Pliavelle Privacy Policy
Last updated: 13 November 2026.
The short version: Pliavelle collects what it needs to build your Pilates plan, run your sessions and manage your membership. Comfort notes, the AI coach, usage analytics and crash reports are optional, and each one stays off until you choose it. Pliavelle has no ads, doesn’t track you across other companies’ apps or websites, and we don’t sell your information. You can export your data or delete your account from inside the app.
Who we are
Pliavelle is developed by Josh Waller, trading as Kovus, in Perth, Western Australia. Contact pliavelle@kovus.dev with any privacy question or request. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and we apply the rights described in “Your choices and rights” to everyone who uses Pliavelle, wherever they live.
This policy covers the Pliavelle iPhone app and the server that supports it. If you live in the United States, also read our Consumer Health Data Privacy Policy.
What we collect and why
We collect only what the app needs to work, plus the optional features you choose to turn on.
- Your account: your email address (or the relay address Sign in with Apple gives us), your app user ID and an installation ID for each device. We use them to sign you in, keep your plan on your devices and tie your membership to your account.
- Your setup and plan: the answers you give during setup, your preferences, your plan, programmes, finished and partial sessions, and any other movement you log. We use them to build and adjust your plan.
- Comfort notes: optional. If you choose to add comfort reasons or a note, they can reveal health information, so we ask for separate consent first. They stay on your iPhone until your first membership purchase is confirmed or you choose Save to my account. They are never used for analytics and never sent to an AI provider automatically.
- Membership: your subscription status and store purchase references. Apple handles payment; we never see your card details.
- Coach conversations: optional. What you write to the coach, its replies and any memory you ask it to save.
- Feedback and reports: what you send from Help and about, and only the diagnostic details you choose to attach. A report about a movement includes which version of it you saw, and is sent only after you agree. Chat and health details are never added without you choosing them.
- Crash reports: optional, and off until you turn on Send crash reports in Privacy and AI settings. If you turn them on and Pliavelle crashes, a technical report goes to Sentry so we can fix the problem. A report holds the type of error and where in the code it happened, error codes, and the app and iOS versions. It doesn’t include your account details, your network address, comfort notes, coach conversations or anything you type. Turn the setting off at any time to stop them from that iPhone.
- Analytics: only if you opt in, in Privacy and AI settings. Nothing from before you turn it on is recorded, and the positions you avoid and your comfort notes are never included. Analytics events stay in our own database; no analytics company receives them.
Pliavelle has no advertising and doesn’t track you across other companies’ apps or websites.
Health information
Comfort notes, and anything you choose to write to the coach, can reveal health information. Under Australian privacy law this is sensitive information, and many other countries treat it the same way. That’s why comfort notes need your separate consent, why they and the positions you avoid are never sent to an AI provider, and why neither is used for analytics. You don’t need to share any medical information to use Pliavelle.
The optional AI coach
The coach is optional and clearly identifies itself as AI. It can’t observe your technique, and it doesn’t diagnose or prescribe treatment.
- Text coach: your messages, the plan and session details the coach needs, and any coach memory you have confirmed are sent through our server to OpenAI OpCo, LLC to write a reply. We ask for your consent to OpenAI before the first message. Comfort notes, the positions you avoid and Apple Health data are never sent.
You can withdraw that consent at any time in Privacy and AI settings. New requests to OpenAI stop straight away, and the coach falls back to the plan controls that don’t use AI.
Response storage and data sharing are off for the Pliavelle project. OpenAI does not use these API messages to train or improve its models. Its default abuse-monitoring logs may contain your messages and replies and are retained for up to 30 days, unless law requires longer retention or it is reasonably necessary to protect the service or third parties from harm. Automatic prompt caching may keep encrypted technical representations of messages for up to 24 hours. Deleting a Pliavelle conversation does not immediately erase OpenAI’s abuse-monitoring logs.
We use OpenAI’s standard API service without regional data residency. Your messages may be processed outside Australia.
Sources: OpenAI API data controls, Services Agreement.
