Legal

Privacy Policy

Effective 4 August 2026 · HypoMe (“we”, “our”, “us”)

1. Information We Collect

We collect the minimum data required to operate the service. We do not collect data for advertising, tracking, or profiling purposes.

Account data: Email address and/or Apple ID (name, anonymised Apple identifier) provided at sign-up via Apple Sign-In or email/password registration.
Experiment and entry data: Experiment titles, interventions, outcome values, adherence flags, free-text notes, and confound tags you log. When you use an AI feature (see below), the experiment metadata and entries relevant to that feature are sent to our AI provider to generate a response.
Objective-metric CSV import (optional): In the web app, you can choose a CSV file from an instrument or service to import objective history. The file is parsed locally in your browser. The raw CSV file, its filename, column headers, and unused cells are not uploaded to our servers or retained by HypoMe. Only the objective date, numeric value, unit, and source you review and confirm are sent to our servers and stored as account-linked experiment entries. Deleting your account permanently deletes those imported entries with your other experiment data. If you grant AI data-sharing permission and invoke an AI feature for an experiment containing imported entries, the confirmed objective values may be included in that request to Anthropic; they are not sent to Anthropic otherwise.
AI-feature usage: HypoMe includes optional AI features — the AI Experiment Designer, AI Results Interpreter, AI next-experiment suggestions, AI confound insights, and AI voice check-in parsing — powered by Anthropic’s Claude API. Before we send personal experiment or check-in details to Anthropic for the first time, HypoMe asks for explicit AI data-sharing permission. When you use one of these features after granting permission, we send only the details needed for that request, which may include experiment titles, interventions, outcome definitions, daily outcome values, adherence flags, notes, confound tags, voice transcripts, and numeric Apple Health, Oura, or glucose values that are already part of the experiment entries. We do not send your email, name, Apple ID, payment details, crash reports, or product-usage telemetry to Anthropic. You can revoke AI data-sharing permission at any time in Settings; revoking it prevents new AI requests until you grant permission again. We also store a per-request log entry containing the model name, token counts, request duration, error type, and a one-way hash of your internal user ID (or, for requests made without an account, a one-way hash of the install identifier described below) for cost auditing and abuse prevention. Raw prompts and raw responses are not persisted on our servers after the request completes. AI requests are rate-limited (free accounts: 3 AI designs and 3 next-experiment suggestions per month; premium accounts: hourly fair-use ceilings) and can be globally disabled or restricted per-user via an operator kill switch.
Apple Health data (optional): If you choose an outcome backed by Apple Health (Sleep Duration, Daily Steps, Heart Rate Variability, Active Calories, or Blood Glucose) and grant HypoMe the corresponding per-metric read permission on your device, HypoMe reads the relevant values from Apple Health on-device to populate your baseline and daily check-in entries. Your Apple Health data is never sent to our servers or to Anthropic as a separate health-data export — only the resulting numeric outcome values for your experiment days are stored with your entries, the same as if you had logged them manually. If you grant AI data-sharing permission and invoke an AI feature for an experiment that includes those entries, those numeric outcome values may be included in the prompt sent to Anthropic because they are part of the experiment data being analysed. For blood glucose, individual readings (for example from a connected glucose monitor) are read and processed entirely on your device — only the day’s mean glucose value is stored with your entry, and time-in-range statistics shown in Results are computed on-device and never uploaded. You can revoke Apple Health access at any time in the iOS Settings app.
Oura data (optional): If you connect your Oura account from Settings, we store the authorisation tokens needed to access the Oura API on your behalf, and our servers retrieve and store a small daily summary from your Oura account (sleep duration, heart rate variability, readiness score, steps, active calories, and skin-temperature deviation) to populate Oura-backed outcomes. Cached daily summaries are kept for a rolling one-year window while your account exists. Disconnecting Oura in Settings revokes our access at Oura and deletes the stored tokens and every cached daily summary; deleting your account does the same. Your Oura data is never sold or shared with third parties, and is not sent to Anthropic as a separate payload — only the numeric outcome values for your experiment days appear in your entries.
Voice check-in (optional): If you use voice check-in, HypoMe uses your microphone and the device or browser speech-recognition system to transcribe your speech. No audio recording is stored by HypoMe. The resulting transcript is sent to our server and then to Anthropic’s Claude API only after you grant AI data-sharing permission, so the AI parser can turn it into draft check-in values, adherence, and notes for you to review. Only the values and notes you choose to submit are saved as your check-in. You can revoke microphone and speech-recognition access in your device or browser settings, and you can revoke AI data-sharing permission in HypoMe Settings.
Device and notification data: Push-notification token (to deliver reminders you schedule) and device timezone (to compute experiment schedules). Aside from the random install-scoped identifiers described under “Using HypoMe without an account” below and the crash-reporting installation identifier described under “Crash and diagnostic data”, we do not collect device identifiers, and we never collect hardware serial numbers, advertising identifiers, or location data.
Subscription and billing data: Subscription tier (free or premium), Apple or Stripe transaction and subscription identifiers, and billing state (e.g. active, expired, in billing grace period) stored on our servers to enforce entitlement access. Payment processing is handled entirely by Apple (for subscriptions purchased on iOS) or Stripe (for subscriptions purchased on the web); we never receive or store your payment-card details.
Crash and diagnostic data: If the app encounters an error, our crash-reporting service (Sentry) may collect device type, operating-system version, app version, and a stack trace of the error. The crash-reporting SDK also assigns a random installation identifier to your app install; it is not derived from your identity or hardware. This data does not include your experiment content or account credentials. You may opt out of crash reporting in your device’s system privacy settings.
Usage events: We collect lightweight product-usage events (e.g. “experiment created”, “check-in completed”) to improve the service. Raw telemetry event files stored in our AWS account contain the event name, timestamp, app environment, and optional non-content properties. Separate daily aggregate records store an internal user identifier solely to calculate daily active users; that identifier does not include your email or name and is removed from those aggregates if you delete your account. We do not include your experiment content or account credentials in telemetry, and we do not share these events with third parties. If you use HypoMe without an account, usage events are collected differently and only with the consent described under “Using HypoMe without an account” below.
Anonymous community contributions (opt-in): If you enable “Anonymous Sharing” in Settings, we collect aggregate statistical results from your completed experiments — such as mean values, percent change, effect size, adherence rate, experiment category, and outcome type. These contributions contain no user identifier, experiment identifier, intervention text, hypothesis text, or raw daily data. They are stored separately from your account and cannot be linked back to you. You can revoke previously shared contributions at any time from Settings.
Internal account annotations: Our team may attach short internal labels (for example, “family” or “Apple reviewer”) and free-text notes to your account record for support and operational purposes — for example, identifying review or test accounts and recording context relevant to support. These annotations are visible only to authorised staff, are stored alongside your other account data, are never shared with third parties, and are deleted when you delete your account.

