Welcome to Thryvo. Thryvo, Inc. ("Thryvo," "we," "us," or "our") operates the Thryvo mobile application (the "App"), an AI-powered fitness platform that uses computer vision and machine learning to deliver real-time form correction, posture analysis, and personalized workout coaching.
This Privacy Policy ("Policy") explains how we collect, use, store, share, and protect information about you when you use our App, website, and related services (collectively, the "Services"). It also describes your rights regarding your personal information and how you can exercise them.
By downloading, installing, or using the App, you agree to the practices described in this Policy. If you do not agree, please do not use the Services. We will notify you of material changes to this Policy by updating the "Last Updated" date above and, where required by law, by sending you a direct notification.
This Policy applies to all users of the App worldwide, with additional disclosures for users in the European Economic Area (EEA), United Kingdom, California, and other jurisdictions where additional rights apply.
We collect the minimum data necessary to provide, improve, and personalise your Thryvo experience. The categories below describe what we collect and how.
A. Camera & Posture Data
When you grant camera permission, your device's camera captures video frames solely to analyse your movement, posture, and exercise form in real time. All computer vision inference runs on-device using optimised machine learning models. Raw video frames, skeletal keypoints, and posture scores are processed locally and are never uploaded, streamed, or transmitted to Thryvo's servers or any third party. See Section 4 for full technical details.
The only camera-related data we may receive are aggregate, anonymised session metrics (e.g., "workout completed," "rep count") — not any image, video, or biometric data derived from your image.
B. Health & Fitness Data
To personalise your programme and track progress, we collect:
- Fitness goals you set in the App (e.g., weight loss, strength, mobility)
- Self-reported physical attributes (height, weight, age, fitness level)
- Workout logs including exercise type, sets, reps, duration, and intensity ratings
- Heart rate, step count, and activity metrics you choose to sync from Apple HealthKit or Google Health Connect — always with your explicit, revocable consent
- Personalised programme history and AI coaching recommendations generated for you
We treat all health and fitness data as sensitive information and apply heightened protections described throughout this Policy.
C. Account Information
When you create a Thryvo account, we collect:
- Name and email address
- Password (stored using bcrypt hashing — we never store plaintext passwords)
- Profile photo (optional, only if you choose to upload one)
- Subscription and billing information (processed by our payment provider; we store only payment reference tokens)
- Authentication tokens when you sign in via Apple ID or Google Sign-In
D. Usage & Diagnostic Data
We automatically collect limited technical data to operate and improve the App:
We do not use persistent advertising identifiers (IDFA/GAID) for ad targeting. We do not build advertising profiles.
We use the information we collect for the following purposes, each grounded in a lawful legal basis where required by applicable law:
Service Delivery
- Creating and maintaining your account
- Generating personalised AI workout plans, form feedback, and coaching recommendations
- Tracking your fitness progress and displaying historical data in-app
- Processing subscription payments and managing your plan
- Sending transactional emails (account confirmation, password reset, billing receipts)
Safety & Personalisation
- Adapting workout difficulty and exercise selection to your fitness level and goals
- Surfacing appropriate rest recommendations and injury-prevention cues
- Enabling streak tracking, achievement badges, and progress milestones
App Improvement
- Diagnosing and fixing bugs and performance issues
- Understanding which features are most valuable to users in aggregate
- Training and improving our on-device AI models using only anonymised, aggregated data — never your raw camera data
Communications
- Sending workout reminders and push notifications you have enabled
- Sharing product updates, new features, and tips (you can opt out at any time in Settings)
- Responding to support requests and feedback
Legal & Security
- Detecting, preventing, and investigating fraud, abuse, or security incidents
- Complying with legal obligations and responding to lawful requests from authorities
- Enforcing our Terms of Service and protecting the rights of Thryvo and our users
We do not sell your personal information. We do not use your data for targeted advertising by third parties. We do not use health data for purposes beyond delivering and improving the App without your explicit, separate consent.
This is our most important privacy commitment. Thryvo's AI form analysis is architected from the ground up to be private by design. All visual inference — body landmark detection, joint angle measurement, rep counting, and posture scoring — occurs entirely within the secure enclave of your own smartphone.
Technical Architecture
Here is exactly how on-device processing works in Thryvo:
- Your device's camera captures video frames at up to 30 fps during an active workout session.
- Each frame is passed directly to our local ML runtime (Apple Core ML on iOS / TensorFlow Lite on Android) — no network call is made.
- The model outputs skeletal keypoints (x, y confidence scores for each body joint). These keypoints are used to calculate joint angles and posture vectors in memory.
- Form feedback and rep counts are derived from these vectors and displayed to you in real time on screen.
- At the end of each set, aggregated summary metrics (e.g., average knee-angle deviation, rep count) may be written to your on-device local storage and synced to your account — but never the underlying frames or raw keypoints.
- When your device is offline, all features continue to work identically.
What This Means for You
Camera Permission
We request camera access only when you explicitly start a tracked workout session. You can revoke camera permission at any time through your device's system settings. Revoking this permission does not affect other App features such as programme browsing, progress tracking, or nutrition logging.
Thryvo does not sell, rent, or trade your personal information. We share data only in the limited circumstances described below, and always under strict contractual safeguards.
