GramRep privacy policy

Effective 2026-10-11. This is the policy for the GramRep app on iPhone and Apple Watch, and for the optional account and sync service behind it. Its first version was dated 2026-09-20, the day it was finished: the app was not in the App Store yet and the sync service was not running, so it governed nobody on that date. It applies to you from the day you install the app.

The short version

GramRep works with no account and no connection. Your training, your food diary and your measurements live in a database on your phone. An account is optional. It copies those rows to our server so a second phone can see them and a lost phone does not lose them, and it lets you search our food catalog. You can export everything as one file and delete everything from inside the app. Nothing is sold, nothing is shared for advertising, and nothing about you is used to track you anywhere.

Who is responsible

The controller of your data is PROJECT CIP S.R.L., a Romanian limited liability company (societate cu răspundere limitată) with its registered office at Bulevardul Dacia nr. 133, etaj D, sector 2, Bucharest, Romania, registered with the Romanian Trade Register under number J2025030670009 and holding the sole registration code (CUI) 51711091.

For anything about your data, write to contact@archthorpe.com. There is no data protection officer; the address reaches the people who can answer.

What stays on your phone

Your workouts: the exercises, sets, reps, weights, RPE, warm-up marks and notes. Your routines and the exercises you create. Your food diary, the foods and recipes you create, your servings and your daily targets. Your weight, body fat and waist measurements.

Your settings stay on the phone: units, appearance, language, the Apple Health switch and your favourites.

Training works with the phone in airplane mode, in a basement, forever. Logging a set never waits for the network. Signed out, nothing you log leaves the phone: no workout, no set, no diary entry, no measurement. Two things can leave a signed-out phone, and they are the only two: a barcode you scan or type is looked up in our catalog, and an unhandled crash sends a report. Both are described below.

Every number on the Insights screen, the protein-against-volume comparison, the weekly buckets and the trends, is computed on your phone from your own rows.

An account is optional. If you create one, the rows listed above are copied to our server, hosted by Amazon Web Services in Frankfurt, Germany, in the European Union. They go up when you change them and come back down on your other phone.

Stored with them:

your e-mail address, which is the account;
one unit system and one time zone for the account, taken from your phone only at the moment the account is created and never updated from the phone afterwards;
the word "iPhone" for each signed-in phone. It is the same for every phone and says nothing about you.

Signing in sends you one e-mail with a link. There is no password. The link works once and expires after fifteen minutes. Asking for the link also sends the language the app is set to, so the e-mail is written in it if that is English or Romanian, and in English otherwise; the server uses it for that e-mail and keeps nothing. Only a hash of the link is kept on the server, so nobody reading that table can sign in as you. A signed-in session lasts ninety days unless you sign out.

The e-mail is delivered through Amazon Simple Email Service, which sends it for us — a processor, in the regulation's word — and therefore sees your address and what the message says. It is sent from Amazon's Frankfurt region, the same one the server runs in. Amazon Web Services, which stores your rows and sends the e-mail for us, is a company established in the United States; where its people outside the European Union can reach a stored row or a message, that access rests on the European Commission's standard contractual clauses in Amazon's data-processing terms.

The server writes one line per request to its log: the method, the route, the status, the time and the network address the request came from. A barcode in a route and anything after a question mark are taken out of that line before it is written. Three events write one more line each: asking for a sign-in link records your e-mail address with everything between its first letter and the @ hidden, signing in records the same hidden address and your account's identifier, and deleting the account records that identifier. A request our server fails to answer writes one more, described under "Crash reports". We read the log to fix problems and to limit abuse (each address may only make so many requests a minute), and for nothing else.

Food search and barcodes

While you are signed in, typing in the food picker sends the text you typed to our server, which answers and keeps nothing. Search text is never written to a log.

Scanning or typing a barcode sends the barcode to our server, whether you are signed in or not, so that a scan is answered from our own catalog first. The server answers and keeps nothing: the log records that a barcode was looked up, never which one.

