Privacy Policy
Last update: September 23, 2026
Jyva processes health data (workout, nutrition, body measurements) — this page explains precisely what we collect, why, who it's shared with, how long it's kept, and how to regain control at any time.
1. Who is responsible for your data
The data controller under the GDPR is Nathan MUFUTA MULAMBA, publisher of Jyva — see the legal notice for his full identity. For any questions regarding your data: contact support.
2. Data we collect
Only what is needed to make the app work — nothing sold to third parties, nothing used for advertising.
Identity and connection
- Email (if you use email login)
- Sign in with Apple or Google ID (never your Apple/Google password itself)
- First name, last name, username, avatar — whatever you choose to fill in
Profile and body measurements (special category — Article 9 GDPR)
- Date of birth, gender, height, weight
- Goal, fitness level, available equipment, restrictions
Menstrual cycle tracking (optional — special category, Article 9 GDPR)
This feature is entirely optional and disabled by default. Your cycle dates (last period, average length) — whether you enter them yourself or they are read from Apple Health (iOS) or Health Connect (Android) — remain only on your phone. They are never sent or stored on our servers: the calculation that adapts the suggested intensity of your workouts is done entirely on your device.
What we actually receive on our servers if you enable this option:
- A simple switch (enabled/disabled) — not the dates themselves.
- The date on which you gave your consent, to justify it if necessary (Article 7(1) GDPR).
You can disable this option at any time from your profile (Settings → Well-being): the dates stored locally are then deleted from your device. Removing access to Apple Health or Health Connect, if you granted it, is done in your phone's settings (iOS: Settings → Privacy & Security → Health; Android: Settings → Health Connect → App permissions) — Jyva cannot remove it for you.
Apple Health and Health Connect (optional)
Only if you allow it, Jyva can:
- read your weight and active calories burned (and your steps, on iOS), to pre-fill your profile and adjust your targets;
- write your workouts, the calories they burn and your meals, so they show up in Apple Health or Health Connect.
This data is never used for advertising, never sold and never transferred to third parties other than the processors listed in §5. Jyva's use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements.
Workouts
- Generated programs, logged workouts (exercises, sets, reps, weight)
- Personal records, progression history
Nutrition and hydration
- Meal photos you scan (sent to our AI subprocessor, see §4)
- Manually entered meals, calories and macronutrients
- Hydration log
Progression photos and measurements
- Photos you choose to add to your progression gallery (private by default)
- Body measurements you enter
Community (if enabled — entirely optional)
- Friends, friend requests
- Shared workouts, reactions, comments
- Duels (Versus), joined challenges
- Workouts/programs you make public
Technical
- Push notification token (to send you reminders if enabled)
- Subscription status (active/expired, renewal date) — not payment details, which are handled directly by Apple (App Store) or Google (Google Play)
- Terms you search for in the app (foods, users) — processed on the fly to show results, never stored
- A pseudonymous identifier for usage statistics (can be turned off in Settings → Usage data)
3. Why we use it
| Purpose | Legal basis |
|---|---|
| Provide the service (generate a program, track your workouts/meals) | Performance of contract |
| Synchronize your offline data between devices | Performance of contract |
| Apple Health / Health Connect synchronization (if enabled) | Consent |
| Adapt workout intensity to menstrual cycle (optional, 100% local calculation) | Explicit consent (Article 9 GDPR) |
| Community features (if enabled) | Consent |
| Anti-abuse safeguard for meal scans (daily quota) | Legitimate interest |
| Subscription management | Performance of contract |
| Subscription financial/accounting records | Legal obligation |
| Product improvement (anonymized usage statistics) | Legitimate interest |
4. Artificial intelligence
Meal scanning and the virtual coach rely on OpenAI's GPT-4o models, our subprocessor for this feature. Concretely:
- The photo you take is sent to the OpenAI API to estimate calories and macronutrients.
- In accordance with OpenAI's API terms of use (distinct from consumer ChatGPT), these data are not used to train their models.
- The result is an estimation, not an exact measurement — you can always correct it yourself in the app.
- No automated decision-making having a legal or significant effect is taken on this basis (Article 22 GDPR): the AI proposes, you decide.
AI estimations do not replace the advice of a health or nutrition professional — see the Terms of Service.
5. Who we share it with
Only providers necessary for the operation of the service — no data is ever sold:
| Subprocessor | Role | Data concerned |
|---|---|---|
| OpenAI | Analysis of meal photos, virtual coach | Meal photos |
| PostHog (EU cloud) | Product usage statistics | Anonymized/bucketized usage events — never photos, exact weight/height, email or name (see POSTHOG_ANALYSE.md) |
| RevenueCat | Subscription management | User ID, subscription status |
| Apple (APNs, Sign in with Apple, App Store) | Connection, notifications, billing | Apple ID, notification token, payment (handled entirely by Apple) |
| Google (Google Sign-In, Google Play, Firebase Cloud Messaging) | Connection, notifications, billing | Google ID if you choose this method, notification token, payment on Android (handled entirely by Google) |
| Scaleway (Object Storage) | File storage (avatar, progression) | Image files |
6. Where your data is hosted
Our database, application servers and file storage are hosted at Scaleway in France. PostHog is configured on its European cloud. Some subprocessors (OpenAI, for meal scanning and the virtual coach) may process data outside the EU; these transfers are governed by the European Commission's standard contractual clauses or an equivalent mechanism.
7. How long we keep it
As long as your account is active, your data is kept to allow you to use the app. If you delete your account (see the dedicated page):
- Your personal data is anonymized and the rest deleted from our active systems within 30 days.
- An encrypted copy may remain for up to 60 additional days in our disaster recovery backups — never accessed outside of a restore incident, then automatically overwritten.
- If you have duels (Versus) with other users, your username and avatar disappear from their history, but the match remains visible to your opponent — deleting your account does not delete someone else's data.
- Records related to your subscription are kept for 10 years, as required by French commercial law (Code de commerce) — they do not contain your profile or health data.
8. Your rights
Under the GDPR, you can at any time:
- Access your data and export it — directly from the app (Settings → Export my data), already available.
- Rectify your information — directly in your profile.
- Delete your account and data — see the dedicated page.
- Object to certain processing or request its restriction.
- Withdraw your consent at any time for consent-based processing (Apple Health / Health Connect, cycle tracking, community), without affecting the lawfulness of processing based on consent before its withdrawal.
To exercise a right not available directly in the app, contact support. You can also file a complaint with the CNIL (cnil.fr).
9. Security
Communications between the app and our servers are encrypted (HTTPS/TLS). Backups of our database are encrypted at rest. Access to production data is restricted. No system is infallible — if you identify a security vulnerability, please report it to us directly at security@jyva.app before any public disclosure.
10. Minimum age
Jyva is intended for individuals at least 16 years old. We do not knowingly collect data regarding younger individuals.
12. Modifications to this policy
This policy may evolve, notably if new subprocessors are added. Any significant modification will be notified to you in the app before it takes effect.