Tirata
Privacy Policy
Effective date: June 5, 2026
Last updated: June 5, 2026
This Privacy Policy explains how Tirata, Inc. (“Tirata,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information when you use the Tirata mobile application and related services (collectively, the “Service”). Tirata is an off-bike strength training and injury-prevention app for competitive cyclists that builds and adapts personalized strength programs around your riding schedule.Contents
Contents
1. Who we are and how to contact us
2. Scope and minimum age
3. Information we collect
4. How we use personal information
5. How we disclose personal information
6. Service providers we rely on
7. How long we keep information
8. Your choices and rights
9. How we protect information
10. Where information is processed
11. Third-party services
12. Changes to this Policy
13. Contact us
1. Who we are and how to contact us
The Service is operated by Tirata, Inc., a Delaware corporation. We are the “business,” “controller,” or equivalent responsible for the personal information collected through the Service under applicable U.S. state privacy laws.
Email: support@tirata.app
Website: https://tirata.app
Mailing address: 995 Old Farm Ln, Aptos, CA 95003
If you have questions about this Policy or how we handle your personal information, contact us using the details above.
2. Scope and minimum age
This Policy applies to personal information we collect through the Tirata mobile app on iOS and Android and through related online services we provide. It does not apply to third-party products or services that we do not control, even where they integrate with the Service (for example, the Apple App Store or Google Play). It is directed to users in the United States and describes rights available to residents of U.S. states with comprehensive consumer privacy laws (see Section 8).
The Service is intended only for adults aged 18 and over. We do not knowingly collect personal information from anyone under 18. If you are under 18, please do not use the Service or provide any information to us. If we learn that we have collected personal information from a person under 18, we will delete it. If you believe a minor has provided us with personal information, contact us at support@tirata.app.
3. Information we collect
We collect the following categories of personal information. We collect most of it directly from you when you create an account, complete onboarding, and use the app; some is generated automatically as you use the Service or is provided by the third parties described in Section 6.
3.1 Account and identity information
Email address — used to create and secure your account (email/password sign-in).
Name — your first and last name, provided during onboarding.
Authentication identifiers — if you sign in with Apple or Google, we receive a unique account identifier and basic profile information (such as name and email) from that provider. With Sign in with Apple, you can choose to hide your email, in which case Apple provides a private relay address.
We use a third-party authentication and backend provider (Supabase) to manage sign-in. We do not store your account password in readable form; passwords are handled and hashed by our authentication provider.
3.2 Training profile and preferences
To build your program, we collect the information you enter during onboarding and in settings, including:
Age group (e.g., under 25, 25–50, 50+).
Cycling discipline (road, gravel, or mountain bike).
Strength-training experience level and training status.
Available equipment and loading capability.
Preferred unit of measurement (kg or lbs).
Training frequency and session volume preferences.
Your weekly ride schedule and chosen strength-training days.
Time zone, used to schedule sessions and notifications.
Race events you add — the race name, date, and priority (A or B race).
3.3 Workout and activity data
As you follow your program, we collect data about your training so the app can track progress and adapt future sessions. This includes:
Generated programs, phases, weeks, and scheduled sessions.
Session activity — when you start, complete, skip, or miss a session, and session duration.
Exercise logs — the weight you lift, reps completed, perceived exertion (RPE), set duration, and completion status.
Exercise swaps and other adjustments you make to your plan.
This workout data describes your physical training activity. It is not collected for medical purposes, and Tirata is not a medical device or a substitute for professional medical or physical-therapy advice.
3.4 Feedback you provide
If you submit in-app feedback, we collect the message you write and limited technical context (such as the app screen or version) to help us understand and act on it.
3.5 Device, technical, and usage information
When you use the app, we and our service providers automatically collect:
Device and app information — device model and name, operating system and version, and app version.
Push notification token — a device identifier issued by Apple/Google push services so we can send notifications you have enabled, plus your notification preferences and a log of notifications sent.
Usage and event data — actions you take in the app (for example, screens viewed, onboarding steps, sessions started/completed, exercise swaps, and paywall interactions), captured through our analytics provider.
Diagnostic and crash data — error reports, crash logs, and limited performance data captured through our crash-reporting provider to keep the app stable.
We do not collect precise (GPS) location. We infer only a general region from the time zone you select.
