Privacy

Privacy Policy

Last updated: October 31, 2026

NYUS Inc. ("NYUS", "we", "our", "us") operates the NYUS mobile application and related services (collectively, the "Service"). This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, and the rights you have over it.

1. Information We Collect

1.1 Information you provide directly

• Account data: email address, name and profile photo. Member accounts have no password: you sign in with a one-time code we email you (we store only a hash of it) or with Google Sign-In.
• Body stats and health profile: age, sex, height, weight, activity level, goals, dietary preferences, allergies, training history.
• Logged data: meals, workouts, weights, measurements, sleep, mood, ratings, and progress photos you choose to upload.
• Optional health details: medical conditions and medications you choose to enter, and, if you turn it on, your menstrual cycle (last-period date and cycle length). We store them with your profile and use them to keep your plans and coaching safe and relevant.
• Mental-health check-ins: if you take the optional PHQ-9 wellness check-in, we store your answers and score so the app can respond to them.
• Meal photos: a photo you take to log a meal is sent to OpenAI to estimate what is on the plate. NYUS does not store that photo. Barcode scanning reads the code on your phone, and the camera image does not leave it; NYUS receives only the barcode number. A picture you keep for a meal is saved on your phone only: NYUS does not upload or receive it (if you use your phone's own Google backup, that backup may include it).
• Voice input: if you tap the microphone (it asks for microphone permission), your phone's speech recogniser, an Android or Google service and not NYUS, turns your speech into text. NYUS receives only that text and does not record or store audio.
• Chat content: messages exchanged with the in-app AI coach and other users.
• Support requests: the message you send to support and any image, PDF, text or video file you attach.
• Payment data: payments are processed by Razorpay. We receive the plan, amount, date and Razorpay order and payment IDs. Your card, UPI or bank details go to Razorpay only; we never see or store them.

1.2 Information from Health Connect (with your permission)

If you grant permission, NYUS reads the following from Android Health Connect:

• Steps (READ_STEPS) — daily step counts for activity tracking.
• Total calories burned (READ_TOTAL_CALORIES_BURNED) — daily energy expenditure.
• Weight (READ_WEIGHT, WRITE_WEIGHT) — body weight history; when you save a weight on the Log Weight screen with Health Connect connected, we write that weight back to Health Connect.
• Heart rate (READ_HEART_RATE) — workout intensity tracking, and the high-heart-rate alert if you turn it on.
• Exercise (READ_EXERCISE) — completed sessions. NYUS never writes workouts to Health Connect.
• Sleep (READ_SLEEP) — sleep duration and stages, for recovery insights and the sleep alerts you turn on.
• Resting heart rate (READ_RESTING_HEART_RATE), heart rate variability (READ_HEART_RATE_VARIABILITY), blood oxygen (READ_OXYGEN_SATURATION) and breathing rate (READ_RESPIRATORY_RATE) — shown on your Health alerts screen and used only for the alerts you choose to turn on.

Data read from Health Connect is copied to our servers so it appears in your history and can power the alerts you set. Synced Health Connect data, such as your steps, sleep, weight, workouts and figures worked out from your heart rate, is also included in the context sent to our AI provider, OpenAI (Section 4), for coach replies. It is never used for advertising, never sold, and is deleted with your account (Section 7). NYUS's use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements.

You can revoke Health Connect access at any time from Health Connect settings on your device. Revoking permission stops further reads; data already imported into NYUS is governed by Section 7 (retention and deletion).

1.3 Information collected automatically

• Device and usage data: device model, OS version, app version, IP address, crash and error reports (sent to our own servers, which forward them to our team's Discord alert channel, see Section 4), performance metrics, feature interactions.
• Identifiers: a NYUS user ID, a device push token (for notifications), and a Firebase Analytics app-instance ID linked to your NYUS user ID. NYUS does not use the Android advertising ID: the app does not request it and Firebase Analytics is set not to read it.
• Cookies and local storage: used to maintain your session and remember preferences.

2. How We Use Your Data

• Provide, maintain, and improve the Service.
• Personalize your training plan, diet plan, and AI coaching responses.
• Compute progress charts, streaks, weekly insights, and notifications.
• Process subscriptions and prevent fraud.
• Send transactional and (with consent) marketing communications.
• Detect, investigate, and prevent security incidents and abuse.
• Comply with legal obligations.

