Privacy Policy

1. Who We Are

Iron & Grits is a strength training and nutrition app operated by Vylon LLC, a South Carolina limited liability company ("Vylon," "we," "our," or "us"). Vylon LLC is the controller of the personal information described here.

This Privacy Policy explains what we collect, how we use it, and who it goes to when you use the Iron & Grits mobile application. It forms part of our Terms of Service.

By creating an account, you agree to this policy. If you do not agree, please do not use Iron & Grits.

2. Information We Collect

Account data: your email address and name when you register. If you use Sign in with Apple or Google, we receive the identifier and email that provider sends us. If you use Apple's Hide My Email, we only ever see the relay address.

Fitness data: workouts you log, including exercises, sets, reps, weight, rest periods, RIR and RPE entries, workout duration, skill holds, and personal records.

Nutrition data: food and meals you log, including descriptions, barcodes you scan, and the calorie and macronutrient values associated with them.

Food photos: photos you take to scan a meal are saved on your device only. They are sent to an AI provider for analysis at the moment you scan, and they are not uploaded to or stored on our servers. Deleting the scan deletes the photo from your device.

Body data: any body weight or measurement data you enter voluntarily.

AI interaction data: messages you send to Atlas, our AI coaching assistant, the workout and nutrition context sent with them, the food descriptions or photos you submit for analysis, and the responses and estimates generated.

Voice data: when you use hold-to-talk voice control, your device transcribes your speech. Depending on your device, locale, and iOS settings, that audio is processed on-device or sent to Apple for transcription under Apple's privacy policy. We receive only the resulting text, and we do not record, store, or transmit raw audio ourselves.

Subscription data: if you subscribe, Apple and RevenueCat tell us which plan you hold, whether it is active, when it renews or lapses, and a pseudonymous purchase identifier tied to your account. We use this to unlock the features you paid for.

Device and usage data: app version, operating system version, feature usage counts used to enforce plan limits and prevent abuse, and crash or diagnostic reports that Apple shares with us if you have opted in to sharing analytics with developers in iOS Settings.

What we do not collect: your payment card or billing details (Apple handles payment and never gives them to us), location data, Apple Health or HealthKit data, contacts, advertising identifiers, or biometric identifiers.

3. How We Use Your Information

We use your information to:

• Provide and improve the Iron & Grits app and Atlas coaching
• Personalize training recommendations and progressive overload suggestions
• Maintain your workout history, nutrition log, and personal records
• Deliver and verify the subscription features you have paid for, and enforce free plan limits
• Detect, prevent, and investigate abuse, fraud, and security incidents
• Send account-related communications (not marketing)
• Diagnose and fix technical issues
• Comply with legal obligations and enforce our Terms

We do not use your data to train our own AI models, and we do not send it to any third party for their model training.

4. How We Share Your Information

We do not sell your personal data, and we do not share it for cross-context behavioral advertising. Ever.

We share data only with the following processors and providers:

Supabase (database and authentication): your account credentials, profile, and all workout and nutrition data are stored on Supabase infrastructure. Supabase is SOC 2 Type II certified.

OpenAI and Google (AI processing): messages you send to Atlas, relevant workout and nutrition context, and any food descriptions or photos you submit for analysis are transmitted to OpenAI's and/or Google's AI APIs to generate coaching responses and food estimates. Under these providers' current API data-usage policies, data submitted through their APIs is not used to train their models.

Apple and Google (sign-in): if you use Sign in with Apple or Google, that provider authenticates you and tells us the identifier and email you authorized.

Apple and RevenueCat (subscriptions): Apple processes your purchase. RevenueCat receives your purchase receipt and a pseudonymous account identifier and reports your entitlement status back to us. Neither passes us your payment details.

Apple (voice transcription): described in Section 2.

Open Food Facts (barcode lookup): when you scan a barcode, that barcode is sent to the Open Food Facts public database to retrieve product nutrition data. We do not send them your identity or any other information about you.

Legal and safety: we may disclose information if we are legally required to, or where we believe in good faith that disclosure is necessary to comply with law, enforce our Terms, or protect the rights, safety, or property of any person.

Business transfer: if Vylon LLC is involved in a merger, acquisition, financing, or sale of assets, your information may transfer as part of that transaction. It would remain subject to this policy, and we would notify you of any material change.

No other third parties receive your data. We do not use advertising networks or third-party analytics SDKs.

5. Health and Fitness Data

Your workout logs, nutrition logs, body metrics, and fitness history are sensitive personal information. We treat this data with heightened care:

• Used exclusively to provide and improve Iron & Grits features for you
• Never sold, rented, or licensed to any third party
• Never shared with advertisers, insurers, employers, or data brokers
• Shared only with the providers named in Section 4, and only for the purposes described there

Iron & Grits is not a covered entity or business associate under HIPAA, so HIPAA does not apply to this data. We apply equivalent care standards to your health and fitness information regardless of what the law requires.

6. Data Retention

We retain your data as long as your account is active. If you delete your account (Settings → Delete Account), your profile, workout history, nutrition log, and all associated data are permanently deleted from our systems within 30 days. Encrypted backups may hold residual copies for a short additional period before they rotate out.

Food photos live on your device only, so deleting the app removes them.

Apple and RevenueCat keep their own records of your purchases under their retention policies, and we cannot delete those. We may also retain a minimal record where the law requires it, for example for tax or fraud purposes.

7. Data Security

All data is transmitted over HTTPS/TLS. Passwords are hashed and never stored in plaintext. Session tokens are held in the iOS keychain. Database access is protected by Supabase Row Level Security, so each user can only read and write their own records. We regularly review our security practices.

However, no method of transmission over the internet and no method of electronic storage is 100% secure. While we work hard to protect your information, we cannot guarantee its absolute security, and you provide it at your own risk.

8. Your Rights and Choices

You may request access to, correction of, or deletion of your personal data at any time.

To delete your account and all associated data: open Settings → Delete Account.

To take your data with you: open Settings → Export Data for a JSON or CSV copy of your training history.

Device permissions: camera, photo library, microphone, and notifications are all optional and can be granted or revoked at any time in iOS Settings. Declining a permission only disables the feature that needs it.

For any other request, contact us at support@ironandgrits.com. We may need to verify that the request comes from you before we act on it.

California residents: we do not sell or share personal information as those terms are defined by the CCPA and CPRA. You have the right to know what data we hold, to request correction or deletion, and to not be discriminated against for exercising those rights. The in-app delete and export functions are the fastest route.

EEA, UK, and similar jurisdictions: we process your data to perform our contract with you, to pursue our legitimate interests in operating and securing the app, and with your consent where it is required, for example for AI processing. You have rights of access, rectification, erasure, restriction, portability, and objection. Contact us at the address above to exercise them.

9. Children's Privacy

Iron & Grits is intended for users 18 years of age and older. We do not knowingly collect data from anyone under 18. If we become aware that a user is under 18, we will delete their account and associated data promptly. If you believe a minor is using the app, contact us at support@ironandgrits.com.

10. Where Your Data Is Processed

Vylon LLC operates from the United States, and your data is stored and processed in the United States by us and by our providers. If you use Iron & Grits from outside the United States, you understand that your information will be transferred to and processed in the United States, where privacy laws may differ from those in your country.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the app or by email and update the "Last updated" date above. Continued use of Iron & Grits after changes are posted constitutes acceptance of the updated policy.

12. Contact

Questions about this policy?

Vylon LLC
Email: support@ironandgrits.com