Privacy policy

1. Who is responsible for your data

The data controller is ConCraft Limited, Irish company number 575358, registered at 3 Brindley Park Road, Brindley Park, Ashbourne, Co. Meath, A84 D526, Ireland. Send privacy questions and rights requests to privacy@tylertailoredfitness.com. General support is available at support@tylertailoredfitness.com.

2. Account and consent information

The app processes the information needed to create and manage an account, including:

• Name and email address, account identifier and verification status.
• Account creation details, accepted policy versions and dates.
• Your required 18-or-over attestation and explicit health-data consent record.
• Theme, units and optional marketing preference.
• Authentication and security information used to confirm an email, create sessions, reset a password and protect the account.

3. Profile, training and nutrition information

Depending on the features you choose, we process:

• Age band, sex, height, weight, target weight, goals, schedule, training experience, equipment, location and preferences.
• Movement limitations, injury or restriction context, recovery check-ins, pregnancy, eating-disorder history and relevant medical condition answers that you choose to provide.
• Activity and nutrition preferences, allergy information, meal choices, calorie estimates and nutrition targets.
• Tailored plans, programme progress, exercise choices, sets, repetitions, loads, durations, notes and workout history.

4. Optional photos and profile photo

If you choose a private progress photo, workout-sharing photo or profile photo, the app asks for permission to select it from your device. Private progress and profile photos remain in app storage on that device and are not included in the cloud member snapshot. A workout-sharing photo is passed only to the device sharing destination you choose. A photo is not required, and microphone access is not requested for these features. You can replace or remove the selected profile photo.

5. Cloud and device storage

The app uses Supabase to authenticate members and keep an access-controlled cloud snapshot containing account details, tailoring answers, the active plan and workout progress. A local copy is also kept on the device so workouts can continue during interrupted connectivity. This is not a device-only service: when online, changes can be sent to and retrieved from the member's protected Supabase record.

Private photos and the normal Tyler AI Coach transcript are kept locally by the current release rather than included in that cloud snapshot. Device or backup providers may retain copies under settings controlled by you.

6. Why we use information

We use information to:

• Create, verify and secure the account.
• Provide the features you request and remember preferences.
• Tailor training and meal-planning guidance and filter unsuitable options.
• Save workouts, show progress and support interrupted connectivity.
• Respond to support and privacy requests and prevent misuse.
• Meet applicable legal obligations.

Depending on the activity, the legal basis is performance of the service requested under the Terms, consent, ConCraft Limited's legitimate interests in operating and securing the service, or a legal obligation.

7. Health-related information and consent

Answers about injury, movement limitation, recovery, pregnancy, eating-disorder history or a relevant medical condition may be health-related or special-category data. Before the app collects its tailoring profile, it asks for explicit consent to process the health and fitness information you choose to provide. We use it for safety routing, exercise filtering and the personalisation you request.

You may withdraw consent by contacting privacy@tylertailoredfitness.com or delete your account. Withdrawal does not affect earlier lawful processing and may mean the tailored service can no longer be provided. The app is not a medical record, medical device or diagnostic service and does not diagnose, treat, cure or prevent any medical condition. Consult an appropriately qualified healthcare professional for medical advice.

8. Communications and marketing

The account email is used for essential messages such as email confirmation, password recovery, security and replies to your request. Authentication messages are delivered through Supabase and the configured transactional-email provider. Optional marketing is a separate choice that can be switched off. This release has no third-party targeted-advertising technology.

9. Optional Tyler AI Coach

If you choose to use Tyler AI Coach, the message you enter, up to eight recent turns from the conversation, and limited app context are sent through a protected Supabase Edge Function to OpenAI so an answer can be generated. The context may include your selected goal, training status, programme name and level, weekly session count, typical session time, completed-workout count, up to three recent workout titles, nutrition goal, diet pattern and unit preference. It does not include your email address, profile photo or private body-progress entries unless you choose to type that information into the chat.

The submitted material and generated answer are checked using OpenAI's moderation service. A one-way hash of the internal Supabase account identifier is sent as a pseudonymous safety identifier so misuse can be investigated without sending your name or email address. The response request uses store=falseso it is not saved for later API retrieval. OpenAI may retain limited API abuse-monitoring data for up to 30 days under its applicable service controls unless a different approved retention arrangement applies.

Chat history is kept locally on the device. Supabase normally stores only an aggregate per-user daily message count for the 20-message limit, not chat text. If you choose Report reply and confirm, the exact AI reply, report reason, account identifier and report time are stored in Supabase for restricted safety review; your question is not included. Daily-use rows are kept on a rolling 35-day basis. Reports are removed with account deletion. An open report is reviewed within seven calendar days and kept for no more than 90 days unless a documented legal or security hold applies; a resolved report is deleted 90 days after resolution unless such a hold applies. The app presents the main AI data flow before first use. Do not enter information you do not want processed by this service.

10. Payments and health platforms

This release does not process app-store subscriptions and does not sync with Apple Health or Android Health Connect. If one of those features is added, the relevant explanation and choice will be presented before it is enabled for a member.

11. Website and technical information

Website, hosting, authentication, email and security providers may process limited technical information such as IP address, device or browser type, request time, requested page, authentication event and delivery status to provide, protect and troubleshoot their services. The public website does not require an app account and is not described as using targeted-advertising trackers.

12. Sharing and service providers

We do not sell personal data. We disclose information only where needed to operate the service, respond to a valid request, protect legal rights or comply with law. Current provider categories include Supabase for authentication, the protected cloud database and AI request routing; OpenAI for optional Tyler AI Coach message processing; a transactional-email provider for account messages; website hosting and security providers; and Apple or Google for app distribution and their own store services. Providers receive only the information needed for their role and process it under applicable contractual and security arrangements.

13. International transfers

A provider or its subprocessors may process information outside Ireland or the European Economic Area. Where EU or EEA personal data is transferred to a country without an applicable adequacy decision, ConCraft Limited uses an available lawful safeguard through its provider arrangements, such as approved standard contractual clauses, together with supplementary measures where appropriate.

14. Retention and account deletion

Account and cloud member-snapshot information is retained while the account is active and as needed to provide the service. The Tyler AI Coach conversation is retained locally until you clear it or remove app storage. Supabase retains the aggregate daily AI-message count so the daily limit can be enforced; that table does not store the normal chat text. Confirmed AI-reply reports are retained under the approved safety-report schedule. A signed-in member can use Delete account in the app. Once the secure service validates the account and confirms deletion, it permanently deletes the Supabase Auth account and associated cloud member records, including the linked AI usage count and AI reports; the app then clears its local account copy and signs out. If deletion cannot be confirmed, the app reports the failure and does not present the account as deleted.

If you cannot use the app, follow the web deletion route. We may ask for information reasonably needed to verify identity. Limited records may be retained where required for legal, security or dispute purposes. Removing the app does not itself delete the cloud account. Local data otherwise remains until app storage is cleared or the app is uninstalled, subject to backups controlled by you or the platform.

15. Your privacy rights

Subject to applicable limits, you may ask to access, correct, erase, restrict or object to processing of your personal data, receive a portable copy, and withdraw consent. Email privacy@tylertailoredfitness.com. We may request information reasonably needed to confirm identity. We respond without undue delay and ordinarily within one month, subject to extensions permitted by law.

You may also complain to Ireland's Data Protection Commission at dataprotection.ie or to the supervisory authority where you live or work.

16. Security

We use technical and organisational measures intended to protect the service and information involved, including authenticated access and database access controls. No system is completely secure. Protect access to your email, password and device and contact support if you suspect unauthorised access.

17. Adults only

Tyler Tailored Fitness is intended only for adults aged 18 or over. We do not knowingly offer the service to children.

18. Policy changes and contact

Material policy updates receive a new version. The app records accepted versions and may ask members to review a changed policy before continuing. If a change requires a new choice or consent, the app will ask before the related processing begins. Questions can be sent to privacy@tylertailoredfitness.com.