All pages

Privacy and terms

The short version first. The full documents follow.

The short version6
  1. We collect what Eliya needs to work: your account, your training and food logs, and the settings you choose.
  2. Your data is stored in Sydney, Australia.
  3. We don't sell your data, we don't show ads, we don't use analytics or advertising tools, and we don't track you across other apps or websites.
  4. Kai, the AI coach, is off until you turn it on, and only for people 18 and over. When it's on, a summary of your training goes to Anthropic in the United States to produce Kai's replies. Your name, email, birthday, gender, weight, height, location, food logs and account ID are never sent.
  5. Apple Health and Health Connect data are used only to show your training to you. They are never used for advertising.
  6. You can export everything or delete your account from inside the app, or ask us by email without the app.

Documents

3
Privacy policyWhat we collect, why, and your rightsRead
Terms of useThe agreement for using EliyaRead
Delete your accountHow to delete it, in the app or by emailRead

Privacy policy

Plus Ultra Innovations Pty Ltd (ACN 686 310 850) · Policy version 2026-10e, last updated 19 October 2026

Eliya is an app for iPhone and Android phones for strength, running, cycling, swimming, mobility and food tracking, with an optional AI coach called Kai.

Eliya is made by Plus Ultra Innovations Pty Ltd (ACN 686 310 850), a company registered in Victoria, Australia ("we", "us"). We are responsible for the personal information Eliya collects.

This policy explains what we collect, why, where it goes, how long we keep it, and how to get a copy of it or delete it. It follows the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). Eliya is offered in Australia first.

This website. eliyafit.com is hosted by Vercel Inc. (United States). Like any web host, Vercel records each request in access logs, such as your IP address, browser type, the page and the time, to run and secure the site. The site uses no analytics, advertising or tracking tools, and it sets no cookies.

Some of what Eliya handles is health information, which the Privacy Act treats as sensitive. That includes your workouts, heart rate, body weight and food logs. We collect it only with your consent and only for the features you use.

  • We collect what Eliya needs to work: your account, your training and food logs, and the settings you choose.
  • Your data is stored in Sydney, Australia.
  • We don't sell your data, we don't show ads, we don't use analytics or advertising tools, and we don't track you across other apps or websites.
  • Kai, the AI coach, is off until you turn it on, and only for people 18 and over. When it's on, a summary of your training goes to Anthropic in the United States to produce Kai's replies. Your name, email, birthday, gender, weight, height, location, food logs and account ID are never sent.
  • Apple Health and Health Connect data are used only to show your training to you. They are never used for advertising.
  • You can export everything or delete your account from inside the app, or ask us by email without the app.
  • First name: To address you in the app. From you, or from Apple or Google when you sign in with them.
  • Email address: To sign you in, send sign-in codes, and send the emails listed in 3.13. From you, Apple or Google.
  • Password (stored only as a one-way hash by our sign-in provider): To sign you in with email. From you.
  • Passkey (optional, in a later version): Passkeys aren't in this version of Eliya. When they come, a passkey will let you sign in with Face ID, Touch ID or your phone's screen lock instead of a password. Your phone will keep the private key; we'll store only the public key. From you.
  • Sign-in method (email, Apple or Google; passkeys in a later version) and an account ID: To run your account. If you use Sign in with Apple, we keep the identifier Apple gives us so your account keeps working if the app moves to another developer account of ours. Created when you sign up.
  • Birth month and year: To check you're 16 or over, and 18 or over before Kai; to turn off food targets for people under 18. From you, at sign-up (section 9).
  • Language, units, appearance, time zone: To show the app the way you set it. From you and your phone.
  • Dates you accepted the Terms and this policy, and the versions: To keep a record of your agreement. Recorded at sign-up.
  • Sign-in times and security records, which may include IP addresses: To keep your account secure and stop misuse. Our sign-in provider records these automatically.

If you use Sign in with Apple, Apple may give us a private relay email address instead of your real one. That's a normal Eliya account.

Face ID or fingerprint app lock (optional, off by default). If you turn it on, your phone checks your face or fingerprint itself. Eliya only learns whether the check passed. Your face and fingerprint data never leave your phone and we never receive them.

We ask your training focus, experience, days per week and session length, so Eliya can suggest programmes and plan your week. We don't ask about health conditions or injuries.

If you enter your age to estimate heart-rate zones, we use it once to do the calculation and don't save it.

