Application: GRATS · Data Controller: Danylo Puchka · Contact: 37600daniil@gmail.com
Effective date: 7 June 2026 · Last updated: 16 June 2026
This Privacy Policy explains how Danylo Puchka ("we", "us", "our") collects, uses, stores, and protects the personal data of users ("you") of the GRATS mobile application (iOS and Android), available under the bundle identifier com.danylopuchka.grats.
GRATS is a gym membership management platform. The mobile app allows gym members to view their memberships, track visit history, freeze memberships, generate QR codes for gym check-in, and discover gym locations. A separate web platform is used by gym owners and staff to manage customer records and issue memberships.
By creating an account and using the GRATS app, you acknowledge that you have read this Privacy Policy and agree to the processing of your personal data as described herein.
We process personal data in compliance with:
| Data | Purpose |
|---|---|
| Email address | Account creation, identity verification, password reset, transactional notifications |
| Password | Authentication (stored as a secure hash by Firebase; never accessible to us in plain text) |
| First name and last name | Personalisation of your account and identification by gym staff |
| Phone number | Identity verification via SMS one-time password (OTP); linking your account to your gym membership |
| Data | Purpose |
|---|---|
| Email verification status | Confirming your identity before granting access |
| Phone verification status | Confirming ownership of the phone number |
| Membership freeze/unfreeze events — start date, end date, optional reason | Recording your request to pause a membership |
| QR code issuance timestamp | Generating a time-stamped code used for gym check-in |
When you purchase a gym membership, gym staff may create or update the following records on the GRATS web platform, which are visible in your mobile app:
| Data | Purpose |
|---|---|
| Customer record — your phone number linked to a specific gym | Identifying you as a customer at that gym |
| Purchase record — gym name, membership product details (title, validity, visit limits), start date, expiry date, price paid, discount applied, payment method label (cash / card / bank transfer / other), internal notes | Recording your membership and enabling access |
| Visit records — check-in and check-out timestamps, locker/key number assigned | Tracking your gym attendance |
| Data | Purpose |
|---|---|
| Theme preference (light / dark / system) | Remembering your display preference |
| Language preference (English / Ukrainian) | Remembering your chosen interface language |
| Firebase authentication tokens | Keeping you signed in between app sessions |
This data is stored on-device using React Native AsyncStorage and is never transmitted to our servers.
We do not collect any of the following:
| Processing activity | GDPR legal basis (Art. 6) | Ukrainian law basis |
|---|---|---|
| Account creation and authentication | Art. 6(1)(b) — performance of a contract | Art. 11(1) — consent; Art. 11(2) — necessary for contract |
| Onboarding verification (email + phone OTP) | Art. 6(1)(b) — performance of a contract | Art. 11(2) — necessary for contract |
| Displaying your memberships and visit history | Art. 6(1)(b) — performance of a contract | Art. 11(2) — necessary for contract |
| Freeze/unfreeze of memberships | Art. 6(1)(b) — performance of a contract | Art. 11(2) — necessary for contract |
| QR code generation for check-in | Art. 6(1)(b) — performance of a contract | Art. 11(2) — necessary for contract |
| Retention of purchase records for accounting | Art. 6(1)(c) — legal obligation | Legal obligation under Ukrainian accounting law |
We use your personal data solely to:
We do not use your data for advertising, profiling, automated decision-making, or sale to third parties.
We share your data with the following third-party providers strictly for the purposes of operating the service:
| Provider | Role | Data involved | Location |
|---|---|---|---|
| Google Firebase | Identity management, database | All account and operational data | USA / EU (Google Cloud) |
| Resend | Transactional email delivery | Email address, OTP codes | USA |
| SMS Fly | SMS delivery | Phone number, OTP codes | Ukraine |
| [object Object] (Elastic Beanstalk) | Backend API hosting | API request data, Firebase tokens | EU or USA (varies by region) |
| [object Object] (S3) | Gym image storage | Gym photos (not user photos) | EU or USA (varies by region) |
| [object Object] (GCS) | Encrypted weekly Firestore backup (disaster recovery) | All Firestore collections: account, membership, visit, and gym data | USA / EU (Google Cloud) |
All sub-processors are contractually bound to process data only for the purposes we specify. Google Firebase, Google Cloud Storage, and AWS comply with GDPR via Standard Contractual Clauses and applicable data processing agreements.
We do not transfer your personal data to any other third parties without your explicit consent.
Your data may be processed outside Ukraine and/or the European Economic Area (EEA) by the sub-processors listed above. Where data is transferred to countries not recognised as providing an adequate level of protection, we rely on:
| Data type | Retention period |
|---|---|
| Account data (email, name, phone) | Until you request account deletion |
| Email/phone verification codes (OTP) | 15 minutes from issuance, then deleted automatically |
| Password reset codes | 15 minutes from issuance, then deleted automatically |
| Membership (purchase) and visit records | 3 years from the membership end date (accounting obligations) |
| Device-local preferences and tokens | Until you uninstall the app or sign out |
After the applicable retention period, data is deleted or anonymised so it can no longer be attributed to you.
You have the right to:
You have the right to:
Submit a request by email to 37600daniil@gmail.com with the subject line "Privacy Request". We will respond within 30 days. For complex requests, we may extend this period by a further 60 days (with notice).
You can also edit your name via the Profile screen in the app, and you can delete your account by contacting us.
We implement the following technical and organisational measures to protect your data:
No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.
The GRATS app is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided us with personal data, please contact us at 37600daniil@gmail.com and we will delete such data promptly.
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this document. For material changes, we will notify you via an in-app notice or email. Your continued use of the app after such notification constitutes acceptance of the updated policy.
If you have any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact:
Danylo Puchka
Email: 37600daniil@gmail.com
We aim to respond to all privacy-related enquiries within 30 days.