Privacy
policy

1. The short version

Llyr analyses your swimming using your phone's camera. The analysis runs on the phone itself. There is no Llyr account, no Llyr server, and no login to anything we operate — so the recordings and measurements Llyr produces stay in the app's private storage on your device, and you can erase all of them from inside the app.

2. Who we are

Llyr is produced by Llyr Labs. Contact: contact@llyrlabs.com.

3. What Llyr stores on your device

Everything below lives in the app's private storage, readable only by Llyr. None of it is stored by us, because we operate no storage.

Your profile and body data

• Profile details and profile photo
• Body dimensions used to scale the analysis
• App settings and preferences

Your swim sessions

• Session history: stroke, camera viewpoint, date, frames analysed, and counts of each fault detected
• Evidence stills — individual frames saved from your session to illustrate a detected fault
• The QR payload the app generates when you show a coach your read (section 5 sets out exactly what it carries)

Coaching and review records

• Notes you type against a clip while reviewing it
• If you coach: the athletes you have scanned, your teams, and the labels you give roster entries
• If you have joined a coach: the link to that coach, and the one-time codes used to confirm a QR exchange

An on-device diagnostics log

• A short, bounded record of app faults (for example, a still that could not be saved), kept so you can read it. It carries nothing about you or your swimming, and it is not sent anywhere.

No unlock credential. Llyr has no PIN and no biometric unlock. Older versions did; if yours still holds a PIN from one, it sits in Android's encrypted credential store, is never read, and is erased with everything else in section 8.

Working files

• Frames extracted from imported video, and the app's working copies of video or photos you select. These are scratch space and are cleared when you erase your data.

Video. Llyr analyses the camera feed as it arrives and does not save a recording of it. What persists from a session is a set of individual still frames — one per detected fault — written to session_photos/ and named for the session and the fault they illustrate.

If you import an existing video from your phone to analyse, that file stays where it already was; Llyr works from a temporary copy which is cleared when you erase your data.

What we checked Verified 2026-08-11: session_photo_store.dart writes .jpg stills and is the only image writer; no code path in lib/ writes a video file, records video, or references an .mp4 destination.

4. What leaves your device

Your video, your measurements, your profile and your session history are processed on your phone and are not uploaded to us. We operate no server, so there is nowhere for them to go and no way for us to retrieve them.

The exception is what you send. A Llyr QR code is data you deliberately hand to another phone; section 5 sets out exactly what one carries. A correction card (an image with your still on it) or a data export leaves only when you share it yourself, and goes only where you send it.

If you subscribe to Llyr Pro, Google processes the payment through the Play Store under your Google account; Llyr never receives your card details. So that a subscription stays bound to the phone it was bought on, Llyr creates a random identifier for this installation and gives it to the Play Store with the purchase. It is not your name, your Google account or your phone number, and it is sent nowhere else. Llyr learns only whether this phone's subscription is active, from the Play Store app on the phone; it has no server to keep a record of it. Your purchase history is held by Google under Google's privacy policy.

Llyr's movement analysis and QR scanning are built on Google ML Kit. It runs on your device, and Google's own terms state that the images and video it processes — and the measurements it produces from them — are not sent to Google.

ML Kit does send Google information about its own performance, and it is not anonymous. The first time Llyr analyses video, live or imported, ML Kit creates an identifier unique to this installation of Llyr (a Firebase installation ID) and registers it with Google. With it, ML Kit sends diagnostics about how detection ran and performed, together with basic facts about the device and the app (such as the phone model, Android version and Llyr's version), and it fetches its own configuration from Google. Google uses this to maintain and improve those components. The identifier is not your name, your Google account or your phone number, and uninstalling Llyr discards it. We do not receive any of it and cannot access it. It is governed by Google's privacy policy and Google's ML Kit terms. Before its first analysis, the app shows a one-time notice saying this.

What we measured This section is not an assumption. On 2026-08-12 a release build was watched from a clean network baseline for a four-minute session and transmitted 5,829 bytes.

5. Data about other people

If you use Llyr as a coach, scanning an athlete's QR code stores that athlete's information on your phone.

