← Back to Tavy

Privacy Policy

App: Tavy · Effective date: September 3, 2026 · Last updated: September 3, 2026

This Privacy Policy explains how Matjahu (“we”, “us”, or “our”) collects, uses, and protects your information when you use the Tavy mobile application (the “App”) on Android and iOS. By using Tavy, you agree to the practices described in this policy.

If you do not agree with this policy, please do not use the App.

1. Information We Collect

1.1 Account information

When you create an account or sign in, we collect and process:

  • Your email address.
  • Your display name and profile information provided by your chosen sign-in method (Email/Password, Google Sign-In, or Apple Sign-In), and a profile photo if you set one.
  • A unique user identifier associated with your account.

If you sign in with Apple and choose to hide your email, we receive a private relay email address instead of your real one. You can also use Tavy as a guest, without an account; in that case your data stays on your device and is not synchronized.

1.2 Step and activity data

Tavy's core function is counting your steps. Depending on your device and the permissions you grant, step counts may come from:

  • Health Connect (Android) or Apple HealthKit (iOS) — the operating system's health store, which also aggregates data from wearables and other apps.
  • Your device's built-in step counter sensor, used as a fallback when the health store is not available.

From these sources we process your daily step totals and the derived values shown in the App (estimated distance, estimated calories, active minutes, streaks, achievements and level). Where a step total is synchronized to your account, we also store which source it came from.

Three commitments apply to this data specifically:

  • We ask first, and we read nothing until you agree. Tavy shows you a health-data disclosure and requests the platform permission. Until you accept, the App reads no step data at all — it does not fall back to reading it another way.
  • We only read. Tavy never writes, modifies, or deletes anything in Health Connect or Apple Health.
  • We only read steps. We do not request or collect heart rate, sleep, weight, workouts, medical records, or any other health category.

We do not use your health or activity data for advertising, marketing, or data mining, and we do not sell it or disclose it to data brokers, advertisers, or any third party for those purposes.

1.3 Content you create

  • Your daily step goal, unit preference, streaks, unlocked achievements, XP and level, reminder times, theme and language settings, and the display name and avatar on your profile. When you are signed in, this data is stored in the cloud and synchronized to your account so it is available across your devices.

1.4 Friends and leaderboards

Tavy includes optional social features. If you use them:

  • We process the invite codes and friend requests you send or receive. A friendship only exists once both people accept it, and either person can remove it at any time.
  • Your display name, avatar, daily and periodic step totals, level and streak are visible to the friends you have accepted, and your display name, avatar and step totals may appear in the global leaderboard to other users of the App.
  • Only step totals read from Health Connect or Apple HealthKit are eligible to appear in a leaderboard. Readings from the raw device sensor are shown to you but are never published to a ranking.

Leaderboards and friends share step totals only — never your underlying health records, your email address, or any other health category.

1.5 Analytics and diagnostics

With your consent (where required by law), we collect:

  • Usage and analytics data (e.g., feature usage, events) via Firebase Analytics.
  • Crash and performance diagnostics via Firebase Crashlytics to detect and fix errors.
  • Device and technical information such as device model, operating system version, app version, language, and general region.

On iOS, we request your permission through App Tracking Transparency (ATT) before any tracking that requires it. You can decline, and you can change this in your device settings at any time. Your health and step data is never included in analytics events.

1.6 Security

  • We use Firebase App Check and standard security mechanisms to protect the backend from abuse. This may involve device attestation signals.

We do not knowingly collect precise location data, contacts, or biometric data. Biometric unlock (fingerprint / Face ID), if enabled, is handled entirely by your device's operating system; we never receive or store your biometric information.

2. How We Use Your Information

We use the information we collect to:

  • Provide, operate, and maintain the App and your account.
  • Count your steps and show your daily progress, streaks, history, achievements and level.
  • Store and synchronize your progress across your devices.
  • Run the friends and leaderboard features you choose to use.
  • Send local reminders and notifications you configure (these are generated on your device).
  • Detect and prevent implausible or manipulated step data, so rankings stay fair.
  • Improve, debug, and secure the App through analytics and crash diagnostics.
  • Respond to support requests and communicate important service information.
  • Comply with legal obligations and enforce our Terms & Conditions.

3. Legal Bases for Processing (EEA/UK users)

Where the GDPR (or UK GDPR) applies, we process personal data on the following legal bases:

  • Performance of a contract — to provide the App and your account.
  • Explicit consent — for health and activity data, which is a special category of personal data under Article 9 GDPR, and for analytics, tracking, and non-essential identifiers. You may withdraw consent at any time, in the App or in your device's system settings.
  • Legitimate interests — to secure, maintain, and improve the App, and to keep leaderboards free of manipulated data.
  • Legal obligation — where processing is required by law.

4. Third-Party Services

Tavy relies on trusted third-party providers that process data on our behalf or as independent controllers:

  • Google Firebase (Authentication, Cloud Firestore, Cloud Functions, Analytics, Crashlytics, App Check) — data storage, authentication, analytics, and diagnostics.
  • Google Sign-In and Apple Sign-In — authentication.
  • Health Connect (Android) and Apple HealthKit (iOS) — on-device health stores we read step counts from. These are part of your device's operating system; the data reaches us only after you grant permission.
  • Apple App Store and Google Play — app distribution.

Each of these providers has its own privacy policy governing their use of your data. We encourage you to review them.

5. Data Sharing and Disclosure

We do not sell your personal data, and we do not share your health or activity data with advertisers or data brokers. We only share information:

  • With other users, and only as described in §1.4: your display name, avatar and step totals, to friends you accepted and in leaderboards.
  • With the service providers listed above, to operate the App.
  • When required by law, legal process, or to protect our rights, users, or the public.
  • In connection with a business transfer (e.g., merger or acquisition), subject to this policy.

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the App. If you delete your account, we will delete or anonymize your personal data — including your step history, achievements, friendships and leaderboard entries — within a reasonable period, except where retention is required by law or for legitimate business purposes (e.g., abuse prevention, accounting). Step data cached on your device is removed when you uninstall the App.

7. Data Security

We use industry-standard measures to protect your data, including encryption in transit and secure cloud infrastructure. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

8. International Data Transfers

Your information may be processed and stored on servers located outside your country of residence, including in the United States, where our service providers operate. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for such transfers.

9. Your Rights

Depending on your jurisdiction (e.g., GDPR, CCPA/CPRA), you may have the right to:

  • Access the personal data we hold about you.
  • Rectify inaccurate data.
  • Delete your data (“right to be forgotten”).
  • Restrict or object to certain processing.
  • Data portability.
  • Withdraw consent at any time — including revoking Tavy's access to Health Connect or Apple Health from your device settings, which stops all step reading immediately.
  • Opt out of the sale or sharing of personal information (we do not sell your data).

To exercise any of these rights, contact us at kiu.ht.app@gmail.com. You may also delete your account directly from within the App. You have the right to lodge a complaint with your local data protection authority.

10. Children's Privacy

Tavy is not directed to children under the age of 13 (or the minimum age required in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be posted here with an updated “Last updated” date and, where appropriate, notified in the App. Your continued use of Tavy after changes take effect constitutes acceptance of the revised policy.

12. Contact Us

If you have questions or requests regarding this Privacy Policy or your data, contact us at: