Privacy Policy
Sylas is a private training log with account sync and optional AI and Apple Health features. This page explains what the app handles, why, and the choices available to you.
Who operates Sylas
Sylas is operated by d10i ltd, 128 City Road, London, EC1V 2NX, United Kingdom. Contact contact@sylas.coach about your personal data.
What Sylas stores
- Account data: your email address, profile name when supplied by your sign-in provider, product account identifier, sign-in provider identifier, and authentication session.
- Training data: exercises, plans, workouts, sets, loads, repetitions, time, distance, effort, rest settings, and body measurements you record.
- Content you provide: workout and exercise notes, injury notes, text or programmes you ask Sylas to import, and conversations with the AI coach.
- Apple Health data: when you enable the integration, supported workout records such as activity type, date, duration, distance, pauses, and available workout energy. Sylas also records device-local Health sample identifiers to prevent duplicate imports and exports.
- AI operation records: rendered prompts, relevant training context, model replies, tool calls, token usage, latency, and errors. These traces help diagnose incorrect or failed AI behavior.
- Voice and photos: recordings you submit for transcription and selected photos you submit for workout or programme parsing. Original photo metadata is removed. Audio and image bytes are processed for the request and are not retained in Sylas AI traces; resulting text is treated as content you provide.
- Subscription data: Apple transaction and original-subscription identifiers, the product account identifier linking a purchase to your Sylas account, subscription status, expiry and trial information. For Stripe purchases we retain customer and subscription identifiers. Apple or Stripe processes payment details; Sylas does not store card numbers.
- Device settings: preferences such as units, timers, goal, Health import/export choices, and whether onboarding has been completed.
How the data is used
Sylas uses this data only to provide the app: authenticate you, keep your log available across devices, calculate progress, import and export workouts, restore your history, answer coach questions, stage changes you choose to apply, enforce AI allowances, provide support, and diagnose failures.
Sylas does not sell your personal data, use it for advertising, or track you across other companies' apps or websites.
Where data goes
Your account and synchronized app data are sent over HTTPS to Sylas's backend, hosted using Supabase infrastructure. Authentication is also provided through Supabase Auth. Apple receives information when you use Sign in with Apple or ask Sylas to write a workout to Apple Health.
With your permission, when you use remote parsing, voice transcription or the AI coach, Sylas sends the content needed for that request to the configured model provider, currently OpenAI or Anthropic. Depending on the feature, that can include typed import text, exercise names, your question, goal, current injury note, live workout, and relevant summaries or lookups from your training history. You choose whether to allow AI data sharing after sign-in and can change your choice in Settings → Review AI data sharing. Declining leaves the tracker available. Apple handles in-app purchase billing, cancellation and refunds. Our server checks subscription status with Apple. Stripe handles any subscriptions purchased through its checkout. Cloudflare delivers account verification emails on our behalf.
Apple Health access is optional and controlled in Settings → Apple Health and in the Health app. Sylas does not use Health data for advertising or sell it.
Retention
Account, training, notes, AI conversations, proposals, and AI traces remain on the Sylas backend until you delete your account. The app does not currently apply a shorter automatic expiry to AI conversations or traces. Deleting the account cancels existing Stripe subscriptions, removes the authentication-provider user and associated app data, and revokes a captured Sign in with Apple authorization. Deleting a Sylas account does not cancel Apple subscriptions; cancel them separately in App Store subscriptions. A minimal Apple subscription ownership record remains to prevent a deleted account’s purchase being claimed by another account. Financial records that Apple, Stripe or we must retain for tax, accounting or dispute obligations are retained separately for those obligations. A minimal keyed fingerprint of the deleted sign-in identity is retained to prevent an unexpired token recreating the account. Local account data and Health sample identifiers are also cleared from the device by the deletion flow.
Signing out removes account data from the device but keeps the backend copy so it can be restored after signing in again. Device-local Health sample identifiers survive sign-out so a restored workout is not imported twice. Removing the app clears its local storage; Apple Health keeps workouts already saved there under Apple's controls.
Your choices: export, disconnect, and delete
- Export account data: Settings → Export account data downloads JSON containing your account record, synchronized training and plans, body metrics, deleted-row history, and injury-note history.
- Export a portable training log: Settings → Export training log creates a CSV of completed workouts and sets.
- Apple Health: Settings → Apple Health can pause import or export. You can also change access in the Health app under your profile → Privacy → Apps.
- Delete the account: Settings → Delete account removes the Sylas account and its associated Sylas data. This cannot be undone.
- Ask for help or a copy of other records: email contact@sylas.coach. This includes requests concerning AI conversation or diagnostic records that are not in the current self-service export.
Your rights and international processing
We use account and training data to perform the service you request, consent for optional AI sharing, and legitimate interests for security and diagnostics. You may request access, correction, deletion, restriction, portability or object to processing by contacting us. Where processing relies on consent, you may withdraw it without affecting earlier processing. You can complain to the UK Information Commissioner’s Office at ico.org.uk.
Supabase, OpenAI, Anthropic, Apple, Cloudflare and Stripe may process data outside the UK. We rely on the applicable providers’ contractual data-protection safeguards for international transfers. The app does not make decisions with legal or similarly significant effects about you. AI coaching is general fitness information, not medical care.
Security and contact
Sylas uses HTTPS for network traffic and the iOS Keychain for authentication sessions and any AI provider key you enter. No system can promise absolute security. If you have a privacy question, deletion problem, or support request, email contact@sylas.coach.
Changes to this policy
If the app's data practices change, this page and its effective date will be updated before the new practice ships.