GURV Privacy Policy

Last updated: July 20, 2026

This Privacy Policy describes how Vrtl Pirates LLC ("we," "us," or "our") collects, uses, shares, and protects information when you use GURV, an iMessage-native AI fitness, nutrition, and supplement tracker (the "Service"). GURV consists of (a) an iMessage-based interface through which you log workouts, meals, and supplements by texting a designated phone number, and (b) a native iOS application that displays your fitness data, patterns, and insights.

By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described herein, do not use the Service.

1. Information We Collect

1.1 Information You Provide Directly

Account Information

Phone number. Collected during account creation and phone verification. Your phone number links your iMessage identity to your GURV account and is stored in our database.

Body and Profile Information

Body statistics. Height, weight, and age, collected during onboarding via iMessage.
Training profile. Training split (e.g., push/pull/legs, upper/lower), training schedule (day-by-day), fitness goals (e.g., bulk, cut, recomp), experience level, preferred gym, and training time. Collected during onboarding via iMessage and updated as you provide new information.
Supplement stack. A list of supplements you take, including names, dosages, and timing. Collected during onboarding and updated via iMessage.

iMessage Content

Every text message you send to GURV's phone number is stored. This includes workout descriptions, meal descriptions, supplement logs, questions, corrections, casual conversation, and any other content you choose to send. These messages are stored in our conversations database and are processed by artificial intelligence to provide the Service.

Payment Information

If you subscribe to a paid plan, payment details are collected and processed by Apple. RevenueCat supplies subscription entitlement and lifecycle status to us. We do not receive or store your full payment-card details.

1.2 Information Derived from Your Usage

Workout Data. Exercises, weights, repetitions, sets, split day, and workout date -- parsed by AI from the text messages you send.

Meal and Nutrition Data. Food items, quantities, estimated calories, macronutrients (protein, carbohydrates, fat), and meal timing -- parsed by AI from your messages and cross-referenced with USDA and FatSecret nutrition databases.

Supplement Logs. Supplement name, dose, and timing, parsed from your iMessage texts.

Personal Records. Automatically detected from your workout history (e.g., heaviest bench press, most volume in a session).

Daily Macro Aggregates. Daily totals of calories and macronutrients computed from your individual meal entries.

1.3 Information Generated by the System

AI-Generated Insights. The Service generates fitness insights including plateau detection, volume trends, recovery patterns, schedule drift analysis, and nutrition correlations. These are produced by AI models based on your stored data.

AI-Generated Messages. GURV sends service messages through iMessage, including onboarding, logging confirmations, and clarification questions. Optional proactive check-ins are sent only after you turn them on and can be disabled at any time.

Notification Preferences. We store your preferences for which types of messages you wish to receive (e.g., morning prime, nightly recap, weekly digest).

1.4 Information We Do NOT Collect

Location data. We do not collect your location. A geofence feature exists in our codebase but is disabled and does not collect data.
Photos or images. GURV cannot process images. If you send a photo, it is rejected.
Contacts. We do not access your address book.
Health app data. We have no HealthKit integration and do not read data from Apple Health.
Browsing history. We do not track your web activity.
Advertising identifiers. We do not collect IDFA or other identifiers for advertising or cross-company tracking.
Product analytics and diagnostics. We use a pseudonymous account identifier and a narrow set of bounded events to understand onboarding, purchases, activation, and retention. We also collect crash and performance diagnostics. These events exclude phone numbers, birth dates, message bodies, food or workout text, supplement names, model prompts and outputs, and health measurements.

2. How We Use Your Information

We use the information we collect for the following purposes:

To Provide the Service

Parse your iMessage texts to extract workout, nutrition, and supplement data.
Store and organize your fitness data so it is accessible in the iOS app.
Generate personalized insights based on your training and nutrition history.
Deliver iMessage notifications (recaps, check-ins, digests) based on your preferences.
Detect personal records and track your progress over time.

To Improve AI Parsing Accuracy

We may review anonymized or aggregated message patterns to improve how our AI interprets workout and nutrition descriptions. We do not use your individual messages for training third-party AI models.

To Understand Product Reliability and Use

Measure bounded onboarding, subscription, activation, and retention steps without collecting the health or message content entered at those steps.
Diagnose crashes, request failures, and performance regressions using scrubbed technical telemetry.

