Updated 5 October 2026 (how Grip learns from your responses to nudges, legal bases in plain words, a shorter list of processors). TypeSafe pilot disclosure updated 21 September 2026.
1. Who is responsible
Grip is operated by Villiam Bornström, Sweden, who is the data controller under the GDPR. For anything in this notice, write to hello@gripcoach.app. Grip is a one-person project; there is no data protection officer.
2. What Grip collects, and why
Grip works with just the widget. Most of the list below is optional and only starts when you switch it on.
| Data | Where it comes from | Why Grip needs it | Legal basis |
|---|---|---|---|
| Account: email, password hash, sign-in times | You, at sign-up | To have an account at all | Needed to run the service you signed up for |
| What you enter: tasks, plans, goals, notes, messages to the coach, documents you upload | You | This is the product: the plan, the coach, the follow-up | Needed to run the service |
| Coach memory: things the coach has noted about what helps you, pacts, reminders | Derived from your conversations | So the coach doesn’t start from zero each time | Needed to run the service |
| How you respond to nudges: what you tap, rate or skip, and what you tell the coach about them | You, as you use Grip | Tailoring support to you; studying pseudonymised patterns across users to improve how Grip chooses support | Needed to run the service (your own support); legitimate interest: improving support for everyone, which you can object to |
| How you feel: mood, energy, calm, anxiety, focus and sleep-quality check-ins, and the quick mood you tap on the widget | You, when you choose to log one | The coach’s tone and timing, Metrics, noticing rough patches early | Your explicit consent: these describe your mental wellbeing, so Grip treats them as health data. Filling one in is that consent; every check-in is optional, and you can delete them with your account |
| Health: daily steps, sleep sessions, heart rate, workout sessions | Health Connect, only if you connect it | Sleep-aware nudges, Body Map, Metrics | Your explicit consent; withdraw any time in Settings |
| Location: places you name (home, work, gym), arrivals and departures at those places, whether you’re moving, coarse weather area. With “Allow all the time” this is read in the background, when the app is closed or not in use: one location fix when you settle somewhere for about 15 minutes, no continuous route trail | The phone, only if you allow it (precise location; background access is a separate, optional choice) | Nudges that fit where you are, with the app closed too; weather for outdoor suggestions | Your consent |
| Phone usage: unlock count, screen-on time, minutes spent in a scrolling app, the app’s category | The phone, only if you allow usage access | The doomscroll interrupt; staying quiet while you sleep | Your consent |
| Voice: audio and transcript of calls with the coach | You, during a call | Talking to the coach instead of typing | Your consent |
| Technical: device model, OS version, app version, IP address in server logs | Automatic | Keeping the service running and secure | Legitimate interest: keeping Grip running and secure |
| Messages you send: your email address, your name if you give it, and what you write, through the contact form on this website or by email to hello@gripcoach.app | You | To read and answer you, including beta access requests | Legitimate interest: answering people who write to Grip |
What stays on the phone: Grip never sees what is on your screen, which contacts you have, or the content of other apps. It sees that an app in the “social” category has been open for twenty minutes, not what you looked at.
3. How Grip learns
Grip uses how you respond to nudges (what you tap, rate, skip or tell the coach) to tailor support to you. Grip also studies these patterns across users, pseudonymised, to improve how it chooses support for everyone. Your data is never sold, never used for ads, and never used to train outside AI models: OpenAI does not train on what Grip sends it. You can object to the cross-user use at any time by emailing hello@gripcoach.app.
4. The AI part, plainly
The coach is not Grip’s own model. When it answers, Grip sends the conversation and a compact picture of your day (your plan, what you did with it, today’s health totals, recent workouts, unlock count, whether you’re on the move, the weather) to OpenAI’s API. That is the whole point of a coach with context, and it means OpenAI processes that data. Two other things travel the same road: the pages of a document you upload are sent as images so the coach can read them, and a voice note is sent as audio to be turned into text. OpenAI receives all of it under Grip’s account, not yours; it does not know who you are unless you put that in the text.
Grip uses only the parts of OpenAI’s API that take a request and answer it. No stored conversations, no uploaded files kept on their side, no assistants, no fine-tuning on your data. Under OpenAI’s API terms nothing sent this way is used to train their models, and it is held for at most 30 days for abuse monitoring before being deleted. Grip has applied to OpenAI for zero data retention, which would remove that window. That application is pending and may be turned down; until it is approved, the 30 days apply.
Voice calls are carried by ElevenLabs, who convert speech to text and back. ElevenLabs keeps a record of each call, what was said in either direction, for 30 days so that Grip can look into problems with calls. After 30 days it is deleted, and deleting your Grip account asks ElevenLabs to delete it sooner. The transcript is also folded into your Grip chat history, which is deleted with your account like everything else.
TypeSafe / Jev: activity categories and icons
When you add an activity, Grip sends its title, the category if one is already known, and Grip’s fixed list of category and icon definitions to TypeSafe AI, Inc. (their Jev model) to pick a category and an icon for it. Your account id is not in that request, but a title can still identify someone or reveal something sensitive, so it is not anonymous data. Titles already travel to OpenAI as part of the coach’s context; this is the same class of data going to a second processor for a narrower job.
