Privacy Policy

This policy describes how the Mendtide iOS app (the “App”) collects, uses, and shares your data. We wrote this in plain language because clarity matters more here than legal flourish.

1. Who we are

Mendtide is operated by Justyn Ryan Gomez (“we,” “us,” or “our”). For privacy questions or requests, email support@mendtide.io.

2. What we collect

2.1 Apple Health data (on-device only)

When you grant Apple Health permission during onboarding, the App reads the following data types from HealthKit on your device:

• Sleep stages and sleep sessions (in-bed time, asleep time, REM/deep/light)
• Heart-rate variability (HRV)
• Resting heart rate (RHR)
• Respiratory rate
• Heart-rate samples
• Steps and walking/running distance
• Active energy burned (Apple Move ring)
• Exercise minutes and stand hours
• Cardio fitness (VO₂ Max)
• Workouts (activity type, duration, and intensity)
• Caffeine intake, when you log it in Apple Health

These raw samples stay on your device. We process them locally to compute your nightly totals, longest uninterrupted sleep stretch, 14-day baseline averages, consistency score, and your activity and recovery trends.

2.2 Aggregates we send to our AI service

To generate your morning briefing and to power the in-app chat coach, the App sends the following anonymized aggregates to Anthropic (our AI provider) through our backend hosted on Supabase:

• Last night's total sleep minutes, HRV mean, RHR, longest uninterrupted stretch
• Your 14-day baseline averages (total sleep, HRV, RHR) and consistency score
• Any context tags you logged (e.g., “alcohol,” “late workout,” “illness”)
• Your selected life context (general, new parent, perimenopausal, shift worker, etc.)
• Your sleep-need target and current sleep-debt minutes
• Recent activity rollups: today’s step count and your weekly average, active energy, exercise minutes, stand hours, your most recent cardio-fitness (VO₂ Max) reading, and your most recent workout (activity type, duration, intensity)
• Caffeine totals, including the amount logged within the pre-bedtime window
• The text of messages you send to the in-app coach, plus the last several turns of conversation history

We do not send your name, email address, Apple ID, or any directly identifying information to the AI service. We do send session-level start and end times (your bedtime and wake time for the night being analyzed) because the briefing needs them to render the recommendation timing — we do not send individual HealthKit sample timestamps. Anthropic processes the request to generate a response and returns it; per our agreement with Anthropic, your data is not used to train Anthropic's models.

2.3 Account data

When you sign in with Apple, Apple sends us a stable user identifier (an opaque string unique to you and the App) and may — only if you choose to share them — your first and last name and your email address. We use this data as follows:

• User identifier: stored locally on your device to identify your account.
• Name (first and last): if you tap “Share my name” during Sign in with Apple, we store the name locally on your device to personalize greetings inside the App. Your name is never sent to our backend, the AI service, or any third party.
• Email address: we do not collect or store your email address. Even if you tap “Share my email” during Sign in with Apple, the App discards the email value and does not transmit or persist it.

2.4 Crash and diagnostic data

We use Sentry to capture crashes and errors. Sentry receives:

• Crash stack traces and the iOS / app versions involved
• Device model and OS version
• A device-stable identifier (not linked to your name or email)

We do not send the contents of your chat messages, your HealthKit data, or your sleep numbers to Sentry. We use this data only to find and fix bugs.

2.5 What we do not collect

• We do not run advertising tracking. We never request the IDFA.
• We do not use third-party product analytics (no Mixpanel, Amplitude, PostHog, Google Analytics, or similar).
• We do not access your camera, microphone, contacts, location, photos, or files.
• We do not collect your email address, phone number, or any payment information. (Your first and last name may be stored on your device if you share them via Sign in with Apple — see §2.3 — but never leave your device.)

3. How we use your data

The data described above is used only to:

• Generate your morning sleep briefing and chat-coach replies
• Display your sleep trends and recovery dashboard inside the App
• Personalize the AI coach's responses to your sleep patterns and any context tags you log
• Diagnose and fix crashes

We do not use your data for advertising, profiling unrelated to the product, or selling to anyone.

4. Who we share data with

The only third parties that receive any of your data are:

• Apple — for Sign in with Apple, App Store subscription billing, and HealthKit (which stays on your device). Subject to Apple's Privacy Policy.
• Anthropic — the AI provider that generates your briefings and chat replies. Receives only the anonymized aggregates described in §2.2. Subject to Anthropic's Privacy Policy.
• Supabase — our backend hosting provider. Acts as a secure pass-through for the AI calls described above. Subject to Supabase's Privacy Policy.
• Sentry — crash and error reporting only. Subject to Sentry's Privacy Policy.
• Cloudflare — hosting for this legal site and the Mendtide marketing site. Receives standard web-server logs (IP address, browser, page visited) for sites you visit on mendtide.io. Subject to Cloudflare's Privacy Policy.

We will only disclose your data in response to a valid legal process (subpoena, court order) and only after we've reviewed it for scope and appropriateness.

5. How long we keep your data

• On your device: we keep your data until you delete your account in the App's Settings (or delete the App from your device). On-device data includes your sleep sessions, briefings, chat history, and account record.
• At Anthropic: per our agreement, chat content sent to Anthropic for generation is retained for a short operational window (typically 30 days) for abuse detection and is not used to train models.
• At Sentry: crash data is retained according to our Sentry plan's retention window (typically 30 to 90 days, depending on the plan tier).

6. Your rights and choices

• Delete your account. Open Settings inside the Mendtide App and tap “Delete account.” This permanently removes your account, sleep history, briefings, and chat data from your device.
• Sign out. Settings → “Sign out” clears your local data while keeping your Sign in with Apple credential available.
• Revoke Apple Health access. Open iOS Settings → Health → Data Access & Devices → Mendtide and toggle individual data types off. The App will still work but won't generate briefings.
• Revoke Sign in with Apple. Open iOS Settings → your Apple ID → Sign-In & Security → Sign in with Apple → Mendtide → “Stop using Apple ID.”
• Request data deletion or export. Email support@mendtide.io with your Sign in with Apple identifier (you can find this in the App at Settings → Account, though deleting the account in-app is the faster path).

7. California, EU, UK, and other regional rights

Depending on where you live, you may have additional rights under laws such as the California Consumer Privacy Act (CCPA), the EU General Data Protection Regulation (GDPR), or the UK Data Protection Act. Those rights typically include the right to access, correct, delete, or port your data. Email support@mendtide.io to exercise any of these rights and we will respond within the applicable statutory window.

For users in the EU, UK, and European Economic Area: transfers of your data to our US-based AI provider (Anthropic) and US-based backend (Supabase) are made under the EU-US Data Privacy Framework and its UK Extension, which the European Commission and UK government found to provide adequate protection for personal data transferred from the EU/UK to participating US organizations. The legal basis for our processing of your special-category health data is your explicit consent, granted when you first enable Apple Health access inside the App and confirmed by your continued use of the briefing and coach features.

We do not sell your personal information under any definition we are aware of.

8. Children

Mendtide is rated 4+ on the App Store but is designed for adult use. We do not knowingly collect data from children under 13. If you believe a child under 13 has used the App, please contact us at support@mendtide.io and we will delete any associated data.

9. Security

Data in transit between the App and our backend is encrypted (TLS 1.2+). On-device data is stored using iOS's standard SwiftData and Apple Health storage, which are encrypted at rest. Our Anthropic API key is held only on our backend, never embedded in the iOS app.

No system is perfectly secure. If you discover a vulnerability, email support@mendtide.io.

10. Changes to this policy

We will update this policy when our data practices change. The “Last updated” date at the top reflects the most recent revision. Substantive changes will be surfaced in the App on next launch.

11. Contact

Questions, requests, or concerns? Email support@mendtide.io.