Privacy Policy
Last updated: 15 May 2026
Data controller: Plyko, an application published from France and operating under EU and French law.
Contact: privacy@plyko.app
This policy explains what data Plyko (“we”, “us”) collects when you use the Plyko mobile app and the supporting Plyko backend, why, with whom we share it, and the rights you have over it. We follow the EU General Data Protection Regulation (GDPR) and the French Loi Informatique et Libertés. The competent supervisory authority is the CNIL.
1. Summary in plain language
- Your workout, nutrition, weight, and steps data lives mostly on your phone in a local SQLite database. We only mirror a subset to our cloud backend so you can recover it on a new device.
- Photos you scan with the AI features (plate scan, fridge scan, label scan) are sent to Anthropic’s Claude API for processing and are not stored by us or by Anthropic beyond the inference call.
- We do not sell your data. We do not show third-party advertising. We do not track you across apps or websites.
- You can delete your account from inside the app at any time. All cloud copies are erased within 30 days.
2. Data we collect
| Category | Examples | Purpose | Legal basis |
|---|---|---|---|
| Account | Email, password hash, user ID | Sign in, identify you across devices | Contract (Art. 6.1.b GDPR) |
| Profile | Handle, avatar, gender, height, body weight, body-fat %, goals, dietary preferences | Adapt the app and macro targets to you | Contract |
| Workout activity | Sessions, sets, exercises, custom exercises, personal records, workout templates | Core feature — your training log | Contract |
| Nutrition activity | Meal logs, food items, saved recipes, scanned barcodes, nutrition goals | Core feature — your nutrition log | Contract |
| Body metrics | Weight, body-fat, water intake, step count history | Body composition + activity tracking | Contract |
| Apple Health / Health Connect | Step count and active calories read from the OS health store | Display daily activity | Consent (you opt in via the OS prompt) |
| Photos for AI | Pictures of plates / fridges / nutrition labels you take | One-shot AI analysis, then discarded | Consent (you take the action) |
| Subscription | Status and transaction ID via RevenueCat — never card or bank data | Manage your Pro access | Contract |
| Diagnostics | Anonymous crash logs via Sentry; AI feature usage counters | Fix bugs, enforce quotas | Legitimate interest (Art. 6.1.f) |
| Social | Friend list, leaderboard handle, profile photo | Social features you opt into | Consent (you connect friends) |
We never collect: precise GPS location, contacts list, microphone recordings, browsing history, payment card numbers (Apple/Google handle billing).
3. Where the data goes
Plyko relies on the following processors. Each runs under a Data Processing Agreement.
| Processor | What they receive | Where | Why |
|---|---|---|---|
| Supabase Inc. (USA, EU-hosted instance) | All data above except photos and diagnostics | Frankfurt, Germany (eu-central-1) | Database, authentication, edge functions |
| Anthropic, PBC (USA) | Photos and prompts for AI features | USA | Claude API inference |
| RevenueCat, Inc. (USA) | App user ID + Apple/Google transaction IDs | USA | Subscription orchestration |
| Apple Inc. | IAP transactions, push tokens, Apple Health (stays on device) | Apple servers | StoreKit + APNs |
| Sentry (USA / Germany) | Crash stack traces, anonymous device + app version | Frankfurt EU region | Error reporting |
| USDA / Open Food Facts | Food search queries (no user identifiers) | USA / France | Food nutrition data lookup |
Transfers to the United States rely on the Standard Contractual Clauses (SCC) issued by the European Commission and, for enrolled vendors, the EU-US Data Privacy Framework.
4. How long we keep it
- Active account — kept as long as your account exists.
- Deleted account — erased from our active databases within 30 days. Encrypted, write-only backups roll off within 90 days.
- Sentry diagnostics — 90 days, then auto-purged.
- AI photos — never stored. Held in memory only for the duration of the API call.
- Subscription transactions — retained for 10 years under French accounting law (Code de commerce, Art. L123-22), in pseudonymised form once you delete your account.
5. Your rights
Under the GDPR you have the right to:
- access the data we hold on you (Art. 15)
- rectify inaccurate data (Art. 16)
- erase your data (Art. 17) — available in-app
- restrict processing (Art. 18)
- port your data in a structured format (Art. 20)
- object to processing based on legitimate interest (Art. 21)
- withdraw consent at any time for processing based on consent
To exercise any of these rights, email privacy@plyko.app. We respond within 30 days.
You may also lodge a complaint with the CNIL: www.cnil.fr / 3 Place de Fontenoy, 75007 Paris.
6. Security
- Supabase databases encrypted at rest (AES-256) and in transit (TLS 1.2+).
- Passwords hashed with bcrypt — we cannot see or recover them.
- Edge functions authenticated with rotating service-role keys.
- Local SQLite benefits from iOS / Android sandboxing and disk encryption.
- We do not access your data manually except to investigate a support request, or under legal compulsion.
No system is unbreakable. If a breach affects your data, we notify you and the CNIL within 72h as required by Art. 33–34 GDPR.
7. Children
Plyko is rated 12+ and not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child has signed up, email privacy@plyko.app and we will delete the account.
8. Cookies and similar tech
The Plyko mobile app does not use cookies. The Plyko website uses no analytics cookies and no third-party tags.
9. Changes to this policy
We update this policy when our practices change or when laws require. The “Last updated” date reflects the latest revision. Material changes will be announced inside the app at least 30 days before they take effect.
10. Contact
Plyko — published from France. Email: privacy@plyko.app. For full legal entity details, write to contact@plyko.app or see our Legal Notice.