Privacy Policy
Last updated: 2 August 2026
Grappling Athlete is a strength & conditioning coaching platform operated by Filip Svoboda — Dark Side Grappling, Prague, Czech Republic (the “data controller”). This policy explains what personal data we collect, why, and the rights you have over it. Contact for anything privacy-related: svobofilip@gmail.com.
What we collect
- Account data — email, name, date of birth (you must be 18+), and optional height, weight, and unit preferences.
- Training data — the workouts your coach assigns, the results and notes you log, workout duration/intensity, and derived statistics such as estimated one-rep maxes and milestones.
- Chat — messages, photos, and videos you exchange with your coach or team inside the app.
- Subscription data — your subscription status and billing history are processed by Stripe. Card numbers never touch our systems.
- Device data — a push-notification token for your phone (if you allow notifications) and essential session cookies. We use no advertising or tracking cookies.
Why we process it
- To provide the coaching service (contract): delivering training plans, logging workouts, chat, notifications, and billing.
- Anonymous leaderboards (legitimate interest): your results can appear in gym leaderboards fully anonymised — other athletes only ever see ranked numbers, never your name or identity, and a board only shows with at least 4 participants. You can opt out anytime in Settings.
- Legal obligations: accounting and tax records where required by Czech law.
Where your data lives
Personal data is stored with Supabase in the EU (Ireland). Some service providers are based in the US and rely on the EU–US Data Privacy Framework or Standard Contractual Clauses:
- Supabase — database, authentication, storage (EU, Ireland)
- Stripe — payment processing (US/EU)
- Vercel — web hosting (US/EU)
- Expo — mobile builds & push-notification delivery (US)
- Mux — chat video processing (US)
How long we keep it
- Account and training data: for as long as your account exists.
- Chat videos: automatically deleted after 30 days. Chat text and photos are kept.
- Deleted accounts: your identity (name, email, date of birth) is removed immediately; training records are kept only in anonymised form.
Your rights
Under the GDPR you can access, correct, export, delete, or object to the processing of your data. The two most common requests are built into the app: Export my data and Delete my account, both in Settings (they remain available even without an active subscription). For anything else, email us. You can also lodge a complaint with the Czech Office for Personal Data Protection (ÚOOÚ).
Push notifications
Notifications (new messages, workout reminders, achievements) are optional. You can turn each type off in Settings, or disable them entirely in your phone's system settings.
Changes
We'll post any changes to this policy here and update the date above. Significant changes will be announced in the app.