KYZO — Privacy Policy

Last updated: October 15, 2026

Dream Forge Mobile Pte. Ltd. ("we," "our," or "us") operates the KYZO mobile application ("App"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use KYZO. This notice describes our practices; it does not replace permission or consent required for a particular feature.

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

1.2 Health & Fitness Data

Connecting Apple HealthKit (iOS) or Health Connect (Android) is optional and requires your device authorization. The available records and permissions differ by platform, installed app version and the data supplied by your devices or other apps.

Android — Health Connect

In Android versions with the reduced Health Connect scope, KYZO may read the following records you authorize:

When you choose to export a workout, KYZO may write exercise sessions, distance and total calories burned to Health Connect. The reduced Android scope does not request blood glucose, blood pressure, general body temperature, height, lean mass, body water, bone mass or floors-climbed access. Earlier app versions may request a broader scope; you can review or revoke their grants in Health Connect.

iOS — Apple HealthKit

On iOS, authorized reads may include steps, walking/running distance, floors climbed, active and resting energy, exercise minutes, heart rate, resting heart rate, HRV and heartbeat timing, sleep, mindful sessions, workouts and workout routes, VO2 max, weight, height, waist circumference, body fat and lean mass, dietary energy/protein/carbohydrate/fat records, hydration, blood oxygen, respiratory rate, general body temperature, blood glucose and blood pressure. BMI is calculated from your weight and height; current versions do not request separate BMI records. Menstrual flow and, on supported app versions, basal body temperature use the separate Cycle import permission flow. Basal temperature is a distinct record type and is not inferred from general body temperature. When you choose workout export, KYZO may write workouts, walking/running distance and active energy burned; it does not request permission to write all the types it reads.

Optional connected heart-rate sensors

In versions with connected-sensor support, selecting a compatible Bluetooth heart-rate sensor requests Bluetooth access to receive live heart-rate readings during a run or workout. The readings may include beat-to-beat timing. The sensor identifier, name and connection choice are saved locally so the app can reconnect to your chosen sensor. Current versions retain session readings locally for recovery and heart-rate summaries; raw per-reading sensor samples and connection preferences are not part of cloud sync. Saved run and workout records and their supported summary fields can sync when you enable cloud sync. Disconnecting a sensor stops new readings; it does not erase an already saved session. You can revoke Bluetooth access in system settings and use the app's data-deletion controls to remove saved data. These readings are not used for advertising.

Records you enter manually or scan from documents are separate from platform health permissions. Reducing Android access does not delete your existing records or prevent you from recording relevant measurements yourself. Body, cycle and medical histories may therefore contain information that the current Android Health Connect connection does not import.

Important: Health data accessed through Apple HealthKit or Health Connect is used only to provide App features. It is never sold to third parties and never used for advertising. Cloud sync can upload supported health records to Firebase when enabled. In versions with the Data & Backup privacy controls, uploads require you to enable cloud sync for your account on that device. Earlier versions may enable sync by default; check your installed version and setting. Device health permissions, cloud sync, and sending information to an AI feature are separate controls. You can revoke health access at any time in your device settings.

1.3 Location Data

If you use GPS activity tracking (e.g., runs, walks, cycling), KYZO collects precise location — including background location while an activity is active — to map your route and calculate distance, pace, and elevation. Location is used only for activity tracking and is not used for advertising. You can disable location access at any time in your device settings.

1.4 Camera, Photos & Voice

KYZO uses your device camera, photo library, and microphone for:

Voice features can send your recorded audio to Google Gemini to identify ingredients or interpret your request, after you allow AI processing. Meal photos and other images you submit to AI are sent for analysis. Google Gemini is the primary AI provider; eligible requests may be sent to OpenAI as a fallback. Photos uploaded for background analysis are temporarily stored in Firebase, and job records may contain requests and results. Photos you choose for your profile or to share are checked by Google Gemini for inappropriate content before public display, after you allow AI processing. Approved photos can remain stored to provide those features. Automatic meal sharing omits the photo when AI processing is not allowed. See Sections 3 and 6 for recipients and retention.

1.5 Medical Reports and Medication/Supplement Tracking (Sensitive Data)

KYZO offers an optional Medical Report Scanner that lets you scan or upload medical documents (such as lab results). These documents contain sensitive health information and are processed by our AI service (Google Gemini) to extract measurements, summarize and explain the results, and generate result-informed diet and exercise suggestions for discussion with your healthcare professional. Saved reports support your private history and trends. These features include information related to health conditions, but do not establish a diagnosis or a treatment plan. AI output can be wrong; verify the report and consult a qualified healthcare professional before changing diet, exercise, medication or treatment. KYZO is not a medical device and does not diagnose, treat, cure or prevent any medical condition — see our Terms of Service health disclaimer.

Medication and supplement tracking can store the names, doses, schedules, reminders and taken/skipped entries you provide, including prescribed medication entries in pregnancy tracking. These features help you organize your own records and reminders; KYZO does not prescribe medication, verify that a dose is suitable for you, or offer a medication-identification scanner. Follow your clinician's, pharmacist's or product-label instructions. Supplement AI discussion topics are not instructions to start a supplement or change a dose or schedule; those decisions require your own confirmation and appropriate professional advice.

Medical documents and medication/supplement information can contain sensitive health information. AI submission, device health authorization and cloud sync are separate choices. We process submitted documents and relevant context for the features you request after you allow AI processing; supported saved records can sync to Firebase when cloud sync is enabled. We do not sell this information or use it for advertising. The recipients, retention and controls in Sections 3, 6 and 8 apply.

1.6 Device & Usage Information

In versions with the usage-analytics choice, Firebase Analytics receives app interactions only when you enable usage analytics. This can include the duration of an app-recorded completed workout, alongside the workout-completion event, to understand feature use. These fitness analytics are separate from cloud backup and AI processing. Health measurements and medical report contents are not included in these analytics events. Health and fitness conversion events are not sent to advertising attribution services; ordinary install, registration, subscription and purchase attribution follows your advertising choices. You can disable usage analytics in Settings to stop new analytics events.

1.7 Purchase Information

Transaction details for subscriptions and in-app purchases (e.g., carrot credits, premium features) are processed securely through the Apple App Store or Google Play Store. We do not receive or store your payment card details.

1.8 Social & Community Features

KYZO includes optional social features: adding friends via friend codes, tagging friends in meals and workouts, sharing meals, and Wellness Circles (small groups with a shared activity feed and challenges). If you use these features:

Games & leaderboards

If you play Dice Duel while signed in, KYZO records game results automatically, including games against the bot. Your account identifier, display name, avatar (if set), level and game statistics, such as wins, games played, streaks and carrot winnings, may appear on the ranked leaderboard to other signed-in KYZO users. Where multiplayer is available, match participants also share their profiles and match state with their opponent. These records support gameplay and rankings. The separate meal, workout and circle share settings do not control game leaderboard publication.

Account deletion removes your leaderboard and matchmaking entries and clears your name and avatar from shared multiplayer rooms. Shared match state and player identifiers can remain in those rooms for the other participant. Store purchase and legally required transaction retention are described separately below.

2. How We Use Your Information

3. Third-Party Services

KYZO integrates with the following third-party services, each with its own privacy policy:

4. Data Sharing

We do not sell your personal information. We may share data in limited circumstances:

5. Data Security

We implement industry-standard security measures including encryption in transit, secure API communications, and access controls. However, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

6. Data Retention

Retention depends on what the data is used for:

Account deletion removes the data KYZO holds. Copies already received by the third-party services listed in section 3 (for example attribution, advertising and crash-reporting data) are handled under those providers' own retention and deletion policies.

Contact us for the retention details applicable to your records or to request deletion. Deleting KYZO does not delete the underlying records in Apple Health or Health Connect, or your app-store purchase history.

7. Children's Privacy

KYZO is intended only for adults aged 18 or older. People under 18 must not create an account or use the App, including with parental permission. If you believe an under-18 user has provided personal information, contact us so we can investigate and arrange appropriate account and data removal.

See also our Consumer Health Data Privacy Policy for health-data categories, sharing and applicable consumer rights.

8. Your Choices & How to Delete Your Data

You can delete your account and associated data at any time:

You can also revoke health, location, camera, microphone, and tracking permissions at any time in your device settings.

Advertising consent: On iOS, KYZO requests permission through Apple's App Tracking Transparency prompt before using your advertising identifier; if you decline, ads are non-personalized. In the EEA, UK, and Switzerland, KYZO shows a consent dialog (Google's consent framework) before serving ads; you can change or withdraw your choices at any time via Settings → Ad Preferences in the App. Premium subscribers do not see ads.

Turning off cloud sync stops future sync; it does not itself delete previously uploaded records. Device permissions can be withdrawn in system settings. In versions with the Data & Backup privacy controls, enable AI processing before sending content to AI providers. You can turn it off to stop new requests; previously submitted jobs may still complete. These choices are per account and device. Avoid submitting health information you do not want processed remotely. For access, correction, deletion, or a privacy complaint, contact support@dreamforgemobile.com.

9. Your Rights Under GDPR (EEA/UK)

If you are in the European Economic Area or the United Kingdom, you have the right to access, correct, delete, restrict, or object to the processing of your personal data, and to data portability. Where we rely on consent (e.g., health data, precise location), you may withdraw it at any time. We rely on contract necessity for account and requested service administration; consent where required for optional health processing, device permissions and advertising; legitimate interests for proportionate security, abuse prevention and service diagnostics; and legal obligations for required records. Where health information is special-category data, a separate applicable condition is also required, such as explicit consent. You may ask us which basis and condition apply to your data. You may lodge a complaint with your local data protection authority. To exercise these rights, contact support@dreamforgemobile.com.

10. Your Rights Under CCPA/CPRA (California)

California residents have the right to know what personal information we collect, to request deletion or correction, and to opt out of the "sale" or "sharing" of personal information. We do not sell your personal information for money. However, our use of advertising identifiers with Google AdMob for personalized advertising may be considered "sharing" for cross-context behavioral advertising under California law.

Do Not Sell or Share My Personal Information: You can opt out of personalized advertising by declining the App's tracking prompt, using Settings → Ad Preferences in the App (where available), disabling ad tracking in your device settings (iOS: Settings → Privacy & Security → Tracking; Android: Settings → Google → Ads), or by emailing support@dreamforgemobile.com. We will not discriminate against you for exercising your privacy rights.

11. International Data Transfers

Your information may be transferred to and processed on servers located outside your country, including Singapore and the United States. Where required, we use appropriate safeguards for such transfers. You may contact us for information about the safeguards applicable to a particular transfer. Use of the App alone is not consent to an international transfer.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through the App and on this page where required. Changes requiring fresh consent will not be treated as accepted merely because the date changes.

13. Contact Us

If you have questions about this Privacy Policy, please contact us at: