Privacy Policy
Last updated: 1 September 2026
Grappling Athlete is a strength & conditioning coaching platform operated by Filip Svoboda, Czech Republic (the “data controller”). This policy explains what personal data we collect, why, and the rights you have over it. Contact for anything privacy-related: info@grapplingathlete.cz.
What we collect
- Account data — email, name, date of birth (you must be 15+), and optional height, weight, and unit preferences.
- Training data — the workouts your coach assigns, the results and notes you log, workout duration/intensity, and derived statistics such as estimated one-rep maxes and milestones.
- Health-related data — your training results, body measurements (height and weight) and heart-rate figures, including any maximum heart rate on your profile and heart-rate targets your coach prescribes, are fitness and health data. We use them only to deliver coaching and to show you your own progress — never for advertising, and never for profiling outside the service.
- Chat — messages, photos, and videos you exchange with your coach or team inside the app.
- Subscription data — your subscription status and billing history are processed by Stripe. Card numbers never touch our systems.
- Device data — a push-notification token for your phone (if you allow notifications) and essential session cookies. We use no advertising or tracking cookies.
Why we process it
- To provide the coaching service (contract): delivering training plans, logging workouts, chat, notifications, and billing.
- Anonymous leaderboards (legitimate interest): your results can appear in gym leaderboards fully anonymised — other athletes only ever see ranked numbers, never your name or identity, and a board only shows with at least 4 participants. You can opt out anytime in Settings.
- Legal obligations: accounting and tax records where required by Czech law.
Who can see your data
Your coach can see everything you log — your workouts, results, notes, workout duration and intensity, and your full history. That is the service: they write your programme by reading it. Other athletes never see your identity. They only ever appear alongside you as anonymous ranks on leaderboards, which show no names and only appear once at least four people qualify; you can opt out in Settings at any time.
Where your data lives
Personal data is stored with Supabase in the EU (Ireland). Some service providers are based in the US and rely on the EU–US Data Privacy Framework or Standard Contractual Clauses:
- Supabase — database, authentication, storage (EU, Ireland)
- Stripe — payment processing (US/EU)
- Vercel — web hosting (US/EU)
- Expo — mobile builds & push-notification delivery (US)
- Mux — chat video processing (US)
How long we keep it
- Account and training data: for as long as your account exists.
- Chat videos: automatically deleted after 30 days. Chat text and photos are kept.
- Deleted accounts: your identity (name, email, date of birth) is removed immediately; training records are kept only in anonymised form.
Your rights
Under the GDPR you can access, correct, export, delete, or object to the processing of your data. The two most common requests are built into the app: Export my data and Delete my account, both in Settings (they remain available even without an active subscription). For anything else, email us. You can also lodge a complaint with the Czech Office for Personal Data Protection (ÚOOÚ).
Push notifications
Notifications (new messages, workout reminders, achievements) are optional. You can turn each type off in Settings, or disable them entirely in your phone's system settings.
Changes
We'll post any changes to this policy here and update the date above. Significant changes will be announced in the app.