Grammo

Privacy Policy

This English version is provided for convenience only. The German version is legally binding.

Last updated: July 2026

Protecting your personal data is important to us. This privacy policy informs you about which data the "Grammo" app (hereinafter the "App") processes, for which purposes, on which legal basis, and which rights you have. It applies to the use of the App on iOS devices.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

A data protection officer has not been appointed, as the statutory requirements for a mandatory appointment are not met.

2. Principles

Grammo is an app for logging nutrition (in particular protein and nutrient intake) and body weight, and for calculating personal nutrition goals. We process your data exclusively to provide these features to you. The App shows no advertising, contains no advertising or tracking SDKs, creates no usage profiles for advertising purposes, and does not sell data to third parties. Beyond the crash diagnostics described below, no analysis of your usage behavior takes place.

3. What data we process

a) Account data

When you register and sign in (via "Sign in with Apple", Google login, or email magic link), we process:

  • Email address
  • Display name
  • optional: a profile picture (avatar) uploaded by you

With "Sign in with Apple" you can hide your email address from us (Apple relay address). Authentication via Apple or Google takes place in accordance with the privacy policy of the respective provider; we only receive the data required to create your account (email address and, where applicable, name).

b) Health-related data (Art. 9 GDPR)

The App's core function is the recording of nutrition- and body-related data. This information constitutes health data or health-related data within the meaning of Art. 9(1) GDPR (special categories of personal data). This includes:

  • Nutrition logs (recorded foods and meals, including nutritional values/macronutrients)
  • Body weight entries
  • Date of birth or year of birth
  • Biological sex
  • Height
  • Fitness/nutrition goal (lose weight/"Cut", maintain/"Maintain", gain/"Bulk")

You enter this data yourself, actively, in the App. It is processed exclusively to provide you with the App's core function: keeping your logs, statistics, and histories, and calculating your calorie and protein goals (using the Mifflin-St Jeor formula). No processing for other purposes, in particular for advertising purposes, takes place.

c) Purchase and subscription data

If you subscribe to "Grammo Pro" or acquire it as a lifetime purchase, we process the purchase/subscription status (product, term, renewal/expiry date) and a pseudonymous user ID to link the purchase to your account. Payment data (e.g. credit card details) is processed exclusively by Apple; we do not receive any payment information.

d) Diagnostic data (crash reports)

In the event of crashes and technical errors, diagnostic data is collected: error message and stack trace, app version, device model, operating system version, and time of the error. These reports intentionally contain no health data and no contents of your logs.

e) Technical access data

When data is exchanged with our servers and when checking for app updates, connection data (in particular IP address, time of the request, app version) is processed for technical reasons, to the extent required for the transmission.

4. Purposes and legal bases

  • Health-related data (Section 3 b): processed on the basis of your consent (Art. 6(1)(a), Art. 9(2)(a) GDPR). You give this consent by actively and voluntarily entering this data in the App. You can withdraw it at any time with effect for the future by deleting individual entries or by deleting your account entirely (Settings → Delete account).
  • Account data, purchase/subscription data: performance of the contract for the use of the App (Art. 6(1)(b) GDPR).
  • Diagnostic data: legitimate interest in the stability, security, and troubleshooting of the App (Art. 6(1)(f) GDPR).
  • Technical access data: legitimate interest in the technical provision and security of the App (Art. 6(1)(f) GDPR).

5. Hosting and processors

a) Supabase (database, authentication, storage)

Your account, profile, and log data is stored with Supabase (Supabase, Inc., acting as our processor). The data is hosted exclusively in the EU, in the Frankfurt am Main region, Germany. Your content data does not leave the EU. A data processing agreement pursuant to Art. 28 GDPR is in place with Supabase. Data is transmitted in encrypted form (TLS).

b) Open Food Facts (product database for barcode scanning)

When you scan a food barcode, your device's camera is used exclusively for barcode recognition; no photos are taken or stored. The recognized barcode is transmitted from our servers to the Open Food Facts database (openfoodfacts.org, operated by the non-profit organization Open Food Facts, France) in order to retrieve product data (name, brand, nutritional values, product image URL). The query is performed server-side; Open Food Facts does not receive any personal data about you (in particular, not your IP address). Retrieved product data is cached in our database.