Open Food Facts

If our catalog does not know a barcode, your phone, not our server, asks Open Food Facts, a public food database run by a French non-profit association. It is the last resort, after the local database and after our server.

Open Food Facts receives the barcode, the list of fields we want and a request identifier naming the app and a contact address for us. No account, no identifier of you or your phone, no cookie. Their servers see your phone's network address, the way any website you visit does. Their own privacy policy governs what they do with it.

While you are signed in, when they answer, your phone sends that one product to our catalog so the next scan of it is answered by us. Signed out, it does not. Your diary is never part of that, and nothing you type is sent to Open Food Facts.

The camera

The camera reads barcodes, and reads the nutrition table printed on a label. Both happen on your phone: a barcode never becomes a photograph, and the label photograph is read and then discarded. No photograph leaves the phone except the one you send with Identify with AI, below, and none is saved to your photo library.

Identify with AI

Identify with AI is optional. When you press its button, the app takes one photo of your plate and sends it, with your session, to our server, and only then: nothing is sent while you aim the camera, and nothing at all unless you press the button. Before it leaves the phone the photo is made smaller, and its location, time and device details are removed. Our server passes it to Amazon Bedrock, a service of Amazon Web Services, in its European Union regions, which reads the foods and their weights and sends them back. The photo is not stored, it is not written to any log, and it is not used to train AI models, by us or by Amazon. What comes back is a list you check and correct; nothing is added to your diary until you press Add all, and the entries it adds are marked as estimated. To keep the service fair, our server counts how many photos each account sends in a day, and keeps that count, not the photos.

Social is optional, and it is off until you create a profile. Until then nothing about you is shown to anyone. After that, nothing you log is shared on its own: a workout is shared only when you post it.

What a profile shows. A profile has a handle, the name other people find you by, and a display name. There is no photo, no biography and no date of birth. A profile also keeps whether it is public or private, which audience your new posts get unless you choose another, the moment you confirmed you are 16 or older, and the version of the community rules you accepted and when.

What a post shows. When you post a workout, your phone builds a summary of it and sends only that summary: a title if you write one, when the workout started and finished, its category, each exercise's name, how many sets you did and your best set, the total weight you moved, and any personal records it set. The weight and reps of every set are included only if you choose to show them. A post is a copy: editing or deleting the workout later does not change the post, and you can delete the post at any time.

What is never shared. Your food diary and your targets, your weight, body fat and waist, the notes you write in a workout, your e-mail address, and any calorie figure. A post never carries one.

Public by default, private in one tap. A new profile is public: while social is on, anyone with a GramRep account can find it by its handle, see your handle and display name, follow you without asking, and see how many people follow you and whom you follow. A turned-off profile cannot be found. The screen where you create the profile shows this choice before you confirm it. Your posts are shown to your followers unless you choose otherwise; you can make each post public, for followers only, or visible to you alone. One switch on your profile makes the profile private at once: from then on a new follower needs your approval, your counts are hidden from anyone who does not follow you, and a post you had made public is shown only to your followers. You can switch back at any time.

Following, kudos, blocking and muting. Other people can follow you and give kudos to your posts, and you see who did. You can block an account, which ends every follow between the two of you in both directions and hides each of you from the other, or mute one, which hides its posts from you without telling it. A follow request you decline is not shown to the other person as declined.

Age. Social is only for people aged 16 or older. When you create a profile you confirm that you are. We keep the moment you confirmed it, not your age or your date of birth.

Reporting and moderation. You can report a post, or a profile while it is on, for spam, harassment, hate, sexual content, self-harm, impersonation, cheating or another reason, with a note of up to 500 characters if you want to add one. A person at PROJECT CIP S.R.L. reads every report and aims to decide within 24 hours whether to keep the content, hide it, restore it, or suspend the account from social. When we hide or restore your post, or suspend or restore your account, you see the decision and the reason for it in your activity, and you can answer it by writing to contact@archthorpe.com; a decision to keep content you reported, or content reported about you, is not shown in the activity. A post that three different people report is hidden until it has been reviewed. The person you report is not told who reported them. Before a handle, a display name, a post title or an exercise name in a post is saved, it is checked automatically against lists of offensive words in seven languages, and refused if it contains one of them, a web address, an e-mail address or a phone number; the check refuses that text and decides nothing else about you.