  • Exercises, sets, reps, weights, rest, effort ratings, notes, and the date and length of each session, including mobility routines and timed holds.
  • Programmes you follow or build yourself, your progress through them, and whether you moved or skipped unfinished sessions. Programmes you build are private to you.
  • Personal records and achievements that Eliya works out from your workouts. Eliya has no streaks.

Why: to record your training, show your progress and plan your next session.

When you start a run or ride and allow location, Eliya uses your phone's location only between Start and Finish. It keeps measuring while your phone is locked. Your phone shows that location is in use (on iPhone, the location indicator; on Android, a notification that stays while recording). Location stops the moment you finish or discard.

We store each recorded activity, including its route (a simplified line of points with times), distance, pace, splits and elevation. Routes are precise location data.

Why: to measure distance and pace, show your splits and route map, and record personal bests. Routes are never sent to Kai and are not shared with anyone.

You can record without location: Eliya then times the activity and you type the distance.

Distance, time, pool length, stroke and notes that you type in.

  • Your food diary: foods and meals you log, portions, the time you logged them, and the energy (kilojoules), protein, fat, carbohydrate, sugars, fibre and sodium Eliya works out from them. Recipes you build, meals you save, and quick-add entries.
  • Targets (optional, off unless you choose them). You can set daily targets for energy, protein, fibre, carbohydrate and fat, and upper limits for sodium, saturated fat and sugars. Each can be a number you type or a suggested starting point, which we work out from the sex, height, weight and activity level you enter and your birth month and year, using Australia's Nutrient Reference Values for most nutrients. Sugars has no suggested starting point, only a number you type. We store the targets you choose and how each was set. Energy targets never go below 5,000 kJ a day or your estimated resting energy, whichever is higher. People under 18 don't get targets. You can choose to see no numbers at all.
  • If you turn numbers off. In no-numbers mode Eliya doesn't show you energy or nutrients anywhere. It still works them out and stores them with each entry, so they're there if you turn numbers back on. Anything you type into a food or a quick add is stored the same way.
  • Your targets. If you choose targets, we store the mode you picked, your energy unit (kJ or kcal), and for each nutrient you chose (energy, protein, fibre, carbohydrate, fat, and the upper limits for sodium, saturated fat and sugars) its value, whether you typed it or took the suggestion, where the suggestion came from, and whether a safety limit was applied. Energy targets never go below 5,000 kJ a day or your estimated resting energy, and the workouts you log don't change them. Only Eliya's server works out and saves targets.
  • On your phone. Entries you make offline are saved on your phone until they upload. Your recent foods (up to 200), your own foods, saved meals and recipes are also kept on your phone so you can log without a connection. Signing out removes them from the phone.
  • Barcode scanning. Your phone's camera reads the barcode on the phone. Eliya uses the camera only for this and keeps no camera images. The barcode number is looked up in Eliya's own food database on our servers, so no outside food company receives your scans or searches.
  • Where our food data comes from: Food Standards Australia New Zealand's AUSNUT 2023 database, Open Food Facts, the United States Department of Agriculture's FoodData Central, and foods typed in from packaging by our team. Each food shows its source.
  • Foods you add. If a food isn't found, you can add it: barcode, name, brand, serving size and the values from its nutrition panel. A food you add is visible only to you in this version. We check it automatically, and our reviewers may look at it to correct our database. If we later let people share foods with everyone, we'll ask you first.

Why: to record what you eat and show your daily totals, and to keep the food database accurate. Food logs are health information. They are never sent to Kai.

Optional. If you log your weight, we store each entry and its date to show your trend and, if you chose them, to calculate food targets. Weight is never sent to Kai.

On iPhone you can connect Apple Health; on Android, Health Connect. You choose on your phone's own permission screen what Eliya may read and write.

  • Eliya can read: workouts from other apps (runs, rides, swims and other workouts) and, for those workouts, their distance, time, average heart rate and active energy. On first connect we read the last 90 days unless you choose otherwise.
  • Eliya can also read your daily step count, to show it on Today and in Progress. Steps are read on your phone each time you open those screens: they aren't uploaded to Eliya, we don't store them, and Kai never receives them.
  • Eliya can write: workouts you record in Eliya, with their distance and, for GPS sessions, their route.
  • Saving food to Apple Health is off unless you turn it on in Profile › Settings › Food. When it's on, each food you log is saved to Apple Health as one food entry with its name, dietary energy, protein, carbohydrate and total fat, at the time you logged it. If you edit or delete the entry in Eliya, Eliya replaces or removes it in Apple Health. Eliya doesn't read food from Apple Health. Food in Apple Health stays there if you turn the setting off or delete your Eliya account; you can remove it in the Health app.
  • On Android, saving food to Health Connect isn't offered in this version.
  • We copy the workouts we read into your Eliya history so they show in Progress. We don't import workouts that Strava wrote into Apple Health or Health Connect.

This data is used only to show your training and progress to you. We never use it for advertising or marketing, never sell it, and never store it in iCloud. Kai receives activity summaries only if you separately switch on Let Kai use activities from Apple Health / Health Connect (off by default): activity type, date, duration, distance and average heart rate. Kai never receives heart-rate samples or routes.

You can stop Eliya's access at any time in your phone's settings (iPhone: Settings › Health › Data Access & Devices › Eliya; Android: Health Connect › App permissions › Eliya). When you disconnect inside Eliya, you choose whether to keep or delete the activities already imported.

If you connect Strava, Strava gives us a sign-in token for your Strava account, which we keep on our server only.

  • Eliya shows your recent Strava activities (name, type, date, distance, moving time and elevation) to you only.
  • We don't store your Strava activities on our server. Your phone keeps the last list for up to 24 hours.
  • Strava activities don't count towards your Eliya history or records, and Kai never sees them.
  • When you disconnect Strava in Eliya, or remove Eliya in Strava's settings, we revoke and delete the token.

Strava's own privacy policy covers what Strava does with your data.

Kai is an AI coach. It runs on Claude, an AI model made by Anthropic PBC in the United States. Kai only works after you confirm you're 18 or over and agree on the Meet Kai screen, which names Anthropic and shows exactly the list below.

What is sent to Anthropic when you use Kai

  • The language you use Eliya in, so Kai answers in it
  • Your units (metric or imperial)
  • Your sport, experience level and training days
  • Your training zones, if you have set them
  • Your current programme and week
  • Your last 7 workouts: name, date, length and total weight lifted
  • Your runs from the last 30 days: distance, pace and date
  • For a run you have just finished: its distance, time and splits
  • Your next race: its distance and how many days away it is (not its name)
  • Whether a programme check-in is due, and its date
  • Apple Health or Health Connect activity summaries, only if you switch that on (3.8)
  • What you type to Kai
  • A scrambled identifier, so Anthropic can detect abuse without receiving your account ID

Names you gave workouts or programmes are sent as part of the lists above, with email addresses, links, phone numbers and other identifiers removed.

What is never sent

  • Your name, email, birthday or gender
  • Your weight or height
  • Your location or routes
  • Your health notes or injuries
  • Anything you log in Food
  • Anything from Strava
  • Your account ID

What happens to it

  • Eliya doesn't store your conversations. They stay in the app's memory and are gone when you close the app or tap Clear conversation, and Kai doesn't remember past conversations. We keep a log of each Kai request without its content (time, type, language, size and whether it worked) for 90 days, to apply Kai's monthly allowance and fix problems. We keep Today's one-line Kai message for 7 days.
  • If you report a reply with Report this reply, we keep that reply and the reason you chose (not your own messages), so we can review it and improve Kai's safety. We delete the report 180 days after we've resolved it.
  • Anthropic processes what we send to produce Kai's reply. Under Anthropic's commercial terms it may not train its models on it. Anthropic deletes it within 30 days, unless its automated safety systems flag a conversation, in which case it may keep that conversation for up to 2 years and safety scores for up to 7 years, or unless the law requires it to keep it longer.
  • Where: Anthropic stores data in the United States. Anthropic says it may process requests in the United States, Europe, Asia or Australia. The model Kai uses (Claude Haiku 4.5) can't currently be restricted to one region.

Kai's limits. Kai gives general fitness guidance. It doesn't diagnose, treat or give medical advice, and it will tell you to see a physiotherapist or GP about pain or injury. Every Kai screen reminds you that Kai is an AI and that its replies are general information, not professional advice. Contact details you type into Kai (emails, links, phone numbers) are removed before anything is sent. Kai can be wrong: check anything important. Kai has a monthly allowance and may sometimes be unavailable.

You can turn Kai off at any time in Profile › Privacy. Turning it off stops all sending at once.

If you allow notifications:

  • Workout reminders and rest-timer alerts are scheduled on your phone. They don't go through our servers.
  • We don't send notifications from our servers in this version, so we don't store a push token for your phone.

Notification text is kept general, so nothing personal shows on your lock screen. You can turn each one off in Profile › Notifications, or turn all of them off in your phone's settings.

