Privacy Policy

Last Updated: October 13, 2026

TathyaFit ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your personal information when you use the TathyaFit mobile application (the "App").

1. Information We Collect and Process

2. How We Use Information

We use information to provide health, recovery, sleep, nutrition, workout, progress, Coach, and planning features; calculate general-wellness metrics; provide only the specific AI feature and data scopes you separately permit; sync and restore account data; process and restore purchases; deliver notifications you enable; monitor limited service usage and cost; diagnose errors and prevent abuse; secure and troubleshoot the service; and respond to support, privacy, or deletion requests.

We do not use this information for third-party advertising or to track you across other companies' apps or websites.

3. On-Device and Cloud Processing

Many calculations occur only on your device. Wellness Age is an app-defined wellness estimate from your own recorded data, not biological, clinical, cardiac, or medical age. It uses a confirmed age plus up to 182 days of recorded VO2 max, resting heart rate, heart rate variability, body fat, steps, workout minutes, sleep duration, and sleep-timing consistency. It needs at least 30 days of data and three factors, weights the available 0-100 factor scores (VO2 max counts most), and keeps the result on an app scale of calendar age minus 10 to plus 10 years (at most 2 years below calendar age without VO2 max). Wellness pace compares your last 28 days with your own 6-month baseline; it is not an aging rate or a prediction. Transformation Velocity compares your last 7 days of steps, protein, calories, and workouts with targets you saved, using local records. Personal Pattern Comparisons use recent journal, nutrition, Sleep, and Recovery records to display raw group means and sample counts only when each group has at least seven valid days. These app-defined summaries do not establish biological age, causation, diagnosis, prediction, advice, or an outcome guarantee.

Account sync sends the records you choose to sync to TathyaLabs and our cloud-storage provider, Supabase. Cloud storage is separate from third-party AI processing.

The in-App iPhone voice logger requires on-device speech recognition. TathyaFit does not upload its microphone recording. If you separately allow Nutrition Voice AI processing and submit the result, the text transcript is sent through TathyaLabs to the AI recipients listed below. If you choose Apple system dictation or Siri outside that in-App logger, Apple may process your speech under Apple's privacy terms; TathyaFit receives only the resulting text and sends it to our AI recipients only when the same Nutrition Voice permission is already active.

4. Shared Food Library

When you log an AI-estimated food, its name and nutrition values (per standard unit, with its unit and gram measurements) are added to TathyaFit's shared food library so other users can find it in food search, unless you mark it as a Personal item before logging. Personal items stay private to your account. Shared entries never show who logged them, the amount you ate, when you ate it, meal photos, or voice transcripts. For moderation only, we keep an internal reference to the account that contributed an entry, so incorrect or abusive entries can be traced and removed; it is never shown to other users or returned by the App, and it is removed when you delete your TathyaFit account. Recipes are never shared. Unrecognized photo items are shared only if you rename them and leave Personal item off. Because shared entries are not linked to you, they are not removed when you delete your account; if a shared food name identifies you, contact us and we will remove it.

5. Optional Third-Party AI Processing

Available third-party AI processing is off until you see the current in-App disclosure and affirmatively tap Allow for the feature scopes it lists. The food-logging scopes (Nutrition Text, Nutrition Voice, Nutrition Photo, and Recipe Analysis) may be presented together in one disclosure that lists each item; every other scope is requested on its own. Agreeing to the Terms or this Privacy Policy does not itself grant AI permission. Health, journal, memory, workout-planning, and meal-planning permissions are separate from ordinary Coach chat and from one another. Our current AI disclosure version is 2026-10-05.v4.

Coach data connectors remain unavailable until the matching context scope is allowed. After you allow a context scope, Coach can read the matching records it needs for your question and labels the data it used in the chat; every proposed write or change is shown for your confirmation before it is applied. Generated Coach, workout, and meal-plan content is general-wellness information, can be inaccurate, and is not a diagnosis, treatment, exercise clearance, therapeutic diet, or medical prescription. AI analysis of progress photos remains disabled: a progress photo can be stored privately with user-entered metadata, but it is not sent to an AI recipient and no body-fat, muscle, posture, fitness-level, or appearance inference is performed.

