Privacy Policy

Effective date: 28 July 2026 · Last updated: 13 August 2026

This Privacy Policy explains what personal data Plyox collects, why we collect it, who we share it with, how long we keep it, and what rights you have. It applies to the Plyox mobile application, the Plyox coach dashboard, the websites plyox.ai and share.plyox.ai, and the related backend services (together, the "Service").

We have written this policy in plain language on purpose. If anything is unclear, write to us at support@plyox.ai and we will explain it.

1. Who is responsible for your data

The data controller for the Service is:

Raúl Armando Bustamante, an individual sole trader (freelancer) based in Spain, operating under the name "Plyox".
Email: support@plyox.ai

Full identification and contact details are published on our Legal Notice page.

One important exception — coaching relationships. If you use Plyox as an athlete linked to a coach, the coach decides what training and nutrition data they collect about you and why. For that data, the coach is the controller and Plyox acts as a processor on the coach's instructions (see Section 10). We remain the controller for your own account, for the data you create for yourself, and for operating and securing the platform.

2. What data we collect

We only collect what the Service needs in order to work.

2.1 Data you give us

Account data — name, email address, and the authentication identifier from your sign-in provider (email/password, Google or Apple). We never receive your Google or Apple password.
Profile and preferences — language, unit system (metric/imperial), goals, and similar settings.
Training data — workouts, exercises, sets, reps, weights, distances, times, personal records (PRs), training programs, streaks, and the statistics derived from them.
Body measurements and progress photos — weight, body measurements, and any progress photos you choose to upload. These are entirely optional and only exist if you create them.
Nutrition data — nutrition plans assigned to you, meal logs, foods you register (including barcode scans), and the statistics derived from them.
Messages — chat messages, images and attachments you exchange with your coach, and messages you send to the in-app AI assistant.
Support and feedback — the content of feedback or help requests you send us, including up to three screenshots you attach.

2.2 Data collected automatically

Device and technical data — device model, operating system, app version, language, and time zone.
Push notification tokens — so we can deliver the notifications you have enabled.
Usage analytics — aggregated, event-level information about how the app is used (screens opened, features used), collected through Firebase Analytics to help us fix problems and prioritise improvements.
Crash diagnostics — stack traces and device state when the app crashes, collected through Firebase Crashlytics.
Subscription status — whether you have an active Free, Pro or Elite entitlement, and the associated store or billing identifiers, received from Apple, Google or our billing providers. We never see or store your card number.

2.3 Data collected on the website

The plyox.ai website does not run advertising or tracking cookies. It stores your language choice in your browser's local storage, and — if you submit the waiting-list form — stores the email address you typed, together with the page it came from and your language, so we can contact you about the launch.

To understand how the website is used, we measure visits with a self-hosted, cookie-free analytics tool running on our own servers. It records aggregated statistics only — pages visited, referrer, country and device type — sets no cookies, uses no cross-site identifiers, and shares nothing with third parties. Legal basis: our legitimate interests, Art. 6(1)(f).

3. Health-related data (GDPR Article 9)

Training logs, body measurements, progress photos and nutrition data can reveal information about your physical health. Under the GDPR, this is a special category of personal data that requires stronger protection.

We process this data on the basis of your explicit consent, which you give by choosing to use the features that create it. Logging a workout, saving a measurement, uploading a progress photo, logging a meal or linking yourself to a coach are all deliberate acts on your part; we never derive this data from other sources or infer it in the background.

You can withdraw that consent at any time by deleting the individual entries, by unlinking from your coach, or by deleting your account from within the app. Withdrawing consent does not affect processing that already took place before you withdrew it.

We do not use health-related data for advertising, and we do not sell it — to anyone, ever.

4. Why we process your data, and on what legal basis

Creating and securing your account and delivering the app's features — to provide the Service you asked for. Legal basis: performance of a contract, Art. 6(1)(b).
Storing and displaying your workouts, statistics, measurements, nutrition data and chats — the core purpose of the Service. Legal basis: contract, Art. 6(1)(b), together with your explicit consent for health-related data, Art. 9(2)(a).
Generating AI answers, plans and insights — to deliver the AI features you choose to use. Legal basis: contract, Art. 6(1)(b), together with explicit consent, Art. 9(2)(a).
Managing subscriptions, trials and payments — to operate paid plans and to comply with tax and accounting obligations. Legal basis: contract, Art. 6(1)(b), and legal obligation, Art. 6(1)(c).
Sending push notifications you enabled — to keep you informed. Legal basis: consent, Art. 6(1)(a), withdrawable in your device settings.
Analytics, crash reporting, abuse prevention and rate limiting — to keep the Service working, stable and secure. Legal basis: our legitimate interests, Art. 6(1)(f).
Responding to support and feedback requests — to help you. Legal basis: contract and legitimate interests.

We do not carry out automated decision-making that produces legal effects concerning you. AI-generated training or nutrition suggestions are informational: a human — you or your coach — decides whether to follow them.

5. AI features and AI providers

Plyox includes AI assistants: a coach-side assistant that helps build nutrition and training plans, and — for athletes on the Elite tier — an in-app assistant plus automatic weekly and monthly training reports.

When you use an AI feature, we send the relevant context for that request to an AI provider acting as our processor. That context can include your training history, statistics, nutrition plan, meal logs, body measurements, goals and the message you typed. It never includes your password or payment details.

The AI providers we use are:

LLM model providers — coach-side AI assistants and athlete-side AI features, acting as our processors. Details available on request at support@plyox.ai.

