Privacy Policy

1. Data controller

The data controller for Myo (myo.coach, app.myo.coach and the Myo iOS and Android apps) is VR Express OOD, a company registered in Bulgaria (company number 203447777). Contact privacy@myo.coach for any privacy question or request. We have not appointed a Data Protection Officer; privacy@myo.coach is the contact point. You can also complain to the Bulgarian Commission for Personal Data Protection (CPDP, cpdp.bg) or your local authority.

2. What Myo does

Myo is a personal wellness and self-tracking tool that models how your activities drain or restore your reward system. It is not a medical device and not a substitute for professional care. Scores are calculated automatically from your own data; they have no legal or similarly significant effect on you.

3. Data we collect

• Account: email address and password hash, or your name, email and Google account ID if you sign in with Google.
• What you log: activities, free-text and voice log entries, daily check-ins (mood, energy, craving), protocols and experiments, and the scores calculated from them.
• Voice (optional): if you use voice logging, the recording is transcribed and then discarded; we keep only the text.
• Coach chat (optional): messages you send to the coach, with a summary of your scores and recent activities, are processed to write the reply. We do not store the conversation.
• Health and device data (optional, explicit consent): in the Myo apps, if you turn it on, sleep, heart-rate variability, resting heart rate, steps, workouts and mindful minutes from Apple Health (iPhone) or Health Connect (Android), and minutes spent in app categories you choose (Screen Time on iPhone, app usage on Android). Data imported through Health Auto Export or a WHOOP connection (sleep, HRV, resting heart rate). Myo only reads this data; it never writes to Apple Health or Health Connect.
• Cravings, substances and recovery (optional, explicit consent): craving and substance targets and logs, and, in the Recovery module, solo sessions, substance tapers, bloodwork, supplements, therapy sessions, daily recovery logs and weekly reviews.
• Billing: subscription status and, for web purchases, your Stripe customer ID; for App Store purchases, Apple transaction IDs. We never see card numbers.
• Dopamine Audit (no account needed): your answers, score, the referring page and campaign tags, and a salted hash of your IP address used only for rate-limiting. If you arrive from a link with a campaign tag (for example utm_source=reddit), we save that tag and the referring site when you finish the audit or sign up, kept separate from your audit answers. No advertising trackers are used.
• Usage: product events (for example "check-in completed") with a random device ID stored in your browser, and anonymous page-view statistics recorded by our hosting provider.
• Notifications: reminders and check-in prompts are scheduled on your device; their text is kept generic.

4. Why we use it and legal bases (GDPR Art. 6 and 9)

• To provide the app you signed up for: performance of contract.
• To secure accounts, prevent abuse and improve the product (usage events, audit rate-limiting): legitimate interest. You can object at privacy@myo.coach.
• Health and device data, and cravings/substances/recovery data, are special-category health data. We process them only with your explicit consent (Art. 9(2)(a)), given separately for each: "Phone health and screen-time sync" and "Cravings, substances and recovery". Each consent is recorded with its date and wording.
• Emails (weekly digest, daily nudge): your choice in Settings, with an unsubscribe link in every email.

5. Apple Health and Health Connect

Data read from Apple Health or Health Connect is used only to calculate your scores and show them to you. It is never used for advertising or marketing, never sold, never shared with data brokers, and never used for anything unrelated to Myo's features. It is shared only with the processors below that are needed to run those features.

6. Processors

• Supabase, via Lovable Cloud: database, authentication, server functions (EU region).
• Lovable (Lovable Labs): website hosting and anonymous page-view statistics; the AI gateway that routes AI requests; the Google sign-in service used by the mobile apps.
• Google: Google Sign-In; Gemini models (through the Lovable AI gateway) for coach replies and turning free-text logs into activities.
• OpenAI (through the Lovable AI gateway): speech-to-text for voice logs.
• WHOOP: only if you connect it.
• Resend: sending emails.
• Stripe: web subscription billing.
• Apple: App Store purchases. Apple Health and Health Connect data is read on your device by the Myo app.

AI providers receive only what is needed to answer a single request. Recovery data is sent to the AI only when you use the recovery coach, and only with your recovery consent.

7. International transfers

Some processors (Google, OpenAI, Lovable, Stripe, Resend, WHOOP) may process data outside the EU, including in the United States. These transfers rely on the EU–US Data Privacy Framework where the provider is certified, and on the European Commission's Standard Contractual Clauses otherwise.

8. Your rights and how to use them

• Export: Settings › Privacy › "Export all my data" (web), or More › Account › "Export my data" (apps) downloads everything we hold about you as JSON.
• Withdraw consent: Settings › Privacy › Withdraw, for each consent. You can choose to delete the data that consent covered at the same time. In the apps, turning off health or screen-time sync withdraws that consent.
• Delete your account: Settings › Privacy › "Delete account" (web) or More › Account › "Delete account" (apps). This deletes your account and all its data and cancels a web subscription. Cancel an App Store or Google Play subscription in your store settings.
• You also have the right to access, correct, restrict or object to processing, and to complain to a supervisory authority. Email privacy@myo.coach; we reply within 30 days.

9. Retention

• Account data: kept while your account exists; deleted from the live database when you delete your account, and from backups within 30 days.
• Health and recovery data: kept until you withdraw consent with deletion or delete your account.
• Usage events and unclaimed Dopamine Audit results: deleted after 13 months.
• Audit IP hashes: deleted after 30 days.
• WHOOP and Health Auto Export tokens: until you disconnect.

10. Security

Each user can only read and write their own rows (row-level security). Health and recovery data additionally requires your consent at the database level. Wearable tokens are stored encrypted. On your phone, your sign-in is kept in the system keychain or app storage and cleared when you sign out.

11. Cookies and local storage

We use no advertising or cross-site tracking. We store your sign-in session in your browser's local storage (necessary), a random device ID for product events, and our hosting provider sets a session identifier for anonymous page-view statistics.

12. Children

Myo is for adults (18+). We do not knowingly collect data from anyone under 18; contact us and we will delete it.

13. Changes

We update this page and the date above when our practices change, and announce material changes in the app or by email.