Privacy policy

• Your health and workout data — Apple Health imports, your strength map, strength age, plans, and workout history — lives on your device, not in a user database we run. If you delete the app, your data is gone forever — we can't restore it, because we don't keep a copy we could restore it from.
• When Talala generates your plan or coaches you, the relevant parts of your profile are sent to our servers to produce that result. This data may be retained for a limited period for debugging and quality assurance, and is then deleted. It is never added to a user database or profile about you, and it can't be used to restore your data.
• We never train AI models on your data, and we do not permit our AI providers to do so.
• We do not sell your personal information, and we do not use your health data for advertising or marketing. Ever.
• The app may send us crash reports, diagnostic data, and app-usage analytics (using tools like PostHog) so we can fix bugs and improve features. This data does not include your health records.
• Talala is for adults 18 and older.
• Questions or requests: support@talala.app.

The rest of this policy is the full detail behind that summary.

Information you provide in the app. To build your plan and coach you, Talala asks for information during onboarding and use, which may include: your preferred name, biological sex, age, height, weight, resting heart rate, maximum heart rate, training goals and motivation, training location and schedule preferences, and any health issues or movement limitations you choose to share ("Profile Information"). Talala also generates and stores data as you use it: workout logs, sets and weights, muscle measurements, strength map readings, strength age estimates, plans, and streaks ("Workout Data").

Information imported from Apple Health. With your permission, Talala connects to Apple Health (HealthKit) solely to import health and fitness information such as: heart rate, resting heart rate, workout history, movement and exercise activity, sleep, height, weight, age, and biological sex ("Health Information"). You control this connection through your device's Health permissions and can revoke it at any time in your device settings.

Information collected automatically. The app may collect technical data about your device and how the app performs and is used, including: device model, operating system version, app version, crash reports, error logs, performance diagnostics, and app-usage information such as screens viewed, features used, and general interaction patterns ("Diagnostic and Usage Data"). We use PostHog for product analytics, and may use third-party crash and diagnostic reporting tools (such as Sentry or Firebase Crashlytics); the specific tools we use may change over time. Diagnostic and Usage Data is used to fix bugs, understand how features are used, and improve the app. It does not include your Health Information or health records, and it is never used for advertising.

Payment information. Subscriptions are purchased through Apple's App Store or, where offered, through our website or other channels with payment processed by Stripe. Payment is processed entirely by Apple or Stripe. We never see or store your payment card number or billing details. Apple and Stripe provide us only with the transaction information (such as whether a subscription is active) needed to unlock your access.

This is the most important section of this policy. Your data falls into three buckets, and each lives in a different place.

Bucket 1 — Your health and workout data: on your device only. Profile Information, Health Information imported from Apple Health, and Workout Data are stored and processed locally on your device. We do not maintain a server-side database of this data, and we do not have ongoing access to it. This has a real consequence you should understand: if you delete the app, lose your device, or reset it, this data is gone forever — we cannot retrieve or restore it, because we do not keep a copy it could be restored from. This is a deliberate design choice, not a limitation we plan to remove.

Bucket 2 — Plan and coaching generation: processed on our servers, briefly retained for debugging, then deleted. When Talala generates your training plan, adjusts it, or provides coaching, the relevant parts of your Profile Information and Health Information are transmitted to our servers (and, as described in Section 3, to our AI technology providers) to produce that result. Only the information necessary to generate the result is sent. This data may be retained on our systems for a limited period for debugging and quality assurance purposes, and is then deleted. It is not added to any database of user profiles, is not used to build a profile of you, and is not used for any purpose other than generating your result and fixing problems with generation.

Bucket 3 — Diagnostic and Usage Data: sent to us so we can fix and improve things. Crash reports, error logs, performance diagnostics, and app-usage analytics may be transmitted to us and our analytics and diagnostic service providers (such as PostHog) so we can identify bugs, fix them, understand how features are used, and improve the app. Diagnostic and Usage Data is retained only as long as reasonably necessary for these purposes.

Talala's coaching and plan generation use artificial intelligence, including third-party AI technology providers.

We do not train AI models on your data — ever. We do not use your Profile Information, Health Information, Workout Data, or Diagnostic and Usage Data to train, fine-tune, or improve any AI or machine-learning model. We contractually require that our third-party AI providers do not use your data to train their models either.

Purpose limitation. When your data is transmitted to AI providers, it is sent solely for the purpose of generating your plan or coaching response, and for no other purpose. Only the minimum information necessary to generate the response is transmitted. Once data passes through a third-party provider's systems, it is subject to that provider's safeguards; we select providers whose terms prohibit training on customer data.

AI output is an estimate, not a fact. AI-generated plans, coaching, and readings may be inaccurate or incomplete, and are provided for wellness education only — see our Terms of Service for the full disclaimer.