Using HypoMe without an account (guest mode)

You can use HypoMe’s core experiment features without creating an account. Everything in this subsection applies only until (and unless) you sign up; the rest of this section describes data we collect once you have an account.

Your experiment data stays on your device: Experiments, check-in entries, and results you create without an account are stored only on your device, encrypted at rest with a key held in the device’s keychain. They are not transmitted to our servers unless and until you create an account and import them. Deleting the app deletes them.
Free AI design (one per device): If you use the AI Experiment Designer without an account, the app creates a random install identifier and sends it only with these AI requests so we can enforce fair-use limits. Our servers store a truncated one-way hash of that identifier in daily counters that expire about 48 hours later; the goal text you type is sent to Anthropic to generate the design and is not stored on our servers. A structured request log entry (containing the hashed identifier, token counts, and timing — never your prompt or the response) is retained for up to 1 year for cost auditing and abuse prevention. No per-user usage record is created.
Apple DeviceCheck flag: To limit the free AI design to one per physical device, we ask Apple’s DeviceCheck service to set a single per-device flag. The flag is stored by Apple, not on our servers, contains no personal data, and is not cleared by deleting the app or an account (see Section 5).
Usage statistics (with your consent): Where your region requires opt-in consent, we ask before sending any usage events, and you can change your choice at any time in Settings. If enabled, the app creates a random telemetry identifier that accompanies a small allow-listed set of product events (never experiment content). The identifier is one-way hashed before storage; raw event files are deleted within 90 days; identifier-free daily aggregate counts (event name and count only) are retained indefinitely.
These identifiers cannot be linked to you: The install and telemetry identifiers are random values, not derived from your hardware or identity. They are never joined to an account on either the device or the server, and they are deleted from your device when you sign up. The sign-up import sends no device or install identifiers, so experiments you import cannot be traced back to your guest activity.
Your consent choice carries over: If you decided about usage statistics while using the app without an account, that decision (your choice, your country at the time, and when you decided) is recorded into your account’s consent audit record at sign-up, as described in Section 2. The telemetry identifier itself does not carry over.

2. Cookies and Similar Technologies

Our web surfaces (the marketing site and the authenticated web app, both served from hypome.com) use a small number of cookies, local-storage keys, and similar browser-storage mechanisms. We do not use cookies for advertising, cross-site tracking, or behavioural profiling. Cookies fall into two categories:

2.1 Strictly Necessary

Required for the service to function. These are always active and do not require your consent. They store no behavioural or marketing information.

