Vayter Privacy Policy

Effective date: August 22, 2026
Last updated: August 22, 2026

Vayter is a fitness and personal-training application operated by Asher Epstein ("Vayter", "we", "us", or "our"). This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you use the Vayter mobile application, related coach dashboard, and related public pages or support channels (collectively, the "Service").

Vayter is currently provided primarily to trainees as part of a human coaching or personal-training service. Access is invitation-only. A coach creates or authorizes a trainee invitation, and the trainee signs in using a one-time code sent by email.

If you do not agree with this Privacy Policy, do not use the Service.

1. Who is responsible for your information

The operator and data controller of Vayter is:

Asher Epstein
Israel
Email: support@vayter.app

Your human coach may enter, view, or manage information within Vayter as part of providing your coaching service. Where Asher Epstein is also your coach, the same operator is responsible for both the software service and the coaching activity.

2. Information we collect

We collect information that is necessary to provide the Service and the coaching features made available through it.

2.1 Account and contact information

Depending on the information provided by you or your coach, this may include:

• Full name
• Email address
• Phone number, if provided
• Internal user and account identifiers
• Preferred language
• Account status and invitation status

2.2 Profile and health-related information

Depending on the information entered into your profile or used as part of coaching, this may include:

• Body weight and measurement dates
• Height
• Date of birth
• Gender

Some of this information may be treated as health information or other sensitive or special-category personal data under applicable law.

2.3 Fitness and training information

This may include:

• Assigned training programs and workouts
• Workout sessions and workout history
• Exercises
• Sets, repetitions, weight used, warm-up status, and timestamps
• Personal records and current-best performance information
• Workout order
• Weekly workout goal
• Rest-timer preferences
• In-progress workout information stored on the device

2.4 Notes and other content

This may include:

• Profile biography or information you add about yourself
• Training goals entered by your coach
• Notes you add to workout sessions or exercises
• Coach-authored notes or instructions that are intended to be visible to you

2.5 Authentication and operational information

Vayter uses passwordless authentication. We process information needed to:

• Determine whether an email address is authorized to create or use a Vayter account
• Send and verify one-time login codes
• Maintain an authenticated session
• Prevent unauthorized account creation
• Protect the Service from misuse and security threats
• Diagnose operational errors

We do not store a Vayter password for you.

Our own application logging is designed not to include your email address, one-time code, or a user-linked session identifier. Service providers may nevertheless process ordinary network and security metadata, such as an IP address, browser or device connection information, and request timestamps, as part of delivering and securing their services.

2.6 Information we do not currently collect

The current version of Vayter does not intentionally collect:

• Precise or approximate location
• Contacts
• Photos or uploaded files
• Camera or microphone data
• Advertising identifiers
• Device identifiers used for advertising or tracking
• Biometric information
• Payment-card information
• Apple Health or HealthKit data
• Google Health Connect data
• Wearable-device data
• Nutrition or calorie data
• Medication or injury records
• Analytics, advertising, attribution, session-replay, or cross-app tracking data

If this changes, we will update this Privacy Policy and any applicable app-store disclosures before or when the change takes effect.

3. How we obtain information

We may obtain personal information:

1. From you, when you sign in, complete your profile, record a workout, record body weight, add notes, change preferences, contact support, or otherwise use Vayter.
2. From your coach, when the coach creates an invitation, assigns a program, records or updates profile information they are permitted to manage, or adds coach-authored training information.
3. From your use of Vayter, when the Service records workout activity, account state, or other actions necessary to provide the requested functionality.
4. From service providers, where necessary to authenticate users, deliver email, host data, distribute the application, or maintain security and availability.

