G BotG Bot – Privacy Policy
Apple Watch companion app for chatting with Grok · Effective date: [launch date] · Version Draft v0.3 (24 October 2026)
Item | Details |
App name | G Bot (watchOS app) |
Bundle identifier | G Bot for Apple Watch |
Data controller | Daniele Calabrese, individual (persona fisica) – same name as the App Store seller |
Address | Contrada Matarese 20, 87040 Luzzi (CS), Italy |
Privacy contact | |
Supervisory authority | Garante per la protezione dei dati personali (Italy) |
Table of Contents
7. International Data Transfers
15. Push Notifications and Device Permissions
Annex A – Apple App Privacy (Nutrition Label) Mapping
1. Introduction and Scope
This Privacy Policy explains how Daniele Calabrese, an individual (persona fisica) residing at Contrada Matarese 20, 87040 Luzzi (CS), Italy, whose name appears as the seller of the App on the App Store (“we”, “us”) collects and uses personal data when you use G Bot, our Apple Watch app for chatting with xAI’s Grok, together with its backend service “gbot-api” and any related website (the “App”). It is provided in accordance with Articles 13 and 14 of the EU General Data Protection Regulation 2016/679 (“GDPR”) and the Italian Personal Data Protection Code (Legislative Decree 196/2003, as amended by Legislative Decree 101/2018).
Independence from xAI G Bot is an independent, third-party app. It is not affiliated with, endorsed by or sponsored by xAI Corp. or its affiliates. When your prompts are forwarded to xAI, xAI processes them under its own terms and privacy policy, which we encourage you to read. |
2. Privacy at a Glance
Question | Short answer |
Do you sell my data? | No. We do not sell or rent personal data, and we do not share it for cross-context behavioural advertising. |
Do you track me across apps? | No. No advertising SDKs, no IDFA, no cross-app tracking. |
Where do my prompts go? | From your watch to our backend on Cloudflare Workers, then to the xAI API, using your own xAI API key, to generate a response. Voice is transcribed on your device, so no audio reaches our servers. |
Do you train AI on my chats? | No. We do not use your prompts or conversations to train models. |
How long do you keep chats? | We don’t keep them on our servers: your conversation history stays only on your device until you delete it or the App. xAI keeps prompts under its own policy. |
Can I delete my account? | Yes, directly in the App: Settings › Account › Delete account. |
Who regulates you? | The Italian data-protection authority, the Garante per la protezione dei dati personali. |
3. Data Controller
The controller responsible for your personal data is:
Role | Details |
Controller | Daniele Calabrese, individual (persona fisica) |
Represented by | Daniele Calabrese |
Registered address | Contrada Matarese 20, 87040 Luzzi (CS), Italy |
App Store seller name | Daniele Calabrese (Apple Developer Program, Individual enrolment) |
Privacy contact | |
Data Protection Officer | Not appointed (not required under Art. 37 GDPR) |
4. Personal Data We Collect
Category | Examples | Source |
Account data | Apple’s unique app-specific user identifier; name and email address if you choose to share them (email may be an Apple private-relay address); Sign in with Apple tokens. | You, via Sign in with Apple |
Prompts and voice input | Text you type, and the text of voice prompts. Voice is transcribed on your Apple Watch or iPhone by Apple’s on-device speech recognition; only the text is sent, and no audio reaches gbot-api. | You |
Conversation history | Your prompts, Grok’s responses, timestamps and conversation titles, stored only on your device (not on gbot-api). | You and xAI |
xAI access data | Your own xAI API key, stored only in your device’s Keychain. It is passed through gbot-api to xAI with each request and is never stored on our servers. | You |
Push notification data | APNs device token, notification preferences. | Your device / Apple |
Subscription data | StoreKit 2 transaction IDs, original transaction ID, product purchased, purchase and expiry dates, renewal status, App Store server notifications. We never receive your payment card details. | Apple |
Technical and log data | IP address, request timestamps, app and watchOS version, device model, error and crash information, security logs. | Your device; Cloudflare |
Analytics data | Aggregated usage statistics (e.g. feature use, request counts, latency and error rates) computed on our backend from requests the App already sends, with no device or advertising identifier and no cross-app tracking (see Section 16). | Your device |
Support communications | Messages and contact details you send us when you request support. | You |
We do not intentionally collect special categories of personal data (such as health data). Please avoid including sensitive information in your prompts; if you do, it will be processed only to answer your request.
