VYRA
Contents ▾

VYRA Privacy Policy

Last Updated: 2026-04-29

This Privacy Policy describes how VYRA, a sole proprietorship operated by Shoji Nakasu (“VYRA,” “we,” “us,” or “our”), collects, uses, shares, and protects personal information when you use our mobile application, website (https://vyra-app.com), and related services (collectively, the “Service”).

By using the Service, you acknowledge that you have read and understood this Privacy Policy.

1. Introduction

1.1 Who We Are

VYRA is the sole proprietorship described in Section 15. With respect to personal information processed in connection with the Service, we act as a personal information handling business operator under the Japanese Act on the Protection of Personal Information (APPI), as the data controller under the GDPR / UK GDPR, and as a business under the CCPA/CPRA.

The contact point for inquiries, complaints, and requests for disclosure regarding personal information is the email address listed in Section 15 (in line with APPI Article 32(1)(i) and Articles 33–35).

1.2 Scope

This Privacy Policy applies globally to all users of the Service. Where local law (e.g., GDPR, UK GDPR, CCPA/CPRA, APPI, VCDPA, CPA, PIPEDA, LGPD, APP) provides additional rights or imposes additional obligations, those provisions are reflected in this Policy, particularly in Sections 7, 8, 9, and 13.

1.3 Children

The Service is not intended for users under 13 (or 16 in the EEA/UK without parental consent). See Section 8.

2. Information We Collect

We collect personal information in the following categories.

2.1 Information You Provide

CategoryExamples
Account informationEmail address, hashed password, display name.
Profile informationAge, sex/gender, height, weight, body-fat percentage, fitness goals, target body image, training experience.
Health and fitness dataMeal records (food name, calories, PFC macros), workout records (exercise, weight, reps, sets), personal records (PRs), body-composition history (weight, body-fat %), photos of meals, photos of your body.
User-generated contentProfile pictures, shared progress posts, custom AI-coach name, free-text notes.
CommunicationMessages you send to us, AI-coach interactions.
Payment informationSubscription type and status. (Card numbers and bank details are processed and stored by the payment provider, not by VYRA.)

2.2 Information Collected Automatically

CategoryExamples
Device informationDevice model, OS version, device language, device ID (e.g., IDFV / Android ID), time zone.
Network informationIP address, approximate region derived from IP.
Usage dataScreens viewed, features used, in-app actions, session duration, crash logs, push-notification interactions.
Cookies and similar technologiesSession cookies on the web (see Section 10).

2.3 Information from Third Parties

If you sign in via a third-party identity provider (e.g., Apple Sign-In, Google), we receive the basic identity data (email, name) that the provider shares with us under the permission you grant.

2.4 Sensitive Information

Some of the data we collect (e.g., body weight, body-fat percentage, body images, meal images, exercise and health-related data) may be considered special-category / sensitive personal information under certain laws (e.g., GDPR Article 9 health data, CCPA/CPRA “sensitive personal information,” APPI “sensitive personal information” (要配慮個人情報)). We process such information based on your explicit consent (provided when you opt in to the relevant feature) and only as necessary to provide the Service.

We do not consider body images to constitute “biometric information” within the meaning of the CCPA/CPRA. However, where the relevant jurisdiction interprets the term more broadly, we treat such data with corresponding care.

2.5 Information We Do Not Collect

We do not collect:

  • precise GPS location (only approximate region inferred from IP address);
  • device contacts / address book;
  • continuous microphone or camera access (we use cameras only ad hoc to capture meal or body photos);
  • cross-site tracking information from third-party advertising networks.

3. How We Use Your Information

We use personal information for the following purposes:

PurposeDescription
Service provisionOperating the Service, authenticating users, generating AI training and nutrition plans, analyzing meal photos, tracking progress, sending push notifications, processing payments.
PersonalizationTailoring the AI coach, plan recommendations, and home-screen highlights to your goals and history.
Service improvementAnalyzing usage to fix bugs, improve algorithms, and develop new features. Statistical and aggregate analytics use anonymized data.
Safety and fraud preventionDetecting and preventing abuse, fraud, security incidents, and violations of the Terms of Service.
CommunicationsResponding to inquiries, sending service announcements, sending optional marketing communications (only with your consent where required by law).
Legal complianceComplying with applicable law, responding to lawful requests from authorities, preserving records required by tax, consumer-protection, or other regulations.
Affiliate program operationTracking referrals, calculating commissions, fraud detection, and producing tax-related documentation (Affiliates only).

