Legal

Privacy Policy

Effective September 16, 2026 · Version 2026-09-16

1. Scope

This Privacy Policy describes how Physy (“Physy,” “we,” “us,” or “our”) handles information when you use the Physy mobile application, website, and related services (the “Services”).

2. Information we collect

Account information

We collect your name and email address to create and secure your account, authenticate you, send account-related messages, and associate your synchronized data with you.

Workout information

If you use cloud synchronization, we process the plans, exercises, plan membership, workout sessions, completion records, timestamps, and related settings that you choose to create in the app.

Consent records

We record the version and time of your acceptance of our Terms and Privacy Policy. If you separately opt in to marketing, we record and honor that preference. Marketing consent is optional and is not required to use the app.

Technical information

Our service providers may process limited technical data needed to provide authentication, security, synchronization, delivery, and diagnostics, such as IP address, request timestamps, device or app version, and delivery or error logs.

Progress photos

Physy does not upload progress photos to its cloud services. Photos remain in the app’s private storage on your device. If you choose to create or send a backup to Google Drive, Dropbox, or another destination, that transfer is initiated by you and is governed by the destination provider’s terms and privacy practices.

3. How we use information

• Provide authentication, account management, workout tracking, and synchronization.
• Maintain security, prevent abuse, troubleshoot errors, and improve reliability.
• Send essential account messages such as sign-in codes, email-change verification, security notices, and important service communications.
• Send product news, tips, or offers only when you have separately opted in. You can unsubscribe at any time.
• Comply with applicable law and enforce our Terms.

4. Service providers and disclosures

We use service providers to operate the Services, including Supabase for authentication and synchronized database services, an email delivery provider for account and consented marketing email, Cloudflare for website delivery and domain services, Google Play for Android distribution, and user-selected backup destinations such as Google Drive or Dropbox.

We do not sell your personal information. We do not share personal information for cross-context behavioral advertising. We may disclose information when required by law, to protect rights and safety, in connection with a business transaction, or to vendors acting on our instructions under appropriate safeguards.

5. Data storage, retention, and security

Physy is offline-first. Some data is stored locally on your device, while account and eligible workout data may be synchronized to our cloud service. We retain account data while your account is active and for only as long afterward as reasonably necessary for security, legal, dispute-resolution, and backup purposes. Local data may remain on a device after sign-out until you remove the app data or uninstall the app.

We use reasonable administrative, technical, and organizational safeguards, including encrypted network transport, access controls, and user-level database restrictions. No method of storage or transmission is completely secure.

6. Your choices and rights

You can update your name and email in the app, withdraw marketing consent, export available data through the app’s backup tools, or request account deletion. Depending on where you live, you may also have rights to access, correct, delete, restrict, or receive a copy of personal information, or to object to certain processing.

To delete your account and cloud data, follow the instructions on our account deletion page. Removing the app alone does not delete cloud account data.

7. Children

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If local law requires a higher minimum age for independent consent, that higher age applies.

8. International processing

Your information may be processed in the United States and other countries where our service providers operate. Those locations may have different data-protection laws than your home jurisdiction.

9. Changes

We may update this policy as the Services change. We will post the revised policy with a new effective date and provide additional notice when required.