To Process Payments

If you subscribe to a paid plan, Apple processes the transaction and RevenueCat helps us manage subscription entitlement.

To Communicate with You

Send you Service-related messages via iMessage, including onboarding flows, scheduled notifications, and responses to your texts.

To Maintain Security and Prevent Abuse

Enforce rate limiting, detect anomalous usage, and protect against unauthorized access to accounts.

3. How We Share Your Information

3.1 Third-Party Service Providers

We share information with the following third-party service providers solely to operate the Service. We do not sell, rent, or lease your personal information to any third party.

Provider	Data Shared	Purpose	Relevant Policy
Anthropic (Claude API)	Message content, user profile context	AI processing: message classification, parsing, insight generation, response generation	Anthropic does not use API data to train models per their API data policy
Supabase	All stored user data	Database hosting (PostgreSQL), authentication, real-time data sync to iOS app	SOC 2 Type II certified
Photon Spectrum	Phone numbers, message content	iMessage delivery and routing	Photon processes messages in transit to deliver the service
RevenueCat and Apple	Pseudonymous user identifier, product and subscription status	In-app purchases and entitlement management	Apple processes payment credentials; Orph receives purchase lifecycle status
FatSecret	Food item names and descriptions (no user identifiers)	Nutrition data lookup (calories, macros)	We send only food names, not user names, phone numbers, or account information
PostHog	Pseudonymous user identifier and bounded product events	Onboarding, purchase, activation, and retention analytics	No message bodies, health measurements, or free-form content are included
Sentry	Pseudonymous technical diagnostics	Crash, error, and performance monitoring	Request bodies, message content, health data, and sensitive headers are scrubbed
Railway	Application runtime data	Backend hosting infrastructure	Application code and runtime environment

3.2 What We Will Never Do

We will never sell your personal data. Not to advertisers, data brokers, or any other party.
We will never share your fitness or nutrition data with employers or insurance companies.
We will never use your data for targeted advertising. GURV has no ads and no advertising infrastructure.
We will never share your data with other users. Your account and all associated data are private to you.

3.3 Legal Requirements

We may disclose your information if required to do so by law, or in the good-faith belief that such disclosure is necessary to: (a) comply with a legal obligation, court order, or legal process; (b) protect and defend our rights or property; (c) prevent fraud or protect the safety of users or the public; or (d) protect against legal liability.

4. AI Processing Disclosure

GURV uses artificial intelligence extensively. This section explains precisely how.

4.1 What AI Processes

Every text message you send to GURV is transmitted to Anthropic's Claude API for processing. This includes:

Phase 1 (Classification). Your message is sent to a fast AI model (Claude Haiku) to determine what type of message it is (workout log, meal log, supplement log, question, correction, or casual conversation). This produces a near-instant confirmation reply.
Phase 2 (Deep Parsing). Your message is then sent to a more capable AI model (Claude Sonnet) for detailed extraction of structured data -- exercises, weights, foods, macros, supplements, and other relevant information. This model also generates insights and personalized responses.

Your user profile (body stats, training profile, supplement stack, and recent conversation history) may be included as context in AI requests to provide personalized and accurate responses.

4.2 Anthropic's Data Handling

Per Anthropic's API data policy as of the date of this Privacy Policy:

Anthropic does not train its models on data submitted through the API.
API inputs and outputs may be retained by Anthropic for a limited period (typically 30 days) solely for trust and safety purposes (e.g., detecting abuse), after which they are deleted.
Anthropic does not sell API data or use it for advertising.

We encourage you to review Anthropic's privacy policy and usage policy for the most current information.

If Anthropic materially changes their API data policy in a manner that would affect your data (such as using API data for model training), we will promptly notify you via iMessage, suspend transmission of your data to Anthropic, and either obtain your updated consent or transition to an alternative AI provider before resuming data processing.

4.3 AI Limitations

AI-generated nutrition estimates (calories, macros) are approximations and should not be treated as medical or dietary advice. AI-generated insights (plateau detection, recovery analysis) are informational and do not constitute professional fitness or medical guidance.

