Privacy Policy

Effective Date: September 1, 2026 · Last Updated: October 18, 2026

1. Who We Are

tesr ("we," "us," "our") is a personalized fitness and nutrition application, your AI-powered buddy, for iOS and Android. tesr is an initiative of TESR Technologies Private Limited, a company incorporated in India (CIN: U62011TS2026PTC220820), with its registered office in Hyderabad, Telangana, India. We are the data fiduciary (the "controller") for the personal data described here. We can be reached at:

Website: https://tesr.health

Contact: support@tesr.health

2. Information We Collect

2.1 Waitlist information

When you join our early-access waitlist on this website, we collect your email address and the date you signed up. We use it solely to contact you about early access and product updates. You can ask us to remove you from the waitlist at any time by emailing support@tesr.health.

2.2 Account information

When you create an account (including in our TestFlight beta), we collect:

• Email address
• Date of birth (tesr is for adults 18 and over, and your age shapes your plans and guidance)
• Authentication identifiers: managed by our authentication providers. We never store your password directly.
• What you agreed to and when: the version of these terms and this policy you accepted, and your answers to the app's consent questions (such as Bujji), so we can show what you chose
• How you found tesr: the answer you pick at sign-up (and any words you add), so we know where people hear about us

If you sign in with Google or Apple, we receive your name and email from those providers. We do not receive or store your Google/Apple password.

2.3 Health & fitness data

Data you enter while using the app, including:

• Workouts: exercises, sets, reps, weight, duration, dates and notes
• Training plans: plans built for you or by you, and your progress through them
• Nutrition: meals, foods, quantities, and macro/calorie targets
• Body metrics: body weight, measurements, body fat, and readings from a connected watch or phone (sleep, heart rate, steps)
• Cycle data: where you choose to use cycle tracking (18 and over only), your periods, symptoms, moods and notes. It has its own consent and its own delete button (see §6)
• Photos and voice notes: meal photos, food labels, progress photos and voice notes you choose to take or record in the app. Progress photos are kept in your own private storage space, which only your account can open

This data is saved on your phone and in your tesr account, so it survives losing your phone and reaches your other devices.

2.4 Apple Health and Health Connect

If you allow it, tesr reads these types from Apple Health (iPhone) or Health Connect (Android): steps, walking and running distance, active, resting and total energy, workouts, heart rate, resting heart rate, heart rate variability, VO2 max, breathing rate, blood oxygen, sleep, body weight and body fat. If you open a walk or run that has a route, tesr asks separately to read that route and draws it on your phone; routes are not saved to our servers. If you turn on Cycle's Health link, it also reads period days other apps logged. You choose which types to share in the system's own permission screen, and you can change that at any time in the Health app or Health Connect.

tesr writes to Apple Health or Health Connect only if you turn it on in Cycle: then it saves the period days you log there, and never its predictions. It writes nothing else.

We use this data only to provide tesr's features to you, such as your recovery (Battery) score, Day score, training and nutrition guidance, and Bujji's notes. We never use it for advertising or marketing, never sell it, never use it to build profiles for anyone else, and never share it with third parties except the service providers listed in §5 and §10 that process it on our behalf to provide those features. Files holding your health data are kept out of iCloud and Android backups.

2.5 Device & technical data

We collect minimal technical data needed to operate the service: device type, operating system version, app version, and crash reports. We do not collect: your location (a workout's route is read only as described in §2.4), contacts, call logs, SMS, browsing history, advertising IDs, or any data from other apps on your device. Crash reports carry an anonymous id and no health values.

3. How We Use Your Data

• Provide the service: build and adapt your training and nutrition plans, and sync your records across your devices
• Calculate insights: progress analytics, your Battery (recovery), Strain and Day scores, habit and trend tracking
• Bujji and our AI tools: write Bujji's notes and answers, and read the meals, labels, voice notes and photos you ask them to (see §5)
• Authenticate you: sign-in and account management
• Keep the app working: fix crashes, and track what our AI features cost to run
• Communicate with you: service updates and, only with your consent, product news

We do not use your data for behavioral advertising, and we do not sell it. Ever.

4. How We Store Your Data

• On your phone: a database on your phone holds your records, so the app works without a connection
• In our cloud: a copy is kept in your tesr account through our backend (Supabase, in Mumbai, India, with PowerSync for syncing), so it reaches your other devices
• On this website: waitlist email addresses are stored in Google Cloud Firestore

Data is encrypted in transit (TLS/SSL), and our cloud providers encrypt it at rest. Some of our service providers are outside India, in the United States (see §10); we send them only what each one needs.

