Privacy notice

In effect from 26 September 2026.

In short: your health data is kept in your own Google account and on your device. We never receive it. All we process is what signing in needs, and ordinary server logs.

Who is responsible

Skantze Development AB, company registration number 559436-7285, Terrassvägen 15, 131 41 Nacka, Sweden. Email: privacy@skantze.org. We are the controller for the data described under "What we process".

Where your data is

• In your Google Drive: what you record in Gradus (injuries, programmes, sessions, pain, medication, notes) is saved in a folder named Gradus.
• On your device: a copy of the same data, so Gradus works at once and without a connection, and a key that keeps you signed in.
• In your Google Calendar, if you turn reminders on: a calendar named Gradus, with the time, the programme's name, the exercises, and a link to Gradus.

Drive and Calendar are covered by your own agreement with Google and Google's terms. You control them in your Google account.

What Gradus can access in your Google account

• Only the files in your Drive that Gradus created itself, not your other files.
• Only the calendars Gradus created itself, not your other calendars. Calendar access is asked for only when you turn reminders on.
• Your name, which Gradus shows in the app.

This data is used only in the app, to show and save what you record. Gradus's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What we process

• Signing in. When you sign in, and about once an hour after that, the app gets access from Google through our server. The request carries a sign-in key that the server passes on to Google and back. It is not stored and never logged. Legal basis: providing the service you asked for (Article 6(1)(b) GDPR).
• Server logs. Our website (Firebase Hosting) and our sign-in server (Google Cloud Run, in Finland) record IP address, time, and the address requested. No health data and no keys. The logs are kept for 30 days and used to run and protect the service. Legal basis: legitimate interest (Article 6(1)(f)).

Google Cloud is our processor. Data may pass through Google's servers in the United States, under the EU–US Data Privacy Framework.

Beyond this we process nothing: no accounts with us, no statistics on how you use the app, no tracking cookies, and no scripts from anyone else.

Storage on your device

Gradus stores data in the browser's storage on your device, only so that the service you asked for works. This needs no consent (Swedish Electronic Communications Act, chapter 9, section 28). When you sign out, the data is removed from the device and Gradus's access to your Google account is revoked.

Deleting your data

• Delete the Gradus folder in your Google Drive, and the Gradus calendar in your Google Calendar.
• Remove Gradus's access to your account at myaccount.google.com/permissions.
• Sign out of Gradus on each device.

With us there is nothing more to delete than the server logs, which are removed after 30 days.

Your rights

You have the right to know what data we process about you, to have it corrected or erased, and to object to processing based on legitimate interest. Write to privacy@skantze.org. You can also complain to the Swedish Authority for Privacy Protection (IMY), imy.se.

Changes

If anything changes in how we process data, we update this page and the date at the top.