If you use Report a problem on a food, we keep your report: the food, the reason you chose, and any note you add (up to 280 characters). You can report each food once. Notes can't include links, email addresses or phone numbers. If you use Report this reply on Kai, we keep the reply and the reason only. Reports are seen by our reviewers, are kept as section 6 says, and are never sent to Kai.

We send:

  • Sign-in and password-reset codes
  • "Your export is ready" and "your account has been deleted" messages, with no links to your data
  • Product news, only if you opt in. Every news email has an unsubscribe link, and you can also turn it off in Profile › Privacy.

If you email hello@eliyafit.com or privacy@eliyafit.com, we receive your email address, what you write, and the details the app adds to help us (app version, phone system version, language, and the first 8 characters of your account ID).

When something goes wrong in the app, it sends us a short error report: the type of error, the screen it happened on, the app version and build, and your phone's system version and model. It doesn't include your name, email, account ID, location or anything you typed, and it isn't linked to you. Reports are stored in Sydney and deleted after 30 days, and we use them only to find and fix faults.

No advertising identifier, contacts, microphone, browsing history, payment details, or data from other apps beyond Apple Health or Health Connect and, if you connect it, Strava. We keep no camera images: the camera is used only to read barcodes, and you can't add photos in this version. We don't use analytics, advertising or third-party crash-reporting tools in this version.

We don't use your food logs to show you ads or to market anything, and we never sell them. Eliya has no ads.

  • Creating an account means you accept the Terms and this policy, and you tick one explicit line: "I agree that Eliya stores my training, activity, food and health data, as described in the Privacy Policy, to run the app."
  • Location, camera, notifications, Apple Health and Health Connect each ask your permission through your phone when you first use the feature. You can change each one in your phone's settings.
  • Kai, Kai's use of Apple Health or Health Connect activities, and product news emails are separate opt-ins, off by default. You can withdraw each one in Profile › Privacy, and withdrawing never affects the rest of the app.

If you don't give a permission, the feature that needs it won't work, but the rest of Eliya will. For example, you can record a run without location by typing the distance, or log food by searching instead of scanning.

Your Eliya data is stored in a database and file store run by Supabase in Sydney, Australia. Supabase acts on our instructions. Its contracting entity is Supabase Pte. Ltd. in Singapore, and its staff and subprocessors may access the data from other countries to support and secure the service.

Our sign-in, Kai, food and privacy functions run on Supabase's servers. Kai's function is set to run in Sydney.

We share personal information only with the providers below, only for the purpose stated, and under contracts that require them to protect it.

  • Supabase: All Eliya data, for hosting, the database, file storage and sign-in. Stored in Australia; the provider is in Singapore, with support access from other countries.
  • Anthropic PBC: The Kai summary in 3.10, only if you turn Kai on, to produce Kai's replies. United States (storage); processing may occur in the United States, Europe, Asia or Australia.
  • Apple: Your Apple sign-in (if used), for Sign in with Apple. United States.
  • Google: Your Google sign-in (if used), for Sign in with Google. United States.
  • Brevo (Sendinblue SAS): Your email address, language and the email text, to send account emails and, if you opt in, product news. France, with data held in France, Germany and Belgium.
  • Strava: Your Strava token, if you connect Strava, to show your Strava activities. United States.
  • Apple (iCloud Mail): Emails you send to hello@eliyafit.com or privacy@eliyafit.com, and our replies, for our email inbox for support and privacy requests. United States and other countries where Apple stores iCloud data.

Not recipients. Apple Health and Health Connect keep their data on your phone; Eliya reads and writes it there. Food searches and barcode lookups use Eliya's own copy of the food data, so Food Standards Australia New Zealand, Open Food Facts and the USDA receive nothing about you.

The food you log is never sent to Anthropic or to any AI, text-recognition or photo-recognition service.

Overseas disclosure (APP 8). Before we send personal information overseas, we take reasonable steps to make sure the recipient handles it in line with the APPs, mainly through their data processing terms. We remain accountable for how they handle it.

We don't sell or rent personal information, and we don't share it with advertisers or data brokers.

We may disclose information if the law requires it, or to protect someone's life, health or safety.

