PRIVACY
POLICY

When you use Hybrid Grind, we collect the following data:

• Account information — name, email address, and password (hashed)
• Profile data — height, weight, date of birth, gender, and activity level (optional)
• Fitness data — workouts, exercises, sets, runs, nutrition entries, and events you log
• Session data — IP address and user agent for session security

Your data is used exclusively to provide the service:

• Display your workouts, runs, nutrition, and event data
• Generate AI-powered feedback and weekly insights
• Track session activity for security (detecting unauthorized access)
• Send email verification and password reset emails

We do not sell, share, or provide your data to third parties for advertising or marketing purposes.

Hybrid Grind uses two HttpOnly, Secure cookies for authentication:

• token — short-lived access token (15 minutes)
• refresh_token — longer-lived refresh token (7 days)

These cookies are strictly necessary for authentication. We do not use tracking cookies or analytics cookies.

If you connect your Strava account, we receive your run data (distance, pace, route, duration) through the Strava API. You can disconnect Strava at any time from your settings. No data is shared back to Strava.

Your data is retained as long as your account is active. You can delete your account and all associated data at any time from the settings page. Once deleted, your data is permanently removed and cannot be recovered.

You can export your workout, run, nutrition, and event data in CSV or JSON format from each respective section of the app.

Under GDPR and similar regulations, you have the right to:

• Access your personal data (available through the app and data export)
• Rectify inaccurate data (editable through settings and profile)
• Erase your data (account deletion in settings)
• Export your data in a portable format (CSV/JSON export)