A current Llyr code carries no name. It contains an anonymous athlete identifier, a skill level, the period the summary covers, and per-stroke practice statistics — how many sessions, how many frames, and which faults came up most often. Nothing in it identifies the athlete by name or shows their face.

Codes generated by older versions of Llyr did carry a name, and this app still reads them. If you scan an older code, that name is stored on your phone too.

When a coach sends an acknowledgement back to an athlete, that code carries the coach's name and team.

What we checked Verified 2026-08-11 against qr_payload_codec.dart: the v3 wire format (LLYR3:) carries an athlete id, skill level, a window length in days, a nonce, and per-stroke fault statistics. The name was deliberately removed in v3 because it was photographable across a pool deck; the decoder structurally refuses to read a name from a v3 payload even if one is smuggled in. Legacy LLYR1: and LLYR2: codes still decode and do carry a name. LLYRC1: coach acknowledgements carry a coach name and team.

That information is theirs, not yours. If you hold data about other athletes:

• Only scan a code an athlete has knowingly shown you.
• Erasing your Llyr data erases theirs from your device too.
• If an athlete asks you to remove their data, do it — we have no way to do it for you, since none of it reaches us.

6. Children

Llyr is for ages 13 and over. It is not directed to children under 13, and Llyr Labs receives no personal information from anyone of any age.

That second clause is not a promise about our intentions — it is a consequence of how the app is built. There is no Llyr account, no Llyr server and no sign-in, so there is nothing for a child, or an adult, to send us. Everything Llyr records stays in the app’s private storage on the device, as described in section 3. The one thing that leaves the phone without being sent by you — ML Kit’s diagnostics and its installation identifier, section 4 — goes to Google, not to us.

Because we receive nothing, there is no Llyr-held record of a child to access, correct or delete, and no verifiable-parental-consent flow to operate. If you are a parent or guardian and want the data gone, it is on the phone: Me → Wipe → Delete erases it, and uninstalling the app removes it too. See section 8.

If a swimmer under 13 uses Llyr, a parent, guardian or coach should set it up and supervise it — not because of what Llyr sends, but because of what it is: a camera on a pool deck, and measurements that are a second opinion rather than coaching.

Filming other people, including other people’s children, is covered in section 5. That is the part of this app most likely to involve a child who never agreed to anything, and it is the filmer’s responsibility, not ours — we cannot check consent for footage we never receive.

7. Permissions

Llyr removes the microphone permission that some of its components would otherwise request. It never records audio.

8. Erasing your data

Me → Wipe → Delete erases everything listed in section 3 from your device: your profile, membership choice, body dimensions, settings, session history, evidence stills, clip notes, scanned athletes, teams, roster labels, your coach link, the diagnostics log, working files, and any unlock PIN an older version left behind. Me → Copy, just above it, saves a copy of your sessions and profile first if you want one.

This is immediate and permanent. There is no backup, ours or otherwise, and no recovery. If any part cannot be erased, Llyr tells you exactly which part rather than reporting success.

Uninstalling Llyr also removes all of it.

It erases this phone only. Llyr has no server, so there is nothing for us to delete and nothing for us to revoke. If you scanned yourself into a coach's roster, the copy on that coach's phone is theirs and stays there — erasing your own device does not reach it. Ask the coach to remove you from their roster as well.

9. Third-party components

Google ML Kit performs pose detection and QR scanning on your device. See section 4 for what it reports to Google.

Llyr integrates no advertising service, no crash-reporting service, and no third-party analytics.

What we checked Verified 2026-08-11 against the release build's class map: zero classes from Crashlytics, Sentry, Google Analytics or Measurement, Google Ads, or Facebook. The same check found 266 classes of Google's datatransport stack — including its upload backend — and 39 Firebase classes, all pulled in transitively by ML Kit. That is Google's own telemetry transport rather than a third-party analytics SDK, and it is why section 4 could not be answered by inspection alone: an upload backend is compiled into this build, so the traffic was measured instead.

10. Changes

Material changes will be posted here with an updated date. Because Llyr holds no contact details for you, this page is the only place a change can be announced.

11. Contact

contact@llyrlabs.com