6. AI Recipients and Protections

For each enabled and separately allowed AI scope, TathyaLabs sends the limited request to these recipients:

Our provider configuration permits only Microsoft Azure, disables fallbacks to any other provider, requests zero-data-retention processing, and denies data collection for model improvement. Every request, including a Coach retry with a fallback model, uses this same configuration, so a fallback never adds a recipient beyond OpenRouter and Microsoft. We do not enable prompt or response logging in our AI gateway requests. Microsoft states that prompts and completions processed by its Azure-hosted service are not made available to OpenAI and are not used to train generative AI models without permission. The recipients may process requests in the United States or other locations where they operate. We require service providers to use the data only to provide the requested service and to apply privacy and security protections at least as protective as the commitments in this policy.

7. Other Service Providers

We do not sell or rent your personal information. We use service providers only to operate requested features:

Providers may process data in countries other than your own. We require them to use information only to provide contracted services and apply appropriate safeguards. We may also disclose information when legally required or necessary to protect users and the service.

8. Health Data Commitments

9. Retention and Security

We use administrative, technical, and organizational safeguards, including encrypted network connections and access controls. Information stored locally is protected by iOS device security; account credentials are stored using iOS Keychain-backed storage. No system is completely secure.

Account data is generally retained while your account is active. A submitted meal photo or voice transcript is retained only while its temporary analysis is pending or waiting for your review; when you log or discard that result, TathyaFit deletes the private source photo or transcript and its temporary analysis record. Recipe-analysis jobs, structured Coach memories and follow-up events, workout and meal-plan generation records, account-linked AI usage metadata, progress photos, and synced health or fitness records remain in our active cloud systems until the associated record is deleted where that control is available or you delete your TathyaFit account. Coach conversation history is stored on your device unless you deliberately save a structured Coach memory. Revoking an enabled AI scope stops new and queued provider requests but does not automatically delete records already stored by TathyaLabs; you may delete those records or your account.

Under the zero-data-retention and data-collection restrictions described above, OpenRouter and Microsoft Azure are instructed not to retain AI request content or use it for model training. TathyaLabs does not store AI prompts or responses in its AI usage log; that log stores limited account-linked operational metadata such as feature, model, token count, cost, status, and content length or count.

Vercel runtime request, performance, and diagnostic logs are normally retained for the window available under our active Vercel plan and configuration, typically between one hour and 30 days, and then expire. We may preserve a limited copy longer only when reasonably necessary for security, incident response, abuse prevention, dispute resolution, legal compliance, or to document a completed deletion request.

Firebase Crashlytics keeps crash reports for 90 days. Google Analytics for Firebase keeps usage statistics for up to 14 months. Both are then deleted by Google.

10. Your Choices and Rights

The App provides controls for HealthKit access, notification categories, every available optional AI-processing scope, progress-photo locking, and cloud data. You may choose Not now for AI processing and continue to use non-AI, manual, local, database, and cached features. You may grant or revoke any available AI scope at any time with its switch in Settings > Privacy & Data; turning a switch on shows the same in-App disclosure before anything is shared. The server checks the current disclosure version and every permission required by the actual payload again immediately before each enabled AI request, including Coach tool results, queued work, and retries.

You can export your TathyaFit cloud records and on-device app records from Settings > Privacy & Data > Export My Data. Apple Health remains the system of record for data stored in HealthKit and provides its own export controls.

You can permanently delete TathyaFit from Settings > Account > Delete Account. The deletion flow removes your TathyaFit access record and associated meal, workout, nutrition, weight, photo, Coach, notification-token, and generated-content records from our active systems. If you use the same sign-in with another Tathya product, we preserve the shared authentication identity, shared profile, and that other product's records; otherwise, we also delete the shared profile and authentication identity. Deleting TathyaFit does not cancel an Apple subscription; manage it separately in your Apple Account subscription settings.

To request access, correction, assistance with export, or assistance with deletion, contact connect@tathyalabs.com. We may need to verify your identity before fulfilling a request.

11. Age Requirement

TathyaFit is intended only for people aged 18 or older (or the age of majority where higher). The App validates age before requesting HealthKit or notification permission. If we learn that an ineligible person provided personal information, we will restrict access and delete the information.

12. Changes and Contact

We may update this policy as the service changes. Material changes will be communicated as required, and the date above will be updated. Questions or privacy requests can be sent to connect@tathyalabs.com.