Privacy Policy
This policy explains what data Grindful collects, why, who we share it with, and the rights you have. It covers the Grindful website (grindful.app), the web app (play.grindful.app) and the Grindful mobile app.
1. Who we are
Grindful is operated by Ahmad Ayyad, a sole proprietor based in Amman, Jordan (“Grindful”, “we”, “us”). Ahmad Ayyad is the controller of your personal data. For any question about your data, or to exercise your rights, email info@grindful.app.
2. What we collect
- Account details: your email address, your name, a username, and a password — stored only as a salted hash, never in readable form. If you sign in with Google, we receive your email address and name from Google.
- Content you create: tasks, habits, goals, routines, journal entries (including gratitude notes and answers to journal prompts), mood entries, prayer logs, book-tracker notes, characters, and buddy and team-goal information. This exists only if you create it.
- Technical data: a sign-in token, stored on your own device — in your browser’s local storage on the web, and in secure storage on mobile. Our servers set no cookies. When your device contacts our servers, its IP address appears in our server logs.
- Payment data: if you subscribe, PayPal handles the payment. We receive your PayPal account email and an internal reference that links the subscription to your account. We never see or store your card details.
Sensitive data
Prayer tracking records religious observance, which Jordan’s Personal Data Protection Law and other laws treat as a special category of data. A prayer entry exists only once you log it. We use it solely to show you your own tracking and streaks; we never send it to the AI features, and it is not shared with other users.
3. Why we use your data
- To run your account and store the content you create.
- To run an AI feature when you choose to use it (see section 4).
- To send essential account emails — password-reset and account-verification codes.
- To bill you if you subscribe to Premium.
- To show ads to users on the free tier (see section 6).
Under Jordan’s Personal Data Protection Law, we rely mainly on your consent — given when you create an account and when you switch on an optional feature — and on providing the service you asked for. You can withdraw consent at any time (see section 9).
4. Artificial-intelligence features
Grindful has six optional AI features: character generation, goal breakdown, quick capture, calendar extraction, habit replacements, and a weekly coach. Each one runs only when you trigger it, and every result is shown to you to review before anything is saved.
When you use an AI feature, the text it needs is sent to our AI provider, DeepSeek, which generates the result on our behalf and may process and store it on servers in the People’s Republic of China. We send only what the feature needs — for example the goal title you want broken down, or, for the weekly coach, figures our own server has already calculated (completions, streaks, average mood, word counts).
Your journal text is sent only for the weekly coach, and only if you switch on “AI insights from my journal” in Settings — a switch that is off by default. Even then, at most your five most recent entries are sent, each trimmed to 280 characters. We never send the AI your name, email address, account identifiers, prayer logs, mood notes, or gratitude entries.
5. Who we share data with, and international transfers
We do not sell your data. We share it only with the providers that make Grindful work:
| Provider | What they handle | Where |
|---|---|---|
| Contabo GmbH | Hosting our servers and database | European Union |
| DeepSeek | AI-feature processing (only when you use an AI feature) | China |
| PayPal | Subscription payments | United States and global |
| Google sign-in; Google Calendar sync if you connect it; ads on the free tier | United States and global | |
| Brevo | Sending account emails (reset and verification codes) | European Union |
| Mailgun | Receiving email sent to info@grindful.app | United States |
These providers operate outside Jordan, including in countries that may give your data a different level of protection than Jordan does. Using Grindful therefore involves transferring your data abroad, and by creating an account and using these features you consent to those transfers. For optional features (AI, Calendar), the related transfer happens only if you use them.
6. Advertising
Grindful’s free tier is supported by ads; Premium removes them. On the web we use Google AdSense, and on mobile Google AdMob.
- Third-party vendors, including Google, use cookies to serve ads based on your prior visits to Grindful and other websites.
- Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visits to Grindful and/or other sites.
- You can opt out of personalised advertising in Google’s Ads Settings at adssettings.google.com. You can also opt out of a third-party vendor’s use of cookies for personalised advertising at aboutads.info/choices.
- On mobile, ads may use your device’s advertising identifier. On iOS you are asked whether to allow tracking, and you can decline.
7. Cookies and on-device storage
Grindful’s own servers set no cookies. To keep you signed in and remember your preferences, the app stores data on your own device: your sign-in token (browser local storage on the web, secure storage on mobile); your theme, style and display preferences; and, on the web, any background video you upload and any books you add to the book tracker — held in your browser and never uploaded to us. Third-party cookies come only from Google: from the Google sign-in script the app loads, and from Google ads on the free tier (see section 6).
8. How long we keep your data
We keep your account and its content for as long as your account exists. When you delete something in the app, or ask us to delete your account, we mark it deleted and stop using it; a full purge from our systems is a manual step we carry out on request. Our error logs are kept for about two weeks. We do not keep long-term backups. To have your data deleted, email info@grindful.app.
9. Your rights
Under Jordan’s Personal Data Protection Law you can ask us to:
- access the data we hold about you;
- correct or update it;
- restrict or object to how we use it, including any profiling;
- delete or anonymise it;
- receive a copy to move to another service.
You can withdraw a consent you have given at any time, and we will tell you if a breach affects your data. Exercising any of these rights is free and will not disadvantage you. Today, account deletion and data export are handled by request rather than a button in the app — email info@grindful.app and we will action it.
10. How we protect your data
Traffic runs over HTTPS. Passwords are stored only as hashes. You can turn on two-factor authentication. Google Calendar tokens are stored encrypted. No system is perfectly secure, but if a breach affects your personal data we will notify you and Jordan’s Personal Data Protection Unit as the law requires, within 72 hours of becoming aware where that applies.
11. Children
Grindful is for people aged 13 and over. If you are under 18, you may use it only with a parent’s or guardian’s permission. We do not knowingly collect data from children under 13; if you believe a child under 13 has given us data, email info@grindful.app and we will remove it.
12. Changes to this policy
We may update this policy. The date at the top shows when it last changed. If we make a material change we will make it prominent on the site; significant changes take effect when posted, and continuing to use Grindful after that means you accept them.
13. Complaints
If you are unhappy with how we handle your data, please email info@grindful.app first so we can put it right. You also have the right to complain to Jordan’s Personal Data Protection Unit at the Ministry of Digital Economy and Entrepreneurship (MoDEE). Making a complaint will not disadvantage you with us.
14. Contact
Grindful — Ahmad Ayyad
Amman, Jordan
info@grindful.app