Service Providers
We work with carefully selected third-party vendors who process data on our behalf subject to data processing agreements and our instructions:
- Cloud Infrastructure: Encrypted server hosting and database storage (AWS / Google Cloud)
- Payment Processing: Stripe, Inc. — handles all payment card data; Thryvo stores only a payment reference token
- Authentication: Apple Sign-In and Google Sign-In — govern your credentials under their own privacy policies
- Crash Reporting: Anonymised crash diagnostics to identify and resolve App bugs quickly
- Email Delivery: Transactional email provider for account and billing communications
None of our service providers are permitted to use your personal information for their own marketing purposes or to combine it with data from other clients.
Legal Disclosures
We may disclose your information when required by law, court order, or lawful governmental authority, or when necessary to:
- Comply with applicable laws and regulations
- Respond to a valid subpoena, warrant, or other judicial process
- Protect the safety or rights of Thryvo, our users, or the public
- Investigate or prevent suspected fraud, illegal activity, or security breaches
Where permitted by law, we will notify you before complying with such a request.
Business Transfers
If Thryvo is involved in a merger, acquisition, reorganisation, or sale of all or substantially all of its assets, your information may be transferred to the acquiring entity. We will provide notice (via the App or email) before your data is transferred and becomes subject to a different privacy policy. Any acquirer will be required to honour the terms of this Policy or provide equivalent protections.
With Your Consent
We will share your data with additional parties only if you give us explicit, revocable consent at the time of collection — for example, if you choose to share your workout results to a connected social platform or coaching partner account.
We retain your personal information only for as long as necessary to provide the Services and fulfil the purposes described in this Policy, or as required by applicable law.
Account Deletion
You can request complete deletion of your account and all associated personal data at any time from within the App (Settings → Account → Delete Account) or by contacting privacy@thryvo.app. We will process your request within 30 days and confirm deletion by email.
Certain data may be retained beyond this period where required by law (e.g., financial records) or where legitimate interests apply (e.g., fraud prevention logs in pseudonymised form).
Camera & Posture Data
Because all camera and posture processing occurs on-device and raw frame data is never transmitted to or stored by Thryvo, there is no server-side camera data for us to delete. Clearing your local App data via device settings removes all locally cached metrics immediately.
Depending on your location, you have a number of rights regarding your personal information. We are committed to honouring these rights promptly and transparently.
Rights Available to All Users
- Access: Request a copy of the personal data Thryvo holds about you.
- Correction: Update or correct inaccurate information in your profile at any time within the App settings.
- Deletion: Request erasure of your account and associated personal data ("right to be forgotten").
- Data Portability: Request an export of your workout history and account data in a machine-readable format (JSON or CSV).
- Withdraw Consent: Revoke any consent-based processing (e.g., health data sync, marketing emails) at any time without affecting the lawfulness of prior processing.
- Opt-out of Communications: Unsubscribe from non-essential emails via the link in any email footer or App Settings → Notifications.
Additional Rights for EEA / UK Users (GDPR / UK GDPR)
- Restriction of Processing: Ask us to pause processing your data while a dispute is resolved.
- Object to Processing: Object to processing based on our legitimate interests.
- Lodge a Complaint: File a complaint with your local data protection supervisory authority (e.g., the ICO in the UK, or your national DPA in the EU).
Additional Rights for California Residents (CCPA / CPRA)
- Right to Know: Request details on the categories of personal information we collect and our business purposes.
- Right to Delete: Request deletion of personal information subject to certain exceptions.
- Right to Opt Out of Sale/Sharing: We do not sell or share personal information for cross-context behavioural advertising. No opt-out is required, but you may submit a request to confirm this.
- Right to Non-Discrimination: We will not discriminate against you for exercising any CCPA rights.
To exercise any of the above rights, contact us at privacy@thryvo.app or use the in-app Privacy Request tool (Settings → Privacy → Submit Request). We will verify your identity before processing requests and respond within the timeframe required by applicable law (generally 30 days, extendable to 60 days with notice).
Thryvo is designed for users aged 16 and older. We do not knowingly collect personal information from children under the age of 16 (or under 13 in the United States, as defined by the Children's Online Privacy Protection Act).
Our account creation flow requires users to confirm they meet the minimum age requirement. We do not use age-targeted marketing and do not operate features specifically designed to attract minors.
If you are a parent or guardian and believe that your child has provided us with personal information without your consent, please contact us immediately at privacy@thryvo.app. We will investigate and, where verified, delete such information from our systems within 14 days.
Users aged 16–18 may use Thryvo with parental consent. We encourage parents to review this Policy with their children and monitor their use of the App.
If you are under the applicable minimum age in your jurisdiction, please do not use Thryvo and do not provide us with any personal information.
If you have questions, concerns, or requests relating to this Privacy Policy or Thryvo's privacy practices, our dedicated privacy team is here to help. We aim to respond to all enquiries within 5 business days.
Reach our Privacy Team directly at:
privacy@thryvo.appPostal Address
Thryvo, Inc.
Privacy Team
548 Market Street, Suite 12601
San Francisco, CA 94104
United States
EU/UK Representative
For EEA and UK users, our appointed data protection representative can be reached at the same email address above. Please include "GDPR Enquiry" or "UK GDPR Enquiry" in the subject line for expedited routing.
Updates to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Last Updated" date at the top of this page and notify you in-app or via email at least 14 days before the changes take effect. Your continued use of the App after the effective date of any revision constitutes your acceptance of the updated Policy.