3.1 Legal Bases (GDPR / UK GDPR)

For users in the EEA / UK, our legal bases for processing are:

Legal basisExamples of processing
Performance of a contract (Art. 6(1)(b))Account creation, plan generation, payment processing.
Consent (Art. 6(1)(a) and Art. 9(2)(a) for special-category data)Processing health data, body images, push notifications, optional marketing.
Legitimate interests (Art. 6(1)(f))Aggregated analytics, fraud prevention, security, service improvement. We balance these against your rights and freedoms.
Legal obligation (Art. 6(1)(c))Tax-record retention, responses to lawful authority requests.

You may withdraw consent at any time (Section 7) without affecting the lawfulness of processing carried out before withdrawal.

4. Sharing & Disclosure

We do not sell personal information for monetary consideration. We share personal information only as described below.

4.1 Service Providers (Processors)

We share personal information with vetted service providers who process data on our behalf under contracts that require confidentiality and data-protection safeguards. We supervise such service providers in accordance with APPI Article 25 (duty to supervise entrusted parties).

ProviderPurposeData sharedRegion
Google LLC (Gemini API)AI text and image analysisMeal images, body images, prompts containing profile and progress dataUnited States
Google LLC (Cloud / Firebase)Hosting, push notifications, crash reportsServer logs, device tokens, crash dataJapan (asia-northeast1) primarily; some services may use other regions
Stripe, Inc.Web payment processingEmail, billing details, subscription statusUnited States
Apple Inc.iOS in-app purchaseApple ID transaction infoUnited States
Google LLC (Play Billing)Android in-app purchaseGoogle Play transaction infoUnited States

No use of inputs to train Google’s foundation models. We use the Gemini API (and Vertex AI, where applicable) under a paid API agreement configured so that user inputs (text and images) are not used to train Google’s foundation models. For details, see Google’s Gemini API Additional Terms and Google Cloud Privacy Notice.

4.2 Sharing You Initiate

When you use the share feature to post progress, personal records, or generated images to a social-media platform, the share image and any text you choose are transmitted to the platform you select. Once on that platform, the content is governed by the platform’s privacy policy.

4.3 Aggregated and Anonymized Data

We may share aggregated, de-identified, or anonymized data (linked only to a non-reversible “anonHash”) that cannot reasonably be used to identify you, for service-improvement, statistical, and research purposes.

We may disclose personal information when we believe in good faith that disclosure is required to (a) comply with a law, regulation, court order, or lawful government request; (b) enforce our Terms of Service; (c) prevent fraud, security incidents, or harm to any person; or (d) protect VYRA’s rights or property.

4.5 Business Transfers

If VYRA is acquired, merges, transfers assets, or undergoes a change of legal form (e.g., future incorporation), personal information may be transferred to the successor entity. We will notify you in advance and provide you with the choice to request deletion before such transfer takes effect.

We may share personal information with other third parties where you have given separate, explicit consent.

5. Data Retention

5.1 Active Accounts

We retain personal information for as long as your Account is active or as needed to provide the Service.

5.2 Account Deletion (7-Day Cooldown)

When you request deletion of your Account, the Account enters a 7-day cooldown during which it is deactivated. After 7 days, your personal data is permanently and irreversibly deleted from production systems.

5.3 Anonymized Analytics

After deletion, certain non-identifying data linked only to a non-reversible “anonHash” may be retained indefinitely for aggregate analytics, AI-model evaluation, and service improvement. This data cannot be used to re-identify you.

We retain certain records as required by law:

RecordRetention periodReason
Billing and tax recordsUp to 7 yearsJapanese Income Tax Act / Consumption Tax Act / Electronic Books Preservation Act (longest applicable period)
Affiliate commission payment recordsUp to 7 yearsJapanese Income Tax Act / payment-record (支払調書) obligations
Records relevant to a legal disputeUntil resolution and any limitation periodDefense and exercise of legal claims

5.5 Backups

Backups containing your data may persist for up to 30 days after deletion, after which they are overwritten in normal rotation.

6. Data Security

We implement appropriate technical and organizational measures to protect personal information, including:

  • Password hashing with bcrypt (no plaintext passwords stored).
  • Authentication using JSON Web Tokens (JWT) with short-lived access tokens and rotating refresh tokens.
  • Transport encryption using HTTPS / TLS for all client–server communication.
  • Storage encryption at rest for cloud-hosted data.
  • Access control with the principle of least privilege.
  • Logging and monitoring for unusual access patterns.

