Privacy Policy

Last updated: 3 October 2026

1. Introduction & Data Controller

This Privacy Policy explains how Kovio GmbH ("we", "us", "our") collects, uses, and protects your personal data when you use the Treya website (treya.app) and the Treya mobile application.

We are committed to protecting your privacy and handling your data in an open and transparent manner, in compliance with the Swiss Federal Act on Data Protection (nDSG) and the EU General Data Protection Regulation (GDPR).

Data Controller:
Kovio GmbH
Ussbergstrasse 4d, 8864 Reichenburg, Switzerland
Email: office@kovio.ch

2. What Data We Collect

Data collected on our website (treya.app)

  • None. The website has no forms, no accounts and sets no cookies. Section 5 names the services that serve it.

Data collected by the Treya mobile app

  • Account Profile: Email, display name, avatar, bio, sex, birthday, preferred units, privacy settings.
  • Health & Wearable Metrics: Data imported from Apple HealthKit / Google Health Connect (body weight, body fat %, HRV, resting heart rate, sleep duration, sleep quality, workout heart rate time-series, active calories).
  • Body Measurements: Chest, waist, hips, biceps, thighs (in cm).
  • Injury Records: Body region (18-item taxonomy), side, severity, description, dates.
  • Daily Readiness & Wellness: Readiness score, sleep score, recovery score, energy level (1-5), stress level (1-5), notes.
  • Workout Logs: Exercises, sets, reps, weight, RPE, rest times, notes, personal records, session duration, volume tonnage.
  • Social: Followers/following relationships, shared workouts.
  • Push Notifications (optional): A device registration token and the platform name, stored only after you allow notifications. The Firebase software in the app also registers an installation identifier with Google whenever the app starts, whether or not you allow notifications. We do not store that identifier. See Section 5.

3. Health & Sensitive Data

Health consent

The Treya mobile app collects health and biometric data to provide personalised fitness insights. The Health consent lets us collect and use your sleep, resting heart rate, heart rate variability, energy, stress and feeling answers, injuries including anything you write in your own words, and body measurements to calculate your daily readiness, adapt your training around an injury, and show you your trends over time. Because this is sensitive personal data under the nDSG and special category data under the GDPR, we process it only with your explicit consent.

If you refuse the Health consent, Treya remains a workout logger: your workouts, routines and plans stay available, but it does not calculate readiness or provide AI features. You can withdraw the Health consent at any time in the app settings.

Delivery consent

The Delivery consent separately lets us send parts of your health and training data to an external AI provider so it can write your daily tip, workout reviews, training plans and Coach answers. This can include your sleep, resting heart rate, heart rate variability, energy, stress and feeling answers, injuries in your own words, and workout history.

We do not send your name, email address or account identifier with these requests. If you refuse the Delivery consent, all AI features are off. You can withdraw the Delivery consent at any time in the app settings. Section 5 names each AI provider and Section 7 explains where the processing happens.

4. Purpose and Legal Basis

We process your data for the following purposes:

  • Service Provision: To provide and maintain the Treya app and website (Contractual necessity).
  • Health consent: To collect and use health and biometric data to calculate readiness, adapt training around injuries, and show health trends (Explicit consent - nDSG Art. 5(c) and GDPR Art. 9(2)(a)).
  • Delivery consent: To send the health and training data described in Section 3 to an external AI provider so it can write daily tips, workout reviews, training plans and Coach answers (Explicit consent - nDSG Art. 5(c) and GDPR Art. 9(2)(a)).
  • Communication: To send transactional emails such as account confirmations (Legitimate interest).
  • Push Notifications: To tell you that a plan you asked for is ready, or that it could not be written, and that a new message from the Coach is waiting for you, such as your weekly review or monthly report. A notification also sets the number on the app icon to the number of Coach messages you have not read (Consent). You give this consent in the system prompt, and you can withdraw it in your device settings.

5. Third-Party Services & Data Sharing

We use the following trusted third-party services to operate Treya:

  • Supabase: Used for database hosting, authentication, and file storage. Hosted in the EU (Frankfurt).
  • Brevo: Sends the account emails the app needs, such as sign-up confirmation and password reset, on behalf of Supabase Auth. Brevo receives your email address and the email itself, which holds a one-time link. It adds open and click tracking to each of these emails, so it also records your IP address, the time, and when you open the email or click its link. Brevo is a company based in the European Union and acts as a processor under its Data Processing Agreement. It receives no health or workout record. See Section 7.
  • Google Fonts: Loaded via Next.js for website typography (no cookies used).
  • Apple HealthKit / Google Health Connect: Device-local APIs. Data is only pulled to the app with your explicit permission.
  • Cloudflare: Used for three things: hosting the treya.app website, delivering the exercise animations you see in the app, and running the AI models behind the coaching features described in Section 3. Cloudflare's terms state that it does not use this content to train any AI model or to improve any Cloudflare or third-party service, and Treya stores nothing on the AI service. A Data Processing Addendum is in place.
  • EUrouter: A second AI gateway, based in the Netherlands. It is used when the Cloudflare daily allowance is spent, and for the larger model available on the paid tier. EUrouter does not run the models itself: it forwards the request to a model provider and returns the answer. We process on the terms of its Data Processing Agreement, which requires processing of personal data to stay inside the European Economic Area, requires the same of every provider it forwards to, and applies zero retention to the content of requests and answers. We name the provider on every request rather than letting it be chosen for us, so we can tell you who it is: Amazon Web Services, using its Amazon Bedrock service in an EU region. AWS states that inputs and outputs are not used to train any model, and are not shared with the model providers themselves. See Section 7.
  • Google (Firebase Cloud Messaging): Used to deliver push notifications to your device, and only if you allow notifications. The Firebase software is part of the mobile app, so it registers a Firebase installation identifier with Google when the app starts, whether or not you allow notifications. If you allow them, Google also receives five things for each notification: the registration token for your install of the app, the title, the body, the in-app screen the notification opens when you tap it, and the number shown on the app icon, which is how many Coach messages you have not read. A notification body can name the workout plan you asked for, and the screen it opens can carry that plan's identifier. A notification about a Coach message says only what kind of message arrived, never what it says. Google does not receive your email address, your account identifier, or any health or workout record. Google acts as a processor for this service under its own Data Processing Terms. Firebase Cloud Messaging runs on Google's global network, so a notification can be processed outside Switzerland and the European Union, including in the United States. See Section 7.