  • Your account, training and food data: Until you delete your account or delete the item.
  • A deleted account: Removed by our deletion job 7 days after you confirm (the grace period lets you cancel).
  • A data export file: 7 days, then deleted.
  • Foods you added: Until you delete them or your account.
  • Food targets and food settings: Until you change them, turn targets off, or delete your account.
  • Food entries waiting to upload: On your phone until they upload, or until you sign out.
  • Review records (what a reviewer did to a food, with no personal details): For as long as the food is in our database.
  • A note that an account can't share foods (in a later version): Until we lift it or the account is deleted.
  • Kai request log (no content): 90 days.
  • Today's Kai line: 7 days.
  • Kai conversations: Not stored by Eliya; Anthropic keeps them up to 30 days (longer if flagged, see 3.10).
  • Reports (food and Kai): 180 days after we resolve them, then deleted; a food report's note is deleted with it.
  • Strava activities: Not stored on our server; up to 24 hours on your phone.
  • Daily steps: Not stored by us; read on your phone each time.
  • App error reports: 30 days.
  • Record that an account was deleted: Kept with no name or email: a scrambled ID, dates and row counts, so we can show the deletion happened.
  • Database backups: Up to 7 days after deletion, then overwritten.
  • See and correct: Most of your details can be changed in Profile.
  • Export: Profile › Privacy › Export my data prepares a zip file of everything Eliya holds about you, usually within 15 minutes. You download it in the app. The file is kept for 7 days.
  • Delete your account in the app: Profile › Privacy › Delete my account. You confirm it's you (if you use Sign in with Apple, Apple asks you to sign in again), and the account is deleted 7 days later. Sign back in during those 7 days to cancel. When deletion runs we delete your data, revoke Sign in with Apple and Strava access, and email you a confirmation. Kai stops at once when you ask for deletion.
  • Delete without the app: Follow eliyafit.com/delete-account, or email privacy@eliyafit.com from the email address on your account. We confirm it's you and reply within 30 days.

Deleting your account deletes your food diary, recipes, saved meals, targets, food settings, foods you added and reports. If a recipe or saved meal uses a food you added, they are deleted together. Food you saved to Apple Health stays in Apple Health.

Deleting Eliya data doesn't delete data held in Apple Health, Health Connect or Strava. Manage those in their own settings.

  • Data is encrypted in transit between the app and our servers.
  • Each person can read only their own records: the database enforces this on every table.
  • Your sign-in session is kept in your phone's secure storage (the iPhone Keychain or Android Keystore).
  • Secret keys, including the Anthropic and Strava keys, live only on our servers, never in the app.
  • Function logs record request IDs and counts, not your training, food or Kai content.

If a data breach is likely to cause serious harm, we'll notify you and the OAIC as the Notifiable Data Breaches scheme requires.

Eliya is for people aged 16 and over. At sign-up we ask your birth month and year. If you're under 16 we don't create an account. If we learn an account belongs to someone under 16, we'll delete it.

Kai is for people aged 18 and over. Eliya checks your birth month and year before showing the Meet Kai screen. People under 18 also don't get food targets.

Where your phone offers it, Eliya may instead ask Apple or Google for an age range you've chosen to share, rather than asking you.

Kai and Eliya's suggestions (your next session, programme suggestions, food targets, personal records) are made by software. None of them makes decisions that significantly affect your rights or interests. You choose what to do with every suggestion.

We send product news only if you opt in, and every message lets you unsubscribe. We never use health data, Apple Health or Health Connect data, location, food logs or Kai conversations for marketing.

The Eliya app is offered in Australia's app stores, and Eliya is run from Australia under Australian law. Wherever you live, you get the same protections: everything in this policy applies to you, and you can get a copy of your data, correct it, take it with you or delete it (section 7).

  • In the European Economic Area, the UK or Switzerland: we use your information to provide the app you signed up for (our agreement with you), with your explicit consent for health and fitness information and for Kai (section 4), and for our legitimate interest in keeping Eliya secure (section 8). You can withdraw consent at any time, object to use based on legitimate interests, and complain to your local data protection authority as well as to us. Section 5.2 lists who receives your information and where.
  • Anywhere else: you can use any further rights your local law gives you, and complain to your local regulator as well as to us.

Before Eliya is offered in another country's app store (Singapore is next), we'll add a section for that country's law.

If you think we've mishandled your information, email privacy@eliyafit.com. We'll acknowledge it within 5 business days and respond within 30 days.

If you're not satisfied, or we haven't replied within 30 days, you can complain to the Office of the Australian Information Commissioner (OAIC):

Australia

Office of the Australian Information Commissioner

www.oaic.gov.au

1300 363 992

When we change this policy we update the version and date at the top. If a change affects how we use data you've already given us, we tell you in the app and ask again where consent is needed. Kai's consent screen shows again whenever what Kai receives changes.