Oya Privacy Policy

Last updated: July 3, 2026

Oya ("we", "our", "the app") is a social fitness app that lets you and your friends compete on everyday activity — steps, active calories, exercise minutes, and distance. This page explains what we collect, why, and how you can control or remove it.

What we collect

When you create an account:

Account info — your email address, display name, and (optionally) a username, profile photo, and city.
Activity data — daily steps, active calories, exercise minutes, distance, and workout type, read from Google Health Connect (Android) or Apple Health (iOS). Oya only reads this data — we never write to Health Connect or Apple Health.
Push notification token — a device identifier used solely to deliver notifications (e.g. "you've been overtaken").
Usage you generate in-app — circles you join, challenges you create or enter, reactions and comments you post, and your in-app achievements.

We do not collect location/GPS data, contacts, or browsing history, and we never sell your data to advertisers or data brokers.

How we use it

To calculate your Oya Score and show leaderboards to the circles you've joined.
To send you notifications about your circles and challenges (you can disable these in Settings or your device's notification settings at any time).
To improve the app's fairness and reliability (e.g. detecting sync issues).

Who can see your data

Your activity and profile are visible only to members of the circles you choose to join — Oya has no public leaderboard. Circle membership requires either an invite you accept or an invite code someone shares with you.

Where it's stored

Data is stored with Supabase (PostgreSQL database + authentication), protected by row-level security so the API only ever returns data you're authorized to see. Push notifications are delivered via Expo and Firebase Cloud Messaging. Sign-in is handled by Google, Apple, or Supabase's own email/password system — Oya never sees or stores your Google/Apple password.

Your choices

Disconnect your activity source at any time in Settings → Permissions; Oya stops receiving new data immediately.
Delete your account any time in Settings → Delete my account. Your account is deactivated immediately and you're signed out, but nothing is erased right away — you have 30 days to change your mind by simply signing back in. After 30 days, your profile, activity history, and circle memberships are permanently removed. You can also request deletion by emailing founder@oyalabs.ca.
Export or ask about your data any time using the same email address.

Children

Oya is not directed at children under 13, and we do not knowingly collect data from anyone under that age.

Changes to this policy

If this policy changes materially, we'll update the date above and, where required, notify you in-app.

Contact

Questions about this policy or your data: founder@oyalabs.ca.

To report a concern about another user or something you saw in the app: support@oyalabs.ca.

com.oyalabs.oya