PRIVACY POLICY

Last updated September 28, 2026

This Privacy Policy explains how Graydoor LTDA (doing business as Graydoor and Graydoor Apps) ("we," "us," "our") collects, uses, shares, and protects personal information when you use the PumpReps mobile application (the "App") and the website https://pumpreps.com (together, the "Services"). It also explains your privacy rights and how to exercise them. Capitalized terms not defined here have the meaning given in our Terms of Use.

We are the controller of the personal information described in this Privacy Policy. If you have questions or concerns, contact us at [email protected].

SUMMARY

• You can answer the onboarding questions without an account; those answers stay on your device. An account is required to purchase Premium, sync your data, and use Groups.
• If you create an account, we store your account details and a copy of your app data (such as workouts, meals, and your onboarding answers, including weight, height, and goals) in our cloud database so it can be synced and restored.
• Some of this information relates to your body and fitness and may be considered health data. We process it with your consent, which you give when you create an account.
• The App does not use advertising, analytics, crash-reporting, or location tracking, and we do not sell your personal information.
• Payments are handled by Apple or Google. We never receive your card details.
• You can delete your account in the App at any time.

TABLE OF CONTENTS

1. WHAT INFORMATION WE COLLECT
2. HEALTH AND FITNESS INFORMATION
3. HOW WE USE YOUR INFORMATION AND OUR LEGAL BASES
4. DEVICE PERMISSIONS
5. GROUPS: WHAT OTHER USERS CAN SEE
6. WHO WE SHARE YOUR INFORMATION WITH
7. INTERNATIONAL TRANSFERS
8. COOKIES, TRACKING, AND ADVERTISING
9. HOW LONG WE KEEP YOUR INFORMATION
10. HOW WE PROTECT YOUR INFORMATION
11. CHILDREN AND TEENS
12. YOUR PRIVACY RIGHTS
13. DELETING YOUR ACCOUNT AND EXPORTING YOUR DATA
14. ADDITIONAL INFORMATION FOR SPECIFIC REGIONS
15. CHANGES TO THIS PRIVACY POLICY
16. HOW TO CONTACT US

1. WHAT INFORMATION WE COLLECT

Information stored only on your device

Unless you create an account, the information you enter in the App is stored only on your device and is not sent to us. This includes your onboarding answers, workouts, meal logs, lists, and settings. Some information always stays on your device, even if you have an account, including your nutrition goals (such as calorie and macro targets and the age, weight, and height used to calculate them) and the workout photos described in Section 4.

Information you provide when you create or use an account

• Account details: your name, email address, and password (not required if you sign in with Apple or Google). Optionally, a postal address and, for users in Brazil, a CPF number. We do not ask for your phone number or date of birth.
• Onboarding answers: your age range, gender, height, weight, body type, fitness goal, fitness level, training days, training location (gym or home), available equipment, preferred training styles, and what has held you back from training.
• Workout data: workout templates, exercises, sets, repetitions, weights, rest times, notes, personal records, training sessions and their dates, and weekly goals.
• Nutrition and lists: meal logs (foods, quantities, calories, and macros), grocery lists, and task lists.
• App settings: preferences such as language, default rest timer, weekly goal, meal names, and vibration, notification, and tip settings.
• Groups: the Groups you create or join, group names and passwords, challenges and challenge tasks you create, your check-ins, points, and admin status (see Section 5).
• Consent record: the date and the version of our Terms and Privacy Policy you accepted.
• Support messages: if you contact us from the App or by email, your message and the email address you give us for a reply.

Information from third parties

• Sign in with Apple and Google Sign-In: if you choose them, Apple or Google shares your name and email address with us. Apple may provide a private relay email address instead of your real one. We do not store your Google profile photo.
• App Store and Google Play: when you buy or restore Premium, the store gives the App information about the purchase, such as the transaction identifier or purchase token, the product, the platform, the subscription status, and purchase and expiration dates. We store this with your account to give you access to Premium. We do not receive your name, card details, or billing address from the stores.

Information generated by the App

• Country indicator: the App checks your SIM or network country and your device's language settings on your device to decide whether you are in Brazil, because some account requirements differ in Brazil. Only a yes/no indicator is stored with your account. The App does not access your location (GPS).
• Password reset: if you request a password reset, we generate a six-digit code, store it with your account for 15 minutes, and email it to you.

We do not collect information about your contacts, browsing history, advertising identifiers, or precise location, and we do not use device information for tracking.

2. HEALTH AND FITNESS INFORMATION

Information such as your weight, height, body type, fitness level, training data, and meal logs may be considered health data or sensitive personal data under some laws, including the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados, "LGPD") and the EU and UK General Data Protection Regulation ("GDPR").

We use this information only to provide the App's features to you: to personalize your workout and nutrition suggestions, to show your progress, and, if you have an account, to sync and restore your data. We do not use it for advertising, we do not sell it, and we do not share it with anyone except the service providers described in Section 6 that store it on our behalf.

We process this information based on your specific consent, which you give by ticking the consent box when you create an account. You can withdraw your consent at any time by deleting your account in the App or by contacting us. Because the App needs this information to work, withdrawing consent means we will delete your account and the data stored in it. Withdrawal does not affect processing that took place before it.