Why we may do this. Showing your profile and your posts to the audience you chose, and following, kudos, blocking and muting, is providing what you asked for (Article 6(1)(b)). A workout you post can say something about your health; it is shown only because you posted it, and only to the audience you chose (Article 9(2)(a)). Reading reports, the automatic check of names and titles, the daily limits on follows, posts, kudos, reports, blocks and mutes, and keeping a record of reports and of what was decided rest on our legitimate interest in a safe service and on the duties of a hosting service under the Digital Services Act, Regulation (EU) 2022/2065 (Article 6(1)(f) and Article 6(1)(c)).

How long we keep it.

Your profile, posts, follows, kudos, blocks and mutes: while social is on. A post you delete is hidden at once and kept until our clean-up erases it, which it may do once the post has been deleted for 90 days.
Turning social off hides your profile and posts at once and ends your follows, kudos, blocks and mutes. Our clean-up may erase the profile once it has been off for 30 days, and the rest once it has been off for 90 days. Until the profile is erased it keeps your handle, so nobody else can take it.
A handle you stop using is then held for 30 more days so that nobody else can take it and pass for you; during the hold only you can take it back. The hold starts when you change your handle, when you delete the account, or, after you turn social off, when the clean-up erases the profile: about 60 days in all from turning social off. The hold keeps the handle, your account's identifier and the moment it started; when you delete the account, the identifier is removed and the handle alone is held.
The record of your recent actions that the daily limits count: until the clean-up, once it is 7 days old, or 30 days for a change of handle.
Reports and moderation decisions: until the clean-up, once they have been resolved for 12 months. A report that has not been resolved is kept until it is. A report you filed is kept after you delete the account, without your name and without your note.
Reports other people filed about you are kept after you delete the account, as our record of moderation, on the basis of our legitimate interest in a safe service (Article 6(1)(f)): the reason, the reporter's note and, for a report about your profile, your account's identifier. The periods in the previous item apply. The moderation decisions about you are erased with your account.

Your rights. You can change your display name, change your handle once in 30 days, change who sees each post, delete a post, turn social off, or make the profile private, all in the app. Your data export includes your social data: your profile with the moment you confirmed your age and the rules you accepted, the accounts you follow and that follow you, your posts, the kudos you gave and received, your blocks and mutes, the reports you filed, and the moderation decisions about you. It does not include reports other people filed about you, or who filed them. Deleting your account erases all of your social data at once, except what is described above: a report you filed, without your name or note; the reports other people filed about you; and the hold on your handle.

Where it is kept. On our server, with the rest of your account, on Amazon Web Services in Frankfurt. Nothing in social is sent to any other company. The people who see your profile and posts are the other GramRep users you chose to show them to.

Generate with AI

Generate with AI is optional. It suggests a training plan. Before you use it the first time, the app asks your permission to send what is described here to Amazon Bedrock.

What is sent. When you press Generate, the app sends our server your answers: your goal, your experience, how many days a week and how many minutes a session you train, the muscles you want to focus on, your equipment, and any areas you want to go easy on. Our server uses your equipment and the areas to go easy on to choose the exercises that fit, and does not pass them on. It sends Amazon Bedrock your goal, your experience, your days and minutes, the muscles to focus on and a list of possible exercises, each described only by the muscle it trains and its movement. Your e-mail address, your account identifier, your handle, your diary, your measurements and your notes are never sent.

Your training history, only with its own switch. On the screen where you give permission, a separate switch lets the app add your training history. When it is on, the history is the number of hard sets you did for each muscle group in each of the last eight weeks: no dates, no weights, no exercise names and no notes. When it is off, nothing from your history is sent. The switch is on until you turn it off, and you can turn it off there at any time.