4. Why we use personal information

We use personal information to:

• Create, authenticate, and maintain your Vayter account
• Enforce Vayter's invitation-only access model
• Deliver one-time login codes
• Provide your assigned workouts and training program
• Record and display your workout history, performance, and body-weight history
• Calculate or display training-related progress such as personal records and streaks
• Allow your coach to provide and review your coaching service
• Save your preferences and in-progress workout state
• Provide support and respond to requests
• Maintain the security, integrity, and reliability of the Service
• Prevent unauthorized access, abuse, or fraudulent account creation
• Comply with applicable legal obligations and enforce our Terms of Use
• Establish, exercise, or defend legal claims where necessary

We do not use your personal information for behavioral advertising, cross-app tracking, or sale to data brokers.

5. Legal bases for users in the EEA and United Kingdom

Where the EU General Data Protection Regulation ("GDPR"), UK GDPR, or similar law applies, we process personal data only where we have an applicable legal basis.

Depending on the processing, our legal bases may include:

5.1 Performance of a contract

We process account, profile, training, and service information where necessary to provide Vayter and the coaching-related functionality you requested.

5.2 Legitimate interests

We may process limited information where necessary for legitimate interests such as:

• Securing Vayter and preventing unauthorized access
• Preventing abuse or fraudulent account creation
• Maintaining service reliability
• Providing support
• Protecting our legal rights

We do not rely on legitimate interests where your rights and interests override those interests.

5.3 Legal obligations

We may process or retain information where required to comply with applicable law, lawful requests, or legal proceedings.

5.4 Consent

We rely on consent where applicable law requires it, including for optional device permissions or processing that cannot lawfully be based on another ground.

5.5 Health or other special-category data

Where information processed through Vayter is considered health data or another special category of personal data under applicable law, we will process it only where an additional lawful condition applies. Where required, this will be your explicit consent.

If we rely on your explicit consent, you may withdraw it at any time by contacting support@vayter.app. Withdrawal does not affect processing that was lawful before the withdrawal. Because health and fitness information is central to Vayter's training features, withdrawing consent may mean that we can no longer provide some or all of the Service to you.

6. Your coach's access

Your coach can access information about trainees assigned to that coach as necessary to provide the coaching service. This may include:

• Your profile and contact information
• Date of birth, gender, and height if recorded
• Your training goals and profile information
• Assigned programs and exercises
• Workout history, sets, repetitions, and weights
• Personal records
• Body-weight history
• Notes you enter in relation to workouts or exercises

A coach is not permitted through Vayter's normal application permissions to access another coach's trainees.

Your coach's ability to view this information is a core part of the Vayter coaching service. If you do not want your coach to have this access, Vayter may not be suitable for you.

7. How we disclose information

We disclose personal information only as necessary to operate Vayter, provide coaching-related functionality, comply with law, or protect the Service.

7.1 Supabase

We use Supabase for database infrastructure, authentication, and related backend services. Supabase processes the personal information stored in Vayter, including account, profile, health-related, and fitness information, on our behalf as necessary to provide the Service.

7.2 Email delivery provider

We use a third-party email delivery service to send one-time authentication codes and operational emails. That provider receives information necessary to deliver the message, such as your email address and the one-time code or message content.

We may change email providers as our infrastructure evolves. We require service providers to handle personal information only for appropriate service purposes and subject to applicable contractual and legal safeguards.

7.3 YouTube / Google

Some exercise demonstrations can be opened through an embedded YouTube player.

Vayter does not load the YouTube video player or its thumbnail until you choose to open the video feature. When you do, your device connects to Google/YouTube services. Google may receive information such as:

• Your IP address
• User-Agent or similar device/browser connection information
• The identifier of the video you requested
• Cookies, local storage, or similar information used by the embedded YouTube service

Google's handling of that information is governed by Google's own terms and privacy practices.

7.4 App stores and distribution services

Apple, Google, and application distribution or build infrastructure may process information under their own terms and privacy policies when you download, install, test, or update Vayter.

