Privacy Policy
Pryma turns your workouts, sleep and heart data into one daily call: push, train easy or rest. This page explains exactly which data the app uses, where it goes, and what never leaves your phone.
Who is responsible
Pryma is built and operated by Nihar Sherwal, an individual developer based in India, trading as Pryma Labs. For anything in this policy, including requests about your data, write to support@prymalabs.com.
The short version
- Apple Health data never leaves your phone. Sleep, heart rate, HRV and resting heart rate from Apple Health are read and processed on the device only. We have no copy of them.
- Strava activities are stored on our servers so the app can calculate your score; GPS routes are not.
- No advertising, no data sales, no cross-app tracking. The only analytics are first-party and never include health values.
- You can delete everything from inside the app (Athlete → My Account → Delete account).
What we collect, and why
| Data | Where it comes from | Why | Where it is kept |
|---|---|---|---|
| Name, units, training style, weekly frequency, risk tolerance, fitness baselines (5k time, thresholds, FTP, heart-rate limits) | You, during onboarding and in Customization | To calculate your Readiness Score and tailor the Best Move options | Our servers (Supabase) |
| Workouts: sport, name, date, duration, distance, elevation, heart rate (average, max, time in zones), power, speed, cadence, calories | Strava (with the permission you grant), or Apple Health | To compute training load, Training Balance and your daily score | Strava data: our servers. Apple Health data: your phone only |
| Sleep, heart rate variability, resting heart rate, overnight heart rate | Apple Health, only if you connect it | Recovery signals in your score and the Sleep, HRV and Resting HR screens | Your phone only; never uploaded |
| Effort ratings and muscle groups you give after a workout; the plan option you commit to each day | You, in the app | To improve the accuracy of your score and recommendations | Our servers |
| Account identifiers: an app account id, and, if you sign in that way, your Apple ID name and email (which may be Apple's private relay address) or your Strava athlete id and first name | Apple or Strava sign-in | To keep your data with your account across devices | Our servers |
| Strava access and refresh tokens | Strava, when you connect | To keep your activities in sync | Our servers; never in the app |
| Push notification token, your time zone, and your chosen reminder time | Your device, if you turn on the morning reminder | To send the morning readiness reminder | Our servers |
| Feedback you submit, including optional screenshots | You, via Submit Feedback | To fix problems and improve the app | Our servers |
| Purchase status (whether you have Pryma Plus, which plan, trial and renewal dates) | Apple, via our subscription provider | To unlock Plus features and honour your purchase | RevenueCat; Apple keeps the payment itself |
| Approximate location, for the weather on the Today screen | Your phone, only if you allow location access | To show local weather next to today's plan | Not stored by us; see “Weather” below |
We do not collect your age, date of birth, sex, weight or height. We do not store your Strava GPS route coordinates; we only note whether an activity had GPS.
Apple Health
With your permission, Pryma reads health and fitness data from Apple Health, including workouts, heart rate, heart rate variability, resting heart rate and sleep, to calculate your Readiness Score. This data is processed on your device only and is never uploaded to our servers. Pryma never writes to Apple Health. We never use health data for advertising or marketing, never sell it, and never share it with third parties for their own purposes. You can revoke Pryma's access at any time in the iOS Health app under Sharing → Apps.
Strava
If you connect Strava, we access your activities with the permission you grant (activity:read_all) and store the activity details listed above on our servers, so your score can be calculated and kept up to date through Strava's webhooks. Up to two years of history is imported when you connect. Signing out of the app stops syncing; deleting your account revokes Pryma's Strava authorisation and deletes the synced activities. You can also remove Pryma from Strava → Settings → My Apps. Strava's own handling of your data is governed by Strava's privacy policy.
Health data and your consent
Health and fitness information is a special category of personal data under the GDPR and UK GDPR. We process it only on the basis of your explicit consent, given when you connect Apple Health or Strava, and solely to provide the Readiness Score and related recommendations (Article 9(2)(a)). Your account and preferences are processed to provide the service you asked for (Article 6(1)(b)). You may withdraw consent at any time by disconnecting the data source or deleting your account; this does not affect processing already carried out.
Weather
If you allow location access, the app sends your approximate coordinates directly from your phone to Open-Meteo (open-meteo.com), a weather service, to fetch the current conditions, and asks iOS for a place name to display. No account identifier is sent with the request, and your location is not sent to our servers or stored by us. The weather result is cached on your phone. Decline the location prompt and this feature simply stays off.
Usage analytics
To understand how Pryma is used and improve it, we collect product-usage events with PostHog, hosted in the EU (Frankfurt): which screens you visit and for how long, which features you use, whether reminders are opened, and milestones such as completing onboarding. These events are linked to your app account id. They never include your health data: no sleep durations, heart rates, heart-rate variability, workout details or readiness scores leave your device as analytics; at most a coarse category such as “readiness was in the good-to-train band”. We do not collect your location for analytics, do not use advertising identifiers, and do not share these events with advertisers or data brokers. You can turn analytics off at any time in Athlete → Customization → “Share usage analytics”. When you delete your account, the analytics profile and its events are deleted too.
Purchases
Pryma Plus is sold through Apple's App Store. Apple processes the payment and holds your payment details; we never see them. We use RevenueCat to check whether your account has an active subscription or trial; it receives your app account id and Apple's purchase record (product, dates, status), nothing else. Manage or cancel a subscription in your Apple ID settings.
Who else processes your data
| Provider | Role | Data | Location |
|---|---|---|---|
| Supabase | Database, sign-in, server functions | Profile, workouts (Strava), feedback, plans, tokens, push settings | Tokyo, Japan |
| Apple | Apple Health (on device), Sign in with Apple, App Store purchases, push notifications | Health data stays on device; sign-in identity; purchase records | Apple's infrastructure |
| Strava | Activity source | Your Strava activities and authorisation | United States |
| PostHog | Product analytics | Usage events only | Frankfurt, EU |
| RevenueCat | Subscription status | Account id and purchase status | United States |
| Expo (push service) | Delivers the morning reminder | Push token and the notification text | United States |
| Open-Meteo | Weather | Approximate coordinates, sent from your phone | EU |
Where data leaves the EEA or UK, it goes to a country with an adequacy decision (Japan) or is covered by Standard Contractual Clauses with the provider (United States). No provider may use your data for its own purposes.
How long we keep it
For as long as your account exists. When you delete your account, we permanently delete your profile, workouts, feedback, plans, push settings and Strava connection from our servers, revoke Pryma's access at Strava, and delete your analytics profile. Data on your phone is removed when you delete the app. Backups of our database are overwritten within 30 days.
Security
Data travels over encrypted connections (HTTPS). On our servers, row-level access rules mean each account can only read its own rows. The sign-in session is stored on your device; keep your phone's passcode on. No system is perfectly secure, so if we ever learn of a breach affecting you, we will tell you.
Your rights
You can access, correct, export and delete your data, restrict or object to processing, and withdraw consent. Deletion is built into the app (Athlete → My Account → Delete account). For a copy of your data or any other request, email support@prymalabs.com; we answer within 30 days. If you are in the EEA or UK you may also complain to your data protection authority. If you are a California resident: we do not sell your personal information or share it for cross-context behavioural advertising.
Children
Pryma is not directed at children under 16 and we do not knowingly collect data from them. If you believe a child has created an account, email us and we will delete it.
Changes
If this policy changes in a way that matters to you, we will show the new version in the app before it takes effect. The date at the top is always the version in force.