Who reads it. Amazon Bedrock, a service of Amazon Web Services, in its European Union regions. Our server sends the request to Frankfurt, and Amazon may process it in another of its European Union regions. The model is Amazon Nova Lite or, when you ask it to try harder, Claude Haiku 4.5, a model made by Anthropic that Amazon runs inside Bedrock; nothing is sent to Anthropic. What you send is not used to train AI models, by us or by Amazon, and Amazon does not keep it. The plan that comes back is a suggestion: you check it, and nothing is added to your routines until you save it.

What we keep. A count of how many plans your account asked for on the current day, counted in UTC, so that each account can ask for at most 10 a day, 3 of them trying harder; the count for an earlier day is deleted the next time your account asks for a plan. Our server's log records that a plan was made, the model, whether the history was included, and how much text was sent and received, never your answers. If you report a plan, we keep the report: the reason, your note of up to 500 characters if you wrote one, the plan as you saw it, and the model that made it.

Why we may do this. Making the plan you asked for is providing what you asked for (Article 6(1)(b)). Sending your training history rests on your permission, given with its switch and withdrawn by turning it off (Article 6(1)(a) and, as far as it is health data, Article 9(2)(a)). A report is kept so that we can check the plans and make them better, our legitimate interest (Article 6(1)(f)).

How long, and your rights. The answers and the history are not stored: they are gone once the plan is sent back. The daily count is kept until your account next asks for a plan, or until you delete the account. A report is kept until you delete the account, and deleting the account erases it.

Notifications

A notification ends a rest timer while the app is in the background, and the rest timer can show on the Lock Screen and in the Dynamic Island. All of it is scheduled by your phone, on your phone. There is no push server, so nothing about your workout leaves the device to make it appear.

Apple Health

Apple Health is off unless you turn it on. When you do, the app asks for two permissions: to write workouts, and to read your body weight. The app never writes your weight into Health.

A workout we write is a strength-training workout with its start and end, and nothing else: no energy, no heart rate, no sets. We never ask to read calories burned, and an estimate of calories burned from lifting is never fed into your food targets. That is a permanent rule of the product, not a setting.

A weight read from Health becomes one of your own body-measurement rows, and that row syncs like any row you type yourself, if you are signed in. Nothing else read from Health leaves your phone through us. Data read from Apple Health is never sold, never used for advertising or marketing, and never shared with a third party.

The Apple Watch

The watch app does not read or show your heart rate, and never shows a calorie figure. Sets you log on the watch go to your own paired iPhone and nowhere else. A crash of the watch app is reported to Apple through the crash reports you may share with developers in your iPhone's settings, not to us.

Crash reports

If the app crashes, a report is sent to Sentry, a crash-reporting service, in its European Union region. A report goes whether you are signed in or not; only a build carrying a Sentry key sends one at all.

The report carries the error, the stack of the code that was running, up to fifty short notes on what the app was doing, the app version, the iOS version and the device model. Before it leaves the phone, one tested function rewrites every string in it: sign-in tokens, session identifiers, record identifiers, e-mail addresses, file paths and barcodes are removed. The parts of a report that could identify an installation, the network request that was in flight, the device's name and the crash library's own installation identifier, are dropped outright. Performance tracing, session tracking, screenshots and network logging are switched off in our configuration. No account identifier is ever attached.

When our server itself fails to answer a request, it does not report to Sentry. It writes the failure to its own log, which Amazon Web Services keeps for us in Frankfurt with the request log, for 30 days, and we are e-mailed that it happened so that we can fix it. The line holds the error, the stack of the code that was running and an identifier for the request; the request's body, its headers and anything after a question mark are never in it. The error's own message is written as the error gave it, not rewritten first, so it can occasionally quote a value the request carried, such as an e-mail address.

Buying the app

You buy GramRep from the App Store, and Apple takes the payment. Nothing about your purchase reaches us: the app never asks Apple about it, and our server never hears of it.

No tracking, and nothing sold

There are no analytics. There is no advertising identifier, no tracking permission prompt and no third-party tracker in the app. Nothing we hold is combined with data from anyone else. Your data is never sold and never shared for advertising. We never ask for your location.

