Skip to content

App Store Privacy Disclosure Draft

Use this as a starting point in App Store Connect "App Privacy".

Data Types Collected

  • Health & Fitness (User-provided wellness data)
  • Check-in sliders and cycle-aware check-in fields
  • Protocol completion activity
  • Diagnostics / Product Interaction
  • Product events (e.g. onboarding completed, paywall shown, insight refresh tapped)
  • Identifiers (service-generated)
  • Anonymous auth user id (backend-generated, no username/password required)

Purpose

  • App functionality (daily protocol, AI insight/protocol generation)
  • Analytics (product reliability and conversion funnel health)
  • Security/fraud prevention (request validation, abuse/rate-limit controls)

Not Used

  • No ad personalization
  • No data broker sale
  • No third-party advertising SDK tracking

Third-Party Processors

  • RevenueCat (subscription status)
  • Supabase (anonymous auth where enabled, Edge Functions, storage/metrics for cloud features)
  • Anthropic (Claude) — only when the user enables Cloud AI in the app. The backend sends a text prompt to Anthropic’s API to generate short wellness copy or an optional protocol draft.

Anthropic — align with public policy (theonset.app/privacy.html)

Categories that may appear in prompts (high level): mode; biological-sex profile; optional check-in fields the user saved; optional Apple Health summaries if Health is enabled in Onset; optional cycle context for cycle-aware profiles; goals/concerns/prescriptions/allergies/labs entered in the AI generator; coarse on-device “day context” signals; minimal technical context (e.g. locale/date string).

Purpose: general wellness text generation only—not diagnosis or treatment.

Retention (public-facing summary): Supabase may hold limited logs and prompt/response material for security, rate limits, abuse prevention, debugging, and reliability; minimized retention; contact privacy@theonset.app for deletion help.