5. Purposes and Legal Bases
Purpose | Data used | Legal basis (GDPR) |
Creating and managing your account; authentication | Account data | Art. 6(1)(b) – performance of a contract |
Sending prompts to xAI and returning responses | Prompts, voice input, xAI access data, technical data | Art. 6(1)(b) – performance of a contract |
Showing your conversation history (kept only on your device) | Conversation history | Art. 6(1)(b) – performance of a contract |
Sending push notifications | APNs token, preferences | Art. 6(1)(b) – performance of a contract (a feature you request). The system permission you grant is the device-access consent required by ePrivacy rules and can be withdrawn at any time in Settings |
Providing and verifying G Bot Pro subscriptions | Subscription data, account data | Art. 6(1)(b) – performance of a contract |
Accounting, tax and legal obligations | Subscription and transaction records | Art. 6(1)(c) – legal obligation |
Security, fraud and abuse prevention, rate limiting, debugging | Technical and log data | Art. 6(1)(f) – legitimate interests in keeping the Service secure and working |
Product analytics to improve the App | Analytics data | Art. 6(1)(f) – legitimate interests in understanding and improving the App, using aggregated server-side statistics with no device identifier; you can opt out at any time in the App under Settings › Privacy |
Responding to support requests | Support communications | Art. 6(1)(b) – performance of a contract (helping you use the App) |
Establishing or defending legal claims | Relevant records | Art. 6(1)(f) – legitimate interests |
Where we rely on legitimate interests, we have balanced those interests against your rights; you can object at any time (Section 10). Which data is mandatory (Art. 13(2)(e) GDPR): you are not legally obliged to provide any personal data to us. Providing account data (your Apple identifier), your prompts, the technical data needed to deliver requests and, for G Bot Pro, subscription data is a contractual requirement: without them we cannot provide the App or G Bot Pro. Your name and email (which Sign in with Apple lets you withhold or hide), push notifications and voice input are optional. Keeping transaction records is our own legal obligation. We do not carry out automated decision-making producing legal or similarly significant effects on you within the meaning of Article 22 GDPR.
6. Recipients
We share personal data only with the following recipients, and only as needed to provide the App. Our processors act under written data-processing agreements (Art. 28 GDPR); Apple and xAI act as independent controllers for their own services:
Recipient | Role | Purpose | Location / transfer mechanism |
Apple Inc. / Apple Distribution International | Independent controller for App Store, Sign in with Apple, StoreKit; provider of APNs | Authentication, push notifications, payments and subscription management | Ireland / USA – EU-U.S. Data Privacy Framework (Apple Inc. is certified), with Apple’s SCCs as a fallback |
Cloudflare, Inc. | Processor (Art. 28 GDPR) | Hosting and running gbot-api on Cloudflare Workers; storage in Workers KV and D1, encrypted at rest by Cloudflare; network security | Global edge network incl. USA – EU-U.S. Data Privacy Framework (Cloudflare, Inc. is certified), with the SCCs in Cloudflare’s DPA as a fallback |
xAI Corp. (and affiliates) | Independent controller. When you send a prompt, we forward it to xAI using your own xAI credentials; xAI processes it under its own Privacy Policy (x.ai/legal/privacy-policy) and retention, outside our control. You have your own account with xAI and pay xAI directly; your API key stays in your device’s Keychain. | Generating Grok responses to your prompts | USA – transfer made at your request, necessary to perform our service to you (Art. 49(1)(b) GDPR); no SCCs between us and xAI |
No third-party analytics provider | – | Not used: aggregated statistics are computed by us on gbot-api (Cloudflare) | Not applicable |
We may also disclose data where required by law or by a valid order of a public authority, to protect our rights or users’ safety, or to a successor in the event of a sale or reorganisation of the App (in which case this Policy will continue to apply).
7. International Data Transfers
Some recipients are located, or process data, outside the European Economic Area, in particular in the United States. Where a transfer is made to a country without an EU adequacy decision, we rely on the European Commission’s Standard Contractual Clauses (SCCs) (Commission Implementing Decision (EU) 2021/914), supplemented by additional technical and organisational measures where appropriate, such as encryption in transit (TLS) and data minimisation. Per recipient: for Apple Inc. and Cloudflare, Inc., which are certified under the EU-U.S. Data Privacy Framework, we rely on the Commission’s adequacy decision of 10 July 2023, with SCCs as a fallback; for a third-party analytics provider, if one is used and not hosted in the EU, we will rely on the DPF or SCCs as stated in Section 6. Transfers to xAI are not made under SCCs with us: they happen because you ask us to send your prompts to the xAI service you have chosen, which is necessary to perform our service to you (Art. 49(1)(b) GDPR). Please read xAI’s Privacy Policy for how xAI protects your data. You may request a copy of the relevant safeguards by contacting us.