PumpReps is not a medical device and does not diagnose or treat any condition. See the Health and Fitness Disclaimer in our Terms of Use.

3. HOW WE USE YOUR INFORMATION AND OUR LEGAL BASES

We use personal information for the following purposes:

• To provide the Services: create and manage your account, sync and restore your data across devices, run Groups and challenges, and provide Premium features. Legal basis: performance of our contract with you (the Terms of Use).
• To personalize your plan: calculate workout and nutrition suggestions from your onboarding answers. Legal basis: your consent (for health and fitness information) and performance of our contract. These calculations are automatic estimates; they do not produce legal or similarly significant effects on you.
• To manage subscriptions: link purchases to your account, check whether your subscription is active, and restore purchases. Legal basis: performance of our contract.
• To communicate with you: send password reset codes, respond to support requests, and send important notices about the Services or changes to our terms. We do not send marketing emails. Legal basis: performance of our contract and our legitimate interest in supporting users.
• To keep the Services secure and enforce our terms: prevent abuse, investigate reports, and protect users. Legal basis: our legitimate interests and, where applicable, legal obligations.
• To comply with the law: respond to lawful requests from authorities and keep records required by law. Legal basis: legal obligation.

The App sends local reminders (such as rest timer alerts and workout tips) that are scheduled on your device. They do not require us to collect any information.

4. DEVICE PERMISSIONS

The App asks for the following permissions only when you use the related feature. You can change them at any time in your device settings.

• Camera: to take a workout photo with your workout stats added on top. The photo is created on your device.
• Photos / gallery: to save that photo to your gallery. Photos are not uploaded to us. We store only the photo's identifier on your device (and with your synced workout data) so the App can show it again.
• Notifications, alarms, and background timers: to show rest timers and reminders while the App is in the background.

If you choose to share a photo to Instagram Stories or through your device's share menu, the photo is sent directly to the app you choose and is then governed by that app's privacy policy.

5. GROUPS: WHAT OTHER USERS CAN SEE

Groups are private and can be joined only with the group ID and password. When you join a Group, its members can see your account name, whether you are an admin, the days you checked in to challenges, your points and ranking, and challenge winners. Group names, challenges, and challenge tasks are visible to all members of the Group. Other members cannot see your email address, workouts, meal logs, or onboarding answers.

Invitations created in the App (messages, links, and QR codes) include the group ID and password, so anyone who receives them can join. Group admins can remove members, and you can leave a Group at any time. If you delete your account without leaving your Groups first, your name and participation history may remain visible in those Groups; contact us and we will remove it.

6. WHO WE SHARE YOUR INFORMATION WITH

We do not sell your personal information, and we do not share it with third parties for their own marketing or advertising. We share it only as follows:

• Salesforce hosts our cloud database, where account and synced data are stored, and sends password reset emails on our behalf.
• Resend delivers support messages sent from the App to our support inbox. If this service is unavailable, the App opens your own email app instead.
• Apple and Google provide sign-in, app distribution, and payment processing under their own privacy policies.
• Meta (Instagram): the App includes Meta's software kit only to let you share a workout photo to Instagram Stories when you choose to. It is configured not to initialize automatically, not to send automatic app events, and not to collect advertising identifiers.
• Cloudflare hosts our website (see Section 8).
• Other users in your Groups, as described in Section 5.
• Authorities and legal requests: when required by law, court order, or a lawful request from authorities, or when necessary to protect the rights, safety, or property of our users, us, or others.
• Business transfers: if we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to this Privacy Policy.

Our service providers may process personal information only on our instructions and for the purposes described here. The App also contains links to third-party sites (for example, exercise video searches on YouTube, sharing through WhatsApp, and sources for health information). Those sites are governed by their own privacy policies.

7. INTERNATIONAL TRANSFERS

We are based in Brazil. Our service providers, including Salesforce, Resend, Apple, Google, and Cloudflare, may store or process personal information in the United States and other countries whose data protection laws may differ from those of your country. When we transfer personal information internationally, we do so under a transfer mechanism permitted by applicable law, such as contractual clauses offered by our providers or, where applicable, your specific consent, which you give when you create an account.

8. COOKIES, TRACKING, AND ADVERTISING

App. The App does not use cookies, advertising, analytics, crash-reporting services, or tracking technologies, and it does not track you across other companies' apps or websites.

Website. Our website is hosted by Cloudflare, which processes technical information such as your IP address, browser type, and the pages requested in order to deliver and protect the website, and may set strictly necessary security cookies. The main page of the website loads fonts from Google Fonts, which means your browser sends your IP address to Google when you visit it. The website does not use analytics or advertising cookies.

Because we do not track users across sites or apps, we do not respond differently to Do-Not-Track signals. We do not sell or share personal information for cross-context behavioral advertising, so an opt-out preference signal (such as Global Privacy Control) has nothing further to opt you out of.