Why we may process your data

Under the General Data Protection Regulation, each use above rests on one of these grounds:

Providing what you asked for (Article 6(1)(b)): the account, sync between your phones, the sign-in e-mail, food search, barcode lookups and identifying the foods in a photo you send.
Our legitimate interest in running a working, safe service (Article 6(1)(f)): the request log, the rate limits, database backups and scrubbed crash reports. You may object; see your rights below.
Your permission (Article 6(1)(a) and, for health data, Article 9(2)(a)): reading and writing Apple Health, and using the camera. Both are asked for by iOS and can be withdrawn at any time in Settings.

Your weight, body fat, waist, your food diary and your workouts are health data in the sense of the regulation. Signed out they never leave your phone; signed in they are stored only to be shown back to you on your own devices.

How long we keep it

Everything in your account: until you delete the account.
A sign-in link: fifteen minutes; a link whose e-mail could not be sent is deleted at once. Expired links and expired or signed-out sessions are erased one day after they stop working.
The request log, with our server's own error lines in it: 30 days.
Database backups: 14 days. Three kinds of copy are kept, all encrypted and all in Frankfurt: the database's own automatic backups, which can restore it to any moment of the last 14 days; a daily copy in a separate backup vault, each kept 14 days; and a nightly export of the database, each kept 14 days. Every copy is deleted automatically once it is 14 days old. Rows are gone from the live database the moment you delete the account; the backups age out on their own, and nothing puts them back.
Crash reports: kept by Sentry for ninety days by default.
A photo sent with Identify with AI: not kept at all; it is gone once the answer is sent.

Your rights, and how to use them in the app

See everything (access) and take it with you (portability): You, then Account, then Export my data. It writes one JSON file with your account row, your measurements, your workouts and their sets, your routines, the exercises you added yourself — whether or not you have ever used one — your diary entries with the figures they stored, your custom foods, servings, recipes and targets. Nothing from the catalog, because it is not yours. Numbers are in the stored units, kilograms, centimetres and grams, and the file says so. The export works signed out as well as signed in.
Correct it (rectification): edit any set, entry or measurement in the app; the correction syncs.
Erase it (erasure): You, then Account, then Delete account, then confirm. The server revokes every session, deletes your workouts, routines and recipes, your sign-in links and the sync bookkeeping, and then the row holding your e-mail address, which takes your measurements, diary entries, targets, custom foods and custom exercises with it. It is the only place where something you logged is erased outright rather than marked deleted. What is on the phone stays on the phone: after deleting the account the app keeps working, signed out, with your history intact. Delete the app to remove that.
Restrict or object: write to contact@archthorpe.com. Objecting to crash reports or to the request log means we stop using your data that way where the law allows.
Complain: to the Romanian supervisory authority, the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (www.dataprotection.ro), or to the authority of the country you live in.

No decision about you is made automatically, and nothing here is profiling.

Where the data goes

Our server is in the European Union, in Germany: it runs on Amazon Web Services in Frankfurt. Open Food Facts is in France. The sign-in e-mail goes out through Amazon Simple Email Service, from the same Frankfurt region. The app's crash reports go to Sentry's European Union region and are stored there; our server's error lines stay in its log in Frankfurt. Sentry and Amazon Web Services are both companies established in the United States; where their people outside the European Union can reach a report, a stored row or a message, that access rests on the European Commission's standard contractual clauses in those companies' data-processing terms.

A photo you send with Identify with AI is read by Amazon Bedrock in the European Union regions of Amazon Web Services, and is not kept.

Children

GramRep is not for anyone under 16, and we do not knowingly hold data about a child. If you believe a child has created an account, write to contact@archthorpe.com and it will be deleted.

Changes to this policy

When this policy changes, the new version ships with the app update that needs it, the date at the top changes, and the change is listed here.

2026-09-20: first version.
2026-10-11: the sections "Social: your profile, your posts and the people you follow" and "Generate with AI" added.

Contact

contact@archthorpe.com