5. Data Retention

Data Type	Retention Period
Account information (phone and profile)	Retained until you request account deletion
iMessage content (all messages sent and received)	Retained indefinitely for conversation context and insight generation, until you request account deletion
Workout, nutrition, and supplement data	Retained until you request account deletion
Personal records and insights	Retained until dismissed by you or until account deletion
Daily macro aggregates	Retained until account deletion
Notification preferences	Retained until account deletion
Subscription data	Managed by Apple and RevenueCat under their retention policies. We store entitlement status and product information needed to provide access.
Product analytics and diagnostics	Retained according to the configured PostHog and Sentry retention periods and deleted or de-identified when no longer needed.
AI processing logs	Anthropic retains API data for up to 30 days for safety monitoring, then deletes it
Photon Spectrum (iMessage delivery)	Message transit logs are retained according to Photon's service configuration and policies.

We retain your iMessage conversation history for the lifetime of your account because GURV uses historical context to provide more accurate and personalized responses over time. If this concerns you, you may request deletion of your account and all associated data at any time (see Section 7).

6. Your Rights

6.1 Rights Under GDPR (European Economic Area, United Kingdom, Switzerland)

If you are located in the EEA, UK, or Switzerland, you have the following rights under the General Data Protection Regulation:

Right of Access. You may request a copy of the personal data we hold about you.
Right to Rectification. You may request that we correct inaccurate or incomplete personal data. You can also correct workout and meal data directly via the iOS app (swipe-to-delete, tap-to-edit).
Right to Erasure. You may request that we delete your personal data (see Section 7).
Right to Data Portability. You may request a copy of your data in a structured, machine-readable format (see Section 8).
Right to Restriction of Processing. You may request that we restrict the processing of your personal data under certain circumstances. If you request restriction of processing, we will suspend AI processing of your messages while retaining your existing account data. You will not be able to log new workouts, meals, or supplements during the restriction period. You may lift the restriction at any time by contacting us.
Right to Object. You may object to our processing of your personal data for certain purposes.
Right to Withdraw Consent. Where processing is based on consent, you may withdraw consent at any time.
Right Regarding Automated Decision-Making. GURV does not make automated decisions that produce legal or similarly significant effects on you. AI-generated insights, personal records, and nutritional estimates are informational only and do not constitute automated decision-making under GDPR Article 22.

For processing health-related data (fitness activity, nutrition intake, supplement usage, body measurements), our legal basis is your explicit consent provided when you accept this Privacy Policy and begin using the Service (GDPR Article 9(2)(a)). For non-health data processing (account management, payment processing, communications), our legal basis is the performance of our contract with you.

6.2 Rights Under CCPA (California Residents)

See Section 13 for detailed California privacy rights.

6.3 How to Exercise Your Rights

You may exercise any of these rights by:

Sending an iMessage to your assigned GURV phone number requesting the action (e.g., "delete my account," "export my data").
Emailing privacy@gurv.app with your request.
Using the account management features in the iOS app (Settings > Account).

We will respond to verified requests within 30 days (or sooner where required by law). This response period may be extended by up to two additional months for complex or numerous requests, in which case we will notify you of the extension and the reasons within the initial one-month period. We may need to verify your identity before processing a request, which we will do by confirming your phone number.

7. Data Deletion

7.1 How to Request Deletion

You may request complete deletion of your account and all associated data by:

Tapping "Delete Account" in the iOS app (Settings > Account > Delete Account).
Sending an iMessage to GURV with "delete my account."
Emailing privacy@gurv.app with the subject "Account Deletion Request."

7.2 Deletion Process

Upon receiving a deletion request:

Grace period. Your account enters a 7-day grace period during which you may cancel the deletion request. During this period, the Service is suspended (no messages will be processed).
Permanent deletion. After 7 days, we permanently and irreversibly delete all of your data, including:
- Account information (phone number and profile)
- All iMessage conversation history
- All workout, nutrition, and supplement data
- All personal records and insights
- All notification preferences
- All daily aggregates and computed data
Third-party deletion. We instruct our service providers to delete or de-identify data where applicable. Apple and RevenueCat retain transaction records under their legal and operational requirements. AI providers, Photon, PostHog, and Sentry apply their configured retention and deletion policies.

7.3 What Remains After Deletion

We delete all user data from our active database systems. Automated database backups maintained by our infrastructure provider (Supabase) may retain encrypted copies of data for a limited period as part of their standard backup rotation schedule, after which they are automatically overwritten. These backups are encrypted at rest and are not used for individual record retrieval or restoration after account deletion. Anonymized, aggregated statistics (e.g., "X users logged workouts this week") that cannot be linked back to you may persist.

8. Data Export

You may request a full export of your data at any time. Exports are provided in JSON format and include:

Account and profile information
Complete iMessage conversation history
All workout data (exercises, sets, reps, weights)
All nutrition data (meals, foods, macros)
All supplement logs
Personal records
AI-generated insights
Notification preferences

To request an export, use the "Export My Data" feature in the iOS app (Settings > Account > Export Data) or email privacy@gurv.app. Exports are typically delivered within 48 hours.

9. Security

We implement the following security measures to protect your data:

Encryption

All data is encrypted in transit using HTTPS/TLS.
All data is encrypted at rest in our Supabase-hosted PostgreSQL database.

Access Control

Row-Level Security (RLS) policies enforce that each user can only access their own data at the database level.
JWT-based authentication ensures that API requests are verified before data is returned.
Service-role keys (used by backend processes) are stored as encrypted environment variables and are never exposed to client applications.

Application Security

Rate limiting is enforced on all API endpoints to prevent abuse.
No plaintext secrets are stored in code or configuration files.
Input validation is performed on all data before database writes.
The iOS app communicates exclusively over HTTPS.

Infrastructure

Backend hosted on Railway with isolated container environments.
Database hosted on Supabase with SOC 2 Type II certified infrastructure.
Regular security updates applied to all dependencies.

Limitations

No system is perfectly secure. While we implement industry-standard protections, we cannot guarantee absolute security.

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

Notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Article 33
Notify affected users without undue delay via iMessage and, where available, email
Provide the following information in our notification: the nature of the breach, the categories and approximate number of individuals affected, the likely consequences, and the measures taken or proposed to address the breach
Document all breaches in an internal breach register regardless of whether notification to users is required

For California residents, we will comply with the notification requirements of the California Civil Code Section 1798.82.

Law enforcement may request a delay in notification if immediate disclosure would impede a criminal investigation. We will comply with such requests to the extent required by law.

10. Children's Privacy

GURV is not intended for use by anyone under 17 years of age. We do not knowingly collect personal information from individuals under 17. If we learn that we have collected information from a user under 17, we will promptly delete that information.

If you are a parent or guardian and believe that someone under 17 has provided personal information to GURV, please contact us at privacy@gurv.app and we will take steps to delete that data.

11. Health and Fitness Data Sensitivity

We recognize that fitness, nutrition, and supplement data may be considered sensitive personal information under various legal frameworks, including but not limited to health-related data under the GDPR's "special categories" of personal data.

11.1 Elevated Protections

We treat all fitness, nutrition, and supplement data with heightened security:

This data is subject to the same encryption, access control, and security measures described in Section 9.
Row-Level Security ensures that no user, employee, or system process can access another user's health and fitness data without explicit authorization.
We do not make inferences about your medical conditions, diagnoses, or health status. GURV tracks what you tell it -- exercises, meals, and supplements -- and nothing more.

11.2 Consent for Health Data Processing

You provide explicit consent for the processing of your health and fitness data by:

(a) Accepting this Privacy Policy during account creation in the GURV iOS app, where you will be presented with a consent screen describing our data practices before your account is activated; and

(b) Voluntarily sending messages to GURV's phone number containing your fitness, nutrition, and supplement information.

You may withdraw your consent at any time by deleting your account (see Section 7). Withdrawal of consent does not affect the lawfulness of processing conducted prior to withdrawal. If you withdraw consent, we will cease processing your health data and delete your account in accordance with our deletion procedures.

11.3 Confidentiality of All Conversations

All conversations with GURV are treated with equal confidentiality regardless of content. Whether you are logging a meal, discussing your training program, asking about supplements, or sharing any other information, your messages receive the same privacy protections. We do not flag, categorize, or treat any message content differently based on its subject matter for privacy purposes.

