Privacy Policy
Garfil Parks Lab ("we," "our," "us") respects your privacy. This Privacy Policy explains what information we collect through the Garfil Parks Lab mobile application (the "App" or "Service"), how we use it, and the choices you have.
By using the Service, you agree to the collection and use of information as described in this policy.
1. Information We Collect
Account Information
When you create an account, we collect your email address and a securely hashed version of your password. We never store your password in plain text.
Assessment Information
During onboarding, we collect information you provide about your fitness goals, experience level, equipment access, schedule, injury history, and — where applicable and only if you choose to share it — medical clearance status and pregnancy status. This information is used solely to match you to an appropriate training program and to apply safety-relevant exercise substitutions.
Health Data (Apple HealthKit / Google Health Connect)
If you choose to connect Apple HealthKit (iOS) or Google Health Connect (Android), and only after you grant explicit permission through your device's native permission screen, we read the following data types:
- Sleep data
- Resting heart rate
- Heart rate variability (HRV)
- Exercise/workout records
This connection is read-only. We never write, modify, or delete any data in HealthKit or Health Connect. This data is used exclusively to build a personal 14-day recovery baseline and to suggest — never automatically apply — a lighter training session when your recovery signals are meaningfully below your own baseline. You may revoke this permission at any time through your device's Health Connect or Health app settings, or through your device's app permissions.
Health data is not sold, shared with advertisers, or used for any purpose other than the recovery-adjusted programming feature described above.
Payment Information
Subscription payments are processed by Stripe. We do not store your full credit card number. Stripe's own privacy practices govern the data you provide directly to them during checkout.
Usage and Device Information
We may collect standard technical information such as app crash reports (via Sentry, used solely for stability and bug-fixing), device type, and operating system version, to help us diagnose and fix issues.
Communications
If you contact us, or if you sign up for the Service, we may send transactional emails (welcome, check-in reminders, renewal notices) via Brevo. You did not opt in to marketing email by default; transactional emails relate directly to your account and use of the Service.
2. How We Use Your Information
We use the information described above to:
- Create and manage your account
- Match you to an appropriate training program
- Apply recovery-adjusted programming, where you've connected HealthKit or Health Connect
- Process subscription payments
- Send account-related transactional emails
- Diagnose technical issues and improve the Service
- Comply with legal obligations
We do not sell your personal information or health data to third parties, and we do not use your health data for advertising.
3. Third-Party Services We Use
Each of these providers has its own privacy practices governing data they process on our behalf.
| Service | Purpose | Data Involved |
|---|---|---|
| Stripe | Payment processing | Payment details, billing email |
| Brevo | Transactional email delivery | Email address |
| Apple HealthKit / Google Health Connect | Recovery-adjusted programming | Sleep, resting heart rate, HRV, exercise (read-only) |
| Sentry | Crash and error reporting | Device/app diagnostic data |
4. Data Retention
We retain your account and assessment information for as long as your account is active. If you delete your account through the in-app deletion feature, we delete your account, assessment data, and health-derived summaries. Payment records may be retained in anonymized form as required for financial recordkeeping and legal compliance.
5. Your Rights and Choices
If you are located in the EEA, UK, or California, you may have additional rights under GDPR or CCPA, including the right to request a copy of your data or object to certain processing. Contact us using the details below to exercise these rights.
- Access and correction: You can review and update your account information within the App.
- Health data permission: You can revoke HealthKit or Health Connect access at any time through your device settings.
- Account deletion: You can permanently delete your account and associated data at any time from Account settings within the App.
- Marketing communications: Transactional emails are tied to your account and use of the Service; you may still opt out of any non-essential emails via the link included in those emails, where applicable.
6. Children's Privacy
The Service is not directed at children under 13 (or 16 in the EEA), and we do not knowingly collect personal information from children under that age. If you believe a child has provided us with personal information, contact us and we will delete it.
7. Data Security
We use industry-standard measures — including encrypted password storage and secure transmission — to protect your information. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
8. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via the App or email, and update the "Last Updated" date above. Continued use of the Service after changes constitutes acceptance of the updated policy.
9. Contact Us
If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at:
Email: garfilparkslab@gmail.com