Privacy Policy

Gearstack, obrt za računalno programiranje i usluge, vl. Kristijan Bezjak
Zagreb, Lučko, Ježdovečka ulica 2A/1
Email: privacy@gearstacklabs.com

a) Account data: Name, email address at registration.

b) Health data (Apple HealthKit): Heart rate, HRV (RMSSD), sleep stages (Deep/REM/Light), steps, SpO2, body temperature, respiratory rate, ECG classification. Analysis scores are computed on your device (on-device ML). For synchronization across your devices, health data is additionally processed in encrypted form in our Firebase database (EU). Legal basis: your explicit consent (Art. 9(2)(a) GDPR), which you can withdraw in the app at any time.

c) Usage data: Anonymized app usage statistics via Firebase Analytics (can be disabled).

d) Crash reports: Anonymized technical error reports via Firebase Crashlytics.

e) Data for optional cloud AI: Only after your explicit consent, the app assembles the data required for an AI feature that you start: your text input; a photo only when you personally select an AI photo scan; and the context required for the specific request, such as age, weight, goals, sleep, HRV, resting heart rate, activity, workouts, symptoms, and meals. This data comes from your direct input, photos you select, and profile, HealthKit, and app data that you previously entered or allowed Gearstack to access. No data is sent to cloud AI without valid consent.

Gearstack uses 3 CoreML models that run entirely on your iPhone. These ML analyses run entirely on the device; sync and the AI coach use the cloud services described in section 4. The models compute:

• Recovery classification (HRVClassifier)
• Stress level (StressClassifier)
• Sleep quality score (SleepQualityRegressor)

Firebase (Google): Authentication, Firestore database for device sync. Location: EU (europe-west3, Frankfurt). Processor agreement per Art. 28 GDPR.

Optional cloud AI (recipient and purposes): If you give explicit consent, Gearstack sends the data described in section 2(e) to Google LLC through Google Cloud, Vertex AI, and Gemini. Google processes the data as our processor solely to produce the coach response you requested, recognize a meal or exercise when you start that scan, or provide a personalized recommendation you requested. The specific request is processed through a configured Google Cloud/Vertex AI region; operational processing may also take place outside the EU under the Google Cloud terms. Where required, we rely on appropriate safeguards such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

Consent and protection: Consent is optional, explicit, and tied to the version of this disclosure shown to you. You may decline; no data will then be sent to cloud AI and only the cloud-AI features will be unavailable. If the consent disclosure changes, we ask again. You can withdraw your decision at any time under Profile → Privacy. Withdrawal stops future transfers. We contractually require Google, as our processor, to provide the same or equivalent protection as this privacy policy and applicable data-protection requirements. Under the Google Cloud terms, Google does not use customer data to train or fine-tune AI/ML models without prior permission or instruction; technically necessary logging for security and abuse detection may occur under the then-current Google Cloud terms.

RevenueCat: Subscription management. Processes only purchase transactions, no health data.

Legal bases: performance of contract (Art. 6(1)(b) GDPR) for account, sync and subscription; explicit consent (Art. 6(1)(a) and, where health data is involved, Art. 9(2)(a) GDPR) for cloud-AI processing.

Gearstack stores no health data in iCloud. All data stays local on the device or in the Firebase database (EU servers).

Hosting: This website is operated on Cloudflare, Inc. (USA). Technically required server logs (IP address, timestamp, browser type) are processed when you visit. Legal basis: legitimate interest in secure operation (Art. 6(1)(f) GDPR); transfer to the USA based on the EU-US Data Privacy Framework.

Cookies & tracking: Technically required storage (e.g. your cookie choice, language) happens without consent (ePrivacy rules). Analytics tools (Google Analytics 4, Meta Pixel) are only loaded after your consent (Art. 6(1)(a) GDPR). You can change or withdraw your choice at any time via "Cookie settings" in the footer.

Ads in the blog (Google AdSense): We display ads via Google AdSense in our blog articles; the provider for users in the EEA is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. No ads run on the home page or on the product and pricing pages. AdSense sets cookies and similar technologies to serve ads, measure their performance and detect abuse; your IP address, device and usage data may be processed and transferred to Google LLC in the USA (EU-US Data Privacy Framework). This only happens after your explicit consent to the "Ads in the blog" category (Art. 6(1)(a) GDPR). Without that consent no AdSense script is loaded. You can withdraw your consent at any time via "Cookie settings" in the footer; the lawfulness of processing before withdrawal is unaffected. More information: Google – How Google uses data from ads. You can additionally turn off personalised advertising in your Google ad settings.

You have the right to:

• Access (Art. 15) - what data we have about you
• Rectification (Art. 16) - correct inaccurate data
• Erasure (Art. 17) - delete all data ("right to be forgotten")
• Data portability (Art. 20) - export as PDF/JSON
• Objection (Art. 21) - restrict processing
• Withdraw consent (Art. 7(3)) - at any time with effect for the future

Requests to: privacy@gearstacklabs.com

Right to lodge a complaint (Art. 77): you can complain to a data protection authority, e.g. the Croatian supervisory authority AZOP (azop.hr) or the authority where you live.

All data transfers use TLS 1.3 (HTTPS). Health data in the Firebase database is encrypted with AES-256. Access controls ensure only you can access your data.

Account data: until account deletion. Health and app data: until you delete the relevant entry or your account, unless a shorter technical period applies or retention is required by law. Anonymized analytics: 14 months (Google Analytics standard).

Cloud-AI data: An AI request is processed to generate the response you requested. If you save a result as a chat, meal, scan, workout, or other app entry, that entry remains in your Gearstack account until you remove it using the available delete function or delete your account. Under the then-current service terms and selected service configuration, Google Cloud may log requests, responses, or technical metadata for a limited period for security and abuse prevention. Withdrawing consent under Profile → Privacy stops new transfers to cloud AI; it does not retroactively erase completed processing or entries that you chose to save. When you delete your account, Gearstack removes account-linked data from the active systems we control; technically necessary backups or logs may remain until scheduled overwrite or for as long as legally required. You can also send deletion requests to privacy@gearstacklabs.com.