Privacy policy
Last updated 10 October 2026. This policy covers the Tiyisa app and tiyisa.com, including account.tiyisa.com.
The short version
- You can use Tiyisa without an account. Then your entries stay on your phone.
- With a free account, your data is stored in the EU and used only to run Tiyisa. We never sell it, and your health information is never used for ads.
- Health information, Snap your plate, Phone health, Ask and saving progress photos to your account each need your consent, which you can withdraw any time.
- To keep Tiyisa working and make it better, the app sends anonymous usage statistics and crash reports, never what you log and never who you are. They are on unless you switch them off in Settings.
- If you buy Tiyisa Plus, we never see your card number, and nothing about your health goes near a payment.
Who we are
Tiyisa is made by Synthetiq (Pty) Ltd, a private company registered in South Africa (registration number 2024/697058/07), at 16 Craigavon Park, Elm Avenue, Craigavon, Johannesburg, Gauteng, 2091. Under the Protection of Personal Information Act, 2013 (POPIA), we are the responsible party for the personal information you share with Tiyisa, in the app and on tiyisa.com.
Our Information Officer is Sashen Keenen Moodley. You can reach them at info@tiyisa.com.
What we collect
What we collect depends on how you use Tiyisa. Giving us information is your choice. If you'd rather not, the parts of Tiyisa that need it won't work, and everything else will.
Without an account
Everything you enter stays on your phone. We don't receive your doses, weight, measurements, side effects, food entries or photos.
With a free account
You can make your account in the app, or on account.tiyisa.com, with your email address and a six-digit code.
| Information | Why we need it |
|---|---|
| Email address | To sign you in with a six-digit code, and to reach you about your account |
| First name, language, time zone, units and reminder settings | So Tiyisa greets you, reminds you and works the way you set it up |
| Medicines, doses, injection sites and pens | To remind you and keep your history |
| Weight, body measurements (waist, hips, chest, arm, thigh and neck), water, steps, side effects, food, activity and notes | To show your trends and summaries, and back them up |
| What you want Tiyisa to help with, and your daily goals for food, water and steps | So Tiyisa shows what matters to you, against goals you set |
| If you ask for a goals estimate: your sex (only for the formula), birth year, height and how active you are | To work out a starting estimate that you can use, change or ignore. These answers are never shown anywhere else and never sent to another service |
| Your consents, and when you gave or withdrew each one | To show what you agreed to, as POPIA requires |
If you turn on Snap your plate
When you log food from a photo, a nutrition label, a voice note or your own words, what you send goes to one of the services listed under "Who we share it with" to be read, and is then discarded. We keep only a usage record: the kind of request, when it was made, how long it took and how big it was, never its content. Ask, when it launches, works the same way and has its own consent.
If you turn on Phone health
Workouts, steps and weigh-ins from Apple Health on an iPhone, or from Health Connect on Android, including what your watch adds there. Tiyisa only reads them, only after you allow it, and never changes anything in Apple Health or Health Connect. What it reads stays on your phone, and is saved to your account only if you have one. It never goes into usage statistics, crash reports or anything we send to another service.
Progress photos
Progress photos you take in Tiyisa stay on your phone. If you have a free account, you can switch on Save my photos to my account (Your body › Progress photos). That is its own consent, and it's off until you turn it on. Then a private copy of each photo is kept in your account, stored with Supabase in Ireland (EU), where only you can see it, up to 6 photos a week.
You can switch it off any time, and choose whether the copies already in your account are removed. Deleting a photo in the app removes its copy too, and deleting your account removes them all. Photos never go into usage statistics or crash reports, and are never sent to any other service.