Authentication session (web app): AWS Cognito issues an opaque session token that proves you are signed in. Stored in an HttpOnly cookie scoped to hypome.com and cleared on sign-out.
Language preference (language-storage, browser localStorage): the locale you picked in Settings, so the app loads in the right language on next visit.
Appearance preference (appearance-storage, browser localStorage): your light / dark / system theme choice.
Cookie consent record (cookie-consent-storage, browser localStorage): the choice you made on the consent banner, so we don’t ask you again on every visit.
CloudFront edge cache cookies: short-lived cookies our CDN sets to route requests and improve page-load latency.

2.2 Analytics (Consent Required in EU / UK / Canada / Brazil / Switzerland)

Anonymous diagnostic and performance data. Off by default for visitors in jurisdictions where cookie law requires explicit opt-in (EU/EEA, United Kingdom, Canada, Brazil, Switzerland), and you can turn them off from Settings → Cookie Preferences at any time.

Sentry crash reports: device type, browser version, app version, stack trace, and an internal user identifier (never your email or name). No experiment content or credentials are sent. Retained up to 90 days.
CloudWatch RUM (Real User Monitoring): anonymised performance metrics (LCP, CLS, INP), 10% session sample. Cookie-free by construction; uses an AWS unauthenticated identity pool that is not linked to your account.

We do not run any marketing, advertising, or personalisation cookies. If that changes, we will add a new tier here and re-prompt for consent.

How to change your mind: open the consent banner via Settings → Cookie Preferences (signed in) or the Cookie Preferences link in the footer (signed out). You can also reset everything by clearing your browser’s site data for hypome.com.

We keep an append-only audit record of consent changes (timestamp, the choice you made, your country at the time, and whether the change came from the banner, Settings, or a sign-in reconcile) for as long as your account exists. This satisfies our obligation under GDPR Article 7(1) to demonstrate that consent was given.

3. How We Use Your Information

Deliver and operate the HypoMe app and its experiment-tracking features.
Send push notifications for experiment reminders you configure and for experiment-phase transitions (e.g. baseline complete).
Verify and enforce subscription entitlements.
Diagnose crashes, errors, and performance issues to maintain app stability.
Enforce fair-use and anti-abuse limits on AI features, including the one-free-AI-design-per-device limit for use without an account.
Respond to account-deletion requests and support inquiries.

We do not use your data for advertising, user profiling, or sale to third parties.

4. Third-Party Services

The following third-party services process data on our behalf. Each service processes only the minimum data required for its function.

Amazon Web Services (Cognito): Manages user authentication and secure credential storage. AWS Privacy Policy.
Expo Push Notification Service: Routes push notifications from our servers to your device. Expo Privacy Policy.
Apple (App Store / StoreKit): Processes subscription purchases and renewals made on iOS. Apple provides us with signed transaction records (including transaction IDs and subscription state) to verify entitlements. We also use Apple’s DeviceCheck service to enforce the one-free-AI-design-per-device limit for use without an account: the app sends an Apple-issued device token to Apple, which stores a single per-device flag on our behalf; we never receive a persistent device identifier from this process. Apple Privacy Policy.
Stripe: Processes subscription purchases made on the web, including checkout and self-service billing management. Stripe collects your payment details directly — they never pass through our servers; we receive only customer and subscription identifiers and billing state to verify entitlements. Stripe Privacy Policy.
Oura: If you connect your Oura account, we retrieve your daily summary data from the Oura API using the access you grant, as described in Section 1. We interact with Oura only at your instruction; Oura’s own handling of the data in your Oura account is governed by the Oura Privacy Policy.
Anthropic (Claude API): Powers HypoMe’s AI features (Experiment Designer, Results Interpreter, Next-Experiment Suggestions, Confound Insights, and voice check-in parsing). When you grant AI data-sharing permission and invoke an AI feature, the relevant experiment metadata, entries, and voice transcript text for that request are sent to Anthropic for model inference. We do not send your email, name, Apple ID, payment details, crash reports, or product-usage telemetry to Anthropic. Anthropic’s handling of this data is governed by their own terms at anthropic.com/legal.
Sentry: Collects crash reports and diagnostic data to help us identify and fix errors. Sentry receives an internal user identifier (not your email or name) alongside crash data so we can correlate reports during support. Sentry does not receive your experiment content or account credentials. Sentry Privacy Policy.

We do not share your data with any other third parties. Data processed by the services listed above is subject to their respective privacy policies, linked above.

5. Data Retention

Your account data and experiment data are retained for as long as your account exists. Deleting your account from Settings permanently removes your Cognito credentials and all associated experiment, entry, subscription, results, and connected-integration data (including stored Oura tokens and cached Oura daily summaries) from our systems. If you have an active web subscription, account deletion also cancels it at Stripe, and any Oura access token is revoked at Oura before removal.

Exceptions after deletion:

A minimal deletion-safety marker containing only your internal user ID, deletion state and timestamp, and expiry timestamp is assigned an expiry 24 hours after successful account deletion and is removed asynchronously by AWS after that point. It exists only to stop a delayed in-flight request from recreating data after deletion. Imported measurements, their provenance, and all other experiment data are deleted immediately with the account.
A separate key-only deletion-safety marker containing your internal user ID and the deleted experiment’s internal ID remains after you delete an objective-import experiment. It contains no measurements, provenance, timestamps, or CSV data and exists only to prevent a delayed request from recreating the experiment. It is deleted immediately if you delete your account.
Server-side request logs (which may contain your anonymised user ID) are retained for up to 30 days in accordance with our cloud provider’s default log-retention policy, after which they are automatically purged. Structured AI request log entries are an exception: they contain a one-way hash of your user ID (or, for AI requests made without an account, of the install identifier), token counts, and timing — never prompt or response content — and are retained for up to 1 year for cost auditing and abuse prevention.
Raw usage telemetry files already written before 13 April 2026 may include an internal user identifier and can remain in our storage for up to 90 days before automatic deletion. Daily telemetry aggregate records persist after account deletion, but the deleted account’s internal identifier is removed from those aggregates during the deletion process.
Apple retains its own record of your App Store subscription and transaction history independently of us.
Stripe retains its own records of your payment and subscription history independently of us, as required for financial compliance.
Oura retains the data in your Oura account independently of us — disconnecting Oura or deleting your HypoMe account revokes our access and deletes our copies, but does not affect your Oura account.
Crash reports already transmitted to Sentry prior to deletion are retained for up to 90 days.
AI request metadata (model name, token counts, request duration, error type, hashed user ID) is retained in our internal cost-audit store for up to 60 days from the request. Raw prompts and raw responses are not persisted on our servers after the request completes.
The per-device Apple DeviceCheck flag that records whether a device has used its free AI design is stored by Apple against the device, identifies no person, and is not cleared by deleting the app or your account — it is an anti-abuse latch, not personal data we hold.
Server-side data from use without an account (hashed install-identifier counters and hashed telemetry events) is not covered by account deletion, because it was never linked to your account — no join between the two exists on either side. It expires on its own schedule instead: daily counters within about 48 hours, raw telemetry event files within 90 days, and structured AI request logs within 1 year. Experiment data on your device from use without an account is removed when it is imported into an account or when you delete the app.

6. Data Security

All data transmitted between your device and our servers, and between our servers and the third-party services listed above (including Anthropic’s Claude API), is encrypted in transit using TLS. Authentication tokens are stored on your device using the operating system’s encrypted keychain (Secure Enclave on iOS). Server-side data is stored in encrypted-at-rest databases hosted on Amazon Web Services within the US–West–2 (Oregon) region.

7. Your Rights

Access: Contact us at support@hypome.com to request a copy of the data we hold about you. We will respond within 30 days.
Portability: All users can export their experiment data in CSV, JSON, or PDF format directly from the app.
Deletion: Use “Delete Account” in Settings at any time. All associated data will be permanently and irreversibly deleted, subject to the exceptions listed in Section 5.
Correction: Contact us to correct inaccurate account information.

8. GDPR (European Users)

Our legal basis for processing is:

Contractual necessity (Art. 6(1)(b) GDPR) — to provide the service you signed up for.
Legitimate interest (Art. 6(1)(f) GDPR) — to maintain app stability, diagnose errors, and prevent abuse.

You have the right to access, rectify, erase, restrict, port, or object to processing of your personal data. To exercise these rights, contact support@hypome.com. You may also lodge a complaint with your local data-protection authority.

9. CCPA (California Residents)

We do not sell or share your personal information for cross-context behavioural advertising.

You have the right to know what personal information we collect, to request deletion, and to non-discrimination for exercising your rights. Contact support@hypome.com to make a request.

10. Children’s Privacy

HypoMe is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child under 13 has provided us with personal information, please contact us immediately and we will delete the data.

11. Changes to This Policy

We may update this policy when our practices change. We will note the new effective date at the top of this page. If a change materially affects how we handle your data, we will notify you via in-app notice or email before the change takes effect.

12. Contact

Questions or concerns? Email us at support@hypome.com.