License notice: The product data originates from the Open Food Facts database (https://openfoodfacts.org) and is made available under the Open Database License (ODbL) (https://opendatacommons.org/licenses/odbl/1.0/).

c) RevenueCat (purchase management)

To manage and verify purchases and subscriptions, we use RevenueCat, Inc. (USA) as a processor. RevenueCat receives a pseudonymous user ID and App Store transaction data (purchased product, time of purchase/renewal, subscription status). Your email address, your name, and your log data are not transmitted to RevenueCat. For transfers to third countries, see Section 7.

d) Sentry (crash diagnostics)

Crash reports and error diagnostics (Section 3 d) are transmitted to Sentry (Functional Software, Inc., USA, acting as a processor). For transfers to third countries, see Section 7.

e) Expo (app updates)

On launch, the App checks via the EAS Update service operated by Expo (650 Industries, Inc., USA) whether an updated app version (JavaScript bundle) is available and downloads it where applicable. For technical reasons, connection data (IP address, app/runtime version, update channel) is transmitted to Expo in the process. No content or health data is transmitted. For transfers to third countries, see Section 7.

f) Apple

Purchases and subscriptions are handled via the Apple App Store; in this context, Apple (Apple Distribution International Ltd., Ireland, or Apple Inc., USA) processes your data under its own responsibility in accordance with the Apple privacy policy. The same applies to signing in with Apple ("Sign in with Apple").

6. Permissions and features on the device

  • Camera: only after your express approval and exclusively for barcode recognition (see Section 5 b). No photos are stored.
  • Notifications: reminders are scheduled as local notifications directly on your device. Permission is only requested once you enable reminders. No data is transmitted to our servers for this purpose.

7. Data transfers to third countries (USA)

For the services RevenueCat, Sentry, and Expo (Sections 5 c–e), personal data may be transferred to the USA. The USA is a third country without a generally equivalent level of data protection. Transfers take place on the basis of the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and — where the respective provider is certified under the EU-U.S. Data Privacy Framework (DPF) — on the basis of the EU Commission's adequacy decision on the DPF (Art. 45 GDPR). Your log and health data is not affected by these transfers; it remains in the EU (Section 5 a).

8. Storage period and deletion

  • We store account, profile, and log data for as long as your account exists.
  • You can delete your account at any time directly in the App (Settings → Delete account). This deletes your account and all associated data (profile, nutrition and weight logs, goals, avatar).
  • You can delete individual entries (e.g. meals, weight entries) in the App at any time.
  • Crash reports are automatically deleted by the diagnostics service after a limited period (usually 90 days).
  • Statutory retention obligations (e.g. for billing data) remain unaffected.

9. Data export

With Grammo Pro you can export your own log data as a CSV file at any time. Independently of this, you have the right to data portability under Art. 20 GDPR (Section 10).

10. Your rights

Under the GDPR, you have the following rights:

  • Access to the data processed (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)
  • Withdrawal of consent given, with effect for the future (Art. 7(3) GDPR); the lawfulness of processing carried out up to the withdrawal remains unaffected
  • Lodging a complaint with a data protection supervisory authority (Art. 77 GDPR), e.g. with the authority responsible for your place of residence or for our registered office

To exercise your rights, an informal message to [email protected] is sufficient.

11. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place. The target values displayed in the App (e.g. calorie and protein goals) are purely computational reference values based on your own inputs and have no legal or similarly significant effect.

12. Data security

We take appropriate technical and organizational measures to protect your data, in particular transport encryption (TLS) for every data transmission and database-level access controls, so that only you can access your content.

13. Changes to this privacy policy

We will update this privacy policy when the App or the legal situation changes. The current version is available in the App under Settings → Privacy. We will inform you in the App of any material changes.

← Back to home