Privacy Policy

Overview

Tyzra is a platform for online fitness coaches and their clients. This policy explains what data we collect, how we use it, and how we protect it. We keep things simple: we collect only what we need to run the service, and we never sell your data.

If you're a client, your coach decides what to ask you for and can see what you send them. Tyzra stores it so you and your coach can use it.

Data We Collect

• Account information: email address, name, and for coaches a business name and logo.
• Check-in data: text answers, numeric entries such as body weight and measurements, voice recordings, and other responses you send through check-in and intake forms.
• Progress photos: images you upload with check-ins or that your coach uploads for you.
• Training, nutrition and habits: workouts, sets and reps, workout notes, food and meal logs, steps, habits and supplements.
• Messages and feedback: messages between a coach and client, and a coach's written and voice feedback on check-ins.
• Contracts: if your coach asks you to sign a contract, your typed signature, the time you signed, your IP address and the signed PDF.
• Files coaches send us: spreadsheets and photos a coach sends so we can move their clients into Tyzra.
• Payments: if you pay through Tyzra, Stripe handles your card details. We see the payment status and amount, never your full card number.
• Usage data: IP address, browser and device type, pages visited, and recordings of how you use the app while signed in (see Session Recordings below).

How We Use Your Data

• To provide the core service: connecting coaches with clients, managing check-ins, and tracking workouts.
• To authenticate your account and maintain your session.
• To send emails and notifications you need, such as invites, check-in reminders and password resets.
• To take payments for coaching and for Tyzra plans.
• To improve the product and fix issues.

We do not sell your personal data. We do not use your data for advertising. We share it only with the service providers listed below, and only so they can run their part of Tyzra.

Protocol and Bloodwork Records

A coach can choose to keep a record of a client's enhanced protocol (compounds, amounts, timing and injection-site notes) and blood test results with the lab reports behind them. These records are health information, a special category of personal data.

• Explicit consent: we process these records only with the client's explicit consent, asked for separately for protocols and for bloodwork. The client sees what is recorded and who sees it, confirms they are 18 or over, and ticks an unticked box to agree. We keep a record of who agreed, when, and the exact text they were shown. Nothing can be recorded before the client agrees.
• Who is responsible: the client gives consent to their coach. Tyzra stores the records on the coach's behalf, and the coach accepts Tyzra's terms for these features before using them.
• Who can see them: the client's coach. The client sees their bloodwork, and sees their protocol schedule only when the coach shares it. A coach can create a report link, for example for a doctor. The client is told when a link is created, and links expire after 7 days.
• No other use: we never use these records for anything else, never sell or share them, and keep them out of analytics and session recordings. Text is read from uploaded lab reports on Tyzra's own servers, never by an outside service. Tyzra does not give medical advice.
• Withdrawal: a client can withdraw consent at any time in Settings > Privacy. The coach can then no longer add entries, and that feature's records, uploaded lab files and report links are deleted immediately. We keep only the record of the consent and its withdrawal.
• Retention: if the coach turns a feature off while consent stands, existing records are kept so history is not lost, until the client withdraws, asks for deletion, or has their account deleted. A client can ask for a copy or for deletion by contacting their coach or emailing us.

Service Providers

These companies process data for us to run Tyzra:

• Supabase: database and sign-in.
• Cloudflare: file storage for photos, voice notes, lab reports and other uploads, and a check that you're a person when you sign up or sign in.
• Vercel: hosting, plus page-view and page-speed statistics that use no cookies.
• Stripe: payments.
• Resend: sending email.
• Sentry: error reports, stored in the EU.

If you turn on notifications, your browser maker's push service (such as Apple, Google, Microsoft or Mozilla) delivers them in encrypted form. When you open an exercise that has a YouTube video, the video loads from YouTube.

Session Recordings

While you're signed in, we record how you use the app: the pages you open, what you click and what's on screen. We use these recordings to find and fix problems, and only the Tyzra team can watch them. Passwords are never recorded, and progress photos, messages, and protocol and bloodwork screens are hidden. When something breaks, Sentry also keeps a short recording of the moments before the error. We delete recordings after 90 days.

Cookies and Storage

We don't use advertising or tracking cookies. We use:

• Sign-in cookies that keep you signed in, removed when you log out.
• A small cookie with your name, initials, whether you're a coach or client and, for coaches, your business name, so our public pages can show the right buttons. It is removed when you log out.
• If you arrive through a coach's referral link, a cookie that holds the referral code for 90 days so the referral can be credited.
• Your device's own storage for unsent drafts, such as a workout or check-in in progress, and display settings. This stays on your device.

Data Retention

We keep your data for as long as your account is active. Check-in history, progress photos, and workout logs are retained so you and your coach can review historical progress. If you ask us to delete your account, we will remove your personal data within 30 days. Files a coach sends us to move their clients in are deleted 30 days after the clients are moved in.

Data Security

All data is transmitted over HTTPS. Photos and other files are kept in private storage and shown through links that expire, so they cannot be opened without permission. The one exception is a coach's logo, which is public so it can appear as the app icon on clients' phones. Database access is controlled by row-level security policies that restrict data access to authorized users.

Your Rights

You can:

• Request a copy of your personal data.
• Request correction of inaccurate data.
• Request deletion of your account and associated data.

To exercise any of these rights, contact us at the email below.

Changes to This Policy

We may update this policy from time to time. If we make significant changes, we will notify you through the application. Continued use of Tyzra after changes constitutes acceptance of the updated policy.

Contact

If you have questions about this privacy policy or want to request data deletion, email us at support@tyzra.com.