This Privacy Notice for MetaByte Solutions ("we," "us," or "our") describes how and why we might access, collect, store, use, and/or share ("process") your personal information when you use our services ("Services"), including when you:
- Download and use our mobile application (YogaCrunch / AI Yoga Mentor), or any other application of ours that links to this Privacy Notice
- Use YogaCrunch — a mobile app that runs an AI interview to build you a personalised yoga plan, adapts that plan each week, and (only if you switch it on) gives you live on-device camera form correction
- Engage with us in other related ways, including any support, sales, or events
Questions or concerns? Reading this Privacy Notice will help you understand your privacy rights and choices. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policies and practices, please do not use our Services. If you still have questions or concerns, contact us at aiyogacrunch.support@gmail.com.
Where This Policy Is Today
YogaCrunch is under active development. This notice is written in two layers so it is always honest about the app in your hands:
- "Today" — describes the build that is currently released. This is what actually processes your data right now.
- "Planned" — describes features we are building next (subscriptions, wearable sync, in-app data export, product analytics, crash reporting). These are not active yet and do not process your data today. Before any planned feature ships, we will update this notice and — where the feature involves new or sensitive data — ask for your separate consent inside the app. See Section 14.
Summary
What personal information do we process today? Profile details you enter (age, gender, height, weight, experience level), a health record from the interview and check-ins (injuries, conditions, flexibility, stress and sleep answers, and the safety tier the interview assigns), your goals and lifestyle preferences, your account email, and your practice history (sessions, per-pose accuracy, reflections, mood and pain check-ins, progress measures).
Do we process sensitive information? Yes — your health record is health information, which some laws call "special category" or "sensitive" data. We process it to build and adapt your plan and to keep you safe during practice. You can erase all of it at any time with the Delete Account button.
What never leaves your phone? When camera correction is on, the app analyses the camera feed on your device to check your joint angles and draw the skeleton overlay. Camera video frames, body-point coordinates, the overlay, and per-frame scores are processed on your device and then discarded. There is no upload path for any of them anywhere in the app. We also never collect your location or your contacts.
Who do we share it with today? Only the service providers that host and run the app on our instructions. We do not sell your personal information and we do not use it for advertising.
How do you exercise your rights? Use Settings → Delete Account in the app to erase everything, or contact us at aiyogacrunch.support@gmail.com for any other request.
1. What Information Do We Collect?
1.1 Personal information you disclose to us — collected today
In short: we collect the personal information that you provide when you create an account and use the app.
The personal information we collect depends on how you interact with the Services and the features you use. Today this includes:
- Account data — your email address, and a password that our authentication provider stores only as a secure one-way hash.
- Profile data — age, gender, height, weight, experience level, and your join date.
- Goals and lifestyle data — your ranked goals for practice, what has not worked for you in past apps, days per week, minutes per session, and your preferred time and place to practise.
- Practice data — sessions completed, per-pose accuracy scores, written reflections, mood check-ins, pain reported after a session, badges and achievements, and progress measures (flexibility, balance, strength, form, consistency) tracked over time.
- Support communications — the content of any message you send us.
Sensitive information (collected today). With your consent, we process the following, which is health information and is treated as sensitive / special-category data:
- Health record — injuries, medical conditions, a "doctor-cleared" flag, flexibility, and stress and sleep answers you give in the interview and in weekly check-ins, together with the safety tier (1, 2, or 3) and "safe mode" state that the interview derives from those answers.
- Condition programme data (only if you follow a condition programme) — which programme, the week you have reached, and your weekly self-rating of the target problem (for example pain, stress, or sleep).
You can erase all of the above at any time — see Section 16.
1.2 Information processed on your device only — camera correction
In short: when camera correction is on, the app analyses the camera feed entirely on your device. Nothing from the camera is ever uploaded or stored.
If you enable camera correction, the app uses your device camera and an on-device pose-detection model to estimate your joint angles and draw a skeleton overlay so you can check your form. The following are processed transiently in memory on your device and then discarded:
- camera video frames
- body-point (skeleton) coordinates
- the skeleton overlay
- per-frame joint accuracy scores
None of this is uploaded to any server, transmitted to us or any third party, or written to persistent storage — ever. This is a structural property of how the feature is built, not a setting you have to find. Only the summary outputs you would expect to keep — for example a session's overall per-pose accuracy score and any reflection you write — are saved to your account.
