Privacy Policy — رفيق صحتي (Health Companion)

Last updated: September 20, 2026

Where your data lives

Everything you log in the app (weight, meals, water, supplements, medications, sleep, vitals, fasting, habits, appointments and coach conversations) is stored locally on your device. A new user answers a few short questions that tailor the app, and those answers stay **on the device alone** until they sign in with Apple and explicitly consent to storing an encrypted copy with us — not a letter of them is uploaded before that. Our relay server (used for the optional AI features and the subscription) stores no health data: it keeps a random per-device identifier with the app version, platform, language and first/last seen dates, daily request counts, your subscription status, a daily-salted hash of the network address used for abuse limits (deleted after 30 days), and which owner messages you have read.

Account and sync

The app does not work without an account: someone who already has one signs in straight away; a new user answers the questions first and then signs in before entering the app. The account is what makes your data and subscription follow you to any phone, and what lets AI allowances be counted per person rather than per installation. Signing in happens at Apple only, so we never receive your password, and you may hide your address with Hide My Email.

We then take your explicit consent to store your data with us, encrypted — a consent whose date and text version we keep, and nothing is uploaded before it.

If your device holds data you logged before this update, we ask you about it right after you sign in: upload it to your account so you can get it back on any phone? If you say yes it is uploaded encrypted like the rest. If you say no it is deleted from this device, permanently, and the app starts empty — and that happens only after two separate warnings, with an offer to export a copy for yourself first.

One account is one profile: signing in on a new device downloads your saved copy if you have one.

What is uploaded: your profile and goals, weights, water, meals, saved foods, meal plan, workouts and their log, fasting, sleep, medications, supplements and their doses, vitals you enter yourself, appointments, habits and achievements.

What is never uploaded: your meal photos, your conversations with the AI coach, and anything sourced from Apple Health (Apple forbids storing it off your device) — that comes back on its own by syncing with Health on your new phone. "Never uploaded" here means never stored with us; when you yourself ask the AI coach, a summary of your numbers — some possibly from Health — is sent to the model for the reply only and is not stored, as explained under "AI coach".

And we cannot read what is uploaded. It is encrypted on your device before it is sent (AES‑256‑GCM), and its key stays with you alone in your Apple keychain, along with a recovery code. We store meaningless encrypted characters and do not hold the key, so we never see, analyse or share your data.

What we do store about the account itself (never its content): a stable identifier from Apple, your email (which may be a private relay address you choose), your name if you shared it, the account's creation and last-seen dates, how many devices are active on it with their time zones, models and OS versions, the number and size of your encrypted records, and a short fingerprint of your key (a hash that reveals nothing about the key and stops two keys mixing in one file). The device count and time zones are what we use to spot an account shared by several people, as stated in the Terms of Use — counters, never content.

Technical diagnostic lines. With its check-in the app uploads short lines about how it behaves on your phone: when it started and how long it took, whether its local database stalled, and whether the viewport drifted (a known iOS bug). These lines carry no personal data and nothing you logged — a time, an event type, internal numbers and a page name — and they are tied to your device's random identifier, not to you; the twenty most recent are kept per device. Their only purpose is that we see a fault and fix it before you have to report it.

Your copy on the device always stays. The cloud is a second copy, not a replacement, and turning sync off deletes nothing from your phone. At any time, from Settings, you can: turn sync off, clear your cloud data to start fresh, or permanently delete your account and all your data from our servers.

Apple Health

If you choose to connect Apple Health, the app reads (read-only) body measurements, vitals, activity and sleep to display and analyse them on your device. The app never writes to Health, and Health data is never used for advertising or marketing, sold, or shared with any party. You can disconnect at any time from the app or from iPhone Settings. Health-sourced data is never stored on our servers; when you yourself ask the AI coach, a summary of your numbers — some of which may come from Health — is sent to the model for the reply only and is not stored.

AI coach (optional)

AI features are optional and run on a third-party AI model through the app's own relay server (on Cloudflare). When used, your question (or voice recording or meal photo) and a summary of your health data are sent from your device to our relay, which forwards them immediately to the model provider to generate the reply and returns it to you. Our relay stores no question, reply, photo or recording content — only a random per-device identifier (no personal data) and daily request counts to enforce allowances. Processing at the model provider is subject to that provider's privacy policy. Unless you use these features, nothing leaves your device.

Subscription and payment

Purchases, renewals and refunds go through Apple; we never see your card details. We use RevenueCat to manage subscriptions: it receives the purchase receipt from Apple and a random identifier of your device only (no name, email or health data) to activate your plan, and our server reads the subscription status (active/expired) to raise AI quotas. AI features run only after your explicit in-app consent, which you can withdraw in Settings → Privacy.

Notifications, microphone and camera

Notifications are local; if you allow them, our server keeps your device's random push-notification token (it carries no personal data) to wake the app silently at coach review time; the review itself runs between your device and the server as usual and its content is never stored.

Offer and developer-message notifications are off by default and have their own switch in Settings → Notifications: allowing reminders is not consent to promotional pushes, nothing of the kind reaches you until you turn that switch on yourself, and you can turn it off at any time without affecting your reminders. With it off, developer messages still arrive in the in-app bell exactly as they are.

The microphone is used for voice dictation and the camera/photos for meal analysis: you can send up to three photos of the same dish, together with an optional note you write yourself for what the picture cannot show (the oil, the portion size, the ingredients). The clip, the photos and the note pass through our relay to the model provider for analysis only, and none of it is stored by us.

Dish pictures

Dishes the app already knows ship with their pictures inside the app itself and need no network. A dish with no shipped picture — a new one you add — has its picture fetched once, then saved on your device and reused offline from then on. And if you photograph a dish to get its nutrition and then add it to your list, your own photo becomes that dish's picture. This whole library lives on your device: it is never uploaded to the cloud and we never see it.

Apple Watch

The watch app exchanges your data with your iPhone only over the encrypted channel between your own devices.

Backup and deletion

A backup is a file you export yourself and keep wherever you like. If you enable the automatic backup, a copy is also written inside the app's own container on your device (included in your device backup to iCloud or your computer, which Apple encrypts). Deleting the app, or "Erase all data" in Settings, permanently removes all data on this device. If you turned sync on, your encrypted copy stays with us until you delete it yourself from Settings → "Delete my account and data".

Consumer health data (Washington MHMDA and similar laws)

What you log in the app — weight, meals, water, workouts, supplements, medications, fasting, sleep, vitals and your health profile — is consumer health data. Its only source is you (and Apple Health if you allow it). Its only purpose is to show it back to you, compute your scores, reminders and rewards, and answer the AI coach when you ask it. We never sell it or share it for advertising, and we keep none of it in readable form: what is stored with us is an encrypted copy whose key we do not hold. What you send to the coach (with your consent) passes through our server to the model provider for the reply only and is not stored. Your rights: access and export via Backup in Settings, full deletion via Delete all data on the device and via "Delete my account and data" in the cloud, and withdrawing the coach consent in Settings at any time. For any request or appeal, contact the address below; we respond within 30 days.

Children

The app is for ages 13 and over, as stated in the Terms of Use, and for anyone under 18 it runs with no diet and no weight goal. We do not collect data from children under 13, we show no advertising to anyone, and we sell no one's data to anyone.

Contact

Privacy questions: [email protected]