Privacy Policy

Kaizora holds some of the most personal data there is: your body, your health, where you go, and what you spend. This page says plainly what it keeps, who can see it, and what you can do about it. It only describes what the app does today; anything not built yet is marked as coming.

Who We Are

Kaizora is run by [legal name of the business], [mailing address]. The person responsible for your personal information is [name and title of the privacy officer], at [privacy contact email].

What Kaizora Keeps

• Your account: your email address and password, through the sign-in service described below. Your password is stored only as a secure hash. If you turn on two-factor authentication, the authenticator apps you add, each with the name you give it.
• Your profile: your name, date of birth, and sex (which some calculations, like basal metabolic rate, need), and your language, region, time zone, and display preferences.
• What you log or import: measurements, blood pressure, foods and their nutrients, activities, sleep, lab results, location history, air readings, accounts and transactions, and the devices, places, habits, reference ranges, and favorites you set up.
• What your sources did: when each sync or import ran, how it went, and how many entries it logged. Neither the files nor their names are kept.
• Live connections: when you connect a service (Withings is coming first), the access tokens it gives Kaizora.
• Your plan: if you subscribe to Kaizora Plus, your subscription’s status, its current period, and the identifiers Stripe gives it. Never your card number.
• The AI Overview: whether and when you agreed to it, and the overviews written for you.

Who Can See It

• You, through the app. Every row of your data belongs to your account alone. The database itself enforces this with row-level security on every table: it refuses any request to read or change another person’s rows, whatever the app asks for.
• Not anyone else using Kaizora. There is no sharing between accounts.
• The people who run Kaizora, and the hosting provider. Your data isn’t end-to-end encrypted. It’s encrypted on its way to and from the app and stored encrypted by the hosting provider, but the people who operate Kaizora can reach it with administrative access, and so can the hosting provider’s staff for maintenance. We look at your data only to run the service, to fix a problem you’ve asked us to look at, or when the law requires it.

Files You Import

The app reads each file on your device, in your browser, and turns it into rows there. Only those rows are sent to Kaizora: the file itself is never uploaded or kept. Photos you import locations from never leave your device either; only each photo’s time, position, and camera (its make and model) are read and sent.

Live Connections

The tokens a connected service gives Kaizora are kept in a part of the database the app can’t read. Only the server functions that sync your data use them, and they write only to the account the connection belongs to. Disconnecting a service deletes its tokens, so it stops syncing; what it brought in stays until you delete it.

Location

The app records your location only when you log it yourself, import a location history, or turn on tracking. Tracking is a switch on each device, it’s off until you turn it on, and it records only while the app is open.

Kaizora Plus

Kaizora Plus isn’t for sale yet, so for now nothing is sent to Stripe or Anthropic. Once it is, this section and the two that follow apply.

Payments

Plus is paid through Stripe. When you subscribe, Kaizora gives Stripe your email address and your Kaizora account’s identifier, and you give Stripe your payment details on its own checkout page. Stripe receives none of your health data, nothing you log or import. Kaizora receives back only your subscription’s status, dates, and identifiers, never your card number. Stripe also uses payment details under its own privacy policy, for example to prevent fraud.

The AI Overview

The AI Overview on Home is written by Claude, a model made by Anthropic, PBC. Nothing is sent until you agree, in a dialog that says exactly what goes. Then, each time an overview is written (at most one every 12 hours), Kaizora sends Anthropic a summary of your last 60 days: the names and units of the metrics you track, their latest values and dates, their 30-day averages and how many days were outside your reference ranges, your habits’ targets and streaks, and the correlations Discover found. It’s numbers only: it never sends your name, email, notes, places, locations, devices, or anything else you typed, and it doesn’t tell Anthropic who you are. It leaves out reproductive health metrics, such as your menstrual cycle and period lengths.

Under its commercial terms, Anthropic doesn’t train its models on what Kaizora sends. It deletes what it receives and writes within 30 days, unless the law requires keeping it or it’s needed to enforce Anthropic’s usage policy: what its automated safety systems flag can be kept for up to two years.