Apple Health
If you connect Apple Health, Pliavelle only writes your workouts to it. We don’t read your Health data, never send it to an AI provider and never use it for advertising. The app works fully without Apple Health.
Who we share data with
We share data only with the services that run Pliavelle, and only what each one needs:
| Recipient | Why | Where |
|---|---|---|
| Supabase | Hosts our database, sign-in, file storage and server functions | The database is in the United States (US East, Northern Virginia). Server functions run where Supabase routes each request |
| Kovus encrypted backups | Encrypted backup copies of the database, kept so the service can be restored after a failure | Australia |
| OpenAI OpCo, LLC | Writes the text coach’s replies, only if you consent | OpenAI’s standard API service without regional data residency; your messages may be processed outside Australia |
| RevenueCat | Checks your membership with the App Store | RevenueCat is a US company |
| Apple | Handles purchases, trials, cancellations and Sign in with Apple | Under Apple’s own privacy policy |
| Resend | Sends account notice emails, such as the notice before an unused account closes | Resend is a US company; Pliavelle’s emails are sent from its Tokyo, Japan region |
| Sentry | Receives crash reports, cut down to technical details only, if you turn them on | Sentry’s US region |
These providers process information to provide their services to Pliavelle, under their terms with us. We share with each one only what its job needs, as described above.
We don’t sell or rent your personal information, and we don’t use it for advertising or share it for cross-context behavioural advertising. We may disclose information if the law requires it.
Overseas. Our database is stored in the United States, and OpenAI, RevenueCat, Resend and Sentry process information outside Australia. Each may use its own service providers, which can be in other countries. OpenAI receives information only if you turn on the AI coach, and Sentry only if you turn on crash reports. Privacy laws in those countries may not give the same protection as Australian law, and an overseas recipient may not be bound by the Australian Privacy Principles. Where a provider in the United States receives information about people in the European Economic Area, the United Kingdom or Switzerland, we rely on the transfer safeguards in that provider’s terms, such as standard contractual clauses or the EU-US Data Privacy Framework, where they apply.
How long we keep your data
| Information | Kept |
|---|---|
| Coach conversations | 30 days, or sooner when you delete the conversation |
| Your data after you confirm account deletion | Removed from our active systems within 7 days |
| Backup copies | Removed within a further 8 days |
| Deletion status record | Until 90 days after you confirm or 30 days after deletion completes, whichever is earlier; it holds no personal data |
| An unconfirmed deletion request | Expires after 24 hours |
| A data export you request | Available to download for 7 days, then removed |
| Optional analytics events | 180 days |
| Request receipts that stop a change being applied twice | 60 days |
| Purchase event details from RevenueCat | 90 days, then the details are emptied |
| Sign in with Apple account notifications | 90 days |
| Records that stop deleted items being restored | 45 days; an account’s deletion marker is kept so a deleted account is never recreated |
Your plan, history and settings are kept while you have an account. Each service we share data with keeps its own records under its own terms. Deleting your account includes a request to RevenueCat to delete its customer record for your account, and our server asks Apple to revoke Pliavelle’s Sign in with Apple access. Apple keeps its own records of your App Store purchases under Apple’s privacy policy.
Your choices and rights
- Export: request a copy of your data in Privacy and AI settings. You may be asked to sign in again first, and you don’t need a membership.
- Correct: change your setup answers, preferences and logged activity in the app. For anything you can’t change in the app, email us.
- Delete: delete your account and data in Settings, under Delete account and data. You don’t need a membership or to contact us. Deleting your account doesn’t cancel your Apple subscription; cancel that in your Apple account settings.
- Withdraw consent: turn off analytics, crash reports, comfort notes or the AI provider at any time in Privacy and AI settings. Turning off comfort notes deletes your comfort notes and reasons; the positions you avoid stay as they are. Withdrawing consent doesn’t affect what was done before you turned it off.
- Object or restrict: ask us to stop or limit how we use your information, by emailing us.
Email pliavelle@kovus.dev to make a request. We may ask you to make or confirm it from inside Pliavelle, or from the email address on your account, to make sure it comes from the account holder. We’ll never ask for your password. We’ll answer within 30 days. If we can’t do what you asked, we’ll explain why.
