Privacy Policy

1. Introduction

GOODBOY STUDIOS (“we” or the “Operator”) sets out below how information is handled in the GROWTH workout tracking app (the “App”) and the official GROWTH website (the “Website”).

2. Information collected and used

Workout records

We handle records entered by users or generated in the App, including weight, reps, sets, exercises, workout dates, sessions, PRs, estimated 1RM, total training volume and drop sets.

Body information and profile

We handle body data such as weight and body fat percentage, experience, goals, primary goal, weekly training days, equipment, sport and trainer notes. Nickname, gender, age and height remain on the device and are not included in snapshots sent to GROWTH AI.

Authentication and inquiries

The App uses anonymous Supabase authentication sessions and handles authentication information if you link an account with Apple. Linking Apple or registering a name or email address is not a prerequisite for purchasing or restoring Pro. Purchase entitlements are based on verified Apple StoreKit transactions and server verification of their current status. Session information is stored in the device's Keychain. The Website's contact form receives your name, email address and message.

3. Purposes of use

• To provide App features such as workout records, charts, physique photos, backups and restoration
• To organize records and provide suggestions through GROWTH AI
• To authenticate users, verify purchase status, restore purchases and respond to inquiries
• To communicate as needed to address issues and improve the App and Website

4. Apple Health integration

With your permission, the App may read weight and body fat percentage from Apple Health and write weight and body fat percentage to it. The purpose is to let you review and log body data alongside workout records. You can change permissions in your device settings.

Apple's settings and policies also apply to the handling of Apple Health data.

5. Data and consent when using GROWTH AI

Before the first AI submission, the App explains the recipient, information and purpose. Data is sent only if you choose “Agree and Continue.” You can still log workouts if you choose “Not Now.” You can withdraw consent at any time through “AI Data Sharing Consent” in settings; new AI submissions will then stop. Consent is stored on this device for each Growth account and is not included in backups.

Your message and the training information needed for a response are sent via a Supabase Edge Function to the third-party AI service OpenAI to generate a response. This information includes exercise and category names, workout dates, weight, reps, sets, drop sets, estimated 1RM, volume and summaries, body weight and body fat percentage and their history, experience, goals, weekly training days, equipment, sport, trainer notes, response style, app version and language, processing timestamps, and record and request identifiers. Photos, image paths, audio, nickname, age, gender and height are not sent. However, information you enter yourself in messages or notes is included in what is sent.

Voice input is recognized on the device, and only the text you confirm is sent. AI chats and responses are stored on the device. Growth does not save AI input or response bodies as regular records in its Supabase database. Requests to OpenAI use store:false, but this does not guarantee immediate, complete deletion. OpenAI abuse-monitoring logs may generally be retained for up to 30 days, and processing caches for up to 24 hours; the provider's data policies apply.

GROWTH AI responses are training reference information, not medical advice.

6. Progress Photos

Physique photos, workout photos and profile images are stored on the device. Photos and image paths are not included in snapshots sent to GROWTH AI.

Photos are included in the backup package when you create a manual backup. You can delete photos using the App's deletion controls. Once a backup is exported, its storage and sharing destinations are managed by the environment you choose.

7. Backups and CSV export

Manual backups include records, body data, training profiles, workout photos, profile images and physique photos.

CSV export includes training records such as date, session, exercise, set type, weight, reps, total volume, estimated 1RM, PR, completion status and drop-set information. If you use the exported CSV with other apps or services, check their terms of use.

8. Third-party services

• Apple Health: reading and writing permitted weight and body fat percentage data
• Apple Account / Sign in with Apple: authentication when account linking is chosen
• Apple App Store / StoreKit: purchasing Pro, purchase status and restoring purchases
• Supabase Auth / Edge Function: authentication sessions and GROWTH AI processing
• OpenAI: processing user questions and necessary training information for GROWTH AI

Each provider's policies also apply to the handling of information by its service.

9. Storage, deletion and security

Records, body data, photos, profiles and AI conversations are primarily stored in SwiftData or files on the device, while authentication sessions are managed in Keychain. Supabase retains authentication UUIDs, usage and subscription-verification metadata, and security-related call counts, token counts and estimated costs for authentication, purchase restoration and limit management.

For both anonymous and Apple-linked accounts, you can start deletion by selecting “Delete Account” under “GROWTH Account” in the App's settings, reviewing the scope of deletion and providing final confirmation. The server Auth user and associated usage and subscription links are deleted. For Apple-linked accounts, Apple authentication is verified and the linking token is revoked. Security call histories are anonymized by replacing identifiers associated with you with random values, while overall safety-limit counts are maintained. For as long as needed to support legitimate purchase restoration and prevent fraudulent subscription transfers, the server retains only a one-way hash of the original UUID and the deletion timestamp as confirmation of a deleted account. This confirmation contains no original UUID, Apple credentials or session information and cannot be viewed or modified by clients. To support legitimate restoration across devices and prevent duplicate use of AI allowances, subscription-level transaction identifiers, products, active status, verification timestamps and total AI usage remain after account deletion, with links to individual Auth users removed. This information contains no Apple Account email address, name, Apple authentication token or AI input body and cannot be viewed or modified by clients. Providers' technical logs expire according to their retention periods; individual logs may not be erased immediately when an account is deleted.

After successful deletion, the App deletes this device's workout records, body records, in-app photos, profile, AI conversations, custom exercises and categories, authentication session and AI consent. Network, server or Apple unlinking failures are not reported as completed deletions. If only device cleanup remains incomplete, the App prompts a retry. “Reset Record Data” is a separate action.

Exported backups, CSV files and photos, the iPhone photo library and original Apple Health data are outside the scope of account deletion. Delete them from their respective locations as needed. App Store subscriptions are not automatically canceled; manage them separately in Apple's subscription settings. Deleted accounts and records cannot be restored.

For questions about personal information, contact growth@goodboy-studios.com. We verify identity to the extent necessary to respond. We do not use information for advertising or tracking across other companies' apps.

10. Information provided in inquiries

Names, email addresses and messages received through the contact form are used to reply to inquiries, investigate issues and improve features. Messages are sent to growth@goodboy-studios.com .

11. Changes and dates

We may update this policy as App features or external services change. We will announce important changes on the Website or in the App.

Effective date: September 30, 2026
Last updated: October 10, 2026

12. Website analytics

We use Google Analytics 4 (GA4) on this Website to understand usage and improve it. GA4 collects information such as page views, referrers, country, device, language and events that occur on the Website. We do not send names, email addresses or inquiry content as event parameters.

Analytics starts only after you accept the consent banner. If you decline, the analytics tag is not loaded. You can withdraw saved consent by deleting this site’s data in your browser.