We do not sell your personal data to third parties.

6. Cookies

Our website sets no cookies. We do not use any analytics, tracking, or marketing cookies.

7. Cross-Border Data Transfers

Storage.Your account, workout and health records are stored within the European Union (Frankfurt, Germany) via Supabase. Account emails are sent through Brevo, which stores them in France and Belgium. Some of Brevo's sub-processors for support, maintenance and network delivery can reach this data from outside the European Union, including the United States and India. For these transfers Brevo relies on Standard Contractual Clauses and, for the United States, on the EU-U.S. Data Privacy Framework.

AI processing is different, and we state it plainly. The two AI gateways named in Section 5 do not answer this question the same way, so we answer it for each.

EUrouter processing stays in the European Economic Area. Its Data Processing Agreement requires that all processing takes place inside the EEA, and requires the same of every provider it forwards to. The provider we name on those requests, Amazon Web Services, runs them in an EU region. AWS is a company headquartered in the United States, so we do not tell you that no United States company is involved — we tell you that the processing itself happens in Europe.

Cloudflare does not make that commitment. It runs on a global network and does not state the country in which a single AI request is processed. So a coaching request that carries health data can still be processed outside Switzerland and the European Union, including in the United States. Cloudflare answers most coaching requests, so this is the ordinary case rather than the rare one. We rely on Data Processing Agreements with Standard Contractual Clauses for these transfers.

Push notifications also leave the European Union.Google does not guarantee the country in which a notification is handled, so everything Section 5 lists for that service can be processed outside Switzerland and the European Union, including in the United States. It is a narrow transfer: a token, a few lines of text, one screen name, and one number. It carries no health record, no workout history and no account identifier. We rely on Google's Data Processing Terms, which carry Standard Contractual Clauses, and on Google's certification under the Swiss-U.S. Data Privacy Framework.

Push is optional, and you lose nothing by refusing it. Notifications are off until you allow them, and you can turn them off again in your device settings. If you refuse, the app registers no token with us, so no notification and no token ever reach Google. Every plan, review and record still waits for you in the app. The installation identifier described in Section 5 is the one thing that is sent either way, and we do not link it to your Treya account.

Retention. Cloudflare stores no content from this service. EUrouter applies a zero-retention policy to the content of requests and answers: it processes them in memory and keeps only the metadata it needs for billing, such as timestamps and token counts. Amazon Web Services, the provider it forwards to, states that it does not use inputs or outputs to train any model and does not share them with the model providers.

8. Data Retention

We retain your data only as long as necessary to fulfill the purposes for which it was collected:

  • Account & Health Data: Retained until you request account deletion. Once you delete your account, your personal data and workout history will be permanently deleted.
  • Account emails: Brevo keeps your email address and the delivery and tracking record of each account email it sends. Deleting your account in Treya does not delete these records at Brevo. They are deleted when Brevo's own log retention removes them, or at the latest three months after our contract with Brevo ends.
  • Push Notifications: Google holds a notification for up to one day, until your device collects it. A device that never collects it does not get it, and Google discards it. A registration token is retained while the device is registered. If somebody else signs in on the same device, the token moves to their account and stops reaching you. It is deleted when Google reports that it is no longer valid, and when you delete your account.

9. Data Security

We implement robust technical and organisational measures to protect your personal and health data against unauthorised access, alteration, disclosure, or destruction.

10. Your Rights (nDSG + GDPR)

You have the following rights regarding your personal data:

  • Right to Information: Know what data we collect and how we use it.
  • Right to Rectification: Correct inaccurate or incomplete data.
  • Right to Deletion: Request the deletion of your personal data ("right to be forgotten").
  • Right to Data Portability: Receive a copy of your data in a structured, machine-readable format.
  • Right to Restriction of Processing: Limit how we process your data.
  • Right to Objection: Object to our processing of your data.
  • Right to Withdraw Consent: Withdraw explicit consent for processing health data at any time.

To exercise these rights, please contact us at office@kovio.ch. You also have the right to lodge a complaint with your supervisory authority (the FDPIC in Switzerland, or the relevant Data Protection Authority in your EU country).

11. Children's Privacy

Treya is not intended for individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected such data, we will take steps to delete it immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. We will notify users of significant changes, and the "Last updated" date at the top will reflect the latest version.

13. Contact

If you have any questions or concerns about this Privacy Policy or your data, please contact us at:

Kovio GmbH
Ussbergstrasse 4d, 8864 Reichenburg, Switzerland
Email: office@kovio.ch