7.5 Legal and safety disclosures

We may disclose information if we reasonably believe disclosure is required to:

• Comply with applicable law, regulation, legal process, or a binding governmental request
• Protect the rights, safety, or property of Vayter, our users, coaches, or others
• Investigate fraud, abuse, security incidents, or violations of our Terms
• Establish, exercise, or defend legal claims

7.6 Business changes

If the Vayter business is involved in a merger, acquisition, financing, restructuring, or sale of assets, personal information may be transferred as part of that transaction, subject to applicable law and appropriate confidentiality protections.

8. No sale, advertising, or cross-context tracking

We do not currently:

• Sell personal information
• Sell health or fitness information
• Share personal information for cross-context behavioral advertising
• Use personal information for targeted advertising
• Use third-party advertising SDKs
• Track you across unrelated apps or websites for advertising purposes

If these practices ever change, we will update this Policy and obtain any consent or provide any opt-out required by law before the new practice applies.

9. Local storage on your device

Vayter stores some information locally to provide reliable app functionality, including offline and in-progress workout features.

Depending on the type of information:

• Authentication tokens and the local identity snapshot are stored using operating-system secure storage.
• Some cached workout and profile information is stored in local databases on the device.
• An in-progress workout may contain weights, repetitions, timestamps, notes, and related workout state.

User-specific local data is cleared when you sign out or after an account-deletion request successfully completes. Signing out while an unfinished workout exists will discard that unfinished local workout after Vayter warns you.

A language preference may remain on the device after sign-out or account deletion. It is not intended to identify a user.

10. Notifications

Vayter may request notification permission if you choose to enable a local rest-timer alert.

These are local device notifications. Vayter does not currently register your device for marketing or remote push notifications.

You can disable notification permission in your device settings.

11. Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including providing the Service, maintaining account functionality, meeting legal obligations, resolving disputes, and protecting the Service.

In particular:

• Active account data: generally retained while your Vayter account remains active and the information is needed to provide the Service.
• Training, body-weight, and program data: generally retained for the life of the account unless you or your coach remove data through an available feature or your account is deleted.
• Cached local information: temporary cache data may expire automatically and is also cleared on sign-out or account deletion.
• In-progress local workout: retained until the workout is completed, discarded, signed out, or the account is deleted.
• Archived trainee profiles: if a coach archives a profile instead of the trainee deleting the account, the profile may be retained for a limited account-administration period before purge. A trainee can still request account deletion.
• Service-provider logs: infrastructure and email providers may retain limited security, delivery, or request logs for periods determined by their service configuration and legal obligations.
• Backups: where backups are maintained for service resilience, deleted information may remain temporarily in protected backup copies until those backups expire or are overwritten under the applicable backup schedule. Backup copies are not intended to be used to restore a deleted user's account except where legally required.

We may retain limited information for longer where required by law, necessary to resolve disputes, prevent fraud or abuse, or establish, exercise, or defend legal claims.

12. Account deletion

You can delete your Vayter account from within the application through:

Profile > Settings > Delete account

The in-app deletion flow is designed to permanently delete the trainee account and associated Vayter data from the active database, including workout history, logged exercises and sets, personal records, body-weight logs, assigned programs, and the authentication identity, subject to limited technical safeguards where the same authentication identity is legitimately linked to another permitted role or account.

After the server confirms deletion, user-specific local data is cleared from the device.

Account deletion is immediate with respect to the active Vayter account and is not an account deactivation. It cannot be undone.

Some limited information may remain temporarily in service-provider logs or backup systems as described in Section 11, where applicable.

You may also request deletion through Vayter's public account-deletion page or by contacting:

support@vayter.app

We may need to verify that you are authorized to make a request before acting on a request submitted outside an authenticated app session.

13. Security

We use technical and organizational measures intended to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure.

