Privacy Policy

Overview

This policy covers the decoderHealth mobile app, its account and decoderPro services, and decoderhealth.com. “We,” “us,” and “our” refer to the team operating decoderHealth. You can reach us at privacy@decoderhealth.com.

Core tracking runs on your device. Connected health records, fasting sessions, Check-Ins, and Buddy suggestions are processed locally.
Accounts add online processing. Signing in shares your account profile and unit preferences with our backend. An active decoderPro account also syncs visible chat history.
AI chat uses selected context. Redacted messages and requested health summaries are sent through our gateway to an AI provider. Cloud history stores the original visible conversation, separately from that redaction.
No advertising. We do not sell personal information or use health data for advertising.

Health data & permissions

With your permission, decoderHealth reads supported records from Health Connect on Android or Apple Health on iOS. These may include weight, body fat, lean body mass, steps, distance, workouts, energy burned, sleep, nutrition, water, blood glucose, and menstruation flow. Availability depends on your platform and the permissions you grant.

The app keeps a local copy to display charts and summaries, calculate values such as BMI, BMR, TDEE, and energy balance, and generate local Buddy suggestions. Supported manual entries can be written back to your platform health store when you grant write access. Fasting and Check-Ins remain in decoderHealth.

You can revoke read, write, background, or history permissions in your platform settings. Revoking access stops future access under that permission; it does not automatically erase records already copied to the app or written to your health store.

Android background refresh, activity recognition, and startup permissions support health syncing and scheduled reminders. Notification permission supports local Check-In reminders. Internet access supports accounts, purchases, profile sharing, chat, and external content.

Data on your device

The app's private storage holds your connected health records, profile, display preferences, fasting sessions, Check-Ins and notes, Buddy state, reminder schedules, and visible chat conversations. Charts and local tracking do not require an account.

Health sync diagnostics are kept locally and exclude measurement values, record identifiers, payloads, and stack traces. Data and diagnostic exports leave your device only when you choose to save or share them. An exported file may contain sensitive information; the recipient and storage location you choose determine who can access it.

Your device or operating system may retain backups or exported copies under its own settings. Uninstalling the app does not remove files you exported or records held by Health Connect or Apple Health.

Account & profile sharing

Sign-in is provided through Supabase using email and password, Google, or Apple where supported. Account information includes your account identifier, email, authentication information, provider-supplied display name when available, and account timestamps. We do not receive your Google or Apple password.

When you sign in and your local profile is associated with that account, the app shares profile metadata with our backend. This includes date of birth, height, sex used for BMR calculations, time zone, goal type and target weight, conditions you entered, and unit preferences. Profile changes can be shared again while signed in. This is separate from sending context to an AI model.

These fields can be sensitive health information. They support your account's profile and preferences. Your connected health record database, fasting history, and Check-In notes are not uploaded as part of profile sharing. You can use local tracking without signing in; signing out stops account syncing but does not delete information already stored online.

Subscriptions

Google Play or the Apple App Store handles decoderPro payments. RevenueCat manages purchase validation and subscription entitlements. We do not receive your full payment card details.

RevenueCat processes app user or account identifiers, transaction and purchase information, and subscription status. Our backend records plan information, billing periods, renewals, cancellations, entitlement changes, and AI turn usage to provide paid access and enforce the allowance for your plan.

AI chat & cloud history

decoderPro chat requires a signed-in account with paid access. Requests go through our authenticated gateway hosted on Supabase, then to Router.com and the underlying model provider to generate a reply.

Context sent to the model

The app sends a bounded selection of recent messages and relevant earlier context from the current conversation. When the model requests health information, your device supplies compact summaries for supported metrics and time windows, including requested calculated values. The app does not automatically attach your account profile, Check-In notes, raw health database, source record identifiers, or device identifiers to model context. Information you type yourself can still appear in a message.

Before user-authored messages go to the model, an on-device filter removes common identifier patterns, including email addresses, phone numbers, URLs, and certain names, addresses, and identification numbers. The app indicates when it redacts text. This filter cannot detect every personal detail or make your messages anonymous.