9. HOW LONG WE KEEP YOUR INFORMATION

• Account and synced data: kept while your account is active. When you delete your account, we delete your account record from our cloud database straight away. Copies may remain for a limited time in our providers' backup or recovery systems until they are overwritten.
• Data on your device: stays on your device until you delete it, delete your account on that device, or uninstall the App.
• Password reset codes: expire after 15 minutes.
• Support messages: kept for as long as needed to handle your request and keep a record of it.

In any case, we do not keep your personal information for more than three (3) months after your account is terminated, unless a longer period is required or permitted by law (for example, to comply with legal obligations, resolve disputes, or enforce our agreements).

10. HOW WE PROTECT YOUR INFORMATION

We use technical and organizational measures designed to protect your personal information, including encrypted connections (HTTPS) between the App and our service providers, and access restricted to the people who need it to operate the Services. However, no electronic transmission or storage is completely secure, and we cannot guarantee that unauthorized third parties will never be able to defeat our security measures. Use a unique password for PumpReps, keep it confidential, and contact us immediately if you believe your account has been compromised. If a security incident creates a relevant risk or damage to you, we will notify you and the competent authorities as required by law.

11. CHILDREN AND TEENS

The Services are not directed to children. You must be at least 16 years old to use the Services. The App asks for your age range before an account is created and does not allow users who say they are under 16 to continue. We do not knowingly collect personal information from children under 16 (or under 13 in the United States). If we learn that we have collected personal information from a child under 16, we will delete it and close the account. If you believe a child under 16 has provided us with personal information, contact us at [email protected].

Users who are at least 16 but under the age of majority where they live (18 in Brazil and most countries) may use the Services only with the permission of a parent or legal guardian, who may contact us to exercise the rights described below on the minor's behalf. We process minors' information only to provide the Services, in their best interest, and never for advertising or profiling.

12. YOUR PRIVACY RIGHTS

Depending on where you live, you may have the right to:

• confirm whether we process your personal information and access a copy of it;
• correct incomplete, inaccurate, or outdated information;
• delete your information, or have it anonymized or blocked where it is unnecessary, excessive, or processed unlawfully;
• receive your information in a portable format;
• be informed about the entities we share your information with;
• be informed about the possibility of not giving consent and its consequences, and withdraw your consent at any time;
• object to or restrict certain processing; and
• complain to a data protection authority.

You can correct your account details and data directly in the App, and delete your account in the App's settings. For any other request, email us at [email protected] from the email address linked to your account. We may need to verify your identity before responding. We will respond within the period required by applicable law. We will not discriminate against you for exercising your rights.

13. DELETING YOUR ACCOUNT AND EXPORTING YOUR DATA

Delete your account: in the App, go to Settings and choose the option to delete your account. This permanently deletes your account record and synced data from our cloud database and removes your data from the device you use. It cannot be undone. Deleting your account does not cancel a subscription purchased through the App Store or Google Play; cancel it in your store account settings. If you can no longer access the App, email us from the email address linked to your account and ask us to delete it.

Export your data: the App's backup feature creates a file with your workouts, meals, and settings that you can save or share using your device. You can also ask us for a copy of the information stored with your account.

14. ADDITIONAL INFORMATION FOR SPECIFIC REGIONS

Brazil (LGPD)

We process personal information under the legal bases of the LGPD, including consent (Articles 7, I and 11, I), performance of a contract (Article 7, V), compliance with legal or regulatory obligations (Articles 7, II and 11, II, a), the regular exercise of rights (Article 7, VI), and legitimate interest (Article 7, IX). You can exercise the rights under Article 18 of the LGPD by contacting our data protection officer (encarregado) at [email protected]. You also have the right to file a complaint with the Brazilian National Data Protection Authority (ANPD).

European Economic Area, United Kingdom, and Switzerland (GDPR)

Our legal bases are described in Section 3. We process health and fitness information based on your explicit consent (GDPR Article 9(2)(a)). You have the rights described in Section 12, including the right to object to processing based on legitimate interests and the right to lodge a complaint with the data protection authority in the country where you live or work.

United States

Residents of some US states, including California, Colorado, Connecticut, Virginia, and others, have rights to know, access, correct, delete, and obtain a copy of their personal information, and to opt out of the sale of personal information, targeted advertising, and certain profiling. In the past 12 months, we have collected the categories of personal information described in Section 1: identifiers (such as name and email), customer records (such as postal address), commercial information (subscription purchases), and sensitive personal information (health and fitness information and, where provided, account login credentials), from the sources and for the purposes described in this Privacy Policy. We have disclosed these categories only to the service providers described in Section 6 for business purposes. We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising, and we use sensitive personal information only to provide the Services you request. To exercise your rights, or to appeal a decision about your request, email us at [email protected]. You may use an authorized agent, and we may ask the agent for proof of authorization.

15. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. We will update the "Last updated" date above and, if we make material changes, we will notify you in the App or by email before they take effect. Where a change requires your consent under applicable law, we will ask for it.

16. HOW TO CONTACT US

If you have questions or comments about this Privacy Policy, or want to exercise your rights, contact us at:

Graydoor LTDA
VILA REGENTE FEIJO 944 SALA 1506B BOX 1
SAO PAULO, SP 03.342-000
Brazil
[email protected]