This policy explains how Grapefine handles personal data in all of our apps and on our websites: grapefine.app and the websites of our apps, such as movawalk.com.
- Part 1 applies to everything we make.
- Part 2 explains, per app, what that app collects on top of Part 1.
Each app’s website shows the same policy for that app alone, with Part 1 and that app’s part of Part 2: for Mova, movawalk.com/privacy/.
Who we are
Grapefine is registered with the Netherlands Chamber of Commerce (KvK) under number 77291611. Grapefine is responsible (the “controller”) for the personal data described in this policy.
Address: Dopheide 2, 8471 VG Wolvega, the Netherlands Privacy questions: privacy@grapefine.app (about Mova: privacy@movawalk.com)
The short version
- Our apps only collect what they need to work.
- We do not sell personal data and we do not share it with advertisers.
- Usage statistics and crash reports are off unless you switch them on.
- You can export or delete your data from within each app.
- Some apps work with sensitive data, such as health information. We only use that with your explicit consent, and Part 2 explains exactly what and why.
Part 1: All our apps and websites
Our websites
Our websites do not use cookies, analytics or tracking. Our hosting provider (Cloudflare) processes technical data about each visit, including IP addresses, to deliver the sites and protect them against abuse.
If you email us, we use your email address and message only to reply to you. We keep that correspondence for as long as needed to handle your question, and at most two years.
Your account
Most of our apps need an account. You create one with Sign in with Apple, Sign in with Google, or your email address and a one-time code. We store your email address, an account ID and, if you give it, your first name. Sign-in codes are sent by email through Resend.
Each app has its own account. Deleting your account in one app does not affect your account in another.
Subscriptions and purchases
You buy subscriptions and in-app purchases through the App Store or Google Play. Apple and Google handle the payment; we never see your card details. RevenueCat, our subscription service, receives your account ID and the store’s purchase details so that the app knows what you have access to.
Usage statistics and crash reports
Both are off by default in all our apps. If you switch them on in the app’s privacy settings:
- Usage statistics (PostHog, EU servers) receive a fixed list of events, such as “walk completed”, with a random ID that is not linked to your account, your name or your email address. No location, no session recordings.
- Crash reports (Sentry) receive technical details about an error, such as the app version and device model, cleaned on your phone first. No name, email address or health data.
You can switch either off again at any time.
Notifications
Reminders are scheduled on your phone. If an app uses a push notification service, its section in Part 2 says so.
Why we may use your data (legal bases)
| Purpose | Legal basis |
|---|---|
| Your account, the app’s features, syncing between your devices | Performing our agreement with you |
| Health information and other sensitive data (only in apps that ask for it, see Part 2) | Your explicit consent |
| Checking your subscription | Performing our agreement with you |
| Usage statistics and crash reports | Your consent |
| Security, preventing abuse, keeping our systems working | Our legitimate interest in a safe, working service |
| Answering your emails | Our legitimate interest in helping you |
Who processes data for us
We use these service providers. Each processes data only on our instructions, under a data processing agreement. An app that uses an additional provider names it in Part 2.
| Provider | What for | Where |
|---|---|---|
| Supabase | Database and sign-in | EU |
| RevenueCat | Subscription status | United States |
| PostHog | Usage statistics (only if you switch them on) | EU |
| Sentry | Crash reports (only if you switch them on) | EU (Germany) |
| Resend | Sending sign-in codes | EU (Ireland) |
| Cloudflare | Hosting our websites | United States |
| Apple and Google | Sign-in, payments and the platform services an app uses | Under their own privacy policies |
Outside the EU. Where a provider processes data outside the European Economic Area, we rely on the EU–US Data Privacy Framework if the provider is certified, or on the European Commission’s Standard Contractual Clauses.
How long we keep data
| Data | How long |
|---|---|
| Your account and app data | As long as you have an account in that app |
| After you delete your account | Removed within 30 days; removed from backups within 30 days after that |
| A record that an account was deleted (no email address, no app data) | As long as needed to make sure deleted data is not restored from a backup |
| Crash reports | Up to 90 days |
| Usage statistics | Up to 13 months |
| Emails to us | Up to two years |
Purchase records are kept by Apple or Google under their own policies. Part 2 lists any period that is specific to an app.
