GroundWork
privacy policy
GroundWork keeps what you log so that you, and a coach you choose, can use it. We do not sell it, show ads, or share it with anyone for their own purposes.
Who we are
GroundWork is run by Bod By Shaad LLC, 71 Industrial Blvd, New Castle, DE 19720 ("we", "us"). We decide what the app collects and how it is used, so we are responsible for your information under data-protection law.
Questions, requests and complaints: contact@bodbyshaad.com. We answer within 30 days.
This policy covers the GroundWork app on iPhone and Android. It takes effect on October 14, 2026.
What we collect
Account
Email address, password (stored only as a one-way hash), name, whether you coach or train, units, time zone
Required? = Yes, except for a guest account, which has no email or password
Profile
Profile picture, short bio
Required? = No
Getting started
Why you joined (and anything you typed under Other), date of birth, height, weight; for coaches, roughly how many clients you have
Required? = Only your name and role
Training
Programs, workouts, sessions, every set's weight, reps, effort, distance and time, personal records, goals, notes
Required? = No. If you choose to submit an exercise to the shared library, other GroundWork users can see and use it, and it is not shared anywhere else.
Body measures
Weight, body-fat percentage, body measurements, notes
Required? = No
Food
Food diary, meal times and reminders, meals marked as eaten, favorite foods, nutrition targets, meal plans, barcodes you scan
Required? = No
Messages
Messages between you and your coach or client, and the photos sent in them
Required? = No
Appointments
Session times, place, title and notes
Required? = No
Calendars
The address of an outside calendar you link, and the busy times and event titles we read from it
Required? = No
Things you share
Exercises and foods you submit to the shared library, pictures and demo videos, posts, comments and votes on the feedback board
Required? = No
Invites
The email address a coach enters to invite a client
Required? = No
Text reminders
The mobile number a coach enters for a client who does not use the app, whether and when that client agreed to text reminders, and any request to stop them
Required? = No. Only if a coach adds the number and the client replies YES
Notifications
A push token for your device, the device type, and your notification settings
Required? = Only if you allow notifications
Crash reports
What went wrong, the screen, app version, device model and operating system, and your account's ID number
Required? = Sent automatically when the app fails
What we deliberately do not collect:
Your location. The app never asks for it.
Camera pictures. The camera is used only to read a barcode on a food packet. The picture never leaves your device; only the barcode number does.
Your photo library. We receive only the pictures and videos you pick.
Advertising or tracking IDs. The app has no ads and no analytics tools, and does not track you across other apps or websites.
Your IP address or email in crash reports. We switch both off.
What we use it for
We use your information to run the app for you, and for nothing that works against you. Where the law asks us to name a legal basis, it is given after each use:
USe:
Showing you your training, food, measures, goals and history, and keeping them in step across your devices
Legal Basis:
Our agreement with you (the terms of use)
USe:
Showing that information to a coach you connect with, and letting them plan, log and message for you
Legal Basis:
Our agreement with you, and your consent, which you give by connecting
USe:
Holding health-related information: weight, body fat, measurements, food, training and date of birth
Legal Basis:
Your explicit consent, given when you enter it. You can withdraw it by deleting that information or your account
USe:
Sending the reminders and notifications you have switched on, by push or email
Legal Basis:
Our agreement with you; you choose which in Settings
USe:
Texting session reminders, a day and an hour before, to a client who does not use the app
Legal Basis:
Your consent, given by replying YES to our first text. Reply STOP at any time to withdraw it
USe:
Finding and fixing crashes, keeping accounts secure, and stopping misuse
Legal Basis:
Our legitimate interest in an app that works and is safe
USe:
Reviewing exercises and foods submitted to the shared library before others can see them
Legal Basis:
Our legitimate interest in a library people can trust
USe:
Counting, in totals only, why people join and how many coaches and members there are
Legal Basis:
Our legitimate interest in improving the app. No person is identified in these counts
USe:
Answering you, and meeting legal obligations
Legal Basis:
Our legitimate interest, or the law
Who can see it
By default, only you. The database itself enforces this: each row is checked against who is asking, so one account cannot read another's records through the app or by calling our servers directly.
A coach you connect with. While you are connected, your coach can see your profile, training, body measures, food diary, meal times, goals, appointments and your messages with them. They can also plan, log sessions, set goals and targets, and assign meal plans for you. You can stop working with a coach at any time under Settings, then Your trainer, then Leave, and the coach can remove you. Either way they lose access to all of it at once, the program and meal plan they gave you end, and what you recorded stays in your account.
A profile a coach keeps for you. A coach can set up a profile for someone who has no account yet and record their sessions on it. That profile belongs to the person, not the coach. They can take it over with an invite from the coach, and keep it if the coach later removes them. If a coach has kept a profile about you and you want it deleted, write to us.
Other members. Your name and picture are shown only to people you coach or are coached by. Posts and comments on the feedback board are seen by everyone signed in, with your first name and whether you coach, unless you post anonymously. Your votes are private; others see only the total. Once approved, an exercise or food you submit can be seen and used by everyone, without your name.
Our reviewers. A small number of people who run GroundWork can see account details: name, email, when you joined, who coaches whom, and how many clients a coach has. They also check submitted exercises and foods, and manage the feedback board. The app gives them no view of anyone's sessions, meals, measures or messages. Our staff reach that information only to fix a fault you report, to investigate misuse, or because the law requires it.
Anyone with your calendar link. If you turn on the calendar feed, anyone holding its private address can see your session times, and the other person's name unless you switch names off. Treat the address like a password; you can turn the feed off in Settings, which stops the link working.
Others, only when required. We disclose information if the law requires it, to protect someone's safety, or to the new owner if GroundWork is sold or merged. In a sale, this policy would continue to apply to your information.
Text-message reminders
A coach can add the mobile number of a client who does not use the app, so that the client is reminded of their sessions by text.
We text that number once, asking the client to reply YES. No reminder is sent unless they do.
Reminders come a day and an hour before each session with that coach. How many you get depends on how often you train. Message and data rates may apply.
Reply STOP to any text to stop them all, or HELP for help. You can also ask your coach, or email contact@bodbyshaad.com.
Telnyx sends the texts for us and receives only the number and the message.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the categories of sharing in this policy exclude text-messaging originator opt-in data and consent; this information will not be shared with any third parties.
Services we use
Supabase
What it does for us: Hosts the database, sign-in, stored pictures and videos, and our server code
What it receives: Everything in your account
Expo
What it does for us: Sends push notifications
What it receives: Your device's push token and the notification's text
Apple & Google
What it does for us: Deliver push notifications to iPhones and Android phones
What it receives: Your push token and the notification's text
Resend
What it does for us: Sends emails: sign-in and password-reset codes, and reminders you turn on
What it receives: Your email address and the email's text
Telnyx
What it does for us: Sends text-message session reminders
What it receives: The client's mobile number and the reminder's text
Sentry
What it does for us: Collects crash reports
What it receives: The crash details listed under What we collect; no email or IP address
Open Food Facts
What it does for us: Supplies product details for a barcode our food list does not have
What it receives: The barcode number only, sent from our server, not linked to you
jsDelivr
What it does for us: Serves pictures in the exercise library
What it receives: Your device's IP address, as any website would
Your calendar provider
What it does for us: Supplies the calendar you chose to link
What it receives: A request from our server for the address you gave
How long we keep it, and deleting your account
We keep your information for as long as you have an account, so your history is there when you come back. Deleting the account deletes it.
Deleting your account. Go to Settings, then Delete account, or email contact@bodbyshaad.com from the address on the account. This removes your account, profile, training, body measures, food records, goals, appointments, messages, pictures, videos, push tokens and calendar links straight away. Copies in our backups are gone within 30 days.
A few things are kept, without your name:
Feedback board posts and comments stay, so replies still make sense, but no longer show who wrote them.
An exercise or food that was approved into the shared library stays there for everyone, as it already carries no name.
If you coach, deleting your account ends every coaching connection. Your clients keep their accounts and everything they recorded, including sets logged against your own exercises, which become their own copies. Profiles you kept for clients who never claimed them are deleted, because nobody else could reach them.
Guest accounts have no email or password. Signing out of one deletes it and everything in it, and it cannot be recovered.
Other records. Crash reports are deleted by Sentry after 90 days. Email delivery records are kept by Resend for 30 days. We keep anything longer only if the law requires it.
Your choices and rights
Most of these you can do yourself in the app. For the rest, email contact@bodbyshaad.com; we may ask you to confirm it is your account, and we answer within 30 days, free of charge.
See and correct your information: everything you entered can be viewed and edited in the app.
Get a copy of your information in a file you can take elsewhere: ask us.
Delete your information or your whole account: see the section above.
Withdraw consent for health-related information by deleting it. This does not affect what was done before.
Turn off notifications by type and by push or email in Settings, or for push in your phone's settings.
Stop text reminders by replying STOP to any of our texts. Reply START to have them back.
Object or ask us to limit how we use your information, where the law gives you that right.
Complain to a data-protection authority, such as the one where you live. We would like the chance to fix it first.
Depending on where you live, for example the UK, the EU or a US state such as California, you may have further rights. We give them to everyone, wherever you live. We do not sell or "share" personal information as California law defines it, and we do not use it for targeted advertising.
Children
GroundWork is not for anyone under 16. We do not knowingly hold information about a child under that age. If you believe we do, email us and we will delete it.
Security
Information travels between the app and our servers encrypted, and is stored encrypted. Every record is checked against who is asking before it is returned. On a phone, your sign-in is kept in the device's secure storage. No system is perfectly secure; if a breach puts your information at risk, we will tell you and the authorities as the law requires.
Where your information is stored
Our servers are in the United States. If you live elsewhere, your information is transferred there. Where the law requires it, we rely on safeguards such as the European Commission's standard contractual clauses with the services listed above.
Changes to this policy
If we change this policy, we will update the date at the top. If a change affects what we collect or who can see it, we will tell you in the app before it takes effect.