Privacy policy

Last updated: 22 October 2026

Who we are

Grambit is operated by the Grambit team in Singapore ("we", "us"). We are responsible for the personal data described here in accordance with Singapore's Personal Data Protection Act (PDPA). For any privacy question or request, email our data protection contact at [email protected].

What we collect on this website

• Your email address, when you sign up for the beta. We also record which sign-up form you used.
• Basic technical data, such as your IP address and browser type. Our hosting infrastructure records this automatically to maintain server security and availability. Your browser also contacts Google Fonts to load typefaces, which shares your IP address with Google.

We do not use advertising cookies, tracking pixels, or third-party trackers.

Why we use it

• To invite you to test Grambit through Apple's TestFlight.
• To send you occasional updates about Grambit and its launch.
• To verify your qualification for the beta thank-you offer (2 years free) and deliver it.
• To reply when you contact us.

By signing up, you agree to our use of your email for these purposes. You can withdraw your agreement at any time (see "Your choices" below).

Who we share it with

We share your email only with trusted service providers necessary to provide the services above:

• Form and API hosting, to securely receive and process sign-up requests.
• Transactional email providers (Resend and Apple iCloud Mail), to deliver sign-in magic links and beta invitations.
• Apple, when we invite you to TestFlight. Apple processes your email under its own privacy policy.
• Website hosting (Cloudflare and GitHub), to serve and protect the website.

We never sell your data or share it with third parties for marketing or advertising purposes.

Data stored outside Singapore

Some of our infrastructure providers may process data outside Singapore (for example, in the United States or the European Union). We select providers that uphold data protection standards comparable to Singapore's Personal Data Protection Act (PDPA) and international security baselines.

How long we keep it

We keep your email until the beta thank-you offer has been sent, or until you ask us to delete it, whichever comes first. If you choose to continue receiving product news after launch, we keep your email until you unsubscribe.

Your choices

• Unsubscribe or withdraw consent: email [email protected], or click the unsubscribe link in any email update.
• Access or correct your data: email us and we will provide your stored data or update any inaccurate records.
• Delete your data: email us and we will delete your records promptly.

We respond to all verified privacy requests within 30 days.

The Grambit app

• Your account: To use cloud sync and backup, you sign in using your email address (via secure one-time code / magic link). Optional Sign in with Apple will be supported in future releases. We never see or store your Apple account password.
• What we store: Your diary entries, custom foods, nutritional targets (calories, protein, carbs, fat), custom meal sections, day templates, and display preferences. All records are stored locally on your iPhone first (offline-first) and securely synced to our cloud database (Supabase, hosted in the Singapore region, AWS ap-southeast-1).
• Why: Strictly to provide app functionality: to automatically back up your food diary, keep your targets in sync, and allow seamless restoration if you switch devices. We do not sell your data or use it for advertising or third-party profiling. Your personal food diary is strictly private and is never visible to other users.
• Security: All network communication uses Transport Layer Security (TLS 1.3 / HTTPS). Data stored in the cloud is encrypted at rest and protected by database Row-Level Security (RLS), meaning your account can only ever query or modify its own data.
• Food lookups: When you search for a food or scan a barcode, the query or barcode is checked against Grambit's food database and public nutrition datasets (Open Food Facts, USDA FoodData Central). Your personal diary and identity are never transmitted with food lookups.
• Shared food labels: When you scan a new packaged food or enter verified nutrition information, the product's barcode, brand, and nutrition facts are contributed to Grambit's shared food catalog so other users can scan that product too. Your identity, email, and personal diary entries are never associated with shared catalog items. If you submit a photo of a nutrition label for verification, it is securely stored in Grambit's private cloud bucket to verify numerical accuracy, and is automatically deleted once verified (or after 90 days at the latest).
• Account deletion: You can permanently delete your account and all associated cloud data at any time directly inside the app under Account → Delete account. Deletion from our cloud database is executed immediately upon confirmation. Local data on your iPhone is removed when you delete the app or tap Delete all data.
• No advertising: Grambit contains zero third-party advertising, zero advertising SDKs, and zero tracking pixels.

If we add features that share anything else with other people, such as groups, we will update this policy and ask for your agreement first.

Age

The Grambit beta is for adults aged 18 and over. We do not knowingly collect data from anyone younger.

Security

We limit access to your email to the people who run Grambit and use services with standard security protections. No online service is perfectly secure. If a breach affects you, we will tell you as the law requires.

Changes to this policy

If we change this policy, we will update the date at the top. If a change affects how we use your email, we will tell you by email first.