What we keep, what we don't.

HealthBrew is a nightly habit tracker and journal. We collect only what we need to run that ritual for you. We don't sell your data. We don't advertise to you. We don't share what you write in your journal with anyone, ever, outside the AI calls that produce the insights you ask for.

Washington-state residents and other consumers covered by health-data laws: see our Consumer Health Data Privacy Policy for the additional disclosures required by those statutes.

The minimum we collect is the maximum we'll ever have.

• An email address (for login and transactional email).
• An avatar nickname you pick.
• Your timezone, so the 6pm reminder lands at your local 6pm.
• What you write in your nightly Close-the-Day check-in, your journal entries, and any milestones you log.
• If you add child profiles: a nickname and age range. No legal name, weight, BMI, calories, exact sleep duration, or biometric data, ever.
• Subscription status from Apple (active / cancelled / expired). That's the entire field.
• Standard operational data: rotating IP address (rate-limiting and security), browser type, session timestamps.

• No legal name. Not at signup. Not at purchase. Not ever.
• No mailing address.
• No date of birth.
• No gender, race, or ethnicity.
• No Social Security or government ID number.
• No genetic data (we have no DNA upload feature).
• No continuous location data. Stated timezone only.
• Nothing from a child profile beyond the nightly five-item ritual and the “what made you smile today” line.

Most apps collect your legal name, address, and date of birth at signup because their payment processor demands it. We split those two jobs.

Apple is the merchant of record for every HealthBrew subscription, sold as an in-app purchase in the iPhone app. Your Apple ID, payment method, name, billing address, and tax jurisdiction stay with Apple — they handle card processing, sales tax, and refunds. That data lives with them, under Apple's privacy policy.

HealthBrew receives exactly one thing back: subscription status, tied to your account through a StoreKit token the app sets — not through your name, email, or card. Apple never sends us your identity. We could not produce your name or address if asked, because we never received them.

This is data minimization as architecture, not as a promise. Verifiable in our schema, which is public in git.

We've chosen to use Anthropic as our AI frontier model that we're building on because so far it appears to have the highest morals and ethics as a company, since it refused its AI from being used to do harm by the US Department of Defense.

• To run your nightly ritual and remember it for you.
• To send your daily 6pm reminder, if you have that turned on.
• To pass your check-ins and journal entries to Sophia (our AI companion) when you save an entry — so her replies reflect what you actually wrote. We send only your recent context, never your email or identifiers.
• Your chats with Sophia are not kept. We don't save the back-and-forth. From a chat, Sophia keeps only a short, paraphrased note of what might help you — never your exact words. If a message suggests you're in crisis, we keep that one message so a person can follow up safely.
• To compute the weekly insight summary.
• To bill you through Apple after your free 30-close baseline if you keep going.

We do not share your data with advertisers, data brokers, insurance companies, or employers. We do not use what you write for advertising, behavioral profiling, data sales, or anything else.

• Export — download a copy of everything you've written, anytime. (Dashboard → Exports.)
• Delete — close your account from your settings; we delete every row tied to your user_id within 30 days, across check-ins, journal, milestones, your paraphrased Sophia notes, and child profiles. (We don't store raw Sophia chats, so there's no transcript to delete.)
• Correct — edit any entry, anytime. (There's no “legal name correction” right to exercise here, because we don't hold a legal name. Billing-name corrections happen at Apple.)
• Change your email — from Settings. This is also how you change the key identity we hold for you.
• Opt out of the daily reminder — one toggle, no friction.

These rights apply globally. We don't make EU users jump through a different hoop than California users than Texas users. The right thing is the same everywhere.

We do not knowingly collect data directly from children under 18. Child profiles are parent-owned — the parent holds the email and password; the child has a nickname and an age range, nothing else. They use the app on a shared device with you watching. We never collect a child's legal name, weight, BMI, calories, or biometric data, ever.

If you believe we've accidentally collected data from a child under 18 outside the parent-owned model, write to [email protected] and we'll delete it.

We use one cookie: the Supabase session cookie that keeps you logged in. No analytics cookies, no ad cookies, no third-party tracking. That's it.

We'll email you before any material change. The previous version stays in our git history forever, public, so you can audit what changed and when.

Email [email protected] or just reply to any HealthBrew email. A human reads it.