No security measure is perfect. While we work hard to protect your information, we cannot guarantee absolute security. In the event of a personal-data breach (including incidents covered by APPI Article 26), we will respond as required by applicable law:

  • GDPR Article 33: notification to the supervisory authority within 72 hours of awareness, where feasible.
  • GDPR Article 34: notification to data subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms.
  • APPI Article 26 and related cabinet orders: report to the Personal Information Protection Commission of Japan (initial report typically within 3–5 days; final report within 30 days, or 60 days for incidents involving unauthorized access) and notify affected individuals without undue delay.
  • U.S. state breach-notification laws: notification within the timeframes and using the methods prescribed by each applicable state law.

7. Your Rights

This Section summarizes the rights available to you depending on your jurisdiction. To exercise any right, contact hello@vyra-app.com or use the in-app account settings. We respond within the timeframes required by applicable law (typically 30–45 days). We may need to verify your identity before fulfilling certain requests.

7.1 GDPR / UK GDPR (EEA, UK)

You have the right to:

  • Access the personal information we hold about you;
  • Rectify inaccurate or incomplete personal information;
  • Erase your personal information (“right to be forgotten”);
  • Restrict processing in certain situations;
  • Data portability: receive your data in a structured, commonly used, machine-readable format;
  • Object to processing based on legitimate interests or for direct marketing;
  • Withdraw consent at any time;
  • Lodge a complaint with your local supervisory authority (see Section 13).

7.2 CCPA / CPRA (California)

If you are a California resident, you have the right to make requests covering the prior 12-month period, including:

  • Right to Know the categories and specific pieces of personal information collected, sources, purposes, and recipients during the prior 12 months;
  • Right to Delete personal information we hold about you;
  • Right to Correct inaccurate personal information;
  • Right to Opt-Out of Sale or Sharing: VYRA does not sell personal information for monetary consideration and does not “share” personal information for cross-context behavioral advertising as defined under the CPRA. See also the dedicated declaration in Section 12.
  • Right to Limit Use of Sensitive Personal Information: we use sensitive information only for the purposes permitted by the CPRA.
  • Right to Non-Discrimination: we will not discriminate against you (including by denying service, charging different prices, or providing a different level of quality) for exercising your rights.

You may designate an authorized agent (in writing or by power of attorney) to make a request on your behalf, in accordance with California law. We may request additional information to verify your identity.

Categories of personal information collected in the past 12 months (CCPA/CPRA classifications under Cal. Civ. Code §1798.140):

CategoryCollected?Categories of recipients
Identifiers (email, IP address, device ID)YesService providers (cloud, AI analysis)
Categories listed in Cal. Civ. Code §1798.80(e) (name, contact info)YesService providers
Commercial information (purchase history)YesPayment processors
Internet/network activity (usage logs)YesService providers
Geolocation (approximate region from IP)YesService providers
Sensitive personal information (health, body composition)YesService providers (AI analysis)
Biometric informationNo—
Education / professional / inference dataNo—

7.3 Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), and other U.S. state comprehensive privacy laws

Where applicable, you have rights to access, correct, delete, port, and opt out of targeted advertising / sale / certain profiling. Submit requests to hello@vyra-app.com. You may appeal a denial by replying to our response email.

7.4 APPI (Japan)

Under the Act on the Protection of Personal Information (APPI), you may request:

  • Disclosure (開示) of your retained personal data and records of provision to third parties (APPI Article 33);
  • Correction (訂正), addition, or deletion of personal data that is inaccurate (APPI Article 34);
  • Cessation of use (利用停止) or deletion when personal data has been obtained or used unlawfully (APPI Article 35(1)–(2));
  • Cessation of third-party provision when personal data has been provided unlawfully or where retention is no longer necessary (APPI Article 35(3)–(4));
  • Disclosure of records of third-party provision (APPI Article 33(5)).

Requests may be subject to identity verification and a reasonable fee where permitted by APPI. We aim to respond without undue delay (typically within two weeks, and in any case within 30 days) of receipt.

How to submit a request: email hello@vyra-app.com with the subject line “APPI Disclosure Request” (or in Japanese: 「APPI開示等請求」).

7.5 PIPEDA (Canada), LGPD (Brazil), APP (Australia), and Other Jurisdictions

If you are a resident of Canada, Brazil, Australia, or another jurisdiction with applicable data-protection law, you have the rights set out in that law (typically including access, correction, deletion, and the right to lodge a complaint with the appropriate regulator). Contact hello@vyra-app.com.

8. Children’s Privacy

The Service is not intended for children under 13 years of age (or under the local minimum age where higher), and we do not knowingly collect personal information from such children.

