Privacy PolicyXR NADER VIRTUAL PRODUCTIONS · trading as XRVP.io

1. Who we are

XR Nader Virtual Productions, trading as XRVP.io, is the data controller for the personal data described in this policy. You can reach us at hello@xrvp.io. If you prefer, put “Privacy” in the subject line and your message will be routed to whoever handles data requests.

2. What this policy covers

• SYNQ — our consumer mobile app for iOS and Android, distributed through the Apple App Store and Google Play.
• SYNQ Coach — the web dashboard used by coaches and trainers who work with SYNQ users.
• xrvp.io — this website, including our tools, case studies and lab notes.

It does not cover third-party services you choose to connect to (for example Apple Health, Android Health Connect, or your app store account). Those services are governed by their own privacy policies.

3. The data we collect

Account data

Your email address, display name, and the identifier from your sign-in method (email and password, Sign in with Apple, or Sign in with Google). Passwords are handled by our authentication provider and stored only as salted hashes — we never see them in plain text.

Profile data

Information you enter to make recommendations meaningful: date of birth or age, sex, height, body weight, training experience, goals, and preferences such as units and notification settings.

Training, nutrition and recovery data

• Workouts you log — exercises, sets, reps, loads, distances, times, and session notes.
• Nutrition you log — foods, portions, macronutrients, barcode scans, and meal photos you upload for AI analysis.
• Wearable and device health data you choose to connect, such as sleep, heart-rate variability, resting heart rate, heart rate, steps, active energy, and workout sessions.
• Programme and coaching data — assigned programmes, adherence, and messages exchanged with a coach inside the product.

Subscription and payment data

If you subscribe, the purchase is processed by Apple, Google, or our payment processors. We receive subscription status, product identifiers, purchase and renewal dates, and a transaction identifier. We never receive or store your full card number.

Technical and diagnostic data

• Device model, operating system version, app version, language and region, and a per-install identifier.
• Crash reports and error diagnostics, so we can fix problems.
• Product analytics — which screens and features are used, and when — to understand how the product performs.
• Server logs, including IP address and timestamps, kept for security and abuse prevention.

Crash reports and analytics are configured to exclude your health values. We do not use advertising identifiers and we do not embed third-party advertising SDKs.

4. Health and fitness data

SYNQ is a health product, so most of what you log is health data. Under UK and EU data protection law this is “special category” data and gets extra protection. We treat it accordingly.

Apple Health and Android Health Connect

Connecting Apple Health (iOS) or Health Connect (Android) is optional and always your choice. When you grant permission, SYNQ reads only the data types you approve — typically sleep, heart-rate variability, resting heart rate, heart rate, steps, active energy, and workout sessions — and, where you enable it, writes back workouts you log in SYNQ.

• This data is used solely to show you your own trends and to calculate your recovery-adjusted daily recommendation inside SYNQ.
• It is never used for advertising or marketing, never sold, and never shared with data brokers.
• It is not shared with any third party other than the infrastructure providers listed in section 8, who process it strictly on our instructions.
• It is not used to train third-party AI models.
• You can revoke access at any time in Health Connect (Android) or the Health app (iOS), and independently in SYNQ's settings. Revoking stops any further reads immediately.
• When you delete your SYNQ account, health data we hold is deleted as described in section 11. Data held inside Apple Health or Health Connect itself stays under your control on your device.

Meal photos

Photos you take or upload for meal analysis are stored in a private, per-user storage bucket that only you and our processing services can access. Deleting a meal deletes its photo.

5. How we use your data

• To provide the product — logging, history, programmes, and syncing across your devices.
• To produce your recommendations: our rules engine calculates readiness and training guidance from your own training, nutrition and recovery data.
• To estimate nutrition from photos and barcode scans, subject to your review before anything is logged.
• To let a coach you have explicitly connected see the data you have agreed to share with them.
• To operate subscriptions, entitlements and billing.
• To send notifications you have enabled, such as reminders and weekly reviews.
• To keep the service secure, diagnose crashes, and improve product quality using aggregated and de-identified usage data.
• To meet legal obligations and to respond to your data rights requests.

6. AI processing

SYNQ uses AI in two narrow places. First, meal photos are analysed to suggest the foods and portions they contain — you always review and confirm the result before it is logged, and nothing is logged automatically. Second, a language model phrases the explanation attached to a recommendation. The numbers and decisions themselves come from our own deterministic rules engine, not from a language model.

To do this we send the minimum necessary content — the meal photo, or a short de-identified summary of the relevant metrics — to our AI providers. Those providers process it on our behalf under contractual terms that prohibit using your content to train their models, and they do not retain it for their own purposes.