Usage statistics and crash reports
To keep Tiyisa working and to make it better, the app sends usage statistics to PostHog and crash and error reports to Sentry, both in the EU. Usage statistics say when the app is opened, which screens are opened and which features are used, as counts and yes-or-no values, with the app's version, your phone's system (iPhone or Android), the language you chose in Tiyisa and whether you have an account (never which one). They are tied only to a random number the app makes on your phone, never to your name, email or account, and they never include a number you logged, a medicine, a symptom, a photo or anything you typed. Crash reports have personal details removed before they leave your phone.
They are on unless you switch them off: Settings › Privacy and your information › Help make Tiyisa better. Switching off stops both at once and makes the app forget its random number. We rely on our legitimate interest in keeping Tiyisa working and improving it (POPIA section 11(1)(f)), and because these statistics can't be linked to you, they aren't used to make any decision about you.
If you buy Tiyisa Plus
On this website, Paystack takes the payment on its own secure page. It receives your email address, the card details you type there, the amount and a payment reference, and checks the payment with your bank. In the app, Google Play or the App Store takes the payment, and we only learn whether your plan is active, through RevenueCat.
We never see or keep your card number. We keep a record of each payment: the date, the amount, the receipt number, the card's type and last four digits, and the email address it was paid with. The name on your bank statement is SYNTHETIQ.
If you join the waiting list
Your email address, so we can tell you when Tiyisa launches. It's stored with Cloudflare, which runs this website, and we don't use it for anything else. To come off the list, email info@tiyisa.com.
On this website, and cookies
tiyisa.com counts visits with PostHog, in the EU, so we can see how people find Tiyisa and which pages help them: the pages you open, the site that sent you, your browser, the kind of device and your country, and taps on the store and Plus buttons. If you join the waiting list we count that you joined, never your email address. Cloudflare Web Analytics also counts visits, without cookies. Neither is used for ads, and we never sell what they count.
On the website, a banner at the bottom of the page asks once. If you choose Accept, PostHog keeps one cookie on tiyisa.com for a year (and a copy in your browser's storage), so a later visit is counted as the same visitor. If you choose No thanks, or haven't chosen yet, nothing is stored on your device for counting: PostHog counts the visit from a code worked out on its server, which changes every day and can't be traced back to you. Your browser keeps only your choice. If your browser sends Global Privacy Control, we treat it as No thanks. Change your choice any time with Cookie settings at the bottom of every page. IP addresses are not kept.
The account pages, where you sign in on the website, have no analytics at all, and use only the cookies that keep you signed in. They end when you sign out, or after 30 minutes without activity, and they're never used to track you.
When you sign in or pay on the website, Cloudflare's Turnstile checks that you're a person, using signals from your browser, without a puzzle unless it's needed. If you use the delete-account form, we use your email address to send the code and keep only a scrambled version of it, deleted within a day. Your IP address is used only to limit how many tries can be made, and is never stored with your account.
Your health information
Doses, weight, body measurements, progress photos, side effects and what you note about how you feel are health information. POPIA treats this as special personal information, so we only process it with your explicit consent (section 27(1)(a)). You give that consent when you set up Tiyisa.
Snap your plate, Phone health, Ask and saving progress photos to your account each ask for their own consent, separately, and the rest of Tiyisa works if you say no. You can withdraw any consent at any time in Settings, or by deleting your data. Withdrawing doesn't undo what was done before you withdrew. Usage statistics and crash reports never contain health information (see "Usage statistics and crash reports" above).
Payments never touch your health information. Payment records are kept apart from it, and no receipt, email or bank statement mentions your medicines or your health.
What we use it for
- to run Tiyisa: your reminders, history, summaries and backups
- to do what you ask, like reading a food photo
- to keep Tiyisa working and secure, and to fix what breaks
- to learn which features help, from usage statistics
- to sell and manage Tiyisa Plus: payments, receipts and refunds, and the records tax law requires
- to send you emails about your account, like sign-in codes, receipts and notices about payments
- to answer you, and to meet our legal duties
We never sell your information, never use your health information for advertising, and never share it with medicine makers, pharmacies, medical schemes or insurers. Nothing about you is decided automatically: summaries only count and show what you logged, and a goals estimate is only a starting number that you choose to use or change.
Where your information goes
Your account data is stored in Ireland, in the European Union, whose data protection law (the GDPR) protects it at least as well as POPIA does.
Snap your plate and Ask send what you give them to providers in the United States, which doesn't have a privacy law like POPIA. We only send it with your consent to that transfer (POPIA section 72(1)(b)), we send only what the feature needs, without your name or email, and the providers' business terms say they don't use it to train their systems. We don't keep a copy of what you send.
Our emails are sent by Resend, and subscriptions bought in the app are checked through RevenueCat, both in the United States. They get only what they need, like your email address and whether a subscription is active, never your health information. They work under data processing terms that require them to protect it as POPIA would (section 72(1)(a)), and sending it is needed to give you what you asked for (section 72(1)(c)).
Paystack keeps payment information on servers in Ireland (EU), and may share it with other Paystack and Stripe companies and its own providers, under contracts that protect it.
Emails you send us are held by our email provider, GoDaddy, in the United States, under data processing terms that require it to keep them confidential and secure.
How we keep it safe
Your data is encrypted in transit and where it's stored. Each account can only reach its own records. The keys to our systems stay on our servers, never in the app, and only people who need access have it.
Card numbers never reach us: you type them only on Paystack's secure page, and Paystack follows the card industry's security standard (PCI DSS). Only our servers can say whether you have a paid plan, and only after the payment provider confirms it.
If a security breach ever puts your information at risk, we'll tell you and the Information Regulator as soon as we reasonably can, as POPIA section 22 requires.
How long we keep it
- Your account data: until you delete your account. Deleting removes it from our live database straight away, and copies in backups are overwritten within 30 days.
- Progress photos in your account: until you delete them, remove them when you switch saving off, or delete your account.
- Records of payments: five years after each payment, even if you delete your account, because South African tax law requires it. They hold the date, the amount, the receipt number, the card's last four digits and the email address, and no health information.
- The waiting list: until we've told you Tiyisa has launched, or sooner if you ask.
- Sign-in cookies on the website: until you sign out, or 30 minutes without activity.
- Crash reports: up to 90 days.
- Usage statistics and website visits: up to a year, and never with your name, your email or anything you logged.
- The website's analytics cookie, if you accept it: a year, or until you clear it or choose No thanks.
Your rights
Under POPIA you can ask us to:
- show you the personal information we hold about you
- correct anything that's wrong
- delete your account and data
- stop processing your information, or object to it
- withdraw a consent
You can do most of this yourself in Settings, and delete your account in the app or at tiyisa.com/delete-account. For anything else, email info@tiyisa.com. It's free. We'll reply within 30 days, and we may first ask you to confirm it's you.
Emails from us
We only send you news about Tiyisa if you've asked for it: by joining the waiting list, or by ticking the box when you make your account on the website. That box is never ticked for you. Every news email has a link that stops them in one click, with no sign-in.
Emails about your account, like a sign-in code, a receipt or a notice about a payment, aren't marketing, so they still arrive while you have an account. They never mention your health.
Children
Tiyisa is for adults aged 18 and over. We don't knowingly collect information from anyone younger. If you think a child has given us information, email us and we'll delete it.
Changes to this policy
If we make an important change, we'll tell you in the app, or by email if you have an account, before it takes effect. The date at the top shows when this policy last changed. Our terms explain the rest of how Tiyisa works.
Contact us and complaints
Synthetiq (Pty) Ltd, 16 Craigavon Park, Elm Avenue, Craigavon, Johannesburg, Gauteng, 2091. Information Officer: Sashen Keenen Moodley, info@tiyisa.com.
If you're unhappy with how we've handled your information, please tell us first so we can put it right. You can also complain to the Information Regulator of South Africa: inforegulator.org.za, POPIAComplaints@inforegulator.org.za, 010 023 5200.