Privacy Policy

The short version

The rest of this page is the detail behind those six points.

Who we are

GoL ("GoL", "we", "us") is an iOS GoL and health tracking app built and operated by Kyle Cressy, an independent developer. For anything in this policy, the contact is kylecressy@gmail.com.

Under the UK and EU GDPR, we are the data controller for the information described below.

What we collect

Only what the app needs to do its job. Nothing here is collected speculatively "in case it's useful later."

How it's used

• To calculate your daily and weekly GoL score and show your trends over time. This is the core of the app.
• To sync your data across your devices and restore it if you reinstall or change phone.
• To analyze meal descriptions and optional photos for calories and macros when you request it.
• To show crew leaderboards, if you've chosen to join one.
• To keep the app working — diagnosing crashes, finding bugs, and understanding which features are actually used so the right things get built.
• To manage your subscription and unlock the features you've paid for.
• To answer you when you email support.

Under the UK and EU GDPR, our legal bases are: performance of a contract (running the app you subscribed to), explicit consent (health data, which you grant through the iOS permission prompts and can withdraw at any time), legitimate interests (keeping the app secure and functional), and legal obligation where one applies.

Apple Health data

Health information gets stricter treatment than everything else in this policy, both because Apple requires it and because it's the right way to handle it. Specifically:

• Data read from Apple Health is used solely to provide the features you enabled — scoring your GoLs, showing your trends, and keeping your streaks accurate.
• It is never used for advertising, marketing, or any similar service.
• It is never sold, rented, or disclosed to data brokers, information resellers, or anyone else for their own purposes.
• It is never used for data mining. The only third party that stores it is Supabase, our hosting provider, which holds it on our instructions so the app can sync between your devices. It is not sent to OpenAI, not sent to RevenueCat, and not sent anywhere else.
• Access is read-only. GoL does not write to your Health records or alter anything already in them.
• You can withdraw access at any time in Settings → Privacy & Security → Health → GoL. It takes effect immediately. Data already synced stays in your GoL account until you delete it.

Meal photos & AI processing

When you request meal analysis, the description you enter and any photo you choose are sent through our Supabase server function to OpenAI for estimated foods, calories, and macros. You can review and edit the result before saving it to your food log.

• Your submitted description and optional photo are used to estimate the meal's nutrition.
• OpenAI states that data submitted through its API is not used to train its models by default.
• The request does not include your Apple Health records.
• GoL stores the nutrition items you choose to save, not the submitted meal photo itself.

You can log meals manually without requesting AI analysis.

Service providers

Running GoL uses specialist service providers. We send the data needed to operate the features you use, subject to each provider's applicable service terms and privacy practices.

We may also disclose information if we're legally required to — a court order, a valid legal request — or if it's genuinely necessary to protect someone's safety. If GoL were ever sold or transferred, your data would move with it under this same policy, and you'd be told before anything changed.

What we never do

• We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under the California Consumer Privacy Act.
• We do not show you ads, and we don't run advertising trackers in the app.
• We do not use your health data to build profiles for anyone's marketing, including our own.
• We do not publish your data or make it visible to anyone outside the crews you deliberately join.

Retention & deletion

Your logged data is kept for as long as your account exists — the whole point of a tracker is the history, so nothing is quietly aged out.

Deleting your account

Open the You tab, scroll to Delete My Account, and confirm. Your account and associated live app data are deleted from our systems. Backup copies expire under our hosting provider's retention schedule. Anonymised, aggregated statistics that can't be traced back to you may remain.

Deleting your account does not cancel your App Store subscription. Cancel that separately in Settings → your name → Subscriptions, or Apple will keep charging you.

If you can't reach the in-app option, email kylecressy@gmail.com from your account address and it'll be done for you.

Your rights

Depending on where you live you have some or all of the following rights, and we'll honour any of these requests regardless of where you are:

• Access — get a copy of the data we hold about you.
• Correction — fix anything inaccurate. Most of it you can edit directly in the app.
• Deletion — remove your account and data, as above.
• Portability — receive your data in a machine-readable format.
• Withdraw consent — revoke Health or screen time access in iOS Settings at any time.
• Object or restrict — ask us to stop or limit certain processing.
• Non-discrimination — exercising any of these rights never costs you access or a worse price.

Email kylecressy@gmail.com and you'll get a response within 30 days. If you're in the UK or EU and you're unhappy with how we've handled something, you can complain to your local data protection authority.

Security

Data is encrypted in transit using TLS and encrypted at rest by our hosting provider. Access to production systems is limited to what's necessary to operate the app. No system is perfectly secure and it would be dishonest to claim otherwise, but if a breach ever affected your data we'd tell you promptly and tell you what to do about it.

Children

GoL isn't directed at children and isn't intended for anyone under 16. We don't knowingly collect data from anyone under that age. If you believe someone under 16 has created an account, email us so we can address it.

International transfers

Our service providers may process data in countries other than yours, including the United States. Where data leaves the UK or European Economic Area, transfers are covered by appropriate safeguards such as the UK International Data Transfer Agreement or the European Commission's Standard Contractual Clauses.

Changes to this policy

If this policy changes, the date at the top changes with it. For anything significant — a new category of data, a new provider seeing your health information — you'll be told in the app before it takes effect, not quietly on a webpage.

Contact