8. Data Retention
Data | Retention period |
Account data | For as long as your account is active; deleted within 30 days of account deletion. |
Conversation history | Not stored on our servers. Kept only on your device until you delete a conversation or the App. |
Prompts in transit (not saved to history) | Processed transiently and not stored beyond the time needed to return the response. [PLACEHOLDER: CONFIRM] |
Data held by xAI | Under xAI’s own retention policy; we cannot delete it on your behalf. |
APNs device token | Until you disable notifications, the token becomes invalid, or you delete your account. |
Subscription and transaction records | For the duration of the subscription and then up to 10 years where required for accounting and tax purposes (Art. 2220 Italian Civil Code). |
Server and security logs | 30 days |
Analytics data | 24 months, in aggregated form only. |
Support communications | Up to 24 months after the request is resolved. |
After these periods, data is deleted or irreversibly anonymised, unless we must keep it longer to comply with a legal obligation or to establish, exercise or defend legal claims.
9. Account Deletion
You can delete your account at any time from within the App, as required by Apple’s App Store Review Guidelines: Settings › Account › Delete account. When you delete your account, we:
- delete your account record and push tokens from gbot-api (your conversation history and xAI API key are stored only on your device and are removed when you delete the App);
- revoke your Sign in with Apple tokens using Apple’s REST API, so the App no longer has access to your Apple account;
- remove any data linked to your account from our logs and statistics (our aggregated analytics contain no account or device identifiers);
- keep only records we are legally required to retain (for example, transaction records for tax purposes).
Deletion is completed within 30 days, and residual copies in backups are overwritten within 30 days. Deleting your account does not cancel your App Store subscription – cancel it in your Apple ID Account Settings. You can also request deletion by emailing privacy@grokwatch.app .
10. Your Rights
Under the GDPR you have the following rights, subject to the conditions and exceptions set out in the law:
Right | What it means |
Access (Art. 15) | Obtain confirmation of whether we process your data and a copy of it. |
Rectification (Art. 16) | Have inaccurate or incomplete data corrected. |
Erasure (Art. 17) | Have your data deleted, including by deleting your account in the App. |
Restriction (Art. 18) | Ask us to limit processing in certain circumstances. |
Data portability (Art. 20) | Receive data you provided in a structured, machine-readable format, e.g. an export of your conversation history. |
Objection (Art. 21) | Object at any time to processing based on legitimate interests, including analytics. You can also switch analytics off directly in the App’s settings, and we will stop including your usage in our statistics. |
Withdraw consent (Art. 7(3)) | Withdraw consent (e.g. for notifications) at any time, without affecting earlier processing. |
Complaint (Art. 77) | Lodge a complaint with a supervisory authority (Section 11). |
To exercise your rights, contact privacy@grokwatch.app . We will respond within one month, extendable by two further months for complex requests, and may need to verify your identity, for example by asking you to confirm the request from within the App. If you are a minor, these rights may be exercised on your behalf by a parent or guardian with parental responsibility.
11. Supervisory Authority
If you believe our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the Italian supervisory authority:
Authority | Details |
Name | Garante per la protezione dei dati personali |
Address | Piazza Venezia 11, 00187 Roma, Italy |
Website |
You may also complain to the supervisory authority of the EU Member State where you live or work, or where the alleged infringement took place. We would appreciate the chance to address your concerns first.
12. Children
The App is not directed at children. G Bot is rated 17+ on the App Store and is intended for users aged 17 and over. Where we rely on consent for users in the EEA, the UK or Switzerland, you must have reached the age of digital consent in your country (14 in Italy under art. 2-quinquies of Legislative Decree 196/2003; for example 16 in Germany or Ireland, 15 in France, 13 in Belgium, Denmark or the UK); below that age, a parent or guardian must consent. Purchases of G Bot Pro by anyone under 18 require the authorisation of a parent or guardian. You must also meet xAI’s own minimum-age requirements for Grok. We do not knowingly collect personal data from children below these ages. If you believe a child has provided us with personal data, contact us and we will delete it. Parents or guardians may exercise the rights in Section 10 on behalf of a minor.
13. No Sale of Personal Data
We do not sell, rent or trade your personal data, and we do not “share” it for cross-context behavioural advertising as those terms are defined under U.S. state privacy laws such as the California Consumer Privacy Act. We do not use advertising identifiers, we do not track you across other companies’ apps or websites, and we therefore do not request App Tracking Transparency permission.
14. Security
We use appropriate technical and organisational measures to protect personal data, including encryption in transit (TLS), encryption at rest of data stored in Cloudflare Workers KV and D1 (provided by Cloudflare), storage of your xAI API key only in the device Keychain, access controls limited to the people who need them, and the security features of Cloudflare’s platform. No system is completely secure; if a personal-data breach occurs, we will notify the Garante and, where required, affected users in accordance with Articles 33 and 34 GDPR.
15. Push Notifications and Device Permissions
The App asks for permission before sending notifications and before using the microphone or speech recognition for voice prompts. You can change these permissions at any time in watchOS or iOS Settings. Voice prompts are transcribed on your Apple Watch or iPhone by Apple’s on-device speech recognition; only the resulting text is sent to gbot-api, and no audio reaches our servers.
