Zyra Workouts — Privacy Policy

Last updated: 2026-10-08

This policy covers the Zyra Workouts app. Its App usage events section also covers Zyra Nutrition, which sends the same kind of usage events. The section at the end covers this website, zyra.fit, separately.

Zyra Workouts ("the app") is built local-first: your training data belongs to you and lives on your device. This policy explains exactly what data the app handles, where it goes, and how to remove it.

Data the app stores on your device

• Workout sessions (exercises, sets, weights, reps, notes)
• Body metrics you log (body weight, body-fat percentage)
• Menstrual-cycle days you mark, if you use that feature
• Custom exercises and app preferences (units, rest presets, dashboard layout, gym plate inventory)

All of this is stored locally on your device, and without an account none of it leaves the device. The app does send usage events, which contain none of these records, only the counts listed under App usage events below.

Apple Health (HealthKit)

With your permission, the app reads body metrics, activity, and heart data from Apple Health to show real numbers on your dashboard (for example scale weight, active energy, resting heart rate). The app does not write to Apple Health.

Health data is used only to display your own numbers to you, on your device. It is never used for advertising, marketing, or data mining, never shared with third parties, and never sold — and HealthKit data is not synced to your account.

Optional Zyra account and sync

Creating a Zyra account is optional. If you sign in, the data listed under "Data the app stores on your device" (excluding HealthKit data) syncs to your account so you can restore it on a new device. Synced data is:

• transmitted over TLS (HTTPS) only,
• stored encrypted at rest,
• visible only to you — there are no social features and no third-party access,
• never used for advertising and never sold.

Account data we hold: your email address, a salted password hash, and your synced training data. When you use the apps signed in, the usage events from your devices are linked to your account. We send account emails only (verification, password reset).

App usage events

Zyra Workouts and Zyra Nutrition send the same kind of small usage events to our own server, api.zyra.fit, from the first time you open them, signed in or not. Each event is the name of an action from a fixed list, with a few counts or labels:

• the app was opened or returned to (on the web, a first open from a link on zyra.fit also names the page the link was on)
• a screen was shown, named by its path in the app (for example a built-in exercise's page)
• an onboarding step was viewed, completed or skipped, and how onboarding ended
• a workout was finished, with the number of exercises, sets and minutes, and whether it had bodyweight sets
• a food was logged, with how it was added (search, barcode, quick add, AI or a recipe)
• a weekly check-in was done, with the number of days logged and weigh-ins, and which kind of estimate it used
• you signed up, signed in or out, or your session expired
• a sync problem, with its kind and error code

With them go a random install ID that the app creates on your device, the app version and platform, a test flag, on only for devices marked as test devices in More (we mark ours), whose events we leave out, and the time of each event.

They never contain the sets, weights, reps or notes you log, food names or amounts, your onboarding answers, or your email address. Our server does not store your IP address with them.

When you sign in, the app tells our server which install it is, so that install's events are linked to your account. We use the events only to understand how the apps are used: never for advertising, never sold, and never shared with anyone.

Deleting your data

• Without an account: delete the app; everything it stored goes with it.
• With an account: More → Account → Delete account (password required). Your account and all synced data are permanently deleted after a 7-day grace period; signing back in within 7 days cancels the deletion. Data on your device stays yours.

What the app does not do

• No advertising, no ad SDKs, no third-party trackers or analytics SDKs. Usage events go only to our own server.
• No selling or sharing of personal data with third parties.
• No use of health data for any purpose other than showing it to you.

Contact

Questions or requests: privacy@zyra.fit

Changes

If this policy changes, the date above is updated and material changes are called out in the app's release notes.

This website (zyra.fit)

Website section last updated: 2026-10-10

zyra.fit is a static site: reference pages, guides, and calculators. It has no accounts, no sign-in, and no forms that store anything. It sets no cookies of its own; the analytics below set theirs.

Analytics and third-party scripts

The site sends one small request to our own server, api.zyra.fit, when a page loads or when you move between pages, and when you tap a link to one of our apps: the page path, the site you came from, campaign tags from the link, and a screen size class. Our server counts visitors with a code made from your IP address and browser for the day only; the address is used in memory and not stored by this counter. No cookie, nothing stored on your device.

The site uses Ahrefs Web Analytics to count page views and see which pages people arrive on and where they came from. It loads one script, analytics.ahrefs.com/analytics.js, on every page. Ahrefs states that the tag is cookieless and collects no personally identifiable information; we chose it over the alternatives for that reason, and we verified on the live site that it sets no cookie.

What it records is the ordinary shape of a web request — the page, the referring site, approximate country, and the kind of device and browser. We use it to learn which guides and calculators are worth writing more of. Nothing you type into a calculator is part of it (see below), and we do not combine it with anything else.

The site also runs Google Analytics 4 (measurement ID G-GWXX2XKXVY), loaded from googletagmanager.com, for the same purpose in more detail — which pages are read, in what order, and which sites send people here.

Google Analytics sets cookies (_ga and _ga_*), so we ask first. Nothing is requested from Google until you accept: on a first visit the tag is not loaded at all, and if you decline it is never loaded. The cookies hold a randomly generated identifier so repeat visits from one browser count as one person rather than several; they carry no name, address or anything you have typed, and Google processes the data under its own terms.

Your answer is remembered in your browser's local storage rather than in a cookie — recording “no cookies, please” should not itself set one. You can change it whenever you like with Cookie settings at the bottom of any page. Declining costs you nothing: every page, calculator and guide behaves exactly the same.

The server also keeps its own access log — the standard record of requests a web server makes — for 14 days, and then deletes it. That log is how we notice broken links.

Calculators run in your browser

Every calculator on this site runs entirely in your browser. The numbers you type — body weight, height, age, a set's weight and reps — are computed on your device and sent nowhere; there is no server call, no storage, and nothing to delete. Closing the page discards them.

Server access logs

The web server keeps standard access logs (IP address, page requested, time, browser string) for up to 14 days, used only to keep the site running and to investigate abuse. They are not combined with any other data and are not used to identify visitors.

Links to the apps

Links from this site to our apps, nutrition.zyra.fit and workout.zyra.fit, carry a plain query string that names the page you came from, so the app can tell which of our pages send visitors. That is the whole mechanism: no cookie is set on this site and no identifier follows you.

Contact

Questions about this section: privacy@zyra.fit.