privacy policy.
The short version
- Your Apple Health data is read and scored on your own phone and watch. It is never stored on our servers.
- We never sell Health data, and we never share it with advertisers or use it for ads.
- If you chat with Kai, your message and a short summary of today's numbers go to our AI provider to write the reply. We ask before the first chat.
- If you allow Apple's tracking prompt, we measure which ad brought you to the app. If you don't, we don't.
Health data
With your permission, Cortisol IQ reads these from Apple Health: heart rate variability (HRV), heart rate, resting heart rate, breathing rate, sleep, sleeping wrist temperature, blood oxygen, AFib history and irregular-rhythm notifications, mindful minutes, steps, workouts, heart-rate recovery, exercise minutes, active energy, VO₂ max and walking/running distance. The score uses six of them (resting heart rate, heart rate while sitting, daytime and overnight HRV, sleep and overnight breathing rate); others tell it when not to trust a reading, or fill your day and workout screens. Cortisol IQ reads your data, and adds only workouts you choose to save.
Apart from the Kai summary described below, Health data never leaves your devices. You can remove access at any time in iPhone Settings → Health → Data Access & Devices → Cortisol IQ.
Setup answers
Details you enter during setup (such as age, sex, height, weight, sleep and exercise habits, and your goals) are kept locally on your phone and used to tailor the app. They are not sent to our servers.
Kai, the AI coach
Kai is optional and off until you agree on the consent screen. When you send Kai a message, we send that message, up to your last 12 messages, and a one-line summary of today (your estimated score, its band, how it compares with your usual and which signal is adding the most) to OpenAI, through our API proxy, AIProxy, to write the reply. Your name and raw readings stay on your phone. We don't keep chat logs on our servers. OpenAI may keep API requests for up to 30 days to check for abuse and does not use them to train its models. Don't share anything in chat you don't want processed this way.
Kai is not a crisis service. If you're thinking about harming yourself, call or text 988 in the US, or your local emergency number.
Account (optional)
You can use the app without an account. If you choose to sign in with Apple or Google, sign-in runs on Google Firebase Authentication, which stores an account ID and the name and email the sign-in provider shares with us (Sign in with Apple lets you hide your email). We keep one user record (ID, name, email) in Google Cloud Firestore. No Health data or scores are stored with your account.
Analytics, crash reports and ad measurement
- PostHog (PostHog Cloud, US) receives anonymous app events such as which setup screen you reached, and whether you started a trial or bought a plan. It never receives Health data, scores or your setup answers, and it isn't linked to you unless you agree.
- Firebase Analytics (Google) tells us how the app is used, for example which screens are opened and where people stop during setup. It never receives Health data or scores.
- Firebase Crashlytics (Google) collects crash reports: device model, OS version, the app's state when it crashed and an installation ID. Crash reports don't include Health data.
- Ad measurement. If you tap Allow on Apple's tracking prompt, Firebase and Google's ad measurement tools use your device's advertising identifier to tell us which ad brought you to the app. If you tap Ask App Not to Track, the identifier isn't collected. Switch it whenever you like in iPhone Settings → Privacy & Security → Tracking.
- Feature requests. If you send a feature request or vote in the app, it goes to WishKit, our feature-request service, along with an anonymous user ID.
Purchases
Subscriptions are processed by Apple. We use RevenueCat to check whether your subscription is active, using an anonymous app user ID and your purchase receipts. We never see your payment details.
Legal basis (EU/UK)
We process Health data and Kai messages with your explicit consent, which you give in the app and can withdraw anytime. We process purchases to provide the service you paid for (contract), and crash reports and basic analytics for our legitimate interest in keeping the app working. Ad measurement relies on your consent through Apple's tracking prompt.
How long we keep data
- Health data: never on our servers. It stays on your devices until you clear it.
- Account record: until you delete your account.
- Analytics and crash data: no longer than 14 months.
- Kai messages: not stored by us; OpenAI up to 30 days, as above.
Where data is processed
Google (Firebase), PostHog, OpenAI, AIProxy, WishKit and RevenueCat process data in the US. Transfers from the EU/UK rely on the European Commission's Standard Contractual Clauses or the provider's equivalent safeguards.
Your rights
You can ask to access, correct, export or delete your data, object to processing, or withdraw consent. Email support@cortisoliq.com and we'll reply within 30 days. In the app, Clear all data (under You) erases everything on your device. If you're in the EU or UK, you can also complain to your data protection authority. California residents have the same rights under the CCPA, and we don't sell or share personal information for cross-context behavioural advertising except the ad measurement described above, which you control with Apple's tracking prompt.
Children
Cortisol IQ is not intended for anyone under 13, and we don't knowingly collect their data.
Changes
If we change this policy we'll update the date above, and tell you in the app if the change is significant.
Contact
Cortisol IQ · support@cortisoliq.com