7. Legal bases for processing

• Explicit consent — for health and fitness data, for connecting Apple Health or Health Connect, for sharing data with a coach, and for optional notifications. You can withdraw consent at any time.
• Performance of a contract — to provide the account, features and subscription you signed up for.
• Legitimate interests — to keep the service secure and reliable, prevent abuse, and improve the product using aggregated insights, balanced against your privacy.
• Legal obligation — to keep records we are required to keep and to answer lawful requests.

8. Who we share data with

We do not sell your data. We share it only with service providers who process it on our instructions, and with people you explicitly choose:

• Coaches you connect to — only the data you approve, scoped to what you allow, revocable by you at any time, and logged so you can see what was accessed.
• Cloud database, authentication and storage — hosting for your account, your logs, and your meal photos.
• Application hosting — the services that run our backend, our background jobs, and this website.
• AI providers — for the photo analysis and explanation phrasing described in section 6.
• Nutrition data providers — barcode and food-composition lookups. We send the query, not your identity.
• Subscription and payment processors — Apple, Google, and our billing providers.
• Push notification delivery — Apple and Google push services.
• Crash reporting and product analytics — configured to exclude health values.
• Legal and safety — where we are required by law, or to protect the rights and safety of users.

All of these providers act as processors under written agreements. We can supply the current list of sub-processors on request.

9. What we never do

• We never sell identifiable health data.
• We never use health data for advertising, and we do not include third-party advertising SDKs.
• We never track you across other companies' apps or websites.
• We never share data read from Apple Health or Health Connect with anyone beyond the processors in section 8.
• We never let third parties use your content to train their AI models.

10. How long we keep data

• Account, training, nutrition and recovery data — for as long as your account is active.
• Meal photos — until you delete the meal, or until your account is deleted.
• Crash reports and analytics — typically up to 12 months.
• Server and security logs — typically up to 90 days.
• Billing and transaction records — for as long as tax and accounting law requires, usually six years.
• Backups — deleted data is removed from routine backups within 30 days.

11. Account and data deletion

You can delete your SYNQ account and its data at any time. Two routes are available:

• In the app — open Settings → Privacy → Delete account, and confirm.
• By email — write to hello@xrvp.io from the address on your account with the subject “Account deletion request”.

Deleting your account permanently removes your profile, workouts, nutrition logs, meal photos, health data imported from Apple Health or Health Connect, coach connections, and messages. We complete deletion within 30 days, and residual copies are purged from backups within a further 30 days.

We keep only what the law requires us to keep — billing and transaction records for tax purposes, and a minimal record that a deletion request was made and fulfilled. If you would rather remove specific data than the whole account, you can delete individual workouts, meals and photos in the app, or ask us to do it.

You can also request a full export of your data before deleting: Settings → Privacy → Export my data, or by email.

12. Your rights

If you are in the UK, EU or another region with equivalent law, you have the right to access your data, correct it, delete it, restrict or object to processing, receive it in a portable format, and withdraw consent at any time. You will not be treated differently for exercising these rights.

Contact hello@xrvp.io and we will respond within 30 days. If you are not satisfied, you can complain to your local data protection authority — in the UK, the Information Commissioner’s Office (ico.org.uk).

13. Security

• All traffic is encrypted in transit with TLS, and data is encrypted at rest.
• Row-level security is enforced on every table, so one user's data cannot be read by another.
• Coach access is explicitly granted, narrowly scoped, revocable, and audit-logged.
• Meal photos are stored in private buckets with per-user access policies.
• Health values are excluded from application logs, analytics and crash reports.
• Service keys are environment-scoped and never shipped inside the mobile app.

No system is perfectly secure, but if a breach affects your data we will notify you and the relevant regulator as required by law.

14. International transfers

We and our providers may process data outside your country, including in the United States. Where data leaves the UK or EEA, we rely on approved safeguards such as the UK International Data Transfer Agreement or the European Commission’s Standard Contractual Clauses.

15. Children

SYNQ is not intended for children. You must be at least 16 years old to create an account. We do not knowingly collect data from anyone under 16; if we learn that we have, we delete it. If you believe a child has given us data, contact us and we will remove it.

16. The xrvp.io website

This website is a static site. We do not set advertising or tracking cookies. Some pages embed third-party video players, which may set their own cookies once you interact with them — those embeds are governed by the provider’s privacy policy. If you email us, we hold your message and address only to reply to you.

17. Not a medical device

SYNQ provides training, nutrition and recovery information for general wellbeing. It is not a medical device and does not diagnose, treat, cure or prevent any condition. Nothing in the app is medical advice. Always consult a qualified healthcare professional about your health, especially before changing training or diet.

18. Changes to this policy

We may update this policy as the product evolves. The “last updated” date at the top always reflects the current version. If a change materially affects how we use your data, we will tell you in the app or by email before it takes effect, and where the law requires it, ask for your consent again.

19. Contact us