Privacy Policy

1. Who We Are

Alora is a mobile application designed for professional Pilates instructors in Australia and New Zealand. It is operated by Thomas O'Halloran (ABN to be confirmed), based in New South Wales, Australia.

For privacy enquiries, please contact us at the details provided at the end of this policy.

2. Information We Collect

Information you provide directly

• Name and email address (at account creation)
• Profile photo (optional)
• Class plans, exercise sequences, and teaching notes you create in the app
• Post-class reflections and self-assessment ratings
• Subscription and billing information (processed via third-party providers)

Information collected automatically

• Device type, operating system, and app version
• App usage data and feature interaction analytics
• Session recordings and in-app behaviour (via PostHog, for product improvement)
• Crash reports and performance data

Information from third parties

• If you sign in with Apple, we receive your name and email address as provided by Apple
• Subscription status information from RevenueCat and the Apple App Store

We do not collect sensitive information as defined under the Privacy Act (such as health records, biometric data, or financial account details) beyond what you voluntarily enter in your class reflections.

3. How We Use Your Information

We use your personal information only for the purposes for which it was collected, or directly related purposes. These include:

• Providing and operating the Alora app and its features
• Personalising your experience and generating coaching insights
• Processing subscriptions and managing your account
• Sending transactional emails (account confirmation, password reset) via Resend
• Improving the app through aggregated, de-identified analytics
• Responding to your support enquiries
• Complying with our legal obligations under Australian law

We will not use your personal information for direct marketing without your explicit consent, and you may opt out of any marketing communications at any time.

4. Disclosure of Your Information

We do not sell your personal information. We may share it with the following trusted third-party service providers, solely to operate the app:

• Supabase — database and authentication infrastructure (servers located in the United States)
• RevenueCat — subscription management (United States)
• PostHog — product analytics and session recording (United States)
• Resend — transactional email delivery (United States)
• Apple Inc. — App Store payments and Sign In with Apple

Where your information is disclosed to overseas recipients, we take reasonable steps to ensure those recipients handle your information in a manner consistent with the Australian Privacy Principles, in accordance with APP 8. By using Alora, you consent to this cross-border disclosure.

We may also disclose your information where required by law, court order, or Australian government authority.

5. Data Storage and Security

We take reasonable steps to protect your personal information from misuse, interference, loss, unauthorised access, modification, or disclosure. These steps include:

• Encrypted data transmission using HTTPS/TLS
• Row-level security policies on our database to ensure you can only access your own data
• API keys and secrets stored server-side only — never exposed in the app
• Access controls limiting which team members can access production data

While we take commercially reasonable precautions, no method of electronic storage or transmission is 100% secure. We encourage you to use a strong password and keep your login credentials private.

6. Data Retention

We retain your personal information for as long as your account is active, or as long as necessary to provide our services. If you delete your account, we will delete or de-identify your personal information within 30 days, except where we are required to retain it for legal or regulatory purposes.

7. Accessing and Correcting Your Information

You have the right to request access to the personal information we hold about you, and to request corrections if it is inaccurate, incomplete, or out of date. To make such a request, please contact us at the details below.

We will respond to access and correction requests within 30 days. In limited circumstances, we may decline a request where permitted by the Privacy Act, and will provide written reasons if we do so.

You may also update much of your personal information directly within the Alora app via your Profile settings.

8. Children's Privacy

Alora is intended for use by adult Pilates instructors (18 years and over). We do not knowingly collect personal information from children under 18. If you believe a child has provided us with personal information, please contact us and we will promptly delete it.

9. Privacy Complaints

If you believe we have breached your privacy or failed to comply with the Australian Privacy Principles, you may lodge a complaint with us in the first instance. We will acknowledge your complaint within 5 business days and endeavour to resolve it within 30 days.

If you are not satisfied with our response, you may escalate your complaint to the Office of the Australian Information Commissioner (OAIC):

• Website: oaic.gov.au
• Phone: 1300 363 992
• GPO Box 5218, Sydney NSW 2001

NSW residents may also contact the NSW Privacy Commissioner regarding matters covered by the Privacy and Personal Information Protection Act 1998 (NSW) at ipcnsw.gov.au.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. We will notify you of material changes via the app or by email. Continued use of Alora after changes take effect constitutes your acceptance of the updated policy. The current version will always be available at this URL.