1.3 Information automatically collected — today
In short: the app stores your plan and content on your device so it works offline, and needs the standard Android permissions for the features you turn on.
- On-device app data — your downloaded plan, the pose library, cached pose videos, session drafts, your reminder settings, and your theme choice are stored locally on your device so the app works offline and remembers your settings. This stays on your device; deleting your account (or uninstalling the app) removes it.
- Android permissions — camera (only if you use camera correction), notifications (only if you set a practice reminder), and microphone (only during the voice interview). You grant each one through the standard Android permission prompt and can revoke it in Android Settings at any time.
- Practice reminders are scheduled locally on your device. They do not run through a server and do not send us any data.
1.4 What we do NOT collect
We do not collect or store camera video or images, your precise or approximate location, your contacts, your advertising ID, or any cross-app tracking identifiers. We do not use advertising or tracking SDKs.
1.5 Information collected by planned features — not collected today
The following are not active in the current app and are described here for transparency. Each is covered in Section 14:
- app-store subscription status (when in-app subscriptions launch)
- physiological data from a connected wearable — sleep, resting heart rate, HRV, steps, session heart rate (when the optional Health Connect integration launches)
- de-identified product-usage analytics and crash diagnostics (when those tools are added, behind their own switch)
2. How Do We Process Your Information?
In short: we process your information to provide and run the Services, keep you safe during practice, communicate with you, and comply with law. We rely on your consent for health data and can act only where we have a valid legal reason.
Today we process your personal information to:
- Create and manage your account and let you log in and stay logged in.
- Run the AI interview and build your initial plan — your profile, goals, lifestyle and health answers are used to generate your first personalised plan. The interview uses a real-time voice service and an AI language model; see Section 3.
- Adapt your plan each week — from your practice history, reflections, and mood and pain check-ins.
- Keep you safe during practice — the injuries and conditions you tell us about are used to widen or narrow the acceptable joint-angle range during camera correction, so the app does not push you past a limit you have declared. Pose selection is always routed through a fixed, rules-based safety check.
- Show you your progress — your practice data and progress measures produce your progress report and achievements.
- Deliver the reminders you set — scheduled locally on your device.
- Respond to your support requests.
- Keep the Services secure and prevent fraud and abuse.
- Comply with legal obligations — for example responding to lawful requests, and establishing or defending legal claims.
Legal bases (EEA / UK). We rely on: consent for processing your health record and other sensitive data (and you may withdraw it at any time); performance of a contract to provide the plan, camera correction, and progress features you sign up for; legitimate interests to keep the Services secure and to improve them; and legal obligation where the law requires processing.
↑ Back to top3. When and With Whom Do We Share Your Personal Information?
In short: today we share information only with the providers that host and run the app on our instructions. We do not sell your personal information and we do not use it for advertising.
Each provider below processes data only on our instructions and only to provide its part of the Service, under a contract that requires it to protect your information. We share the minimum each one needs.
3.1 Service providers we use today
| Provider | Role | What it receives |
|---|---|---|
| Supabase (database, authentication, file storage) | Hosts your account and stores your profile, health record, plan, and practice history. Hosted in the Seoul, South Korea (ap-northeast-2) region. | All account data you provide, protected by row-level security so each account can access only its own rows. |
| LiveKit | Real-time voice transport for the sign-up interview (microphone in, audio out, turn detection). | Live interview audio and transcript, during the interview only. |
| Google (Gemini API, via Google AI Studio) | Speech-to-text / text-to-speech and the language model that powers the interview and the plan-building step. | The interview transcript and the structured profile and goal data extracted from it. |
| Modal | Cloud compute that runs the AI planning and evaluation steps and the weekly re-plan queue. | The structured inputs those steps need (profile, goals, the safe pose pool, practice summaries). |
| Email delivery provider | Sends account emails such as sign-up confirmation and password reset. | Your email address and the message content. |
3.2 Providers we plan to add
The following are not in use today. Each is covered in Section 14 and this notice will be updated before any of them goes live: Google Play Billing and a subscription-management provider (subscriptions), Health Connect (optional wearable sync), a push-notification service (server-sent alerts), a crash-reporting provider, a product-analytics provider, and a consent / data-request management tool.
3.3 Other disclosures
- Business transfers. We may share or transfer your information in connection with a merger, sale of company assets, financing, or acquisition of all or part of our business. We will notify you and tell you of any choices you may have.
- Legal requirements. We may disclose your information where legally required to comply with applicable law, a governmental request, a court order, or legal process.
We do not sell your personal information, and we do not share it for third-party marketing or advertising.
↑ Back to top4. What Is Our Stance on Third-Party Websites?
In short: we are not responsible for the safety of information you share with third parties that we link to.
The Services may link to third-party sites or services (for example your app store, or an external help article). We cannot guarantee the safety and privacy of data you provide to third parties, and any data they collect is not covered by this Privacy Notice. We encourage you to read the privacy notice of every site you visit.
↑ Back to top5. Do We Use Cookies and Other Tracking Technologies?
In short: the mobile app does not use cookies and, today, contains no analytics or tracking SDKs.
Our mobile application does not use browser cookies. It stores data locally on your device (a local database and preferences) so that your downloaded plan, pose library, and session drafts work offline and so the app remembers your settings.
The current app contains no product-analytics SDK, no crash-reporting SDK, and no advertising or cross-app tracking. If we add privacy-friendly product analytics or crash reporting in future, it will be behind its own switch and disclosed in Section 14 and here.
↑ Back to top6. Is Your Information Transferred Internationally?
In short: your primary data store is in South Korea, which the EU recognises as providing an adequate level of data protection. Some service providers operate in the United States.
Our servers and primary database are located in South Korea (Seoul region). South Korea benefits from a European Commission adequacy decision under the GDPR (in force since December 2021, reconfirmed in 2026), so personal data can be transferred from the EEA and the UK to our database without additional safeguards.
Some providers in Section 3 operate in the United States or other countries whose data-protection laws may differ from those in your country. Where we transfer personal information to them, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and equivalent UK mechanisms, alongside the contractual and security commitments described in this notice.
For more information about the safeguards we use, contact us at aiyogacrunch.support@gmail.com.
↑ Back to top7. How Do We Keep Your Information Safe?
In short: we use organisational and technical security measures to protect your information, though no system is perfectly secure.
Our measures include:
- On-device-only camera processing — camera video is structurally unshareable (see Section 1.2).
- Row-Level Security on every table holding user data, from the first database migration, so each account can read and write only its own rows.
- Encryption in transit for all traffic between the app and our servers.
- Access controls limiting staff and provider access to what is necessary.
- Separation of privileged keys — administrative database keys are never included in the mobile app; account deletion runs through a server function that verifies your identity from your login token.
- Log hygiene — our systems are configured not to write raw health-record fields to logs.
- Device backups disabled — the app opts out of Android system and cloud backups so health-adjacent data does not ride along in them.
Despite these measures, no method of electronic transmission or storage is 100% secure, so we cannot guarantee absolute security. Access the Services within a secure environment.
8. How Long Do We Keep Your Information?
In short: we keep your information for as long as your account exists, and then delete it.
We keep your personal information only for as long as necessary for the purposes in this notice, unless a longer period is required or permitted by law. For most of your data, that period is for as long as you maintain an account with us.
When you delete your account, we delete your account and its associated personal information from our active systems immediately. Residual copies in encrypted backups are cycled out on a rolling basis after that. Anonymised or aggregated data that can no longer be associated with you may be retained.
A minimal record that a deletion request was made and fulfilled may be kept where the law requires it.
↑ Back to top9. What Are Your Privacy Rights?
In short: depending on your location, you may have rights to access, correct, delete, export, and restrict processing of your information, and to withdraw consent. Today, deletion is a one-tap action in the app; other requests are handled by contacting us.
