Privacy Policy

1 Information We Collect

Personal Information You Provide

• Account information: Name and email address when you register as a coach or client
• Fitness & health goals: Workout preferences, fitness objectives, and program targets you enter for AI plan generation
• Dietary preferences: Nutritional goals, dietary restrictions, allergies, calorie targets, and macro preferences used to generate personalized meal plans
• Body metrics: Weight, height, and activity level (optional) used to calculate macro recommendations
• Business information: Business name and coaching specialization for coach profiles

Payment Information

Payment transactions are processed securely through Stripe. We do not store your full credit card number, CVV, or bank account details. Stripe may collect billing address and payment card information directly. See Stripe's Privacy Policy.

Location Data

• ZIP code: You may voluntarily enter a ZIP code to find grocery stores and real-time food prices near you. We use this to query the Kroger API for nearby store locations and product pricing.
• We do not collect GPS coordinates or precise device location. ZIP code data is used only for the food price search feature.

Social Media Account Connections

If you connect social media accounts (Instagram, Twitter/X, Facebook, TikTok) through the Client Portal's Social Sharing feature:

• We store the access tokens provided by those platforms to enable posting on your behalf
• We access only the permissions you explicitly grant during the OAuth authorization flow
• We do not read your private messages or followers lists

Usage Data & Technical Information

• Device information: Browser type, operating system, and screen resolution
• Usage analytics: Pages visited, features used, time on platform (collected via anonymized analytics pixel)
• Execution logs: AI plan generation requests and results for quality improvement
• IP address: Logged for security purposes; not used for persistent tracking

2 How We Use Your Information

• Service delivery: Authenticating your account, connecting coaches with clients, managing coaching plans and subscriptions
• AI meal plan generation: Your dietary preferences, goals, and body metrics are sent to OpenAI's API to generate personalized 7-day nutrition plans with macro breakdowns
• Food price search: Your ZIP code is used to query the Kroger API for nearby grocery stores and real-time product pricing
• Workout programming: Building and delivering workout plans tailored to your goals
• Messaging & notifications: Sending account confirmation emails, subscription receipts, coaching updates, and platform notifications to your email address
• Payment processing: Creating and managing Stripe checkout sessions for subscriptions and coaching plan purchases
• Social media posting: Publishing content to your connected social accounts when you explicitly trigger a post
• Platform analytics: Understanding feature usage to improve GrindFuel's services
• Marketing communications: Sending promotional emails about new features (you may opt out at any time)
• Legal compliance: Complying with applicable laws and responding to lawful requests

3 Information Sharing

We do not sell your personal information. We share data only as described below:

Third-Party Service Providers

• Stripe (Payment Processing): Payment information is transmitted to and stored by Stripe, Inc. Stripe is PCI-DSS Level 1 certified. Stripe Privacy Policy →
• Kroger API (Grocery Pricing): Your ZIP code is sent to the Kroger API to search for stores and product prices near you. Kroger Privacy Policy →
• OpenAI (AI Features): Your dietary preferences, health goals, and meal plan inputs are processed by OpenAI's API to generate AI-powered nutrition and workout plans. OpenAI Privacy Policy →
• Social Media Platforms (Sharing): When you connect accounts and post, content is transmitted to Instagram, Twitter/X, Facebook, and/or TikTok per their respective platform APIs and terms of service.
• Polsia (Infrastructure): GrindFuel runs on infrastructure provided by Polsia. Polsia may process technical data (server logs, crash reports) to maintain platform operations. Polsia Privacy Policy →

Legal Disclosures

We may disclose your information if required by law, court order, or governmental authority, or to protect the rights, property, or safety of GrindFuel, our users, or others.

Business Transfers

If GrindFuel is acquired or merges with another company, your information may be transferred as part of that transaction. We will notify you via email and/or prominent notice on our platform before your data is transferred and becomes subject to a different privacy policy.

4 Data Retention

• Account data: Retained as long as your account is active. Deleted within 30 days of account deletion request.
• Meal plans & workout programs: Stored until you delete them or your account is closed.
• Payment records: Retained for 7 years for tax and accounting compliance, even after account deletion.
• Usage analytics: Anonymized aggregate data may be retained indefinitely. Identifiable usage logs are deleted within 12 months.
• Social media access tokens: Deleted immediately when you disconnect a social account or delete your account.
• ZIP code data: Not persistently stored — used only during the active food search session and not retained after the request completes.

