Privacy Policy

Last updated: August 22, 2026

This Privacy Policy explains what information Nyrax collects, how it is used, and the choices you have. We collect only what the App needs to work — there are no ads, no analytics profiling, and we do not sell your data.

Who is responsible for your data

Or Maximuk, Ain Dor 9, Rishon Lezion, 7583149, Israel, is the data controller for the personal information described in this policy. For any privacy question or request, contact support@nyrax.app.

Information we collect

Account: your name, email address, and password (handled by our authentication provider; we never see your password in plain text). If you sign in with Apple or Google, we receive your name and email address from them — not your password.

Fitness profile: date of birth, gender, height, weight, training goals, experience level, equipment preference, and any injuries or limitations you choose to share.

Training data: the workouts you create, the sets, reps, and weights you log, your workout history, and your conversations with the AI Coach.

Photos: if you use the workout-import feature, the photo of a workout plan you submit is sent for transcription and is not retained afterwards. A profile photo, if you choose one, stays on your device — the image itself is never uploaded.

Subscription status: if you subscribe, whether your subscription is active and when it renews. Payment is taken by Apple or Google — we never see or receive your card details.

Technical data: when the App calls our AI service, your IP address is processed momentarily to rate-limit abuse. It is held only in short-lived memory, is never written to your account, and is not used to identify you.

Support and diagnostics: messages you send to support, and crash/error reports (via Sentry) that help us fix bugs.

How we use your information

Your data is used to run the App: syncing your training data across devices, personalising your workout plans, powering the AI Coach, showing your stats and progress, unlocking paid features, and providing support. We do not sell your data or use it for third-party advertising.

Health information and your consent

Injuries, limitations, and any health details you share are sensitive information — "special category" data under European law, and "information of special sensitivity" under Israeli law.

They are always optional: the App logs workouts perfectly well without them. We ask for your explicit consent in the App before storing them, and we use them for one purpose only: adapting your training and coaching around them.

This consent also governs the AI Coach. If you have not given it, the coach will not save health details it notices in conversation to your profile. You can withdraw consent at any time by clearing these fields in Settings → Fitness Profile, or by deleting your account. Withdrawing erases the health data we hold and does not affect processing that already took place.

Legal basis for processing

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases:

Performance of a contract — your account and training data, processed to provide the App you signed up for, and your subscription.

Explicit consent — health information, as described above (Article 9(2)(a) GDPR).

Legitimate interests — crash and error diagnostics, rate-limiting and abuse prevention, and keeping the App secure and working correctly.

Legal obligation — where we are required to retain or disclose data by law.

AI processing

The AI Coach and AI workout generation are powered by Google's Gemini API. When you use these features, relevant parts of your data — such as your fitness profile (including age, height, weight, and, where you have consented, injuries), workout history, your messages, and, if you use the workout-import feature, the workout-plan photo you submit — are sent to Google through our secure server to generate a response.

We use the paid tier of the Gemini API. Under Google's terms for that tier, Google acts as our data processor: it does not use your prompts or responses to train or improve its models, and processes them only to return the response. We do not store the prompts we send.

The AI personalises training suggestions automatically, but it does not make decisions about you that produce legal or similarly significant effects, and you are always free to disregard what it suggests.

If you prefer not to share this data, you can simply not use the AI features — workout logging works without them.

Who we share data with

We do not sell your data. We share it only with the service providers who run the App for us, each acting as our processor under contract:

Supabase — database, authentication, and server functions.

Google (Gemini API) — AI coaching and workout generation, as described above.

Sentry — crash and error diagnostics.

RevenueCat — subscription management. Receives your purchase and renewal status and a device identifier so your subscription follows you across reinstalls. It does not receive your training or health data.

Apple and Google — payment processing for subscriptions, and sign-in if you use it. They act as independent controllers for payments under their own privacy policies.

Cloudflare — hosting and security for the nyrax.app website.

We may also disclose data where the law requires it, or to establish or defend legal claims.

Where your data lives

Your account data is stored with Supabase (our database provider) and protected by per-user access rules — your data is only readable by your account. Data is encrypted in transit, and your login session is encrypted at rest on your device. A copy of your recent data is cached on your device so the App works offline.

International data transfers

Nyrax is operated from Israel, and the providers listed above may process your data outside your own country.

Where personal data is transferred out of the European Economic Area or the United Kingdom, the transfer is covered by the European Commission's Standard Contractual Clauses or by an adequacy decision, depending on the provider. Israel holds an adequacy decision from the European Commission. You can request details of these safeguards at support@nyrax.app.

The nyrax.app website

The website carries no advertising, no analytics, and no tracking or profiling cookies, and it asks you for nothing. Cloudflare, which serves and protects the site, may set a strictly necessary security cookie to tell human visitors from bots. It holds no profile of you and is not used for tracking or advertising, so no cookie banner is needed.

Deleting your account and data

You can delete your account and everything associated with it at any time: open Profile → Delete Account and confirm. This permanently removes your account, profile, workouts, workout history, the AI Coach's saved notes, and your support messages from our servers.

If you no longer have the App installed, or cannot sign in, go to nyrax.app/delete-account, or email support@nyrax.app from the address on your account and ask us to delete it. We will verify the request and complete the deletion within 30 days.

Your subscription is held by Apple or Google, not by us — deleting your account does not cancel it. Cancel in your store account settings to stop further billing.

How long we keep your data

Account, profile, and training data: kept for as long as your account exists. Deleting your account (Profile → Delete Account) removes it from our servers immediately; residual copies inside encrypted backups are overwritten within 90 days.

AI Coach conversations: stored on your device. The coach's long-term notes are stored with your account and are deleted with it.

Workout-import photos: sent for transcription and not retained by us.

Crash and error reports: kept for up to 90 days.

Support messages: kept for up to 24 months so we can follow up on recurring problems, or until you delete your account, whichever comes first.

Data cached on your device is removed when you uninstall the App.

Your rights

Wherever you live, you can view and correct your data by editing your profile in the App, and you can delete everything with Profile → Delete Account.

If you are in the European Economic Area or the United Kingdom, you also have the right to access a copy of your data, to have it corrected or erased, to object to or restrict processing, to data portability, to withdraw consent at any time, and to lodge a complaint with your national data protection authority.

If you are in Israel, you have the right to review the data we hold about you, to request that it be corrected or deleted, and to complain to the Privacy Protection Authority.

If you are a California resident, you have the right to know what personal information we collect and why, to request its deletion, to correct it, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined by the CCPA, and have not done so in the past 12 months.

For any request, contact support@nyrax.app — we respond within 30 days.

Children

Nyrax is for adults only. The App is not intended for anyone under 18, we do not knowingly collect data from minors, and the App asks for your date of birth during setup to enforce this. If you believe someone under 18 has created an account, contact us and we will delete it.

Data security

We protect your data with per-user database access rules that make your rows unreadable to any other account, encryption in transit, and encrypted storage of your login session on your device. Secret keys are held server-side only and never ship inside the App.

No system is perfectly secure. If a breach ever affects your personal data, we will notify you and the relevant regulator where the law requires it.

Changes to this policy

We may update this policy as the App evolves. Material changes will be communicated in the App, and the date above always reflects the latest revision.

Contact

Privacy questions or requests: support@nyrax.app, or write to Or Maximuk, Ain Dor 9, Rishon Lezion, 7583149, Israel.