11.4 Who Will Never See Your Data

Your health and fitness data will never be shared with:

Employers or prospective employers
Insurance companies or underwriters
Advertisers or marketing companies
Data brokers
Any party seeking to use your data to make decisions about your employment, insurability, creditworthiness, or eligibility for any benefit or service

12. App Store Privacy Disclosures

In accordance with Apple's App Store requirements, we declare the following data practices:

Data Used to Track You: None. We do not track you across other companies' apps or websites.
Data Linked to You: Health & Fitness data (workouts, nutrition, supplements), Contact Info (phone number), Identifiers (pseudonymous account ID), Purchase History (subscription status), Product Interaction, Crash Data, and Performance Data.
Data Not Linked to You: None. All collected data is associated with your account.
Data Not Collected: Location, Contacts, Browsing History, Search History, Diagnostics, Advertising Data.

These declarations are consistent with our data practices described throughout this Privacy Policy.

13. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (as amended by the California Privacy Rights Act) provides you with specific rights regarding your personal information.

13.1 Categories of Personal Information Collected

Category (per CCPA)	Examples from GURV
Identifiers	Phone number and pseudonymous account identifier
Personal information under Cal. Civ. Code 1798.80(e)	Phone number, name
Internet or electronic network activity	iMessage content sent to GURV
Professional or employment-related information	Not collected
Biometric information	Not collected
Geolocation data	Not collected
Sensory data	Not collected
Inferences drawn from personal information	AI-generated insights (workout trends, nutrition patterns, personal records)
Sensitive personal information	Health-related information (body stats, workout data, nutrition data, supplement usage)

13.2 Your California Rights

Right to Know. You have the right to request that we disclose what personal information we collect, use, and share about you.
Right to Delete. You have the right to request deletion of your personal information (see Section 7).
Right to Correct. You have the right to request correction of inaccurate personal information.
Right to Opt-Out of Sale or Sharing. We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising. There is nothing to opt out of in this regard.
Right to Limit Use of Sensitive Personal Information. You may request that we limit our use of your sensitive personal information to what is necessary to provide the Service.
Right to Non-Discrimination. We will not discriminate against you for exercising any of your CCPA rights.

Although we do not sell or share personal information for cross-context behavioral advertising, California residents may submit a verifiable request regarding the sale of their personal information by contacting us at privacy@gurv.app or through the 'Privacy' section of the GURV iOS app settings.

13.3 Exercising Your California Rights

To exercise your rights, contact us at privacy@gurv.app or use the in-app account management features. We will verify your identity using your phone number before processing any request. We will respond within 45 days of receiving a verifiable request.

13.4 Financial Incentives

We do not offer financial incentives tied to the collection, sale, or deletion of personal information.

14. International Data Transfers

GURV's backend infrastructure is hosted in the United States via Railway and Supabase. If you are accessing the Service from outside the United States, your data will be transferred to, stored in, and processed in the United States.

For users in the European Economic Area, United Kingdom, or Switzerland:

For transfers of personal data from the European Economic Area, United Kingdom, or Switzerland to the United States, we rely on transfer mechanisms maintained by our sub-processors, including Supabase, our AI providers, Photon, RevenueCat, PostHog, and Sentry, as applicable.

By using the Service, you acknowledge that your data will be processed in the United States, where data protection laws may differ from those in your jurisdiction.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

Update the "Last updated" date at the top of this policy.
Notify you via iMessage to your registered phone number.
If required by applicable law, obtain your consent to material changes.

Your continued use of the Service after notification of changes constitutes your acceptance of the updated Privacy Policy. If you do not agree with any changes, you may delete your account as described in Section 7.

We encourage you to review this Privacy Policy periodically.

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, you may contact us at:

Email: privacy@gurv.app
General support: support@gurv.app

Mailing address:
Vrtl Pirates LLC
30 North Gould Street
Sheridan, WY 82801
United States

For GDPR-related inquiries, you may also contact our data protection point of contact at privacy@gurv.app. If you are in the EEA and believe our processing of your personal data violates the GDPR, you have the right to lodge a complaint with your local supervisory authority.

17. Governing Law

This Privacy Policy is governed by the laws of the State of Wyoming, United States, without regard to its conflict of laws principles.

Vrtl Pirates LLC is committed to protecting your privacy. GURV exists to help you track your fitness goals, and your data is used solely for that purpose.