What this means in practice:

Providers process the data only to generate the response we requested, under contract, as our processors.
We do not train AI models on your data, and we require our AI providers not to use content submitted through our accounts to train their models.
Your conversations with the athlete AI assistant are private to you: your coach cannot read them.
AI output can be wrong. It is not medical, dietary or professional health advice — see the Health and Fitness Disclaimer in our Terms of Service.

If you prefer not to have your data sent to an AI provider, simply do not use the AI features; the rest of the Service works without them.

6. Who we share data with

We do not sell, rent or trade your personal data, and we do not share it with advertisers.

We share data with the following categories of recipients:

6.1 Your coach (if you have one)

If you link your account to a coach, that coach can see the training, nutrition and body data relevant to coaching you, your chat with them, and your progress. Your conversations with the AI athlete assistant are not visible to your coach. You can end this access by unlinking from the coach.

6.2 Service providers (processors and sub-processors)

Google (Firebase / Google Cloud) — authentication, Firestore database, file storage, Cloud Functions (hosted in the EU region europe-west1), Analytics, Crashlytics and push notifications. EU and US.
LLM model providers — AI processing (coach-side and athlete-side).
Adapty — mobile subscription management and entitlement validation. EU and US.
Polar — coach billing. Polar acts as Merchant of Record: it is the seller of record for coach subscriptions and processes payment data as its own controller, under its own privacy policy. US.
Apple and Google — in-app purchases and store billing for athlete subscriptions, as independent controllers under their own policies. US and EU.
Expo (EAS) — building the app and delivering over-the-air updates. US.

Each provider is bound by a data-processing agreement and may only process your data on our instructions and for the purposes above.

6.3 Legal reasons

We may disclose data if we are legally required to (for example, a valid order from a competent authority), or where necessary to establish, exercise or defend legal claims, or to protect the rights and safety of users.

6.4 Business transfer

If the Service is ever transferred to another operator, your data may be transferred as part of that transaction. We would tell you beforehand and you would keep every right described in this policy.

7. International transfers

Some of our providers are based in the United States or otherwise outside the European Economic Area. When we transfer personal data outside the EEA, we rely on one of the following safeguards:

an adequacy decision by the European Commission covering the recipient (for example, providers certified under the EU–US Data Privacy Framework); or
the European Commission's Standard Contractual Clauses (SCCs), together with supplementary technical measures such as encryption in transit and at rest.

You can request a copy of the relevant safeguards by writing to support@plyox.ai.

8. How long we keep your data

Account and content data — for as long as your account exists. You are in control: you can delete individual entries (workouts, measurements, photos, meal logs, chats) at any time.
Account deletion — deleting your account from within the app removes your personal data from the live database. Some records we are legally required to keep (for example, invoices and tax records relating to a paid subscription) are retained for the period required by Spanish law.
Backups — we run automatic daily backups of the database for disaster recovery. Backups are retained for 180 days and are then deleted automatically. Data you delete disappears from the live Service immediately, and ages out of the backups within that window. Backups are only ever restored to recover from an incident.
Support and feedback — kept for as long as needed to handle the request and for a reasonable period afterwards for reference.
Analytics and crash data — kept in aggregated form according to Firebase's retention settings.

9. Your rights

Under the GDPR you have the right to:

access the personal data we hold about you and receive a copy;
rectify data that is inaccurate or incomplete;
erase your data ("right to be forgotten") — you can do this yourself by deleting your account in the app;
restrict or object to processing based on our legitimate interests;
data portability — receive your data in a structured, commonly used, machine-readable format, or have it transmitted to another controller;
withdraw consent at any time, without affecting processing carried out before withdrawal.

To exercise any of these rights, write to support@plyox.ai from the email address associated with your account. We respond within one month, as required by the GDPR. We do not charge for this.

If you believe we are handling your data unlawfully, you have the right to lodge a complaint with the Spanish data protection authority — the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es — or with the supervisory authority of the EU country where you live.

10. If you are a coach using Plyox

When you use Plyox to manage your clients, you are the controller of your clients' personal and health data, and Plyox acts as your processor. We process that data only to provide the Service to you, under the data-processing terms set out in our Terms of Service. The list of sub-processors in Section 6.2 above is the sub-processor list referenced by those terms.

You are responsible for having a lawful basis to collect and process your clients' data, for informing them, and for honouring their rights. We will assist you in doing so.

11. Security

We protect your data with measures appropriate to the risk, including:

encryption in transit (TLS) and encryption at rest by our infrastructure provider;
authentication handled by Firebase Authentication — we never store your password;
server-side access rules that restrict every document to the account that owns it (and, where relevant, to their linked coach);
privileged operations (billing, entitlements, moderation-sensitive writes) executed only by server-side Cloud Functions, never by the client;
rate limiting and abuse controls on AI and other costly endpoints;
daily encrypted backups.

No system is perfectly secure. If a personal data breach occurs that is likely to result in a high risk to your rights, we will notify you and the AEPD as required by Articles 33 and 34 of the GDPR.

12. Children

The Service is not directed at children. You must be at least 16 years old, or the minimum age of digital consent in your country, to create an account. We do not knowingly collect data from children below that age. If you believe a child has provided us with personal data, contact support@plyox.ai and we will delete it.

13. Changes to this policy

We may update this policy as the Service evolves. When we make material changes, we will update the "Last updated" date at the top and give reasonable notice in the app or by email before the changes take effect. Continuing to use the Service after that means you accept the updated policy.

14. Contact

For any privacy question, request or complaint:

Raúl Armando Bustamante (operating as Plyox)
Email: support@plyox.ai
Spain — full details on our Legal Notice page

This policy is published in English, Spanish and Finnish. The English version is the legally binding one; in case of discrepancy, the English text prevails.