Privacy Policy

• We do not sell your data. Not identified, not de-identified, not aggregated, not to researchers, not to pharmaceutical companies, not to advertisers. There is no version of this product where your protocol becomes someone else's dataset.
• We do not use your data to train AI models, and neither does the AI provider we use.
• You can export everything and delete everything, at any time, without asking us.
• Your records are visible only to you. Access is enforced by the database itself, not only by our application code.

Only what the product needs to function:

• Account: your email address, and a display name and timezone if you provide them.
• Protocol and dose logs: the compounds you record, doses, schedules, when you logged or skipped a dose, and the injection site if you use the rotation feature.
• Bloodwork: marker values you enter or import. Where you upload a lab PDF, we extract values from it and always show you the result for review before anything is saved.
• Daily check-ins: weight, body fat, sleep, mood, energy, notes, and anything else you choose to record.
• Connected device data: if, and only if, you connect a device account such as WHOOP, Oura or Withings, or Apple Health in the iPhone app, we retrieve the specific measurements shown on the Health screen. We request the narrowest permissions that make the feature work and nothing beyond them.
• Basic technical logs: standard server and error logs, used to keep the service running and to diagnose faults.

We do not use advertising trackers, and we do not buy information about you from anyone else.

Food and body scan photos are sent to our AI provider for one-time analysis and are never stored. They are not written to our database, not kept on our servers, and not used to train any model. The only thing saved is the numbers you review and approve, and you can delete those at any time. Body photos are the most personal data this app could touch, which is exactly why we designed scanning so we never hold them.

In the iPhone app you can choose to connect Apple Health. We then read three things and nothing else: daily step counts, sleep duration and weight. Those readings are shown on your own Health screen alongside the values you enter by hand, and they are stored against your account like any other measurement you record.

We never write to Apple Health, never share Health data with anyone, and never use it for advertising or any purpose other than showing you your own trends. You can disconnect in the app at any time, and you can revoke the permission itself in the Health app under Sharing. Readings already synced stay in your history because they are your record; delete them if you would rather they did not.

Your records are stored in a database where every row is tied to your account, and the database refuses reads that do not belong to the signed-in user. That check sits below our application code, so a bug in the app is not enough on its own to expose one person's data to another.

Access tokens for connected devices are held in a table that the browser cannot read at all. They are used only by our servers to fetch your measurements.

A small number of people operating the service can access production systems in order to run and repair them. We look at individual records only where it is necessary to fix a fault or where you ask us to.

We use these companies to run the product. They process data on our instructions and are not permitted to use it for their own purposes:

• Supabase — database, authentication and file storage.
• Vercel — application hosting.
• Anthropic — the AI model behind Ask, the written insights and the photo scanners. Your questions, scan photos and the relevant facts from your own records are sent to generate a reply. This content is not used to train models, and is retained only briefly for abuse monitoring before deletion.
• Resend — transactional email such as password resets and reminders.
• WHOOP, Oura and Withings — only where you connect them, and only to retrieve your own measurements.

Some competitors in this category reserve the right to license or sell user data, including in aggregated or de-identified form. We deliberately do not.

• We will not sell, rent or license your data to anyone, in any form.
• We will not share your records with insurers, employers or advertisers.
• We will not use your data to train AI models.
• We will not use your health information to target advertising.

If this ever changed, it could only apply to data collected afterwards and only with your explicit, opt-in consent. We would tell you directly rather than by quietly editing this page.

• Export: download your protocol and records from the app at any time.
• Correct: every value you enter can be edited or removed.
• Disconnect a device: this stops any further sync immediately. Measurements already synced stay in your history, because they are your record. Delete them if you would rather they did not.
• Delete your account: this removes your records from the live database. Encrypted backups roll off on their normal cycle, within 30 days.

To exercise any of this, or if something is not working, contact us at privacy@getstack.app.

Your records are kept while your account is open, because the product is built on long-run trends and deleting history would defeat it. When you delete your account, the data goes. Technical logs are kept for a short period and then discarded.

Our providers operate infrastructure in several countries, so your data may be processed outside Australia. We only use providers that commit to appropriate safeguards for international transfers.

Data is encrypted in transit and at rest, access is scoped per user at the database level, and device tokens are never exposed to the browser. No service can promise perfect security, and we will not pretend otherwise. If a breach affects you, we will tell you and the relevant regulator as required by Australian law.

Stack is not intended for anyone under 18, and we do not knowingly collect information from children.

Stack is a tracking and reference tool. It does not provide medical advice, diagnosis or treatment, and using it does not create a clinician relationship. Reference ranges shown against your bloodwork are population defaults, not an assessment of you. Always consult a licensed clinician about anything you are taking.

If we change this policy we will update the date above, and we will notify you directly about anything that materially affects how your data is handled.

Questions, requests or complaints: privacy@getstack.app. If you are in Australia and are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner.