Privacy Policy

rackd. · Last updated: 1 October 2026

FineGrind B.V. ("we", "us", "our") operates the rackd. mobile application (the "App"). This policy explains what personal data we collect, why, how long we keep it, and what rights you have under the General Data Protection Regulation (GDPR).

1. Who is responsible for your data

The data controller is:

FineGrind B.V.
Jacob van Lennepkade 155H
1054 ZL Amsterdam, The Netherlands
Chamber of Commerce (KvK): 42111130
Contact: hello@finegrind.nl

2. What we collect

Account data

Your email address and a hashed password, held by our authentication provider, Supabase. We never see your password in readable form. You are also assigned an internal account identifier that links your records together.

Training data

Your workouts, training plans, and exercise logs — including sets, reps, weights, session duration and dates. This data is stored on your device and synced to our servers so it is preserved if you lose or replace your device and stays consistent across devices you sign in on.

Body measurements

If you record them: body weight and body fat percentage, with the date of each entry. These sync to our servers alongside your training data.

Menstrual cycle and energy data

Cycle tracking is off by default. It records nothing until you switch it on. When enabled, and only for the days you choose to log, we store:

• Which days you mark as period days
• Your self-rated daily energy level, on a scale of 1 to 5
• Your typical cycle length, if you set one manually

These entries sync to our servers so your cycle history is not lost with your device. The App derives your cycle phase and predictions from them on your device; we do not store calculated phases or predictions on our servers.

We rely on your explicit consent for this data (Article 9(2)(a) GDPR), given when you enable cycle tracking. You can withdraw it at any time — see section 6. We never use this data for advertising, never share it for marketing, and never sell it. It is not used for any purpose beyond adapting training guidance inside the App.

Injuries

If you record injuries or problem areas so the App can avoid unsuitable exercises, that list is stored with your settings and synced to our servers. This is also health data under Article 9, handled on the same explicit-consent basis and with the same restrictions as your cycle data.

Profile and preferences

Your training goal, experience level, available equipment, focus areas, preferred weight unit, onboarding status, and whether cycle tracking is enabled. If you use the AI coach, the text of your most recent coaching summary is stored with your settings so it appears on all your devices.

Subscription data

If you subscribe, we store the platform (Apple or Google), the product purchased, a store transaction identifier, the expiry date, and the current status of your subscription. We use it only to determine whether your subscription is active. Payment is handled entirely by Apple or Google — we never see your card details, billing address, or full name.

AI usage counters

Counters recording how many AI plans you have generated this month and whether you have requested a coaching summary this week. These exist solely to enforce the usage limits described in the App, and are tied to your subscription rather than to your account.

This one record is deliberately kept when you delete your account, and is the only thing that is. AI requests cost us money per request, so without it anyone could delete and re-register to reset their allowance and use the feature without limit. We keep it for about a month after your last use of an AI feature — long enough to cover the monthly allowance it protects — and then delete it automatically.

It holds only a reference to your App Store or Google Play subscription and the counts. It does not contain your email address, your name, your payment details, your training data, your cycle data, or any record of what you asked the AI for. The subscription reference is an identifier issued by Apple or Google — it cannot be used to contact you, and on its own it does not identify you to us.

Technical data

Our infrastructure provider, Cloudflare, processes IP addresses and request metadata to route traffic, serve content, and detect abuse. We keep short-lived rate-limiting and abuse-prevention records keyed to your email address. We use no analytics SDKs, no advertising identifiers, and no cross-app or cross-site tracking of any kind.

3. How the AI features use your data

The AI plan generator and AI coach are the only features that send your data outside our own infrastructure. When you actively request one, we assemble a summary and send it through our server to Anthropic's Claude API, which generates the response.

Depending on the feature and on what you have recorded, that summary can include:

• Your training goal, experience level and available equipment
• Recent workout history and training volume
• Body weight and body fat trends
• Your recorded injuries
• Your current cycle day and phase, and your average energy by cycle phase — only if you have enabled cycle tracking and logged enough entries for an estimate

This only happens when you tap to generate a plan or a coaching summary. It never happens in the background.

We do not store the content of AI prompts or responses on our servers, apart from the coaching summary saved to your settings so you can read it again. Anthropic processes the request as our processor and does not use data submitted through its commercial API to train its models. If you never use the AI features, none of your data is ever sent to Anthropic.

4. Legal bases for processing

Under Article 6 GDPR:

• Performance of a contract (Art. 6(1)(b)) — your account, training data, preferences, sync, and subscription status. We cannot provide the App without them.
• Legitimate interests (Art. 6(1)(f)) — rate limiting, abuse detection and service security, including keeping the AI usage counter described above after an account is deleted. Our interest is keeping a paid-for service affordable and available to everyone; the data involved is minimal, time-limited, and never used to profile you or for any other purpose.
• Consent (Art. 6(1)(a)) — sending your data to Anthropic when you request an AI feature.

For health data, Article 9 requires a second, stricter basis in addition to the above:

• Explicit consent (Art. 9(2)(a)) — your menstrual cycle and energy entries, and your recorded injuries. Given when you enable those features, and withdrawable at any time.

We do not make any decision about you that produces legal or similarly significant effects by automated means. The App's AI output is a training suggestion you are free to ignore.

5. Who we share data with

We do not sell your personal data, and we do not share it for advertising. We use these processors:

• Supabase — authentication and database hosting, in the European Union. Privacy Policy
• Resend — delivers account emails such as address confirmation and password resets, from servers in the European Union. Receives your email address only. Privacy Policy
• Cloudflare — API hosting, content delivery and abuse prevention. Privacy Policy
• Anthropic — processes AI requests you initiate, as described in section 3. Privacy Policy
• Apple and Google — distribute the App and process subscription payments as independent controllers, under their own privacy policies.

We may also disclose data where we are legally required to, for example in response to a valid order from a competent authority.

6. Withdrawing consent and turning features off

• Cycle tracking — turn it off in Settings at any time. To erase entries already recorded, delete them in the App or contact us and we will remove them from our servers.
• Injuries — clear the list in Settings; the change syncs to our servers.
• AI features — simply stop using them. Nothing is sent to Anthropic unless you request it.

Withdrawing consent does not affect processing that took place before you withdrew it.

7. Where your data is stored

Your account and synced data are held in the European Union. Cloudflare serves requests from the location closest to you and may process technical data such as IP addresses outside the EEA.

8. International transfers

When you use an AI feature, the data described in section 3 is transferred to Anthropic in the United States. That transfer is covered by the European Commission's Standard Contractual Clauses together with supplementary safeguards, under a data processing agreement we have in place with Anthropic. Cloudflare transfers are covered by equivalent mechanisms. You can request a copy of the relevant safeguards from us.

9. How long we keep your data

• Account, profile, cycle and subscription data — until you delete your account.
• AI usage counters — roughly one month after your last use of an AI feature, whether or not you still have an account, for the anti-abuse reason given in section 2. Allowances are counted per calendar month and per week, so a record older than that protects nothing and we do not keep it. Removed automatically. This record holds a subscription reference and the counts only — no email address.
• Training and body data — we retain a rolling window per account: your most recent 300 exercise logs, 200 workouts, 50 plans, 365 body measurements and 750 cycle entries. Older records are removed automatically.
• Deleted records — when you delete something in the App it is hidden immediately, then permanently erased from our servers within 30 days.
• Rate-limiting records — expire automatically, within 48 hours of creation at the longest. If we have had to suspend an account for abuse, we keep that record until the suspension is lifted.
• Deleted accounts — deleting your account in Settings erases your account and every record linked to it: training data, body measurements, cycle entries, injuries, preferences and subscription status. Your email address is erased with the account. The only thing retained is the AI usage counter described above — a subscription reference plus counts, no email — and only for about a month. Data still held on your own device is removed when you sign out or uninstall the App.

10. Your rights

If you are in the European Economic Area you have the right to:

• Access the personal data we hold about you
• Rectify data that is inaccurate or incomplete
• Erase your data — you can do this yourself in Settings → Delete Account. The single exception is the AI usage counter (a subscription reference plus counts, containing no email address), which we retain for about a month on the legitimate-interest basis set out above; you can object to this under Article 21 and we will consider your circumstances
• Restrict or object to processing based on legitimate interests
• Withdraw consent for health data or AI processing at any time (section 6)
• Data portability — receive your data in a structured, machine-readable format
• Lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, or your local supervisory authority

Write to hello@finegrind.nl to exercise any of these. We respond within one month, as GDPR requires.

11. How we protect your data

• All traffic encrypted in transit with HTTPS/TLS
• Passwords stored only as salted hashes, never in readable form
• Every API request authenticated with a signed token
• Database access controls that make it impossible for one account to read another's data
• Rate limiting and automated abuse detection
• Encrypted storage for authentication tokens on your device

No system is perfectly secure, but if a breach ever affects your rights we will notify you and the Autoriteit Persoonsgegevens as required by Articles 33 and 34 GDPR.

12. Minors

The App is for adults. It is not intended for anyone under 18, and we do not knowingly collect data from anyone under 18 — including the body measurements and menstrual cycle data described above. If you believe someone under 18 has provided us with personal data, contact us at hello@finegrind.nl and we will close the account and delete the data.

13. Changes to this policy

We may update this policy as the App changes. If a change materially affects how we handle your data — especially your health data — we will tell you in the App or by email before it takes effect, and where the law requires it we will ask for your consent again. The date at the top always reflects the current version.

14. Contact

Questions about this policy or your data:
hello@finegrind.nl