Exporting and deleting your data
In the app. Every app that has an account lets you export your data and delete your account under its privacy settings. For your security we ask you to sign in again before deleting.
Deleting your account does not cancel your subscription. Cancel it in the App Store or Google Play settings first.
Without the app. Email the privacy address of that app (for Mova: privacy@movawalk.com) from the email address of your account and ask us to delete your account. We will confirm it is you and delete it within 30 days.
Your rights
You have the right to access, correct, delete or export your personal data, to restrict or object to its use, and to withdraw your consent at any time. Most of this you can do in the app; for anything else, email privacy@grapefine.app, or the privacy address of the app concerned (for Mova: privacy@movawalk.com). We answer within one month.
You also have the right to complain to a data protection authority, in the Netherlands the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or the authority in the country where you live.
Age
Our apps are for adults aged 18 and over. We do not knowingly collect data from anyone younger.
Security
App data is encrypted on your phone and sent to our servers over an encrypted connection. Access to our systems is limited and protected.
Changes to this policy
When we change this policy, we update the date at the top. If a change matters for how an app uses your data, we tell you in that app before it takes effect. When we launch a new app, we add its section to Part 2.
Contact
Grapefine, Dopheide 2, 8471 VG Wolvega, the Netherlands privacy@grapefine.app
Part 2: Per app
Mova
Mova is our walking app for weight loss, at movawalk.com. Privacy questions about Mova: privacy@movawalk.com. On top of Part 1, Mova works with the data below.
What you tell Mova during onboarding
To build a plan that fits you, Mova asks about your goal, your age, sex, height, current weight, an optional target weight, your current activity and walking habits, your schedule and your preferences. It also asks about things that affect how safely you can walk, such as joint discomfort, balance, advice from a healthcare professional, or a recent pregnancy.
Some of this is health data, a special category of personal data under the GDPR. Mova only processes it with your explicit consent, which it asks for before the first health question. If you do not give consent, Mova does not keep the health answers you entered. You can withdraw your consent at any time under Profile & settings › Privacy & data. Withdrawing does not affect processing that happened before.
If you stop onboarding before you finish, we delete what you entered after 14 days.
Your walks and activity
When you walk with Mova, it records the type of walk, start and end time, duration, distance, steps and an estimate of the calories you used, and it keeps your daily step and distance totals. This is stored on your phone and in your account, so your progress is safe if you change phones.
Location. Mova uses your location only during a walk you start, and only if you allow it. Your route is stored encrypted on your phone and is not uploaded to our servers. You can switch route recording off.
Maps. To show a route on a map, Mova uses Apple Maps on iPhone and Google Maps on Android. To load the map, your phone requests map images of the area from Apple or Google.
Apple Health and Health Connect
If you connect Apple Health (iPhone) or Health Connect (Android), Mova reads your steps and walking distance to show your daily activity and adjust your plan. When you finish a walk, Mova can save it as a workout in Apple Health or Health Connect. Mova does not read your weight, heart rate, routes or other health records.
Data from Apple Health and Health Connect is used only to provide Mova’s features to you. It is never used for advertising, never sold, and never shared with third parties for their own purposes. You can disconnect at any time in the settings of Apple Health or Health Connect.
Deleting your Mova account
In Mova, go to Profile & settings › Privacy & data and choose to delete your account. Mova then deletes your profile, health answers, plan, walks, routes, daily activity, challenges and reminders, and signs you out on every device.
Deleting your Mova account does not:
- cancel your Mova subscription: cancel it in the App Store or Google Play settings first;
- remove workouts that Mova saved to Apple Health or Health Connect: you can delete those in those apps.
Without the app, email privacy@movawalk.com from the email address of your Mova account and ask us to delete it, as described in Part 1. See movawalk.com/delete-account/ for the details.
Exporting your Mova data
In Mova, go to Profile & settings › Privacy & data and choose to export your data. You get a file with your account details, plan and walks, and the routes stored on that phone.