Interpretation and Definitions
Definitions
- Application: The software program Grindlock provided by the Company.
- Company: Abenteuergeist, Widenmayerstraße 11, 80538 München, Germany.
- Country: Germany.
- Device: Any device that can access the Service such as a mobile phone or tablet.
- Service: The Application and all related services provided by the Company.
- You: The individual accessing or using the Service.
Information We Collect
Account Information via Apple or Google Sign-In
When you sign in to Grindlock using Sign in with Apple or Google Sign-In, we receive your name and your email address (or an Apple-generated relay email address if you choose that option). This information is used solely to create and maintain your account.
Workout Data
Grindlock collects data about your workouts including:
- Rep counts for each exercise
- Exercise type and variations
- Session duration and timestamps
- All workout history and progress tracking
Profile Data
Your profile data includes your XP points, current level, workout streak and complete session history. This information is used to provide your personalized experience and track your progress.
Device Information
We collect information about your device type, operating system version and identifiers for crash reporting. If you allow tracking (see “Advertising Attribution” below), your device’s advertising identifier (IDFA) is additionally used to measure our ad campaigns.
Camera & Exercise Detection
Grindlock uses your device’s camera to detect exercises and count repetitions. It’s critical to understand how this works:
- On-Device Processing Only: All camera analysis uses machine learning models bundled with the app. Processing happens entirely on your device.
- No Recording: Your device does not record, store or transmit any camera frames or video.
- Real-Time Analysis & Immediate Discard: Camera frames are analyzed in real time and immediately discarded. No visual data leaves your device.
- No Data Transmission: Camera data is never sent to Abenteuergeist’s servers or any third party.
The camera is used only during active exercise detection. You control when the camera is active.
Screen Time & App Blocking
Grindlock’s core feature lets you block distracting apps and earn screen time through exercise. This is built on Apple’s Screen Time technology (Family Controls) and works entirely on your device:
- Your app selection stays local: The list of apps you choose to block is stored only on your device by iOS. Apple’s framework never reveals it to us.
- No usage data leaves your device: Blocking schedules, unlocked minutes and app usage are processed on-device and are never transmitted to our servers or any third party.
- You are in control: Screen Time authorization is requested during setup and can be revoked anytime in your device settings.
Workout & Account Data — Supabase
Your workout data and account information are stored on Supabase, our backend infrastructure provider. This data is:
- Stored securely with row-level security (RLS) policies
- Only accessible to you and your account
- Never sold, shared or used for advertising purposes
- Protected by industry-standard encryption
Crash Reporting — Sentry
When Grindlock crashes or encounters an error, we collect crash reports through Sentry to identify and fix bugs:
- Technical Data: Device type, OS version, app version and stack traces for debugging.
- Account Reference: Reports include your user ID so we can tell how many users an issue affects and help you if you contact support. They contain no message content, workout details or other profile data.
- Retention: Crash reports are deleted automatically after 90 days.
For more information, see Sentry’s Privacy Policy.
Subscription Data — RevenueCat
App Store subscriptions are managed through RevenueCat:
- No Payment Information: We never handle credit card or payment details. All payment processing is done by the Apple App Store.
- What RevenueCat Receives: Your app user ID, your email address, your purchase history and device information needed to validate and restore purchases.
- Attribution: RevenueCat also receives the attribution data described under “Advertising Attribution” below to connect subscriptions to the ad campaign that led to the install.
For more information, see RevenueCat’s Privacy Policy.
Advertising Attribution — Adjust, ATT & SKAdNetwork
We advertise Grindlock on platforms like Apple Search Ads, TikTok, Meta and Google. To measure which campaigns work (not to show you ads inside the app), we use the mobile measurement provider Adjust:
- Your Choice via ATT: On first launch, iOS shows the App Tracking Transparency prompt. Only if you allow tracking is your device’s advertising identifier (IDFA) used for attribution. If you decline, the IDFA is not accessed.
- What Adjust Processes: Device identifiers, IP-derived coarse location, install and in-app events (such as completed workouts, trials and subscriptions) to attribute them to ad campaigns.
- Ad Network Partners: Attribution results are shared with the ad network that delivered the ad (for example Apple Search Ads, TikTok, Meta, Google or Snap) in aggregated or pseudonymous form so we can pay for and optimize campaigns.