3.6 Subscription and purchase information
Tirata offers paid subscriptions. Purchases are processed by the Apple App Store or Google Play, not by Tirata. We do not collect or store your full payment card or bank details. We use a subscription-management provider (Superwall) and the app stores to present offers and confirm your subscription status; we receive confirmation of whether you converted, your subscription/entitlement status, and related non-financial transaction events.
3.7 Categories of personal information under California law
For California residents, the table below maps the information above to the statutory categories in the California Consumer Privacy Act, as amended (the “CCPA”). “Yes” means we collect information in that category.
CCPA category
Examples in Tirata
Collected?
Identifiers
Name, email address, account/user ID, third-party sign-in IDs, device push token.
Yes
Customer records
Name and email associated with your account.
Yes
Commercial information
Subscription status and purchase/transaction history (records held by the app stores).
Yes
Internet/network activity
App usage and event data, feature interactions, diagnostic and crash data.
Yes
Geolocation data
General region inferred from your selected time zone only. No precise/GPS location.
Coarse only
Professional/employment, education, biometric, audio/visual, genetic
Not collected.
No
Health/medical information
We collect self-reported workout activity (weights, reps, RPE, training history). We do not collect medical records or diagnoses.
Activity data
Inferences
Training preferences and program parameters derived from your inputs and activity.
Yes
We do not collect Social Security numbers, driver’s license numbers, financial account numbers, precise geolocation, log-in credentials for other accounts, racial or ethnic origin, religious beliefs, sexual orientation, citizenship or immigration status, genetic or biometric data, medical diagnoses, or the contents of your private communications. Some U.S. state privacy laws treat certain categories — such as health-related information — as “sensitive.” To the extent any information we collect is considered sensitive under your state’s law, we use it only to provide the Service you request, and not for targeted advertising, the sale of personal information, or profiling; where your state requires your consent to process sensitive data, we will obtain it. Under the CCPA, we do not use or disclose sensitive personal information for purposes that give rise to the right to limit.
4. How we use personal information
We use personal information for the following business purposes:
Provide the Service: create and secure your account, generate and adapt your training program, schedule and track sessions, and log your workouts.
Personalize your program: tailor exercise selection, prescriptions, and timing to your profile, equipment, schedule, and race calendar.
Send notifications: deliver the reminders and alerts you have enabled (such as weekly reminders, phase completion, race-week alerts, and missed-session alerts).
Subscriptions: present offers, confirm subscription status, and manage access to paid features.
Improve and develop the Service: understand how features are used, fix bugs, monitor stability and performance, and build new functionality.
Communicate with you: respond to feedback and support requests and send service-related messages.
Safety, security, and compliance: protect against fraud and abuse, enforce our terms, and comply with legal obligations.
We do not use your personal information to build advertising profiles, we do not engage in targeted advertising or cross-context behavioral advertising, and we do not use it for profiling in furtherance of decisions that produce legal or similarly significant effects about you.
5. How we disclose personal information
We do not “sell” your personal information, we do not “share” it for cross-context behavioral advertising, and we do not process it for targeted advertising, as those terms are defined under U.S. state privacy laws. We disclose personal information only in the following circumstances:
Service providers: we share information with vendors that process data on our behalf to run the Service, under contracts that limit their use of the data to providing services to us (see Section 6).
App stores and platforms: Apple and Google process your purchases and operate the push, sign-in, and distribution platforms the app relies on.
Legal and safety: we may disclose information if required by law, subpoena, or other legal process, or where we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
Business transfers: if we are involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy.
With your direction or consent: where you ask us to share information or otherwise consent to its disclosure.
6. Service providers we rely on
We use the following third-party providers to operate the Service. Each receives only the information needed for its function and is contractually limited in how it may use that information. Each provider maintains its own privacy practices.
Provider
Function
Information involved
Supabase
Authentication, database, and backend hosting
Account credentials, profile, training and workout data, feedback, notification data.
Mixpanel
Product analytics
User/device identifiers, app and device info, usage and event data, selected profile attributes (e.g., experience level, equipment, frequency).
Sentry
Crash and error reporting
User ID, device and app info, crash logs, error and limited performance data.
Superwall
Subscription paywall management
Device/user identifiers and subscription/paywall interaction and status events.
Expo (EAS)
App build and push-notification delivery
Push notification tokens and message delivery data.
Apple
Sign in with Apple, App Store purchases, iOS push
Authentication identifiers, purchase records, push delivery.
Google Sign-In, Play purchases, Android push
Authentication identifiers, purchase records, push delivery.
7. How long we keep information
We keep personal information for as long as your account is active and as needed to provide the Service. After that, we retain information only as long as necessary for legitimate business purposes — such as resolving disputes, enforcing our agreements, maintaining security, and complying with legal obligations — after which we delete or de-identify it.
When you delete your account (see Section 8), we delete your account and the personal information associated with it from our systems. Some information may persist for a limited period in backups or in aggregated or de-identified form that no longer identifies you. Records held by the app stores (such as purchase history) are retained by Apple and Google under their own policies.
8. Your choices and rights
8.1 Choices available to everyone
Access and edit your profile: you can view and update your training profile and preferences in the app.
Notifications: you can enable or disable push notifications in the app’s settings or your device settings, and choose which notification types you receive.
Delete your account: you can permanently delete your account and associated data from within the app. This action is irreversible.
8.2 Your U.S. state privacy rights
Depending on where you live, U.S. state privacy laws give you rights over your personal information. These laws include the California Consumer Privacy Act, as amended by the CPRA (California), and the comprehensive consumer privacy laws of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, and other states as their laws take effect. Subject to the exceptions and verification requirements in each law, you may have the following rights:
Right to know / access: confirm whether we process your personal information and request access to it, including the categories and specific pieces we have collected, the sources, the purposes, and the categories of third parties to whom we disclose it.
Right to correct: request that we correct inaccurate personal information.
Right to delete: request that we delete personal information we have collected from or about you.
Right to data portability: obtain a copy of your personal information in a portable and, where feasible, readily usable format.
Right to opt out: opt out of the sale of personal information, processing for targeted advertising, and certain profiling. We do not engage in any of these activities, so there is nothing to opt out of; you may still contact us with questions.
Right regarding sensitive data: limit, or where required decline to consent to, the processing of sensitive personal information. We use such information only to provide the Service (see Section 3.7).
Right to non-discrimination: we will not discriminate or retaliate against you for exercising any of your privacy rights.
8.3 How to exercise your rights
To submit a request, email support@tirata.app describing the right you wish to exercise. So that we can respond, you may also use the account-management and deletion tools available in the app. We will verify your request using information associated with your account before responding, and we will not use that information for any other purpose. You may use an authorized agent to submit a request on your behalf; we may require the agent to provide proof of authorization and may require you to verify your own identity. We will respond within the time required by your state’s law (generally 45 days, with the possibility of an extension where permitted).
8.4 Right to appeal
If we decline to act on your request, we will tell you why. Residents of states that provide an appeal right (including Virginia, Colorado, Connecticut, Texas, Oregon, Montana, and others) may appeal that decision by replying to our response or emailing support@tirata.app with the subject line “Privacy Appeal.” We will respond to your appeal within the period required by law and explain the reasons for our decision. If your appeal is denied, you may contact your state attorney general to submit a complaint.
8.5 California-specific disclosures
In addition to the rights above, California residents are entitled to the following. We have collected the categories of personal information described in Section 3 over the preceding 12 months, from the sources described in Section 3, for the business purposes described in Section 4, and have disclosed them to the categories of recipients described in Sections 5 and 6. We do not sell or share personal information as defined under the CCPA. Under California’s “Shine the Light” law, residents may request information about disclosures of personal information to third parties for those third parties’ own direct marketing; we do not make such disclosures.
9. How we protect information
We use technical and organizational measures designed to protect personal information, including encryption in transit, access controls, and row-level security that restricts each user’s data to that user. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. Please keep your login credentials confidential and notify us promptly if you believe your account has been compromised.
10. Where information is processed
Tirata is operated from the United States, and the personal information we collect is processed and stored in the United States and in other locations where our service providers operate. If you access the Service from outside the United States, you understand that your information may be transferred to and processed in the United States, where data-protection laws may differ from those in your jurisdiction.
11. Third-party services
The Service relies on third-party platforms (such as Apple and Google) and may reference or link to third-party services. This Policy does not cover those third parties’ practices. We encourage you to review the privacy policies of any third-party services you use in connection with Tirata.
12. Changes to this Policy
We may update this Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, provide additional notice in the app. Your continued use of the Service after an update takes effect means you accept the revised Policy.
13. Contact us
If you have questions, concerns, or requests regarding this Policy or your personal information, contact us:
Email: support@tirata.app
Company: Tirata, Inc. (a Delaware corporation)
Mailing address: 995 Old Farm Ln, Aptos, CA 95003