In addition to everything above, we make the following commitments specifically for data obtained through Apple's HealthKit framework:

• We will not use HealthKit data for advertising, marketing, or similar purposes, or for use-based data mining, other than for improving your health, fitness, and wellness experience within Talala.
• We will not sell HealthKit data to advertising platforms, data brokers, or information resellers.
• We will not disclose HealthKit data to any third party without your express permission, except to our service providers strictly for providing the Services as described in this policy.
• HealthKit data is used only to provide the health and fitness features of Talala.

We use the information described in this policy to: provide the Services (measure your body, generate and adjust your plan, coach your workouts, calculate strength map and strength age readings); fix bugs, debug generation issues, and improve app stability and features; respond when you contact us for support; and comply with legal obligations.

Restrictions. We do not use your Health Information or Profile Information for advertising or marketing purposes. We do not build advertising profiles. We do not conduct automated decision-making that produces legal or similarly significant effects about you.

We share data only in these narrow cases:

• Service providers. Cloud infrastructure providers that run our plan-generation servers, AI technology providers (Section 3), and analytics and diagnostic providers such as PostHog and crash reporting tools (Section 1) — each processing data solely on our behalf and solely to provide and improve the Services.
• Apple and Stripe. Subscriptions and payments run through Apple and Stripe under their own terms and privacy policies.
• Legal requirements. If required by law, subpoena, or court order, or where necessary to protect the rights, safety, or property of you, us, or others. Where legally permitted, we will tell you before disclosing your data in response to a legal request.
• Business transfers. If SkyPorch LLC is involved in a merger, acquisition, or sale of assets, data we hold (which, per Section 2, is limited) may transfer as part of that transaction. This policy's restrictions — including the no-AI-training and no-selling commitments — would continue to apply to that data unless you are notified and given a choice.

We do not sell your personal information, for money or anything else. We do not share it for targeted or cross-context behavioral advertising. Our analytics are used only to improve the app — we do not run third-party advertising or ad-tracking SDKs — so there is no "sale" or "sharing" of your data as those terms are defined under U.S. state privacy laws.

• On-device data (Bucket 1): kept on your device until you delete it or delete the app. Deleting the app deletes this data permanently. We have no copy.
• Plan-generation data (Bucket 2): retained for a limited period for debugging and quality assurance, then deleted.
• Diagnostic and Usage Data (Bucket 3): retained only as long as reasonably necessary for debugging and improvement.
• Support emails: retained as long as needed to resolve your issue and for a reasonable period afterward.

To delete your data: delete the app from your device. That removes everything in Bucket 1 immediately and permanently. To request deletion of anything we may briefly hold in Buckets 2 or 3, email support@talala.app and we will honor the request within the timeframes required by applicable law. Note that deleting the app does not cancel an active subscription — manage subscriptions in your Apple ID settings (or, for purchases made through Stripe, contact support@talala.app).

We use commercially reasonable technical and organizational measures to protect data in transit and the limited data we temporarily hold, including encryption in transit. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. The strongest protection in our design is structural: the most sensitive data never leaves your device except transiently, and we keep no database of it. If we learn of a security incident affecting your personal information, we will notify you as required by applicable law, including Florida's Information Protection Act.

Depending on where you live (including U.S. states such as California, Colorado, Connecticut, Texas, Virginia, and others, and the EEA/UK), you may have rights to access, correct, delete, or receive a copy of your personal data, to object to or restrict certain processing, and to appeal a decision we make about a request.

In Talala's case, most of these rights are already in your hands, literally: your data is on your device, where you can view it, correct it, and delete it directly. For anything else — including data we briefly hold for debugging — email support@talala.app. We will verify your request (typically by confirming control of the email associated with your inquiry), respond within the time required by applicable law (generally 45 days in the U.S.), and will never discriminate against you for exercising your rights. Authorized agents may submit requests with proof of written permission.

EEA/UK users: our legal bases for processing are performance of our contract with you (providing the Services), legitimate interests (debugging and improving the app), and consent (Apple Health access, which you may withdraw at any time in device settings). You may lodge a complaint with your local supervisory authority, though we'd appreciate the chance to resolve concerns first. Data is processed in the United States; where required, transfers rely on appropriate safeguards such as Standard Contractual Clauses.

Do Not Track / Global Privacy Control: the Services do not track you across third-party apps or websites, so there is nothing for these signals to opt out of.

Talala is for adults 18 and older. The Services are not directed to anyone under 18, and we do not knowingly collect personal information from anyone under 18. If we learn that a person under 18 has provided personal information through the Services, we will delete it promptly.

SkyPorch LLC is not a "covered entity" or "business associate" as defined under the Health Insurance Portability and Accountability Act of 1996 (HIPAA). Health Information you provide through the Services is not protected health information subject to HIPAA and is governed solely by this Privacy Policy. You should not use the Services to store or transmit information that you believe requires HIPAA-level protection.

We reserve the right to change this Privacy Policy at any time. When we do, we will update the date at the top, and the current version will always be available at talala.app/privacy. Continued use of the Services after a change takes effect means you accept the updated policy.

SkyPorch LLC, Florida, USA

support@talala.app

We read everything sent to this address.