Legal

Privacy Policy

Last updated: 5 July 2026

Ciyanu is a health and wellbeing app for iPhone and Android that helps you track fitness, nutrition, sleep and wellbeing. This policy explains what information the app handles, why, and the choices you have. The short version: your data is used to run the app for you, it is never sold, there is no advertising, and there are no third-party analytics or trackers.

1. Who is responsible for your data

Ciyanu is operated by Sameer Azeez, sole proprietor ("we", "us"). For anything in this policy, contact privacy@ciyanu.com.

2. Information you give us

• Account: your email address and a password (or Sign in with Apple on iPhone). Passwords are handled by our authentication provider and are never visible to us.
• Profile and onboarding answers: name, age, sex, height, weight, activity level, goals, and optional health context you choose to share such as medical conditions, medications, food allergies, dietary preferences, pregnancy status, and sleep habits. You can skip the optional items.
• Daily logs: meals and water, workouts and sets, runs and walks (including the GPS route if you use cardio tracking), sleep sessions, body measurements, and mood or wellbeing check-ins.
• Photos you take for analysis: food photos, nutrition label photos, and body composition photos are sent to our AI service to produce an estimate, then discarded. They are not stored on our servers. Progress photos you deliberately save are stored in a private storage area only your account can access.
• Chat messages: what you type to the in-app AI assistants (nutrition and wellbeing) is processed to generate the reply.

3. Information from your device, with your permission

• Apple Health (iPhone): if you allow it, the app reads data such as sleep, workouts, heart rate, steps and body measurements to fill in your dashboard, and writes workouts you complete in Ciyanu. You control every category in iOS Settings and can revoke access at any time.
• Location (cardio tracking): precise location is used only while you track a run, walk or ride, to draw your route and measure distance. The route is saved to your account as part of that activity. Location is never collected in the background outside an active tracked session.
• Camera: used only when you choose to photograph food, scan a barcode or nutrition label, or take a body composition or progress photo. Barcode reading happens on the device itself.
• Microphone and motion (iPhone sleep tracking): if you enable sound detection, short sleep-sound clips and movement estimates are recorded and stay on your phone only. They are never uploaded, and they are deleted when you sign out or delete the app.
• Notifications: reminders are scheduled locally on your phone. We do not run a push notification service and hold no push tokens.

4. Journal entries stay on your phone

The wellbeing journal is local-only. Entries are stored on your device, are not synced to our servers, and disappear if you delete the app.

5. How we use your information

• To run the app: sync your logs across the app, compute your scores and insights, and show your history.
• To personalise: your profile, goals and recent logs shape your workout plans, meal plans, targets and AI answers.
• To keep the service healthy: per-account daily limits on AI features and basic error logs (which contain technical details, not your health logs) help us prevent abuse and fix crashes.

We do not sell or rent your data, we do not show ads, and we do not use third-party analytics or advertising trackers of any kind.

6. AI processing

Ciyanu's AI features (meal plans, workout plans, food photo analysis, body composition estimates, sport fuel guidance, and the chat assistants) are powered by Anthropic's Claude models, called from our own servers. The relevant context (for example your goals, allergies, today's log summary, or the photo you just took) is sent to generate the result. Under Anthropic's commercial API terms, your inputs and the outputs are not used to train their models. AI outputs are estimates and general guidance, not medical advice.

7. Who else processes data, and why

• Supabase: our backend platform. It stores your account and synced logs in a managed database and handles sign-in. Data is encrypted in transit and at rest, and database rules restrict every record to the account that owns it.
• Anthropic: AI processing as described above.
• USDA FoodData Central and Open Food Facts: when you search foods or scan a barcode, the search text or barcode number is sent to look up nutrition facts. No account information goes with it.
• Apple App Store / Google Play: subscriptions and payments are handled entirely by Apple or Google. We never see your card details.
• Map tiles (Android cardio): the run map loads tiles from OpenFreeMap, which, like any web request, sees your IP address but nothing about your identity or route.

8. Data retention

Your data is kept while your account exists so your history and trends keep working. Photos sent for AI analysis are processed and discarded. Local-only data (journal, sleep audio, motion estimates) lives and dies on your device.

9. Deleting your account and your data

In the app, go to Settings, then Delete Account. This permanently deletes your account and all server-side data: profile, logs, workouts, sleep, scores, chat usage counters and stored photos. It takes effect immediately and cannot be undone. You can also just delete the app to remove all local data from your phone.

10. Exporting your data

Settings also includes a full data export that gives you a machine-readable copy of everything stored for your account.

11. Your rights

Depending on where you live (including under the EU and UK GDPR and the California CCPA/CPRA), you have rights to access, correct, export, restrict and delete your personal data, and to complain to your local data protection authority. The export and delete tools above cover the common cases instantly; for anything else, email privacy@ciyanu.com and we will respond within 30 days. We do not sell personal information, so there is nothing to opt out of under the CCPA's "sale or sharing" definitions.

12. Legal bases (GDPR)

We process your data to perform our contract with you (running the app you signed up for), with your consent for optional items (health details, Apple Health access, location, camera, microphone), and in our legitimate interest for abuse prevention and error logging. Health information is processed only because you choose to enter it, which is your explicit consent; you can use the app without providing it.

13. Children

Ciyanu is not intended for children under 13 (or the higher minimum age in your country), and we do not knowingly collect data from them. If you believe a child has created an account, contact us and we will delete it.

14. Security

All traffic uses TLS encryption. Server data is encrypted at rest. Every database record is protected by row-level rules tied to your account, and API keys for our AI and food-data providers live only on our servers, never in the app.

15. International transfers

Our service providers may process data in countries other than yours, including the United States. Where required, transfers rely on standard contractual clauses or equivalent safeguards offered by those providers.

16. Changes to this policy

If we make material changes, we will update this page and the date at the top, and highlight the change in the app where appropriate.

17. Governing law

This policy is governed by the laws of Queensland, Australia.