Privacy Policy
1.Who we are
Girder Labs Ltd (“Girder Labs”, “we”, “us”, “our”) is a software studio registered in England & Wales. We design, build and operate our own applications. We are the data controller for the personal data described in this policy.
- Company: Girder Labs Ltd, registered in England & Wales (company number 17275076).
- Registered office: London, United Kingdom.
- Data protection contact: girderlabs@outlook.com
- ICO: we are registering with the UK Information Commissioner’s Office; our registration reference will appear here once issued.
2.The data we collect
Depending on which product you use, we may collect:
- Account data — name, email, and authentication details (passwords are stored hashed, never in plain text).
- Profile & app data — settings, preferences, and content you create.
- Health & fitness data (ForgeFit) — workouts, programmes, and progress you choose to enter. Some of this may be “special category” health data, which we process only with your explicit consent.
- Earnings data (TrueShift) — figures you enter to calculate take-home pay; processed on your device wherever possible.
- Payment data — handled by our payment providers (Stripe, Apple, Google). We never store full card numbers.
- Technical data — device type, app version, IP address, and log, diagnostic and basic usage data.
- Communications — messages you send us.
3.How and why we use it
We process personal data on these lawful bases under the UK GDPR:
- To provide and operate the apps and your account — performance of a contract.
- To process subscriptions and payments — contract / legal obligation.
- To provide health & fitness features in ForgeFit — your explicit consent (Article 9).
- To provide AI-assisted features — see section 4; legitimate interests and/or consent.
- To secure, debug and improve our products and prevent abuse — legitimate interests.
- To comply with legal obligations — legal obligation.
- For marketing, if any — only with your consent, which you can withdraw anytime.
4.AI-assisted features
Some features use third-party AI providers (currently Anthropic). When you use an AI feature, the relevant inputs are sent to the provider to generate a response. We do not sell your data, and we do not permit our AI providers to use your personal data to train their models. We minimise what is sent and, where feasible, avoid sending directly identifying information.
5.Sharing & sub-processors
We don’t sell your personal data. We share it only with service providers who process it on our behalf under contract:
- Supabase — database, authentication and storage
- Stripe — payment processing
- Apple / Google — app distribution and in-app purchases
- Anthropic — AI features
- Vercel — website and app hosting
Some providers are located outside the UK/EEA. Where that happens, we rely on appropriate safeguards such as the UK International Data Transfer Addendum or EU Standard Contractual Clauses.
6.Cookies & analytics
Our website uses only essential cookies by default. If we introduce analytics, we’ll keep it privacy-respecting and ask for your consent where required.
7.Data retention
We keep personal data only as long as needed to provide the service and meet legal, accounting or reporting requirements. When you close an account, we delete or anonymise your data within a reasonable period unless we’re required to retain it by law.
8.Your rights
Under the UK GDPR you can: access your data; correct it; delete it; restrict or object to processing; request portability; and withdraw consent at any time. To exercise a right, email girderlabs@outlook.com. You also have the right to complain to the ICO (ico.org.uk) — though we’d appreciate the chance to put things right first.
9.Children
Our apps are intended for adults and are not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we’ll remove it.
10.Security
We use industry-standard measures — encryption in transit, access controls, hashed credentials and rate limiting — to protect your data. No system is perfectly secure, but we take protection seriously and will notify you and the ICO of any breach where the law requires.
11.Changes to this policy
We may update this policy. We’ll post the new version here and update the date above; material changes will be highlighted.
12.Contact
Questions about your privacy? Email girderlabs@outlook.com.