/UK Users (GDPR)

If you are located in the European Economic Area or UK, you have additional rights under GDPR, including the right to lodge a complaint with your local data protection authority.

California Users (CCPA/CPRA)

California residents have the right to know what personal information is collected, request deletion, and opt out of the sale of personal information. GritSaga does not sell personal information.

7. Data Retention

  • Body scan photos and fitness logs are retained while your account is active, plus a grace period of 90 days after account deletion (in case of accidental deletion or recovery requests), after which they are permanently deleted.
  • Aggregated, anonymized analytics data may be retained indefinitely as it cannot identify you.

8. Children's Privacy

GritSaga is not directed at children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, contact us immediately and we will delete it.

9. Security

We use industry-standard measures to protect your data, including encryption in transit (TLS) and at rest, access controls, and regular security reviews. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

10. International Data Transfers

Your information may be processed in countries outside your own, including the United States, where our service providers operate. We rely on appropriate safeguards (such as Standard Contractual Clauses) where required by law.

11. Contact Us

For privacy questions, data requests, or concerns, contact us at:

Email: hey@gritsaga.com

Website: gritsaga.com

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via the app or by email. The "Last updated" date at the top reflects the most recent revision.

← Back to GritSaga