1. Introduction

Drop It (“we”, “us”, “our”) is committed to protecting your privacy. This Privacy Policy explains how we handle your information when you use the Drop It mobile application (“App”) and its associated services.

GRIM WORKS SL complies with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and all applicable Spanish and international privacy laws.

2. Information We Collect

We treat your data with care and transparency. The App processes the following types of information:

A. Locally stored and synced data:

• Training Data: Exercises performed, sets, reps, weights, and training history.
• Menstrual Cycle Data: Information you choose to provide about your cycle, such as start dates, duration, and symptoms.
• App Usage Data: Anonymous in-app events used strictly to improve functionality (e.g., screen flow or usage patterns).
• Subscription Status: Managed securely via RevenueCat, which tracks your active subscription through your Apple ID.

B. Conversation and AI Data:

If you choose to activate and use the virtual assistant "Siena", we process:

• Chat History: The content of messages you voluntarily send to interact with the AI.
• Health Context: Data about your cycle or symptoms you share during the conversation to get personalized recommendations.
• Note: This data is processed by third-party providers (Google Gemini) exclusively to generate responses.

C. Data used for marketing analytics:

To understand how users interact with our ads and improve our campaigns, we collect a minimal set of events:

• App installation
• Completion of initial setup steps
• Subscription purchases

3. How We Use Your Information

We use the information listed above to:

• Provide personalized training recommendations based on your data.
• Dynamically adapt your training based on performance and menstrual cycle phase.
• Generate assistance and wellness responses through the AI chat ("Siena").
• Sync your preferences, chat history, and settings via the secure cloud.
• Validate and manage your subscription using RevenueCat.
• Measure the effectiveness of our ad campaigns through attribution tools (Meta, Apple SKAdNetwork, etc.), always with your explicit consent (ATT).

We do not use your data for automated profiling with legal effects, nor do we sell your personal data to third parties.

4. Data Storage and Transfers

To offer advanced features like cloud sync and the AI Assistant, Drop It uses secure third-party infrastructure:

• Supabase (Database): We store your user profile, chat history, and workout logs on secure, privacy-optimized servers. Data is encrypted at rest.
• Google Gemini (AI): When using the "Siena" chat, your conversation text is securely sent to Google (as a data processor) to generate the response. Google does not use this data to train its public models under our current configuration.
• Local Storage: We keep a local copy of your data on your device to ensure fast performance and offline availability.
• RevenueCat: Subscription status is securely managed via RevenueCat and your Apple ID. We do not have access to your billing information.

5. Payments and Subscriptions

All purchases and subscriptions are handled exclusively through Apple’s App Store. Your subscription is linked to your Apple ID and can be managed at any time via:

iOS Settings > Apple ID > Subscriptions

6. Advertising and Analytics

If you consent to tracking when installing the app (ATT), we collect limited, non-identifiable data to analyze our marketing performance. We may share this data only with:

• Meta (Facebook/Instagram): To measure campaign performance.
• TikTok: For attribution purposes.
• Apple (SKAdNetwork): For anonymous, aggregated attribution.

7. App Tracking Transparency (ATT)

In accordance with Apple’s ATT framework, Drop It asks for your permission to track your activity across other apps and websites. You are free to allow or deny tracking; either choice will not affect your in-app experience.

8. Your Rights

You correspond always in control of your data:

• Account Deletion: You can request the complete deletion of your account and all your cloud data (including chat history) by emailing support or using the "Delete Account" feature within the App.
• Local Deletion: Go to Settings > Delete All Data to erase information from the device.
• Ad Management: Meta automatically deletes analytics events after 12 months. You can revoke your tracking consent in iOS Settings at any time.

9. Security

We design Drop It with privacy and security in mind:

• Encryption: All communications use HTTPS (SSL/TLS).
• Restricted Access: Administrative access to the database is strictly limited to essential technical personnel for maintenance and support purposes.
• Database Security: We use Row Level Security (RLS) to ensure that only you can access your own chat history.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be reflected on this page with an updated “Last Updated” date.

11. Contact

If you have any questions, concerns, or feedback about this Privacy Policy, please contact us at:

📧 administracion@grimworks.es