Appeals. If we decline your request, you can ask us to reconsider by replying to our answer. We’ll respond to an appeal within 45 days and explain our decision. If you’re still not satisfied, you can complain to the regulator where you live, such as your state Attorney General in the United States.
Complaints. You can complain to us at pliavelle@kovus.dev. If you’re not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au) or to the data protection authority in the country where you live.
If you’re in the European Economic Area, the United Kingdom or Switzerland, we rely on these legal bases: providing the service you signed up for (your account, plan, sessions and membership); your explicit consent for comfort notes, the AI coach, usage analytics and crash reports; and our legitimate interests in keeping Pliavelle secure, preventing misuse, and keeping the records that stop a deleted account being recreated.
Regional information
Some countries’ laws ask us to state the following. The rest of this policy applies everywhere.
South Korea. We transfer your information overseas to the services that run Pliavelle. It’s sent over encrypted connections as you use the app, and each service keeps it only as long as “How long we keep your data” says.
- Supabase Pte. Ltd., stored in the United States: your account details, setup answers, plan, sessions, consent records, membership status, coach conversations and memory, and feedback. Comfort notes and analytics only with your consent. Purpose: hosting our database, sign-in and server functions.
- OpenAI OpCo, LLC, United States: your coach messages, the plan and session details the coach needs, and coach memory you’ve confirmed. Purpose: writing coach replies, only if you consent.
- RevenueCat, Inc., United States: your app user ID and App Store purchase and subscription records. Purpose: checking your membership.
- Plus Five Five, Inc. (Resend), United States, with emails sent from Japan: your email address. Purpose: sending account notices, such as the notice before an unused account closes.
- Functional Software, Inc. (Sentry), United States: technical crash details only. Purpose: fixing crashes, only if you turn crash reports on.
You can refuse the coach and crash-report transfers by leaving those features off, or withdraw consent later in Privacy and AI settings. The other transfers are needed to provide the service, so refusing them means deleting your account. Our privacy officer is Josh Waller, owner of Kovus: pliavelle@kovus.dev.
India. Our grievance officer is Josh Waller, owner of Kovus: pliavelle@kovus.dev. We resolve complaints within one month.
Quebec. The person in charge of the protection of personal information is Josh Waller, owner of Kovus: pliavelle@kovus.dev.
Connecticut. If you live in Connecticut, you can ask us to confirm whether we process your personal data, and to access, correct or delete it or give you a portable copy. You can also opt out of targeted advertising, the sale of your personal data and profiling that has legal or similarly significant effects; we don’t do any of these. We process sensitive data, such as health information in comfort notes or coach messages, only with your consent, and you can withdraw it in Privacy and AI settings. We don’t use your personal data to train large language models. To make a request, email pliavelle@kovus.dev. If we decline, you can appeal as described under “Appeals” above. If you’re not satisfied with the outcome of an appeal, you can contact the Connecticut Attorney General (portal.ct.gov/ag).
European Economic Area and United Kingdom. You have the rights described in “Your choices and rights”: to access, correct, delete and take a copy of your data, to restrict or object to how we use it, and to withdraw consent at any time. You can also complain to a data protection supervisory authority, in particular where you live or work or where you think a breach happened. In the United Kingdom that is the Information Commissioner’s Office (ico.org.uk).
Adults only
Pliavelle is for adults. Setup asks you to confirm you are 18 or older, and ends if you aren’t. If you think someone under 18 has created an account, contact us and we’ll delete it.
This website
These pliavelle.com.au pages don’t contain your Pliavelle records. Vercel hosts the website and can process request records, such as your IP address, browser details and the page you asked for, to deliver and secure it. This website doesn’t use analytics.
Changes to this policy
If this policy changes, we’ll publish the new version here with a new date. If a change is significant, we’ll tell you by email or in the app before it applies.
Contact
Email pliavelle@kovus.dev with any question about this policy. Read the Terms of Use, the Consumer Health Data Privacy Policy or visit Pliavelle support.