Current safeguards include:

• Passwordless authentication using one-time codes
• Server-side enforcement of invitation-only account creation
• Operating-system secure storage for mobile authentication tokens
• Database row-level access controls intended to separate users and coaches
• Restricted service credentials that are not bundled into the mobile or coach client applications
• Redaction of email addresses and one-time codes from application error logging
• Secure network transport where supported and configured by the production infrastructure

No method of transmission or storage is completely secure. We therefore cannot guarantee absolute security.

If you believe your account or information has been compromised, contact support@vayter.app.

14. International data transfers

Vayter is operated from Israel and may be made available to users worldwide. Our service providers may process information in countries other than the country where you live.

Different countries may provide different levels of privacy protection.

Where applicable law requires safeguards for an international transfer of personal data, we will use or require an appropriate legal mechanism before making the transfer, such as an adequacy framework, approved contractual safeguards, or another legally recognized transfer mechanism.

15. Your privacy rights

Depending on where you live and which privacy law applies, you may have rights concerning your personal information, including the right to:

• Request access to personal information we hold about you
• Request correction of inaccurate or incomplete information
• Request deletion
• Request restriction of certain processing
• Object to certain processing
• Request portability of information in an applicable format
• Withdraw consent where processing is based on consent
• Complain to an applicable data-protection or privacy authority
• Receive information about how your information is used

Some rights are subject to legal conditions, exceptions, and verification requirements.

To exercise a privacy right, contact support@vayter.app. We may request information reasonably necessary to verify your identity and protect your account.

We will respond within the period required by applicable law.

15.1 EEA and United Kingdom

If GDPR or UK GDPR applies to you, the rights above may include access, rectification, erasure, restriction, objection, portability, and withdrawal of consent.

Where processing is based on legitimate interests, you may have the right to object based on your particular situation.

Where processing is based on consent, withdrawal is effective for future processing and does not affect processing that was lawful before withdrawal.

You may also lodge a complaint with the data-protection authority responsible for your country or region.

15.2 California and other U.S. states

If a U.S. state privacy law applies to Vayter and to your information, you may have rights such as access, correction, deletion, portability, and rights concerning sale, sharing, or targeted advertising.

Vayter does not currently sell personal information or share personal information for cross-context behavioral advertising, and does not use personal information for targeted advertising.

We will not discriminate against you for exercising a privacy right that applicable law grants you.

15.3 Israel

If Israeli privacy law applies, you may have rights concerning personal information held about you, including applicable rights of access and correction. You may contact us at support@vayter.app to exercise an applicable right.

16. Children and minors

Vayter is a general fitness and coaching service and is not directed to children under 13.

We do not knowingly permit a child under 13 to use Vayter unless the collection and use of that child's information is lawfully authorized, including verifiable parental or guardian consent where required.

If you are under the age at which you can independently agree to the processing of your information or enter into these Terms in the country where you live, you may use Vayter only with the consent or authorization of a parent or legal guardian where required by applicable law.

Because Vayter is invitation-only, coaches should not invite a minor unless the coach and operator have confirmed that the intended use is lawful and any required parent or guardian authorization has been obtained.

If we learn that we collected a child's personal information in a manner that is not permitted by applicable law, we will take appropriate steps to delete or otherwise lawfully handle that information.

17. Automated decision-making

Vayter does not currently make decisions about you that produce legal or similarly significant effects using solely automated processing.

Training programs are provided by a human coach. Any workout-related suggestion derived from your previous training information is intended as a fitness convenience and is not a medical or clinical decision.

18. Third-party links and services

Vayter may link to or display content from third-party services, including YouTube.

We do not control the independent privacy practices of third parties. You should review their privacy policies before using their services.

19. Changes to this Privacy Policy

We may update this Privacy Policy as Vayter changes, as our service providers change, or as legal requirements evolve.

If a change is material, we will provide notice as required by applicable law, which may include notice in the app, on the website, or by email.

The "Last updated" date at the top of this Policy shows when it was most recently revised.

20. Contact us

For privacy questions, requests, or concerns:

Asher Epstein
Israel
support@vayter.app