Kaizora keeps the overviews written for you in your account, until you delete your account. You can withdraw your consent in Settings at any time: nothing more is sent, and Home stops showing your overviews.

What Kaizora Doesn’t Do

• No ads, and no advertising or tracking tools in the app.
• No analytics in the app: it doesn’t record how you use it.
• Your data is never sold, rented, or shared for advertising.

This Website

The website (not the app) uses Cloudflare Web Analytics, which counts page views without cookies and without tracking you across sites. If you choose light or dark mode here, that choice is kept in your browser only. The app keeps your sign-in session and a few settings, such as whether location tracking is on, in your browser’s storage; neither the site nor the app uses tracking cookies.

Where It’s Hosted

Your data is stored by Supabase, Inc., which runs Kaizora’s database, sign-in, and server functions, in [hosting region]. Your data may be stored and processed outside Canada, including in the United States, where Stripe and Anthropic also process what they receive, and where the local law may let authorities access it.

Service providers that handle personal information for Kaizora:

• Supabase — database, sign-in, and server functions.
• Cloudflare — this website’s analytics. [Add website and app hosting once chosen.]
• Withings — only if you connect your Withings account; Kaizora receives your Withings data from it.
• Stripe — payments for Kaizora Plus. It receives your email address and the payment details you enter, never your health data.
• Anthropic — only if you agree to the AI Overview: it receives the numbers-only summary described above.

Two services the app reaches directly from your device see your device’s IP address, as any website does:

• OpenStreetMap — the map images (tiles) the app’s maps show, loaded from the OpenStreetMap Foundation’s servers for the area on screen.
• Photon, run by komoot — searching for a place by name. It receives only the text you type and your device’s rough position, to rank nearby results first.

Kaizora also downloads public currency exchange rates from the US Treasury, and public air quality readings from the US EPA’s AirNow. Nothing about you is sent.

Keeping and Deleting Your Data

Your data stays until you delete it. Today you can delete any value yourself, or everything one source brought in (a service’s live connection, or every file of one kind), from its page in Data Sources. The devices a source named stay, for you to edit or delete. What you delete is gone from the database. Copies may remain in the hosting provider’s backups for up to [backup retention period] before they’re overwritten.

If Kaizora Plus lapses, nothing is deleted or hidden. Your AI overviews and your record of consent stay in your account until you delete it. Stripe keeps the records of your payments for as long as tax and accounting law requires, even after you delete your account. [Owner to confirm how long Kaizora keeps billing records itself.]

Export: in Settings, you can download everything you’ve logged and imported, with your accounts, devices, places, habits, reference ranges, and favorites, as a ZIP with a CSV file per table. It’s free.

Deleting your account: in Settings, you can delete your whole account, for free. It deletes every row of your data and your connections’ tokens, and cancels any Plus subscription so you’re not charged again.

Your Choices

• Export everything, for free, from Settings, at any time.
• Delete any value, or everything a source brought in, yourself, or your whole account from Settings.
• Withdraw your consent to the AI Overview in Settings, and nothing more is sent to Anthropic.
• Turn off location tracking on any device.
• Disconnect a live connection, which deletes its tokens; what it brought in stays until you delete it.

Your Rights in Canada

[Owner to confirm which laws apply, given where the business is and where its users live.] Under the federal Personal Information Protection and Electronic Documents Act (PIPEDA), you can ask to see the personal information Kaizora holds about you, have it corrected, and withdraw your consent, which means closing your account. You can complain to us and, if you’re not satisfied, to the Office of the Privacy Commissioner of Canada.

If you live in Quebec, the Act respecting the protection of personal information in the private sector (Law 25) also gives you the right to get your information in a structured, commonly used format, to know how it’s used, and to complain to the Commission d’accès à l’information. Kaizora’s person in charge of the protection of personal information is named above. If a privacy incident risks serious injury to you, we’ll tell you and the authorities that require it.

We treat everything about your health as sensitive information, and we use it only to provide Kaizora to you.

Changes

If this policy changes, the new version will be posted here with its date. If a change matters to how your data is used, the app will tell you before it applies.

Contact

[privacy contact email]