5. Data Sharing

We share data only in these limited circumstances:

• Infrastructure providers: as our data processors (cloud hosting, syncing, sign-in, crash reports, notifications), bound by their own privacy and security obligations
• AI providers: Google (Gemini API) and Anthropic (Claude API) process data for us only in two cases. First, when you say yes to Bujji: then what Bujji reads (the areas you allow: workouts, food, sleep, body, and your cycle only if you said yes to that too) is sent to them to write your notes, reviews and chat answers, and to build your plan. Second, when you ask one of our AI tools to read something: a meal photo, a voice note, a typed meal, a food label, a workout import, or your progress photos if you chose body fat from photos. They process it as our service providers under their commercial API terms, which do not allow them to use it to train their models, and they keep it only briefly for safety checks. AI features are available only to adults, and you can turn Bujji, and each area it reads, off at any time in the app
• Product lookups: when you scan a packaged product, its barcode (and nothing about you) is looked up in Open Food Facts' public database
• Sharing you choose: if you share a workout, a meal or your cycle with someone, they see what you chose to share
• Legal requirements: if required by law, court order, or government request

We do not use third-party advertising or cross-app tracking SDKs.

6. Your Rights

You have the right to:

• Access your data: all your data is visible within the app
• Edit your data: change your records at any time
• Delete your data: delete single entries in the app. In Cycle settings, "Delete all your cycle data" removes every period, symptom, note and setting, and what Bujji wrote about your cycle, from your phone and our servers
• Export your data: YOU › Export everything makes one Excel file of all your data, on your phone
• Delete your account: in the app, YOU › Delete my account (or see tesr.health/delete-account). You are signed out at once; for 30 days you can sign back in and change your mind; after 30 days your account and your data, including your photos, are erased
• Withdraw consent: turn Bujji, any area it reads, cycle reading or body fat from photos off at any time in the app; it stops from then on
• Grievance redressal: under India's Digital Personal Data Protection Act, 2023 (DPDP Act), you may raise concerns with our grievance officer at support@tesr.health, who will respond within the timelines prescribed by the Act. If you are not satisfied, you may complain to the Data Protection Board of India

If you are in California (CCPA), Canada (PIPEDA) or Australia (Privacy Act 1988), you have additional rights under local law. Contact us to exercise these rights.

7. Data Retention

• Waitlist entries: kept until you ask us to remove you or we retire the waitlist
• Your records: kept as long as your account exists, until you delete them
• Bujji chats: 30 days
• Notification records and AI job counts: 90 days
• AI cost records (which AI feature ran, and what it cost): one year; they stop naming you when your account is erased
• Bujji's notes and weekly reviews: two years
• Account deletion: everything is erased 30 days after you ask. Indian law asks us to keep a small record for one year after that: a coded account number (not your email), the dates you used the app, what you agreed to and when, and a note that you asked us to delete it. After one year it goes too
• Our service providers: some keep short-lived copies, like crash reports and AI safety logs, for up to 90 days before they clear them

8. Children's Privacy

tesr is for adults 18 and over. We do not knowingly collect data from anyone under 18, and an account found to belong to someone under 18 is deleted. If you believe someone under 18 has given us personal data, please contact us at support@tesr.health and we will delete it.

9. Security

• All data transmitted between the app and our servers is encrypted using TLS/SSL
• Database security rules ensure each account can only reach its own data, and your progress photos and pack photos can be opened only by you
• We do not store passwords; sign-in is handled by our authentication provider and, where you choose them, Google and Apple
• If a breach of your personal data happens, we will tell you and the authorities as the law requires

No system is 100% secure. If you discover a security vulnerability, please report it to support@tesr.health.

10. Third-Party Services

• Supabase (your account, and your data so it reaches your other devices; India): Privacy Policy
• PowerSync (the syncing itself): Privacy Policy
• Google Gemini API (AI features, see §5; United States): Privacy Policy
• Anthropic Claude API (AI features, see §5; United States): Privacy Policy
• Sentry (crash reports, with an anonymous id and nothing about your body; United States): Privacy Policy
• PostHog (which features are on for you, by anonymous id; United States): Privacy Policy
• Expo (delivers Bujji's notes to your phone as notifications; United States): Privacy Policy
• Grafana (our AI cost dashboard: which AI feature ran for your account, and what it cost): Privacy Policy
• Open Food Facts (a scanned product's barcode, see §5): Privacy Policy
• Google Firebase (website waitlist storage): Privacy Policy
• Google Sign-In: Privacy Policy
• Apple Sign-In: Privacy Policy

We do not use advertising networks, social media trackers, or analytics platforms that track individual users across apps.

11. Changes to This Policy

• The "Last Updated" date at the top will change
• For significant changes, we will tell you in the app or by email before they apply, and ask again where the law needs your consent

12. Contact Us

If you have any questions about this Privacy Policy or your data:

Email: support@tesr.health

Website: https://tesr.health

Post: TESR Technologies Private Limited, Hyderabad, Telangana 500089, India