5 Your Rights

You have the following rights regarding your personal information:

To exercise any of these rights, email grindfuel@polsia.app. We will respond within 30 days (45 days if your request is complex). We may need to verify your identity before processing your request.

Marketing Opt-Out

You can unsubscribe from marketing emails at any time by clicking "Unsubscribe" in any email we send, or by emailing us directly. Transactional emails (receipts, account confirmations) cannot be opted out of while your account is active.

6 Cookies & Tracking

What We Use

• localStorage (session data): We store your authentication state and preferences locally in your browser using localStorage. This is required for the platform to function and cannot be disabled.
• Analytics pixel: We use a lightweight first-party analytics pixel (hosted by Polsia) to track page visits and feature usage. This generates an anonymized visitor ID stored in localStorage. No cookies are set by this pixel.
• Service Worker & cache: GrindFuel is a Progressive Web App (PWA). Your browser may cache static assets for offline and faster loading. You can clear this via your browser settings.

Third-Party Tracking

We do not use Google Analytics, Facebook Pixel, or other third-party advertising trackers. We use Google Fonts, which may set its own cookies — see Google's Privacy Policy.

Managing Cookies

You can clear all stored data by clearing your browser's localStorage and cache. Note that this will log you out and reset your preferences. Most browsers allow you to block cookies via their settings, though this may affect platform functionality.

7 Children's Privacy

GrindFuel is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If you are under 16, please do not create an account or provide any personal information.

If you are a parent or guardian and believe your child under 16 has provided us with personal information, please contact us at grindfuel@polsia.app and we will delete that information within 30 days.

For users in the United States: GrindFuel complies with the Children's Online Privacy Protection Act (COPPA). We do not collect personal information from children under 13.

8 Security Measures

We take the security of your data seriously and implement industry-standard protections:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS (HTTPS)
• Encrypted token storage: OAuth access tokens for social media accounts are stored using AES-256-GCM encryption
• Password-free authentication: We use email-based magic links — no passwords are stored or vulnerable to password breaches
• Secure database: Your data is stored on a managed PostgreSQL database with access restricted to our application servers
• PCI compliance via Stripe: We never handle raw payment card data — all payment processing is handled by Stripe, a PCI-DSS Level 1 certified processor
• Access controls: Employee and system access to user data is limited to what is necessary to operate the platform

Despite these measures, no transmission over the Internet or electronic storage is 100% secure. If you discover a security vulnerability, please email us immediately at grindfuel@polsia.app.

9 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

Your California Rights

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you in the past 12 months
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions
• Right to Correct: You may request correction of inaccurate personal information
• Right to Opt-Out of Sale or Sharing: We do not sell or share your personal information for cross-context behavioral advertising. You have nothing to opt out of.
• Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information beyond what is necessary to provide our services
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

Categories of Personal Information Collected (Past 12 Months)

• Identifiers (name, email address)
• Commercial information (subscription and purchase history)
• Health and fitness information (dietary preferences, fitness goals, body metrics)
• Internet or other electronic network activity (usage data, feature interactions)
• Geolocation data (ZIP code, not precise location)

How to Submit a Request

To submit a CCPA request, email grindfuel@polsia.app with subject line "California Privacy Request." We will respond within 45 days. We may need to verify your identity before processing your request.

10 International Users (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR) or equivalent local laws.

Legal Bases for Processing

• Contract performance: Processing necessary to provide the services you requested (account management, AI plan generation, coaching services)
• Legitimate interests: Analytics, security monitoring, and service improvement — only where our interests are not overridden by your rights
• Consent: Marketing emails (you may withdraw consent at any time)
• Legal obligation: Retaining financial records as required by law

Data Transfers

Your data may be transferred to and processed in the United States, where our servers and third-party providers (OpenAI, Stripe, Kroger) are located. These transfers are subject to appropriate safeguards, including Standard Contractual Clauses where required.

Right to Lodge a Complaint

You have the right to lodge a complaint with your local data protection authority (DPA). For EEA users, this is the DPA in the country where you reside. For UK users, this is the Information Commissioner's Office (ICO): ico.org.uk.

Data Controller

GrindFuel (operated by Polsia) is the data controller for personal information collected through the platform. Contact: grindfuel@polsia.app

11 Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Send an email notification to registered users for significant changes
• In some cases, request renewed consent where required by law

We encourage you to review this policy periodically. Your continued use of GrindFuel after changes take effect constitutes acceptance of the updated policy.

12 Contact Us

For privacy-related questions, data requests, or to exercise your rights: