Privacy Policy

This policy explains what personal information the Myo app (formerly MyoScore) collects, why we collect it, where it goes, how long we keep it and what rights you have. If anything is unclear, write to us at support@bysepia.com.

1. Who we are

Myo is provided by SépiaLab, an individual business registered in Québec, Canada, which publishes apps under the name Sépia ("we", "us", "our"). We are responsible for the personal information described in this policy.

• Email: support@bysepia.com
• Address: Québec, Canada

Person in charge of the protection of personal information. As required by Québec's Act respecting the protection of personal information in the private sector (as amended by Law 25), SépiaLab has designated a person in charge of the protection of personal information. You can reach the person in charge of the protection of personal information at SépiaLab at support@bysepia.com.

2. Who Myo is for

Myo is only for adults aged 18 and over. When you start, we ask for your birth month and year. If they show that you are under 18, you cannot use the app. We also block devices and accounts that we identify as belonging to a minor, and if a photo appears to show someone under 18, we delete the photos.

We do not knowingly collect personal information from minors. If you believe a minor has used Myo, contact us and we will delete their data.

3. What we collect

Information you give us

• Account. The first time you open Myo, we create an anonymous account identifier through Firebase Authentication (Google). We do not ask for your name. If you sign in with an existing account, we also process the email address of that account.
• Profile. Your birth month and year, your goal, where you train, how many days per week you train and the language of the app.
• Progress photos. The front, side and back photos that you take with the camera or pick from your library. We collect them only after you give your explicit consent in the app, and only the photos you choose.

Information created by the app

• Analysis results. The observations for each body zone, the trends between your scans and your three training priorities.
• Device identifier. A random identifier kept on your device and on our servers. We use it to enforce the 18+ rule, for example to keep a blocked device blocked.

Information from Apple and Google

• Subscription. If you subscribe, Apple (App Store) or Google (Google Play) gives us the store transaction identifiers, your plan, its expiry date and its renewal status, so that we can unlock your subscription. We never receive your card number or other payment details.

Information on your device

• Notification settings. If you allow notifications, the app schedules a local reminder on your device before your free trial ends. You can turn notifications off at any time in your device settings.

Technical information

• Technical logs. When the app communicates with our servers, we record technical information such as the date and time, the request made and any errors, so that we can run the service, keep it secure and fix problems.

We do not ask for your name, and we do not collect your precise location, your contacts or any advertising identifier.

4. How your photos are processed

• Upload. The app sends your photos to a private Amazon S3 storage bucket located in the United States (AWS region us-east-1), through signed links that expire after a few minutes.
• Age check. Amazon Rekognition estimates an age range from the face in your photos, only to enforce the 18+ rule. It is not used to identify or recognize you, and the estimated age is not stored. If a photo appears to show someone under 18, we delete the photos and block the account and the device.
• Analysis. An AI model (Anthropic Claude) running on Amazon Bedrock, a service of Amazon Web Services (AWS), analyzes your photos and produces your observations, trends and training priorities. Under the Amazon Bedrock terms, your photos and results are not used to train the models, and AWS does not share them with the model provider. To handle demand, Amazon Bedrock may process a request in AWS data centers outside the United States, only for the time needed to process it.
• Storage. Your results are stored in Google Firebase (Cloud Firestore) and on AWS, linked to your account, so that you can follow your progress. Your photos stay in the private storage bucket and are compared with your later photos to measure change.

Your photos are never used for advertising, never sold, never shown publicly and never shared with other users. Access to them is limited to what is needed to provide the service, keep it secure and help you when you contact us.

Myo is not a medical device. It does not give a medical diagnosis, and its observations are not a measure of your health. For any medical question, talk to a health professional.

Earlier versions of the app (MyoScore)

Earlier versions of the app, published as MyoScore, also offered meal photo analysis, processed the same way (AWS, Amazon Bedrock), and a physique score, and they used Firebase Analytics (Google) for anonymous usage statistics and the TikTok Business SDK to measure TikTok advertising campaigns. These features are being retired with Myo.

5. Why we use your information and on what legal basis

• To provide Myo (create your account, analyze your photos, show your results and progress, apply your subscription): to perform our contract with you, that is, the terms of use.
• To process your progress photos: your explicit consent, given in the app before your first photos. You can withdraw it at any time (see section 9). We will then stop analyzing new photos and, if you ask, delete your photos. Without this consent, the analysis cannot work.
• To send you the trial reminder: your consent, through the notification permission of your device.
• To enforce the 18+ rule, keep the service secure and prevent fraud and abuse (for example, misuse of free scans or subscriptions): our legitimate interest in protecting our users and the service.
• To keep purchase records, answer lawful requests from authorities and respond to your privacy requests: our legal obligations.
• To answer your messages: to perform our contract with you and our legitimate interest in helping you.

We do not use your information to build advertising profiles. We do not sell or rent your personal information. There are no third-party advertising trackers in Myo (for earlier versions, see section 4), and we do not track you across other companies' apps or websites.

Automated decisions

Some decisions are made automatically: access is refused if your birth month and year show that you are under 18, and an account and device are blocked if the age check estimates that a photo shows someone under 18. You can contact us to learn what information and main factors led to the decision, to correct your information and to ask a person to review the decision.

6. Who processes your information

We share your information only with the service providers that help us run Myo. They may use it only to provide their services to us and must protect it.

• Google (Firebase Authentication, Cloud Firestore): account and storage of your profile and results.
• Amazon Web Services (Amazon S3, AWS Lambda, Amazon DynamoDB, Amazon SQS, Amazon Rekognition, Amazon Bedrock): photo storage, servers, processing queue, age check and AI analysis.
• Anthropic: provider of the Claude model, used through Amazon Bedrock. The model runs within AWS, and Anthropic does not receive your photos or your results.
• Apple and Google (App Store, Google Play): app distribution and payments. They handle your payment under their own privacy policies.

We may also disclose information when the law requires it (for example, a valid court order), to protect the rights and safety of our users or of Myo, or as part of a sale or reorganization of the business, in which case the recipient must keep protecting your information as described in this policy.

7. International transfers

We are based in Québec, Canada. Your information is stored and processed outside Québec: in the United States (AWS region us-east-1), on Google Cloud servers, and, for the analysis, possibly in other AWS regions. The laws of these countries may differ from those where you live. We rely on the contractual commitments and security measures of these providers, including the standard contractual clauses they offer for transfers from the European Union and the United Kingdom.

8. How long we keep your information

• Account, profile, photos and analysis results: as long as your account exists. When you ask us to delete your account, we delete it with all your photos within 30 days.
• Analysis tasks (temporary processing records): they expire automatically after 7 days.
• Photos of someone who appears to be under 18: deleted as soon as this is detected. The block on the account and the device is kept to enforce the 18+ rule.
• Subscription and purchase records: as long as your account exists, then only as long as the law requires (for example, tax and accounting rules).
• Technical logs: for a limited period, for security and troubleshooting.
• Messages you send us: as long as needed to answer you and follow up.

9. Your rights

Wherever you live, you can ask us to:

• give you access to the personal information we hold about you and a copy of it;
• correct information that is inaccurate or incomplete;
• delete your account, your photos and your other information;
• give you your information in a structured, commonly used technological format (portability);
• withdraw your consent at any time, for example to the processing of your photos (this does not affect processing already done);
• have a person review an automated decision (see section 5).

Québec (Law 25). You also have the rights provided by the Act respecting the protection of personal information in the private sector. If you are not satisfied with our answer, you can file a complaint with the Commission d'accès à l'information du Québec (www.cai.gouv.qc.ca).

European Union and United Kingdom (GDPR and UK GDPR). You can also object to processing based on our legitimate interests and ask us to restrict processing. You can file a complaint with the data protection authority of the country where you live or work, or, in the United Kingdom, with the Information Commissioner's Office.

California (CCPA, as amended by the CPRA). You have the right to know what personal information we collect, use and disclose, and the right to delete and correct it. We do not sell or share your personal information, and we use sensitive personal information only to provide the service, so there is nothing to opt out of or limit. In the past 12 months, we have collected the categories described in section 3 (identifiers, age information, commercial information about your subscription, photos and the results derived from them, and technical information), for the purposes in section 5, and disclosed them only to the service providers in section 6. We will not treat you differently for exercising your rights. Residents of other US states with privacy laws have similar rights and can contact us in the same way.

Other countries. If you live in another country with a data protection law (for example, Brazil and its LGPD), you have the rights that law provides and can contact us in the same way.

How to exercise your rights

Write to us at support@bysepia.com. Because your account is anonymous, we may ask you for information that helps us find your account and confirm that it is yours. We answer within 30 days, free of charge.

Deleting your account. You can ask us at any time to delete your account and all your photos by writing to support@bysepia.com, from your account's email address if you have one, otherwise telling us which app you use (MyoScore or Myo). We complete the deletion within 30 days of your request. In the current MyoScore app, you can also delete your data yourself: open Profile and, under Danger zone, tap Delete all data. This also deletes your photos and the data stored in the cloud. In Myo, the new version of the app, deletion directly in the app is coming in a future version. Until then, write to us. Deleting the app from your phone does not delete your account, and deleting your account does not cancel a subscription: cancel it in your App Store or Google Play settings.

10. Security

• Data sent between the app and our servers is encrypted in transit (HTTPS).
• Your photos are kept in a private storage bucket that is not publicly accessible, and the links used to upload them expire after a few minutes.
• Our providers encrypt the data they store.
• Our servers require your account to be authenticated, each account can access only its own data, and access on our side is limited to what is needed.

No method is completely secure. If a confidentiality incident presents a risk of serious injury, we will notify you and the authorities as required by law.

11. Changes to this policy

We may update this policy when the app or the law changes. We will post the new version on this page with its effective date and, if the changes are significant, tell you in the app or by another appropriate means before they apply.

12. Contact

For any question about this policy or your personal information:

• Email: support@bysepia.com
• Address: Québec, Canada

Effective date: September 27, 2026.