Privacy

Privacy policy

Maya is a sports and nutrition coach run by an artificial intelligence. To do her job she needs data that touches your health. This page says which data, why, where it goes, and what you can demand at any time.

Last updated — 31 August 2026

1. Who processes your data

Darius Zdancewicz, sole trader, 29 Chemin de Kerroué, 29000 Quimper, France. Business number 10757230700018. For any question about your data: hello@getmaya.app.

2. What Maya collects, and why

Data	What it is for	Legal basis
Email address, account id, first name	Creating your account and signing you back in	Performance of the contract
Age, biological sex, height, weight, body fat and muscle mass, injuries	Calibrating sessions and intake to your actual body	Explicit consent
Goals, training level, dietary preferences, available equipment	Proposing a programme you can actually follow where you train	Explicit consent
Your messages to Maya, and the photos you send her	Letting her answer and adjust the programme	Explicit consent
GPS track of your runs and interval sessions	Measuring distance, pace and route	Explicit consent
Active calories measured by your Apple Watch	Counting what you actually spent instead of estimating it	Explicit consent
Completed sessions, scores, weight history	Following progress and revising the programme each week	Explicit consent
Technical counters of AI model usage	Keeping the running cost of the service under control	Legitimate interest
Email address left on the website waiting list	Telling you when the app is released	Consent

3. Your health data

Your weight, your injuries, your body composition and the photos you send are health data. European regulation forbids processing them as a matter of principle, and allows it only with your explicit consent. That is what you give before your first conversation with Maya, on the app's welcome screen — so before any data is transmitted.

You can withdraw it at any time. Since this data is the very material the coaching is made of, withdrawing it means closing your account: one action, in the app's settings, and everything is erased.

4. Photos are not kept

When you send Maya a photo — a meal, a posture, a gym machine — it is passed to the model for as long as the answer takes, then it is gone. No photo is stored on our servers. Only the number of photos stays attached to the message, so the conversation still makes sense when you read it back.

5. Who else has access

Your data is not sold, not rented, and never handed to advertisers. It is entrusted to technical providers, each for one precise job:

Provider	What it does	What it sees
Supabase (Ireland)	Hosts the database and handles sign-in	Your account and your history
Vercel	Hosts the service that runs the app	Your data while it is in transit
An artificial-intelligence model provider (servers in China)	Provides the model that is Maya	Your profile and your messages, on every exchange
Bunny	Delivers the exercise demonstration videos	Your IP address, nothing else
Apple, Google	Sign-in providers, in-app purchases	Your sign-in identity

6. Transfers outside the European Union

The artificial intelligence model that runs Maya is supplied by a provider whose servers are located in China. Your profile and your messages — so, potentially, health data — are sent there on every exchange, for as long as producing the answer takes. China is not recognised by the European Union as offering an equivalent level of protection, and this provider does not offer the European Commission's standard contractual clauses. That transfer therefore rests on your explicit consent, given with full knowledge on the app's welcome screen, after being told of this risk. You can withdraw it at any time by closing your account.

Your database itself is in Ireland: your sessions, your programme and your history never leave the European Union. Only the profile and the messages sent to Maya go out, and only for as long as her answer takes.

The model provider may change — it is a technical choice that gets re-evaluated. Its name is given on request at the address at the top of this page, and the date at the top of the page says when this section was last checked.

7. How long your data is kept

For as long as your account exists, for everything that makes up your programme and your history.
Three years after your last sign-in, your account is deleted. An email warns you beforehand.
For the length of one exchange for photos, which are never written to disk on our side. The model provider may keep what it receives for up to thirty days to watch for abuse, under its own policy.
Ten years for accounting records tied to a subscription only, because the law requires it. They contain no health data.
Until the app is released for the address left on the waiting list, or sooner if you ask.

If you close your account, everything is erased at once: your profile, your sessions, your runs, your weight history and your entire conversation with Maya. There is no bin and no grace period. Two technical traces survive it, at our providers: the sign-in log kept by Supabase (the email address and IP address of each sign-in, kept for a few weeks), and the copies the model provider keeps for the period stated above.

8. Your rights

At any time you may access your data, correct it, erase it, ask for a portable copy, restrict its processing, object to it, and withdraw your consent.

Deleting your account and getting a copy of your data are both done directly in the app, without writing to us: both are in the settings. Deletion is immediate; the export hands you a file with everything your account holds. For every other right, write to hello@getmaya.app: we answer within a month, free of charge.

If our answer does not satisfy you, you may lodge a complaint with the French data protection authority: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or at cnil.fr. You may also complain to the supervisory authority of your own country of residence.

9. Apple Health data

If you play your sessions on Apple Watch, Maya reads your heart rate and your active calories during the session, with your permission.

Heart rate is shown on your watch during the effort and is never sent to our servers.
Active calories are recorded with the session, so your summary reflects what you actually spent.
This data is never used for advertising, never sold, and never passed to a third party for marketing.
Maya also writes your sessions to the Health app, so they count towards your activity rings.

10. Maya is an artificial intelligence

You are not talking to a person. Maya is a program, and her answers can be inaccurate or unsuitable. She makes no decision producing legal effects concerning you, and nothing in the app rests on a solely automated decision within the meaning of Article 22 of the regulation.

Maya replaces neither a doctor, nor a dietitian, nor a coach. The terms of use go into this.

11. Minimum age

The app is for adults only. We do not knowingly collect data about minors. If you find that an account was opened by a minor, write to us: it will be deleted.

12. This website

This site sets no cookies, uses no trackers and measures no audience. The only thing stored in your browser is the language you picked. That is why no banner asks for your agreement: there is nothing to accept.

13. Security

Every exchange with our servers is encrypted in transit.
The database isolates each account's rows at the engine level: a query cannot reach another user's data, even if the code gets it wrong.
Your sign-in token is held in your phone's secure keychain, not in the clear.
Keys granting privileged access to the database are never shipped inside the app.

14. Changes

This policy may change, notably if a provider changes. The date at the top of the page gives the last revision. A change affecting your rights or bringing in a new recipient will be signalled in the app before it takes effect.