Privacy Notice

1. Scope and controller

This notice covers the GRUN mobile application, gruncalorietracker.com, account and support services offered in Türkiye, Ireland and the United Kingdom in English and Turkish. GRUN is provided by an independent developer who acts as the data controller for the service. Privacy questions and rights requests can be sent to support@gruncalorietracker.com.

2. Data we process

Account and identity: email address, encrypted credentials, verification status, Apple/Google sign-in identifiers, linked login providers, account and consent history.

Profile and goals: name, age, gender, height, weight, body-fat value when supplied, target weight, activity level, goals, language, market region, time zone and unit preference.

Nutrition and wellness: foods, portions, calories, macro/micronutrients, meals, recipes, grocery lists, water, fasting, exercise, weight/progress, steps, sleep and related notes you choose to add.

Connected health data: with your separate explicit permission, provider, steps, active calories, distance, sleep duration, heart rate, timestamps and provider sample identifiers from Apple Health, Health Connect or a supported provider.

AI inputs and results: voice-derived text, meal photos, prompts needed for an AI feature, generated drafts, corrections, confirmation/rejection feedback and privacy-safe request metadata. GRUN does not store the audio recording; device speech-to-text supplies text. Raw voice transcripts, notes and full image references are not retained in long-term request metadata.

Transactions and entitlement: plan, entitlement, product and transaction references, purchase/expiry status, refunds and AI-credit activity. Payment and subscription providers process payment details; GRUN does not receive your full card number.

Device, communications and diagnostics: push token metadata, device/platform identifier, notification preferences, app language/version, security events, IP/access logs, correlation identifiers, support messages and product interaction events. Product analytics must not contain raw voice transcripts, full prompts, medical notes or sensitive free text.

3. Why we use data and our legal bases

We process account, diary, goal, subscription and support data to provide the service and perform our contract with you. We use security, fraud-prevention, service reliability and limited product measurement data for our legitimate interests in protecting and improving GRUN, balanced against your rights. We process records required for tax, payment reconciliation, disputes and compliance where there is a legal obligation.

Health and similar wellness information can reveal health data and may be special-category data. GRUN relies on your explicit consent for connected-health processing and AI recommendation processing where it uses such data. You can revoke those consents in the app; revocation does not make earlier lawful processing unlawful. Core profile information you ask us to use for calorie and nutrition calculations is processed to deliver the service you request and, where it constitutes health data, with your explicit consent.

Marketing email is optional and based on consent. You can withdraw it without losing core service access.

4. AI and automated processing

AI features create estimates, drafts and general guidance. A meal photo or voice entry is never written directly to your diary: you review and confirm it first. Generated nutrition, recipe, coaching and workout content may be inaccurate and must not be used for diagnosis, treatment or emergencies. GRUN does not currently make solely automated decisions that produce legal or similarly significant effects.

5. Permissions and connected services

Camera/photo-library access is used only when you choose photo logging, barcode scanning, avatar or recipe/product evidence upload. Microphone access is used for voice entry; audio is converted to text on the device and is not stored by GRUN. Notification permission is used for reminders you enable. Health permission is requested by the operating system for the data types you select. You can change permissions in device settings, although a related feature may stop working.

Disconnecting a health provider stops future synchronisation but preserves prior synced data. The app also provides separate controls to delete one provider’s data or all synced health data, even after a plan downgrade.

6. Recipients and international transfers

GRUN may share only the data needed to operate the service with providers of secure hosting and storage, email delivery, subscriptions and payments, notifications, sign-in and artificial-intelligence processing. These providers may process data only for the agreed service and under applicable confidentiality, security and data-protection obligations. We may also disclose data to professional advisers, authorities or a successor where lawfully required.

Some providers may process data outside the UK or EEA. Where required, we use an adequacy decision or approved contractual safeguards and assess supplementary protections. Contact us for information about the safeguard relevant to a transfer.

7. Retention

Account, diary, health, notification and user-owned AI records are kept while your account is active and are deleted or anonymised through account deletion, unless a legal hold applies. Temporary AI meal photos expire after approximately 30 minutes. Pending product-evidence images are retained for no more than 28 days; rejected evidence for no more than 7 days. Product interaction analytics are configured for up to 400 days. Consent evidence and de-identified payment audit events may be retained for up to 7 years for legal, reconciliation and fraud-prevention needs. Security logs, backups and support correspondence are kept only as long as reasonably necessary for their stated purpose and are then deleted or irreversibly anonymised.

8. Your choices and rights

The app lets you review legal-consent history, revoke optional consent, export a machine-readable copy of your data, disconnect health services, delete synced health data and delete your account. Depending on applicable law, you may also request access, correction, deletion, restriction, portability or object to processing. You can complain to the Irish Data Protection Commission if Ireland is your supervisory authority, or to the UK Information Commissioner’s Office if UK data law applies. You may also contact your local supervisory authority.

See Account and data deletion for the exact controls and effects. We may need to verify your identity before acting on a request.

9. Children

GRUN is not available to children under 13. Users aged 13–15 must have permission from a parent or guardian where local law requires it. We may ask for age or guardian confirmation and restrict age-sensitive features. If you believe a child under 13 has provided data, contact us so we can investigate and delete it. Advanced fasting features are for adults only.

10. Security and changes

We use access controls, encryption in transit, credential hashing, rate limits, audit trails, environment-separated secrets and restricted administration. No system is completely secure. We will update this notice when processing materially changes and will request renewed consent where required. The version shown in the app and recorded in consent history identifies the terms you accepted.