- SKAdNetwork & AdServices: Independently of ATT, we use Apple’s privacy-preserving attribution frameworks (SKAdNetwork, AdServices), which report campaign performance without identifying you individually.
- Legal Basis: Your consent (Article 6(1)(a) GDPR), given through the ATT prompt. You can change your choice anytime in iOS Settings → Privacy & Security → Tracking.
For more information, see Adjust’s Privacy Policy. Grindlock shows no third-party ads and never sells your personal data.
Notifications
Grindlock may send you local notifications on your device for:
- Screen time expiry reminders
- App re-lock notifications
- Workout streak reminders
These are local notifications stored only on your device. No notification data is sent to our servers or any third party. You can disable notifications in your device settings.
Legal Basis for Processing Personal Data Under GDPR
We process your personal data on the following legal bases under GDPR:
- Article 6(1)(b): To perform our contract with you (provide the Service).
- Article 6(1)(f): Legitimate interests in crash reporting and service improvement.
- Article 6(1)(c): To comply with legal obligations.
- Article 6(1)(a): With your consent for optional features, including ad attribution via the App Tracking Transparency prompt.
How We Use Your Information
We use the information we collect for the following purposes:
- Provide and Maintain the Service: Creating accounts, storing workouts, tracking progress.
- Track Exercise Progress: Displaying stats, streaks, levels and XP.
- Fix Bugs: Using crash reports to identify and resolve technical issues.
- Manage Subscriptions: Processing and maintaining your App Store subscription.
- Measure Ad Campaigns: Attributing installs and purchases to our advertising campaigns (with your consent, see “Advertising Attribution”).
- Comply with Law: Responding to legal requests when required.
Data Retention
We retain your data as long as your account is active. If you delete your account, your data is removed within 30 days, except where we’re required by law to retain it. Crash reports are retained for 90 days for debugging purposes.
Data Transfers
Your data is processed and stored in the European Economic Area (EEA) or Germany where possible. For any data transfers outside the EEA, we use Standard Contractual Clauses as approved by the European Commission.
Your GDPR Rights
If you are a resident of the EU, you have the following rights regarding your personal data:
- Right of access (Article 15 GDPR): You can request a copy of your personal data.
- Right to rectification (Article 16 GDPR): You can correct inaccurate data.
- Right to erasure (Article 17 GDPR): You can request deletion of your data.
- Right to restrict processing (Article 18 GDPR): You can limit how we process your data.
- Right to data portability (Article 20 GDPR): You can export your data in a standard format.
- Right to object (Article 21 GDPR): You can object to certain processing.
- Right to withdraw consent: You can withdraw any consent you have given.
- Right to lodge a complaint: with the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA).
Data Deletion
You can delete your account and all associated data directly in the Grindlock app. Alternatively, contact us at info@abenteuergeist.com to request deletion. Your data will be permanently removed within 30 days.
Disclosure of Information
Your information may be shared with:
- Supabase: Our database provider (your account and workout data).
- Sentry: Our crash reporting service (crash reports with your user ID).
- RevenueCat: Our subscription management service (app user ID, email, purchase history, attribution data).
- Adjust: Our ad attribution provider and, in aggregated or pseudonymous form, the ad networks it measures (see “Advertising Attribution”).
- Apple: App Store, Sign in with Apple and Apple’s attribution frameworks.
- Google: Google Sign-In, if you choose it for authentication.
- Expo: Delivery of app updates (over-the-air bundle updates).
- Law enforcement: When legally required.
Security Measures
We take the security of your data seriously:
- Row-Level Security: Database policies ensure only you can access your data.
- TLS Encryption: All data in transit is encrypted.
- Minimal Data Collection: We only collect data necessary for the Service.
- On-Device Processing: Camera data never leaves your device.
Children’s Privacy
Grindlock is not intended for children under 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected such information, we will delete it promptly.
Third-Party Links
Grindlock may contain links to third-party websites. We are not responsible for their privacy practices. Please review their privacy policies before using their services.
Changes to This Privacy Policy
We may update this Privacy Policy at any time. Changes will be effective when posted. We will notify you of significant changes by updating the “Last updated” date.
Contact Us
If you have questions about this Privacy Policy or how we handle your data, contact us at:
Abenteuergeist
Widenmayerstraße 11
80538 München
Germany
info@abenteuergeist.com