Visible conversation history

For an active paid account, chat titles, message text, roles, identifiers, and timestamps are synced to our backend so your conversation history is available across signed-in devices. This history includes the original visible messages, before model-request redaction, and assistant replies. Personal information or health details you type may therefore be stored in cloud history even if the model request was redacted.

Gateway records and provider processing

Our gateway stores account, session, and message identifiers, model details, token and turn usage, request and response payloads, and a random installation identifier and its fingerprint for diagnostics and abuse prevention. Payloads may contain redacted chat text and selected health summaries. The installation identifier is generated by the app and is not a hardware or advertising identifier.

The gateway requests a 24-hour prompt cache using an opaque session key. This cache setting is not a guarantee that providers delete all records after 24 hours. Router.com and its model providers apply their own processing and retention policies. We use these services to generate your requested response; we do not sell your conversations.

Recipe replies may display images from Unsplash. Loading an image connects your device to Unsplash's image service, which receives your IP address and request information. The gateway's image lookup uses a recipe search term. Links to sources or photographer profiles open third-party services under their own privacy policies.

Website & support

The current website does not load an advertising or third-party analytics tracker. The mobile app does not include a third-party advertising, analytics, or crash-reporting SDK.

Contact and app access forms collect the name, email, message, and other fields you submit so we can respond. Newsletter forms collect your email to send requested updates. When delivery is configured, submissions go to our form delivery provider, such as Formspree; otherwise they may be recorded in server logs. Avoid submitting health records or other sensitive details unless needed for your request.

Support article feedback stores aggregate helpful or unhelpful counts. Browser local storage remembers your feedback choices. Hosting and form services may process IP addresses, request information, and logs to deliver the website and limit abuse. Fonts are served through the site's font setup; any external font request exposes connection information to that provider.

Retention & deletion

Local records: remain until you delete them through available app controls or remove the app's local storage. Health store records, device backups, and exports must be managed separately.
Cloud conversations: deleting a synced session removes its synced messages and replaces its title with a deletion marker once the deletion reaches the server. A session identifier and deletion timestamp remain to prevent other devices restoring it. Offline deletions need a successful later sync.
Gateway diagnostics: deleting a visible chat does not delete the separate gateway request and response logs. These account-linked records currently remain until account deletion; no shorter automatic deletion period is implemented.
Account deletion: use the Account screen to delete your authentication account and associated backend profile, cloud chats, subscription records, turn counts, and gateway logs. This does not delete the health data, fasts, Check-Ins, or chat history stored on your device.
Store subscriptions: account deletion and uninstalling do not cancel recurring billing. Cancel separately through your store's subscription controls. Stores and RevenueCat retain their own records under their policies; contact us for help with a provider deletion request.

Support correspondence, newsletter information, hosting logs, and provider backups may remain for the period needed to deliver the service, resolve requests, meet legal obligations, or complete the provider's backup cycle. Contact us to request deletion of information held outside the in-app account deletion flow.

Your choices & rights

You can manage health permissions, edit your local profile, sign out, delete conversations, export supported data, and delete your account. To request account access, correction, a copy, deletion, or restrictions on processing, email privacy@decoderhealth.com. We may need to verify your identity before handling account requests.

Depending on your location, you may have rights to portability, to object to processing, to withdraw consent, or to complain to a data protection authority. We respond according to the laws that apply to your request and do not discriminate for exercising applicable privacy rights. Withdrawal does not undo processing already performed.

Where data protection law requires a legal basis, account and subscription processing supports providing the services you request, security processing supports protecting those services, and optional processing relies on consent where required. Health permissions and choices control access to platform health data. Applicable additional protections for sensitive health information also apply.

Children

decoderHealth is not intended for children under 13, and onboarding requires an age of at least 13. A higher minimum age applies where required by local law. We do not knowingly collect account information from children under 13. Contact us if you believe a child has provided information so we can investigate and remove it where appropriate.

Changes & contact

We update this policy as our services and data practices change. The effective date identifies the current revision. We will provide additional notice or request consent for material changes where required by law.

For privacy questions or deletion requests, email privacy@decoderhealth.com. For general support, use our contact page. The Terms of Service describe the rules for using decoderHealth.

Questions? Contact the decoderHealth team.