Privacy Policy

1. Who is responsible for your data

The data controller under the GDPR is Nathan MUFUTA MULAMBA, publisher of Jyva — see the legal notice for his full identity. For any questions regarding your data: contact support.

2. Data we collect

Only what is needed to make the app work — nothing sold to third parties, nothing used for advertising.

Identity and connection

• Email (if you use email login)
• Sign in with Apple or Google ID (never your Apple/Google password itself)
• First name, last name, username, avatar — whatever you choose to fill in

Profile and body measurements (special category — Article 9 GDPR)

• Date of birth, gender, height, weight
• Goal, fitness level, available equipment, restrictions

Menstrual cycle tracking (optional — special category, Article 9 GDPR)

What we actually receive on our servers if you enable this option:

• A simple switch (enabled/disabled) — not the dates themselves.
• The date on which you gave your consent, to justify it if necessary (Article 7(1) GDPR).

You can disable this option at any time from your profile (Settings → Well-being): the dates stored locally are then deleted from your device. Removing access to Apple Health or Health Connect, if you granted it, is done in your phone's settings (iOS: Settings → Privacy & Security → Health; Android: Settings → Health Connect → App permissions) — Jyva cannot remove it for you.

Apple Health and Health Connect (optional)

Only if you allow it, Jyva can:

• read your weight and active calories burned (and your steps, on iOS), to pre-fill your profile and adjust your targets;
• write your workouts, the calories they burn and your meals, so they show up in Apple Health or Health Connect.

This data is never used for advertising, never sold and never transferred to third parties other than the processors listed in §5. Jyva's use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements.

Workouts

• Generated programs, logged workouts (exercises, sets, reps, weight)
• Personal records, progression history

Nutrition and hydration

• Meal photos you scan (sent to our AI subprocessor, see §4)
• Manually entered meals, calories and macronutrients
• Hydration log

Progression photos and measurements

• Photos you choose to add to your progression gallery (private by default)
• Body measurements you enter

Community (if enabled — entirely optional)

• Friends, friend requests
• Shared workouts, reactions, comments
• Duels (Versus), joined challenges
• Workouts/programs you make public

Technical

• Push notification token (to send you reminders if enabled)
• Subscription status (active/expired, renewal date) — not payment details, which are handled directly by Apple (App Store) or Google (Google Play)
• Terms you search for in the app (foods, users) — processed on the fly to show results, never stored
• A pseudonymous identifier for usage statistics (can be turned off in Settings → Usage data)

3. Why we use it

4. Artificial intelligence

Meal scanning and the virtual coach rely on OpenAI's GPT-4o models, our subprocessor for this feature. Concretely:

• The photo you take is sent to the OpenAI API to estimate calories and macronutrients.
• In accordance with OpenAI's API terms of use (distinct from consumer ChatGPT), these data are not used to train their models.
• The result is an estimation, not an exact measurement — you can always correct it yourself in the app.
• No automated decision-making having a legal or significant effect is taken on this basis (Article 22 GDPR): the AI proposes, you decide.

5. Who we share it with

Only providers necessary for the operation of the service — no data is ever sold:

6. Where your data is hosted

Our database, application servers and file storage are hosted at Scaleway in France. PostHog is configured on its European cloud. Some subprocessors (OpenAI, for meal scanning and the virtual coach) may process data outside the EU; these transfers are governed by the European Commission's standard contractual clauses or an equivalent mechanism.

7. How long we keep it

As long as your account is active, your data is kept to allow you to use the app. If you delete your account (see the dedicated page):

• Your personal data is anonymized and the rest deleted from our active systems within 30 days.
• An encrypted copy may remain for up to 60 additional days in our disaster recovery backups — never accessed outside of a restore incident, then automatically overwritten.
• If you have duels (Versus) with other users, your username and avatar disappear from their history, but the match remains visible to your opponent — deleting your account does not delete someone else's data.
• Records related to your subscription are kept for 10 years, as required by French commercial law (Code de commerce) — they do not contain your profile or health data.

8. Your rights

Under the GDPR, you can at any time:

• Access your data and export it — directly from the app (Settings → Export my data), already available.
• Rectify your information — directly in your profile.
• Delete your account and data — see the dedicated page.
• Object to certain processing or request its restriction.
• Withdraw your consent at any time for consent-based processing (Apple Health / Health Connect, cycle tracking, community), without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise a right not available directly in the app, contact support. You can also file a complaint with the CNIL (cnil.fr).

9. Security

Communications between the app and our servers are encrypted (HTTPS/TLS). Backups of our database are encrypted at rest. Access to production data is restricted. No system is infallible — if you identify a security vulnerability, please report it to us directly at security@jyva.app before any public disclosure.

10. Minimum age

Jyva is intended for individuals at least 16 years old. We do not knowingly collect data regarding younger individuals.

11. Cookies (website)

The jyva.app website does not place any cookies. It measures its audience with PostHog (EU cloud) in cookieless mode: no identifier is stored on your device, no individual profile is created, and only aggregated data is collected (page views, browser language, referrer, approximate country, device type). No consent banner is therefore required.

12. Modifications to this policy

This policy may evolve, notably if new subprocessors are added. Any significant modification will be notified to you in the app before it takes effect.