1. Who we are and what this Policy covers
Sadra Makhmali is the individual controller and operator of the TEVRA service (“TEVRA,” “we,” “us,” or “our”). This Policy applies to the TEVRA Android application, the TEVRA web app (PWA), the iOS application once it is released, this website, our APIs, administrative services, and related communications that link to it (the “Services”).
Contact: [email protected]
Safety reports: [email protected]
2. Personal data we collect
Account and sign-in data
You sign in with Google or with Apple. From the sign-in provider we receive an account identifier, your email address (or an Apple private relay address if you choose to hide yours), and your name where the provider shares it. We also process session and refresh tokens, onboarding and acceptance status, device and app information, login and logout history, and security events. We do not receive or store your Google or Apple password.
Profile and onboarding data
When you set up and edit your profile, we process your display name, date of birth, optional gender, weight, height, the body mass index (BMI) calculated from them, your goal (for example staying active or meeting people), the sports you choose, an optional profile photo, the language you use, and whether your profile is public. Turning your profile to private removes it from search and buddy suggestions; existing buddies keep their access.
Health and fitness data
If you connect Apple Health (iOS) or Health Connect (Android), the app reads workouts or exercise sessions and calories burned on your device, only after you grant permission, so it can help you fill in an activity log after an event. TEVRA never writes to Apple Health or Health Connect. Our servers store only whether the connection is turned on and the duration and calories you choose to submit when you log an event. Health data is never used for advertising, never sold, and never shared with data brokers. You can revoke access at any time in your device’s Health settings.
Events and activity data
We process the events you create, join, leave, or are invited to, including title, sport, description, start time, duration, capacity, minimum level, public or private visibility, invitations and their status, share links, participants, and host actions such as editing, cancelling, or removing a participant. When you log an event, we process the duration and calories you submit and the time you logged them, and we use them to build that event’s leaderboard.
Buddies, progress, and notifications
We process buddy suggestions, connect requests and their status, your buddies list, and buddy leaderboards. We also process points, levels, weekly streaks and streak freezes, challenges and milestones, in-app notifications and their read state, and notices you dismiss.
Media and files
We process the profile photo you upload, including technical metadata needed to validate, store, resize, deliver, secure, and delete it. Photos are kept in private storage and are delivered through short-lived links. Do not upload identity documents or other sensitive images.
Technical and security data
When you use the Services, we process connection and request metadata such as IP address, timestamps, language and locale, app version, device and platform, response status, rate-limit signals, crash or error context, and security events. We limit production logs and redact tokens, secrets, and other fields that are not needed for operations.
Website and web app data
This website does not use advertising or analytics cookies and does not provide account creation. The web app stores your sign-in session and your chosen language in your browser’s local storage so you stay signed in and see the app in your language, and it may cache app files on your device so it loads quickly. You can clear both from your browser settings. Our hosting, DNS, and security providers may process ordinary web-request data such as IP address, browser information, requested URL, and security signals to deliver and protect the site.
3. How we obtain data
We obtain data directly from you, automatically from your device and use of the Services, from Apple Health or Health Connect on your device when you allow it, from other users when they invite you, add you to an event, or interact with you, and from service providers such as Google and Apple sign-in, app stores, and infrastructure or security providers.
4. Why we process personal data
We process personal data to:
- Create, authenticate, secure, and recover accounts and sessions;
- Provide profiles, events, invitations, buddy discovery and connections, leaderboards, points, levels, streaks, challenges, milestones, notifications, and support;
- Respect profile visibility, private events, and your communication preferences;
- Apply eligibility rules such as minimum age and event level requirements;
- Detect abuse, fraud, security incidents, and violations of the Terms of Use;
- Operate, troubleshoot, measure, back up, restore, and improve the Services;
- Send service, security, and support communications;
- Comply with law, valid legal process, regulatory duties, and the establishment, exercise, or defence of legal claims.
Depending on the context and applicable law, we rely on performance of our agreement with you, your consent (including for health data and optional profile fields), compliance with legal obligations, protection of vital interests, and our legitimate interests in providing, securing, improving, and enforcing the Services. Where consent is required, you may withdraw it for future processing, but this does not make earlier lawful processing invalid.
5. Automated features
TEVRA uses rules and automated systems to suggest buddies and events based on shared sports and activity, rank leaderboards, calculate points, levels, and streaks, apply eligibility and privacy rules, and detect suspicious activity. These systems do not make decisions that produce legal or similarly significant effects on you. Automated output can be incomplete or wrong; contact us if you believe something is incorrect.
7. International processing and transfers
Our providers may process data in the United Arab Emirates, the European Economic Area, the United States, or other countries in which they operate. These countries may have different privacy laws. Where applicable law requires a transfer mechanism or additional safeguards, we use contractual, technical, organizational, consent-based, or other legally recognized measures appropriate to the transfer. Internet routing and content-delivery networks may process technical request data in several locations.
8. Retention and deletion
We retain personal data only for as long as reasonably needed for the purposes described in this Policy, including while your account is active and for applicable security, fraud-prevention, backup, dispute, and legal periods afterward. Retention differs by category:
- Sessions expire or are revoked under configured security periods, while a limited authentication history may remain for account security;
- A photo you remove or replace is detached from your profile and scheduled for storage cleanup;
- Events you hosted, invitations, and activity logs that are part of other people’s events may remain in limited form so those events and leaderboards stay accurate;
- Security, moderation, and audit records may remain longer when needed for integrity, fraud prevention, legal compliance, or claims;
- Backups are protected and rotate under an operational retention schedule; deleted data disappears from backups as those copies expire unless preservation is legally required.
You can delete your account in the app under Profile, Settings. Deletion removes your user record, linked sign-in identities, onboarding profile, sports, and profile photo, and revokes your active session, subject to the limited retention grounds above. Uninstalling the app does not delete your account.
9. Your choices and rights
Depending on applicable law, you may have rights to receive information about processing; access or obtain a copy of your data; correct inaccurate data; delete data; restrict or object to processing; withdraw consent; receive portable data; and complain to a competent authority. Some rights are subject to lawful exceptions, including the rights and safety of others, fraud prevention, legal obligations, and legal claims.
In the app you can edit your profile, switch your profile between public and private, connect or disconnect Apple Health or Health Connect, leave events, remove buddies, and delete your account. To make another privacy request, email [email protected] from the address linked to your account so we can verify it. We will never ask for your password or unnecessary identity documents by email.
10. Security
We use technical and organizational safeguards appropriate to the nature and risk of the data. These include encrypted connections, access controls, secret management, network restrictions, rate limiting, abuse protection, logging controls, backups, patching, and separation of public and private storage. No system or transmission is completely secure. Protect your device and sign-in accounts, and report suspected compromise promptly.
11. Age limit
The Services are for people aged 16 or older, and you confirm your date of birth during sign-up. We do not knowingly provide the Services to anyone younger. If we learn that an underage person has created an account, we may restrict the account and take appropriate deletion or preservation steps.
12. Changes to this Policy
We may update this Policy as the Services, providers, or law change. We will update the version and date above and provide appropriate notice of material changes. Where law requires consent for a new processing purpose, we will seek it before that processing begins.
13. Contact
- Controller and operator
- Sadra Makhmali, an individual operating TEVRA
- Privacy and general requests
- [email protected]
- Safety reports
- [email protected]