8.1 EEA / UK (Under 16)

In the EEA and the UK, processing of personal data of users under 16 requires verifiable consent from a parent or guardian (GDPR Art. 8). The Service requires users between 13 and 15 in the EEA/UK to confirm such consent before completing registration.

8.2 COPPA (United States)

We comply with the U.S. Children’s Online Privacy Protection Act (COPPA). If we discover that we have collected personal information from a child under 13 in the United States without verified parental consent, we will delete that information promptly.

If you are a parent or guardian and believe your child has provided personal information to us, please contact hello@vyra-app.com and we will investigate and act on your request.

9. International Data Transfers

9.1 Primary Hosting

Production servers are located in Japan (Google Cloud asia-northeast1).

9.2 Cross-Border Transfers

Some service providers process data outside Japan. In particular:

  • Google Gemini API processing may take place in the United States or other Google data-center regions.
  • Stripe processing takes place in the United States and other Stripe regions.
  • Apple and Google Play Billing process payment information in their global infrastructure.

9.3 Transfer Safeguards

When transferring personal information from the EEA, UK, Switzerland, or other regulated jurisdictions to a country that has not been recognized as offering an adequate level of protection, we rely on appropriate transfer mechanisms, such as:

  • Standard Contractual Clauses (SCCs) approved by the European Commission;
  • the UK International Data Transfer Addendum for transfers from the UK;
  • supplementary measures (encryption, access controls) where required by case law (e.g., Schrems II).

You may request a copy of the transfer safeguards by contacting hello@vyra-app.com.

10. Cookies & Tracking Technologies

The VYRA mobile app does not use traditional browser cookies; it uses platform-level identifiers and locally stored authentication tokens.

The VYRA website uses session cookies strictly necessary to operate the site (e.g., authentication, security). We do not use third-party advertising cookies or cross-site tracking cookies. Where local law (e.g., the EU ePrivacy Directive) requires consent for non-essential cookies, we will obtain that consent through a cookie banner before placing such cookies.

11. Push Notifications

If you opt in to push notifications, we send messages such as workout reminders, motivational nudges, and important account or service announcements. You can disable push notifications at any time through your device’s notification settings or in the in-app settings.

12. Do Not Sell or Share My Personal Information

VYRA does not sell personal information for monetary consideration. VYRA does not “share” personal information for cross-context behavioral advertising as defined by the California Privacy Rights Act (CPRA) or any analogous concept under other U.S. state privacy laws.

You do not need to take any action to opt out, because we do not engage in these activities. If our practices change, we will update this Policy, provide a clear opt-out mechanism, and obtain any consents required by law.

13. Supervisory Authorities

If you believe our processing of your personal information violates applicable law, you may file a complaint with the relevant supervisory authority.

RegionAuthority
JapanPersonal Information Protection Commission (PPC) — https://www.ppc.go.jp
EEAThe Data Protection Authority of your member state (list at https://edpb.europa.eu)
United KingdomInformation Commissioner’s Office (ICO) — https://ico.org.uk
CaliforniaCalifornia Privacy Protection Agency (CPPA) — https://cppa.ca.gov
CanadaOffice of the Privacy Commissioner of Canada (OPC) — https://www.priv.gc.ca
BrazilAutoridade Nacional de Proteção de Dados (ANPD) — https://www.gov.br/anpd
AustraliaOffice of the Australian Information Commissioner (OAIC) — https://www.oaic.gov.au

We encourage you to contact us first at hello@vyra-app.com so we have the opportunity to address your concerns.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The “Last Updated” date reflects the most recent revisions. For material changes, we will provide reasonable advance notice through the Service or by email. Your continued use of the Service after the effective date of an updated Policy constitutes acceptance.

15. Contact

For privacy-related inquiries, requests, or complaints, please contact us:

  • Trade name: VYRA (sole proprietorship)
  • Personal information handler / Operator: Shoji Nakasu (中洲翔司)
  • Address: 埼玉県三郷市高州4-21 (virtual office)
  • Email: hello@vyra-app.com
  • Website: https://vyra-app.com

Response target: 2–5 business days. Formal responses to statutory requests will be provided within the timeframes set by APPI, GDPR, and other applicable laws.

VYRA is a small business and currently does not meet the conditions under GDPR Article 37 that would require appointing a Data Protection Officer (DPO), nor has VYRA appointed an EU/UK representative under GDPR Article 27. Should the appointment of either become required, we will appoint promptly and update this Policy accordingly. The operator listed above is responsible for handling privacy inquiries and is the appropriate point of contact for data-protection authorities and data subjects.

Effective Date: 2026-04-29