Depending on where you live, you may have some or all of the following rights (including under the GDPR and UK GDPR): access, rectification, erasure, restriction of processing, objection to processing, data portability, and withdrawal of consent.
9.1 Deleting your data — available today
The "Delete Account" button in Settings is the way to exercise your right to erasure today, and it is immediate and complete. When you use it:
- You open Settings → Delete Account and confirm by typing the word DELETE, so it cannot be triggered by accident.
- The app calls a secure server function that identifies you from your own login token — you can only ever delete your own account, never anyone else's.
- Your account is deleted on the server. Every table of your data — profile, health record, plan, sessions, progress, condition programmes, achievements — is linked to your account with an automatic cascade, so this single action erases all of it.
- The app then wipes its local copies from your device — the offline plan and pose cache, cached pose videos, reminder schedules, and settings.
- You are returned to the login screen. The deletion is permanent and cannot be undone.
This was a deliberate design choice: giving you a single, obvious control to take your data back, rather than making you file a request and wait.
9.2 Other rights — by request today
For access, correction, a portable export of your data, restriction, or objection, contact us at aiyogacrunch.support@gmail.com. We will verify your identity using your account details and respond within the time required by law (one month under the GDPR, extendable where permitted). There is normally no fee. A self-service in-app data export and a data-inventory screen are planned — see Section 14.
9.3 Withdrawing consent
Where we rely on your consent (for your health record and other sensitive data), you may withdraw it at any time by contacting us or by deleting your account. Withdrawing consent does not affect the lawfulness of processing before withdrawal, or processing under another legal basis.
9.4 Right to complain
If you are in the EEA or UK and believe we are processing your personal information unlawfully, you may complain to your local data protection supervisory authority (EEA list; UK: the Information Commissioner's Office).
↑ Back to top10. Controls for Do-Not-Track Features
Most browsers and some operating systems and applications include a Do-Not-Track ("DNT") setting. No uniform standard for recognising and implementing DNT signals has been finalised, so we do not currently respond to them. Our mobile app does not track you across other companies' apps or websites. If a standard is adopted that we must follow, we will update this notice.
↑ Back to top11. Do We Collect Information From Minors?
In short: we do not knowingly collect data from or market to children under 16.
We do not knowingly collect data from, solicit data from, or market to children under 16 years of age, nor do we knowingly sell such personal information. By using the Services, you represent that you are at least 16, or that you are the parent or guardian of such a minor and consent to their use of the Services. If we learn that we have collected personal information from a user under 16, we will deactivate the account and take reasonable steps to promptly delete the data. If you believe we may have collected data from a child under 16, contact us at aiyogacrunch.support@gmail.com.
↑ Back to top12. Do United States Residents Have Specific Privacy Rights?
In short: if you live in California, Colorado, Connecticut, Virginia, or another US state with a comprehensive privacy law, you may have rights to access, correct, delete, and obtain a copy of your personal information, and to withdraw consent. These rights may be limited by applicable law.
Categories of personal information we have collected in the past 12 months: identifiers (email address); personal information categories listed in the California Customer Records statute (physical characteristics you provide — height, weight); characteristics of protected classifications (age, gender); commercial information (not collected today; subscription status once subscriptions launch); internet or other network activity (on-device app activity; no analytics SDK today); and sensitive personal information (health information).
We collect this information directly from you and from your device. We use and disclose it for the business purposes described in Section 2 and Section 3.
We do not "sell" or "share" personal information as those terms are defined under California's CCPA/CPRA, and we do not process personal information for "targeted advertising." This applies to all users, including minors under 16.
Use of sensitive personal information. We use sensitive personal information only to provide the Services you have requested (building and adapting your plan, and keeping you safe during practice). We do not use or disclose it for purposes to which a "right to limit" would apply.
Your US state rights may include: confirming whether we process your personal information and accessing it; correcting inaccuracies; deleting your personal information; obtaining a portable copy; withdrawing consent; and appealing a refusal to act. To exercise them, use Settings → Delete Account in the app, or contact us at aiyogacrunch.support@gmail.com. We will verify your request using your account information. You may use an authorised agent. We will not discriminate against you for exercising your rights. You may also contact your state attorney general with a complaint.
