Your data
Privacy & Cookies
What we collect, how browser storage is used, and what we don't do with it.
Draft, prototype-stage notice. This describes what the app actually collects and does today. It has not been reviewed by an attorney and is not final legal language — it will be revised before any public launch, including a companion Terms of Service and jurisdiction-specific notices (see CCPA/CPRA, Washington My Health My Data Act, and similar as they apply).
What we collect
- Account information: email address, password (stored hashed by our authentication provider, Supabase — we never see or store it in plain text), first name, and — optionally, if you add them in Settings — last name and state.
- Age confirmation: a yes/no confirmation that you're 18 or older. We don't collect your birth date.
- Tracked health data: doses, weight, symptoms, and (if you turn them on) nutrition and hydration entries you choose to log, plus any questions you save for your provider. This is stored in our database (Supabase), tied to your account, and protected by row-level security so only you can read or write it.
Cookies and browser storage
Strictly necessary authentication cookies: Supabase authentication uses first-party cookies to keep you signed in, refresh and verify your session, and prevent access to protected pages without a valid account session. They are not used for advertising or cross-site tracking. Because these cookies are necessary for the login service you request, the app does not present them as an optional setting; you can end the session by signing out.
Health entry storage: the tracked entries described above are saved to our database (Supabase), not your browser's local storage — they sync across any device you sign into. Settings has a "Delete all my data" option that removes them.
Basic page-view counts: the app records the path viewed and the time of the view in its own Supabase table. The record does not contain a cookie ID, user or session ID, IP address, or user-agent field. Infrastructure providers may still process ordinary connection information as needed to deliver and secure their services.
Abuse prevention: login, account-email, feedback, and page-view requests are rate-limited. The server converts an IP address—and, for some actions, an email address—into a one-way keyed hash used only to count recent attempts. Raw IP addresses are not stored in the application database, and these temporary counters are removed after 24 hours.
We do not currently use advertising cookies, cross-site tracking cookies, or third-party analytics cookies. If optional tracking technology is introduced later, this notice and any legally required consent or opt-out controls must be updated before that technology is enabled.
Why we collect it
To operate your account (login, password reset, showing your name in the app) and to provide the tracking and pre-visit report features you use directly. We follow a minimum-necessary-data principle — see AGENTS.md in the project repository — and don't collect fields we don't have an active use for (for example, we deliberately don't ask for your city or full birth date).
Who we share it with
Nobody, by default. We use a small number of infrastructure providers to run the app: Supabase (authentication and database hosting) and Resend (sending account emails like confirmation and password-reset links). They process data only as needed to provide those services. We don't sell your data or use third-party advertising/analytics trackers on any page that shows health data.
Your rights
Self-serve account deletion and data export are planned but not built yet. Until then, you can reach us using the contact info below to request deletion or a copy of your data.
Retention
We keep account information and tracked entries for as long as your account exists. Tracked entries are under your direct control — Settings has a "Delete all my data" option.
Contact
This app doesn't have a public domain or support address yet — a real contact method will be published here before any public launch.