16. Analytics
To understand how the App is used and to fix problems, we compute aggregated usage statistics on our own backend (gbot-api, hosted on Cloudflare) from the requests the App already sends, such as feature use, request counts, latency and error rates. We do not use an analytics SDK on your device, we do not store or read any device or advertising identifier for analytics, IP addresses are not used for analytics, and the statistics are aggregated so that they are not linked to your account or your Apple identity. They are never used for advertising. Our legal basis is our legitimate interest in improving the App (Art. 6(1)(f) GDPR). You can opt out at any time with the analytics switch in the App under Settings › Privacy, and you can object under Section 10. If we ever add a third-party analytics SDK that stores or reads identifiers on your device, we will ask for your prior consent, as required by art. 122 of the Italian Privacy Code, and keep analytics off until you agree. We do not use a third-party analytics service: the statistics are computed by us on gbot-api.
17. Changes to This Policy
We may update this Privacy Policy from time to time. We will post the updated version with a new effective date and, for material changes, notify you in the App or by email at least 30 days before they take effect.
18. Contact
For any question about this Policy or your personal data, contact us at privacy@grokwatch.app or by post at Contrada Matarese 20, 87040 Luzzi (CS), Italy.
Annex A – Apple App Privacy (Nutrition Label) Mapping
This table maps the data described above to the categories used in App Store Connect’s App Privacy questionnaire. It must be kept consistent with the App’s actual behaviour and with any third-party SDKs included in the build.
Apple data type | Collected? | Linked to user? | Used for tracking? | Apple purposes | G Bot data |
Contact Info › Name | Yes (optional) | Yes | No | App Functionality | Name shared via Sign in with Apple |
Contact Info › Email Address | Yes (optional) | Yes | No | App Functionality | Email or private-relay email from Sign in with Apple; support emails |
User Content › Audio Data | No (not collected): speech is transcribed on-device by Apple and only text reaches gbot-api | – | No | – | None: voice is transcribed on-device; only the text is collected (see Other User Content) |
User Content › Other User Content | Yes | Yes | No | App Functionality | Text prompts, Grok responses, conversation history. Prompts count as collected even when not stored, because they are sent to xAI |
User Content › Customer Support | Yes | Yes | No | App Functionality | Support requests |
Identifiers › User ID | Yes | Yes | No | App Functionality | Apple user identifier; internal account ID |
Identifiers › Device ID | No – server-side aggregated analytics use no device identifier | No | No | Analytics | None (not collected) |
Purchases › Purchase History | Yes | Yes | No | App Functionality | StoreKit 2 transactions and subscription status |
Usage Data › Product Interaction | Yes | No | No | Analytics | Aggregated server-side usage statistics (not joined to the account ID) |
Diagnostics › Crash Data | Yes | No | No | App Functionality, Analytics | Crash reports |
Diagnostics › Performance Data | Yes | No | No | App Functionality, Analytics | Latency and error rates |
Diagnostics › Other Diagnostic Data | Yes | Yes (IP logs tied to authenticated requests) | No | App Functionality | Server logs incl. IP address (security, abuse prevention) |
Other Data › Other Data Types | No: the xAI API key stays in the device Keychain and is only passed through to xAI, never stored on gbot-api | – | No | – | xAI access credentials |
Health, Location, Financial Info, Contacts, Browsing/Search History, Sensitive Info | No | – | – | – | Not collected |
Notes: (1) “Tracking” in Apple’s sense is answered No for all data types because no data is linked with third-party data for advertising or shared with data brokers. (2) APNs device tokens are used only to deliver notifications, so they need not be declared as a data type unless they are used for anything else. (3) Data processed only transiently on the backend and not retained may not need to be declared under Apple’s “optional disclosure” criteria; confirm against Apple’s current guidance before submission. (4) Server logs containing IP addresses are tied to authenticated requests and are therefore declared as linked to the user. (5) Re-check this table against the final SDK list, including any crash reporter, before submission.
Website analytics
Our website grokwatch.app uses Google Analytics 4 (Google Ireland Ltd., measurement ID G-3EK9E3WLJS) to measure aggregate visits. IP addresses are anonymized, Google signals and ad personalization are disabled, and analytics cookies are set only if you accept them in the cookie banner (Google Consent Mode v2, default “denied”). You can change your choice at any time via “Cookie settings” in the footer. The website does not collect any account, voice or Grok data. privacy@grokwatch.app
Contact form
Contact form: if you write to us via the form on grokwatch.app, we receive your name, email address and message by email only to answer you, and delete them when no longer needed. The form is protected by Cloudflare Turnstile (Cloudflare, Inc.), which processes technical data to block spam.