↑ Back to top13. Do Other Regions Have Specific Privacy Rights?
In short: you may have additional rights depending on your country.
Australia. We handle personal information under the Australian Privacy Act 1988. You may complain to the Office of the Australian Information Commissioner.
Republic of Korea. Because our primary infrastructure is hosted in South Korea, processing is also carried out in accordance with the Personal Information Protection Act (PIPA). You have rights of access, correction, deletion, and suspension of processing, and may complain to the Personal Information Protection Commission (PIPC).
Other regions. If your jurisdiction has a data protection law not named here, you may still have rights of access, correction, and deletion. Contact us and we will act in accordance with applicable local law.
↑ Back to top14. Features We Are Planning
In short: these features are not in the current app. This section tells you in advance what data each will involve and how we will handle consent. We will update this notice — and ask for your consent inside the app where needed — before any of them goes live.
| Planned feature | What it will do | New data involved | How we will handle it |
|---|---|---|---|
| Premium subscription | Unlock camera correction, the full plan, unlimited sessions, condition programmes, offline downloads, and the full progress report. | Your app-store subscription status, plan, renewal date, and an anonymised purchase identifier — received from Google Play Billing and a subscription-management provider. No payment card number reaches us. | Disclosed in an updated notice; billing is handled by your app store under its own terms. |
| Wearable / smartwatch sync (optional) | Read sleep, resting heart rate, HRV, steps, and session heart rate from Android Health Connect to shape and report on your sessions. | Physiological data — treated as sensitive / special-category data, exactly like your health record. | Off by default, with its own separate consent switch shown before any data is read. Turning the switch off deletes the data it imported. |
| Server-sent notifications | Alerts that need a server (for example a clinician on-call alert), in addition to the on-device reminders that exist today. | A device push token. | Disclosed in an updated notice; tied to notifications you have asked for. |
| In-app data view and export | A screen that lists everything stored about you, by category, and lets you export it in a portable form without contacting us. | No new data — a new way to see and retrieve what we already hold. | Added to Section 9 when it ships. Until then, request an export by email. |
| Granular consent switches | Separate, individually revocable switches for health data, camera, wearable data, and anonymous usage data, each recorded with a timestamp and the policy version in force. | Permission records (which switches you set, and when). | Replaces the current model where using a feature is the consent for it. |
| Product analytics and crash reporting | Understand which features are used and where sessions fail, and diagnose crashes, so we can improve the app. | De-identified usage events tied to a random identifier; technical crash details and device model. Never tied to your name or contact details. | Behind an anonymous usage-data switch that is off until you turn it on. Providers added to Section 3. |
| Clinician (physical therapist) review | An optional feature where a clinician working inside this app reviews part of your practice to help you. | The clinician sees only what is needed to help you; the feature runs on a role-restricted screen, not a third-party platform. | Opt-in, disclosed in an updated notice before launch. |
If your view of these plans changes what you are comfortable sharing, remember you can erase everything today with Settings → Delete Account.
↑ Back to top15. Do We Make Updates to This Notice?
In short: yes. We will update this notice as our features and the law change.
We may update this Privacy Notice from time to time, shown by a revised "Last updated" date. If we make material changes, we may notify you by prominently posting a notice or by sending you a direct notification, and — where the law requires it, or where a new feature involves new or sensitive data — we will ask for your consent again. We encourage you to review this notice regularly.
↑ Back to top16. How Can You Review, Update, or Delete the Data We Collect From You?
You may have the right to request access to the personal information we collect from you, details of how we have processed it, correction of inaccuracies, and deletion, and to withdraw consent. These rights may be limited by applicable law.
To delete everything (available now):
- Open the app and go to Settings → Delete Account.
- Type DELETE to confirm.
- Your account and all of its data are erased from our servers and from your device, and you are returned to the login screen. This is permanent.
For any other request (access, correction, a portable export, restriction, or objection): email aiyogacrunch.support@gmail.com. We will verify your identity using your account details and respond within the time required by law.
↑ Back to top17. How Can You Contact Us About This Notice?
If you have questions or comments about this notice, you may contact us at:
MetaByte Solutions