Privacy Policy

1. What this policy covers

This policy describes what personal data Wellbeing Assistant ("the service") collects, why, and what happens to it. It covers the web application, the optional Telegram bot, and the background services that power them.

The service is a family health and wellbeing journal, so most of the data you enter is sensitive by nature — symptoms, medications, photos, notes about how you feel. We treat all of it as health data and apply the strictest handling we have to every entry.

2. Data we collect

We only collect what you give us or what is needed to run the service:

• Account data: your email address and password (handled by our authentication provider — we never see or store your password in plain text), or your basic Google profile (email and name) if you sign in with Google.
• Family profiles: the name, optional date of birth, optional sex, time zone and language of each profile you create — for yourself, a child, or another family member.
• Journal entries: actions and events (food, medications, exercise, sleep, stress, environment, contacts and similar) with your notes, and optional nutrition estimates for food entries.
• States: symptoms and their severity, digestion, mood, energy, sleep quality, and related notes.
• Photos you attach to entries, together with your captions. Photo GPS location is stored only if you explicitly turn on the photo-location setting; it is off by default.
• Medication details and intake logs, goals and check-ins.
• Device data needed for web push notifications: a push endpoint, its keys, and your browser's user-agent string.
• Optional integrations: your approximate city location (latitude/longitude) if you enable weather context; your Telegram user and chat ID if you link the Telegram bot; your Google account email and calendar events metadata if you connect Google Calendar.

3. How we use your data

Your data is used to run the service for you — nothing else. We do not sell it or use it for advertising. Specifically, we use it to:

• Keep your family's journal and show it back to you on the calendar, dashboard and summaries.
• Compute correlation hypotheses and periodic summaries from your own entries.
• Generate AI commentary on your entries (see the dedicated AI section below).
• Send you the reminders and notifications you have configured.
• Keep the service secure and fix errors, using privacy-restricted error and usage monitoring.

4. AI processing by third-party providers

Some features send parts of your journal to third-party AI providers. Text features (AI comments, summaries, food-note analysis) send the relevant entry text to large language models reached through OpenRouter, a US-based routing service that passes each request on to a model provider. Photo analysis sends the photo itself the same way. We do not name the individual models here — they change as we tune the service. What does not change is the list of data categories we send, set out below.

We minimise what is shared: requests contain only the content needed for the specific comment — never your name, email address or account identifiers. AI usage is metered and capped, and AI output is always labelled in the app as coming from an AI assistant.

Honest status note: we have not agreed data-retention limits or provider restrictions with these AI providers, and we have no data-processing agreement in place. Content sent for AI features may be kept by them. Our own cache of AI results is kept for up to 90 days and is not cleared by an account-deletion request, so some content can outlive the deletion by that period. Using third-party models is a deliberate choice for this service; if that is not acceptable to you, please do not use it. This section must be re-confirmed by the service owner before general availability.

• Sent for text features: the text of the entry or note being commented on, plus minimal context such as entry type and time of day.
• Sent for photo analysis (when enabled): the photo bytes and your caption.
• Sent for periodic insights: aggregated day or period summaries derived from your entries.

5. Where your data lives — our processors

We use a small set of infrastructure providers ("processors") to run the service. Your data is stored in the United States:

• Supabase (database, authentication, file storage; hosted on AWS in the US, region us-east-2) — stores all account, profile and journal data, including photos.
• Vercel (application hosting, US) — runs the web application.
• OpenRouter (AI request routing, US) — forwards AI requests to the model providers it works with, as described in the AI section.
• Sentry (error monitoring) — receives technical error reports with personal data collection disabled; session recording is off.
• PostHog (product analytics, EU-hosted) — receives anonymous-by-design usage events such as page paths; query strings and journal content are never sent.
• Open-Meteo (weather) — receives only latitude/longitude coordinates when you enable weather context; no account data is sent.
• Telegram (optional) — if you link the bot, your messages to it pass through Telegram's platform under Telegram's own terms.
• Google (optional) — sign-in with Google and the optional Google Calendar import, limited to the scopes you approve.

6. Photos and their retention

Photos are stored in a private storage bucket and are accessible only to your account. Location metadata from photos is discarded unless you have explicitly enabled the photo-location setting.

Photos you attach to entries are kept until you delete the entry, the photo, or your account. Uploads that never get attached to an entry (for example an abandoned upload) are automatically cleaned up about 72 hours later.

7. Children's data

You can create profiles for your children and record their wellbeing data. Child profiles are part of your account: they have no separate login, and you — the account holder — control all their data, including editing and deleting it.

Deleting your account deletes every profile in it, including all children's data and photos. The service is intended for use by adults; accounts must be created and managed by an adult.

8. Your rights and controls

You are in control of your data. Directly from the app's settings you can export everything we store about your account as a machine-readable JSON file, and you can request permanent deletion of the whole account.

Deletion has a 72-hour grace period during which you can cancel it; after that, your account, every profile, all journal data and all stored photos are permanently removed. We honour data requests within 30 days at the latest.

• Export: download a JSON copy of your data from Settings at any time.
• Erase: request full account deletion from Settings; it completes after a 72-hour cancellation window.
• Rectify: edit or delete any individual entry, photo, profile or setting directly in the app.
• Ask: contact us (below) for any other privacy request or question.

9. Security

All traffic is encrypted in transit (HTTPS). Every table holding health data is protected by database row-level security, so each account can only ever read its own rows. Administrative credentials are confined to server-side code, and uploads are validated by content type and size.

To be transparent about limits: data is not end-to-end encrypted — it is processed on our servers so that features like correlations and AI comments can work. We deliberately keep personal data out of logs and error reports.

10. Cookies

The service uses a minimal set of cookies:

• Authentication cookies that keep you signed in (set by our authentication provider).
• Preference cookies remembering your language and theme.
• Analytics cookies (PostHog), used only for the privacy-restricted usage analytics described above.

11. Changes to this policy

When this policy changes in a way that matters — new data categories, new processors, new AI providers — we will update this page and its "last updated" date, and flag significant changes in the app.