3. Legal Bases (EEA / UK users)

• Contract: to deliver the Service you signed up for.
• Consent: for Health Connect data, marketing emails, push notifications.
• Legitimate interests: security, fraud prevention, product analytics.
• Legal obligation: tax, accounting, lawful requests.

4. Sharing and Disclosure

We share data only with the following categories of recipients:

• Oracle Cloud Infrastructure (Hyderabad, India): hosting and the database.
• OpenAI: writes the AI coach's replies and builds AI plans. It receives your messages, any meal photo you take to log a meal (to estimate it), and the profile and log details a reply needs, which can include medical conditions, medications, pregnancy status, digestive issues, menstrual cycle phase, wellness check-in results and data synced from Health Connect, under OpenAI's API data terms.
• Razorpay: processes payments.
• Resend: sends our emails (sign-in codes, account and deletion notices).
• Google: Firebase Cloud Messaging (push notifications), Firebase Analytics (app usage analytics), and Google Sign-In if you choose it.
• PostHog: product analytics (which screens and features are used, so we can improve the app). It receives app event names, screen paths and your NYUS user ID, never your email, messages or health values. Session recording is off.
• Discord: internal operational alerts for our team. Activity alerts carry event types, user IDs and counts, never message text, health values or email addresses. Error alerts (server errors and app crash reports) carry the error message and stack trace with email addresses and access tokens removed; an error message can occasionally include a value from the request that failed.
• Food and exercise lookups: to find nutrition data and pictures, our servers send USDA FoodData Central and Open Food Facts (nutrition and barcode data) and TheMealDB, Openverse, Unsplash and Pollinations (food and exercise pictures) only a food or exercise name or a barcode number, never anything about you. Some of those pictures then load in the app straight from the image host, which, like any website, sees your device's internet address.
• Legal: when required by law, court order, or to protect rights, safety, and property.
• Business transfers: in the event of a merger, acquisition, or asset sale, with notice to you.

We do not sell personal data and we do not use Health Connect data for advertising.

5. International Transfers

Our servers are in India (Oracle Cloud, Hyderabad region). Some processors above operate outside India: OpenAI and Google process data in the United States, and Resend and Discord also run outside India. We rely on their contractual safeguards for these transfers.

6. Security

Data travels over TLS. Our database storage is encrypted at rest by our cloud provider, and nightly database backups are encrypted (OpenPGP) before they leave our servers. Sign-in codes are stored only as hashes; sessions use signed tokens that expire, and each refresh token works only once. We also apply rate limiting and server-side input sanitization. No system is perfectly secure; please report anything suspicious to support@nyus.in.

7. Data Retention and Deletion

We keep your data while your account is active. You can delete your account at any time:

• From within the app: Profile → Settings → Delete Account.
• From the web: nyus.in/account-deletion.
• By email: support@nyus.in.

How deletion works. A request made in the app while you are signed in is scheduled at once: your account is permanently deleted 7 days later, and we email you a link to cancel until then. A request from the web or by email must first be confirmed from a link we send to the account's email address; nothing is deleted until you confirm, and the same 7 days then apply.

What is deleted. Your profile, body stats, plans, logs, progress photos, messages, AI coach history and data imported from Health Connect. Shared groups or challenges you created pass to another member, or are deleted if no one else is in them.

What we keep. Payment records (plan, amount, date and Razorpay IDs) for as long as Indian tax law requires; a record that the deletion happened, with your email address removed; and our internal audit log of staff actions. Encrypted database backups are kept for up to 90 days, so your data leaves the backups within 90 days of deletion. Usage analytics held by Google are deleted under Google Analytics' retention settings.

8. Your Rights

Depending on your jurisdiction (GDPR, UK GDPR, CCPA, DPDP Act 2023, etc.), you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion ("right to be forgotten").
• Restrict or object to processing.
• Data portability.
• Withdraw consent (e.g., revoke Health Connect at any time).
• Lodge a complaint with your data protection authority.

To exercise any right, email support@nyus.in. We respond within 30 days.

9. Children

NYUS is not directed at children under 13 (or 16 in the EEA). We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.

10. Third-Party Links

Our Service may link to third-party sites (e.g., Google Play, social platforms). Their privacy practices are governed by their own policies.

11. Changes to This Policy

We may update this Policy from time to time. We will notify you of material changes via the app or email. The "Last updated" date at the top reflects the latest revision.

12. Contact

NYUS Inc.
Email: support@nyus.in
Available Monday – Friday, 9:00 a.m. – 9:00 p.m. IST