What TypeSafe publishes about this: they do not train or fine-tune models on inputs (their privacy policy and customer agreement). The service is hosted in the United States: request data is stored on Amazon Web Services there, and the model itself runs on Modal, Nebius and CoreWeave compute, which process prompts without storing them (their subprocessor list). EEA data goes there under standard contractual clauses. Retention is purpose-based (“as long as necessary”) with no fixed period published, and customer data is deleted when a customer leaves. Grip does not have zero data retention with TypeSafe, and deleting your Grip account does not by itself erase what TypeSafe still holds for that purpose; contact us and we will pass an access or deletion request on to them.
Separately, Grip is testing support-selection judgments with invented situations. Proposed future inputs include selected blockers, current state and relevant preferences, which may themselves be sensitive. This research does not enable that processing for users. Any broader use needs its own data review and updated notices and, where required, consent before it starts.
The coach can be wrong. Nothing it says is medical, legal, or financial advice.
5. Who else processes your data
| Processor | What for | Where |
|---|---|---|
| Supabase | Database, sign-in, file storage | Stockholm, Sweden (EU) |
| Railway | Runs the Grip server, including the website’s contact form | Netherlands (EU) |
| OpenAI | Coach replies, reading uploaded documents, voice-note transcription, exercise names, the self-harm check that shows helplines | Contracted in Ireland (EU); may process outside the EEA |
| ElevenLabs | Voice calls and spoken reminders | United States |
| TypeSafe AI | Category and icon for an activity title (details in section 4) | United States |
| Resend | Account emails and contact-form messages; keeps a copy for 30 days | Sends from Ireland (EU); stores in the United States |
| Open-Meteo | Weather for your area (coarse coordinates, no identity) | EU |
| Cloudflare | Hosts this website, the Turnstile bot check, forwarding of hello@gripcoach.app | Global network |
| Google (Gmail) | The inbox where messages to hello@gripcoach.app are read and answered | Includes the United States |
Where a provider handles data outside the EU/EEA (or its staff and subprocessors can reach it from there, as with Supabase), the transfer relies on the EU’s standard contractual clauses, the EU–US Data Privacy Framework or an adequacy decision.
Grip does not sell data, share it with advertisers, or use it for advertising. There are no ad networks and no analytics SDKs in the app: nothing measures how you use it and reports back.
6. How long it is kept
- Grip account data is kept until account deletion. The deletion process removes account data from the database and server files and requests deletion of older calls at ElevenLabs; a deletion receipt remains. Provider retention is described separately: OpenAI and ElevenLabs below, TypeSafe in section 4 (purpose-based, no fixed period published).
- After deletion Grip keeps an id-only receipt (a random account id and a timestamp, nothing else) so a deleted account cannot resume access. It contains no personal data.
- Generated spoken lines are cached for up to 7 days and then removed.
- OpenAI: at most 30 days of abuse monitoring, then deleted; nothing is kept for training. ElevenLabs: call records for 30 days, then deleted, sooner if you delete your account.
- Workouts read from Health Connect stay in your activity history until account deletion, even if you later delete them in the app that recorded them.
- Location: arrivals and departures are deleted after 30 days. A place you did not name is deleted 30 days after the last visit; a place you named is kept while you keep going there and deleted 180 days after the last visit. You can delete all location history at once in Settings → Integrations.
- Server logs with IP addresses: 7 days at Railway, then deleted.
- Messages to hello@gripcoach.app, by email or through the contact form: kept in the inbox while the conversation is going, then deleted once they are no longer needed to follow up. Ask and they are deleted sooner. Resend keeps its copy of each contact-form message for 30 days.
- The contact form’s limit on messages per sender: your IP address is held in the server’s memory for up to an hour and never written to disk.
7. Your rights
Under the GDPR you can, at any time and for free:
- See and take your data: Settings → Export gives you a machine-readable ZIP of the data included in Grip’s self-service export. It is not a complete access response. Contact us for a broader access request; exclusions from the download do not limit your access rights.
- Correct it: most things you can edit in the app; for the rest, write to us.
- Delete it: Settings → Delete account, or this page without the app.
- Withdraw consent: Health Connect, location, usage access and the microphone can each be switched off in Settings or in Android; the related features simply stop. Mood and feeling check-ins are always optional: to withdraw, simply stop logging them.
- Restrict or object to processing based on legitimate interest, including the cross-user learning in section 3.
- Complain to the Swedish Authority for Privacy Protection (IMY, imy.se) or your local authority.
Grip makes no decisions about you with legal or similarly significant effect by automated means. Nudges are suggestions; you can ignore every one of them.
These are your rights under the GDPR.
8. Children
Grip is not intended for people under 13. If you believe a child has created an account, write to us and it will be deleted.
9. This website
gripcoach.app runs no analytics, no advertising, and no tracking scripts, which is why there is no cookie banner. The Inter typeface is served from this site itself. Two strictly necessary Cloudflare scripts can run: the Turnstile bot check on the account-deletion page and the contact form, and Cloudflare’s own bot protection on the site. These may set short-lived security cookies that are not used to identify or track you. The account-deletion page signs you in directly with Supabase, Grip’s authentication service, and then asks Grip’s server to delete your account. The contact form sends your email address, your name if you give it, and your message to Grip’s server, which checks the Turnstile result and emails the message to hello@gripcoach.app through Resend; it is not stored in Grip’s database. Nothing else is stored in the browser.
10. Security
Data travels encrypted (TLS) and is stored encrypted at rest by Supabase. Every table is protected by row-level security, so a user can only ever read their own rows. The widget uses signed tokens that expire after 30 days rather than your password.
11. Changes
If this notice changes in a way that matters, you’ll see it in the app before it applies. The date at the top always shows the current version.