Privacy at Phaze

2. Quick summary

This summary is informational only. The full text below governs.

• We do not sell your personal information. We tell Meta, and on Android TikTok, when Phaze is installed, opened and subscribed to, so we can see which ad brought someone here. No health value is included, and we share nothing with data brokers. See Sections 6.3 and 8.
• Health data is stored on your device. Phaze keeps no copy on its own servers. On iOS the app writes an encrypted copy to your own iCloud Drive once a day, and on Android you can enable Cloud Backup, which writes an encrypted archive to your own Google Drive. See Section 5. The one exception is Phaze storage, which you can choose for a backup with Phaze Pro on iOS. It keeps an end-to-end encrypted copy on our service that nobody at Phaze can open.
• Community, the room that was in the Phaze app, closed on October 28, 2026. Everything members wrote there, and every field they chose to show on their profile, was deleted (Section 3.1). The Phaze community is now a Discord server outside the app (Section 6.4).
• We do not use Apple HealthKit or Google Health Connect data for advertising, marketing, or sale.
• AI features (Ember chat, food scan, Daily Insights) send your data to Google Gemini through an edge service we operate. They stay off until you grant a separate permission, and you can withdraw it at any time. We do not train AI models on your data. See Section 6.1.
• You must be 18 or older to use Phaze.

3. Information we collect

3.1 Information you provide

• Account information: Phaze has no login and no password. You give a name and a date of birth during onboarding, and both stay on your device. You give an email address only if you choose to, when you send feedback or turn on profile sharing in Settings, Privacy.
• Health and body data: weight, height, body composition entries, progress photos, goals, dietary preferences.
• Medication data: GLP-1 (or other) medication name, dose, schedule, side effects, injection-site notes. Provided voluntarily.
• Nutrition data: food logs, barcode scans, meal photos, voice-described meals, dietary preferences.
• Activity data: exercise logs, hydration entries, fasting windows, sleep summaries.
• Subscription information: purchase confirmations from Apple App Store or Google Play. We do not receive your full payment card number.
• Communications: support emails, in-app feedback.

Community, the room that was in the Phaze app, closed on October 28, 2026. While it was open, it received the username a member chose, the posts and replies they wrote, their votes, reactions and reports, the members they hid, the medication, dose and logging streak a member chose to show on their profile, and the phones registered for its notifications. When it closed, our service deleted every post, reply, vote, reaction and report, every field published on a profile and every phone registered for notifications, and erased each member's record the same way leaving Community erased it. Section 5.4 lists the few records that remain, and Section 9 says how long they are kept. The current version of Phaze only asks our service whether Community has closed, so that it can tell you once where the community went, and sends no member ID, username or anything you wrote with that question. An earlier version that still opens Community is shown a notice, and our service stores nothing it sends. The Phaze community is now a Discord server outside the app (Section 6.4).

3.2 Information collected automatically

• Device information: device model, operating system version, app version, language, time zone, country (derived from store region), and a device-generated pseudonymous identifier used to link your usage events.
• Diagnostics and product analytics: crash reports, performance traces, error logs, and product-analytics events. We do not send your email address, your name, or any medication name, dose, side effect, or injection site to our analytics or crash providers. Analytics events carry which screens you opened and which actions you took, plus your mood and energy ratings from a daily check-in and the name of a lab biomarker you added, never its value. Our analytics provider also records the screen of roughly 10% of sessions, with every text label, image, and input field masked before upload. All of this links to a device-generated identifier, so it is pseudonymous rather than anonymous. One switch in Settings, Privacy turns it all off. See Section 6.2.
• Approximate location: city-level only, derived from IP. We do not collect precise GPS location.

3.3 Information from third parties

• Apple HealthKit (iOS): if you connect HealthKit, we read the data types you authorize. See Section 7.
• Google Health Connect (Android): if you connect Health Connect, we read the categories you authorize. Phaze currently requests: Steps (read), Weight (read and write), Active calories burned (read), Exercise session (read).
• Google Drive (Android only): if you turn on Cloud Backup on Android, you authorize Phaze for the Drive AppData scope so it can write the backup file to your own Drive. We receive no other Drive content. Phaze has no Sign in with Apple and no Google sign-in, because Phaze has no login.

We do not buy data from data brokers and do not enrich your profile from external sources.

3.4 What we do NOT extract

• No biometric identifiers. Phaze does not extract or store face geometry, facial landmarks, fingerprints, iris scans, voiceprints, speaker embeddings, gait analysis, or any other biometric identifier as defined by the Illinois Biometric Information Privacy Act (BIPA), the Texas CUBI statute, or similar laws. Food scans and progress photos are not processed for facial recognition. Voice transcription uses the platform speech APIs and does not create or retain a voiceprint on the Phaze side.
• No precise location. We do not collect GPS coordinates or use geofencing. We do not geofence around health care facilities.
• No third-party advertising IDs we use ourselves. The IDFA or advertising ID on your device is governed by the platform's privacy controls.

4. How we use your information

We process your information for the following purposes and on the following lawful bases (the lawful basis matters most under GDPR, UK GDPR, and LGPD; United States users may disregard the "Lawful basis" column).

We do not use your information to: sell to third parties for monetary or other valuable consideration; show ads in Phaze; profile you to predict future behavior outside the Service; share with insurers, employers, or data brokers. The install-attribution events we share with Meta, and on Android with TikTok, are described in Section 8.

You may withdraw consent at any time by deleting the relevant data in-app, disabling the feature, or contacting privacy@phaze.fit. Withdrawal does not affect prior lawful processing.

5. Local storage and backups

5.1 On your device

Your health, medication, and progress photo data is stored on your device:

• iOS: SwiftData persistent store with iOS Data Protection (NSFileProtectionCompleteUntilFirstUserAuthentication class). Sensitive medical fields (medication identifiers, doses, side-effect entries, injection-site notes, your medical profile, and your dose schedule) are additionally encrypted with AES-256-GCM using a key stored in the iOS Keychain (kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly).
• Android: Room database. Sensitive medical fields are encrypted with AES-256-GCM (cipher mode AES/GCM/NoPadding, 256-bit key, 12-byte IV, 128-bit tag) using a key generated and stored in the Android Keystore (hardware-backed where the device supports it). General preferences use Android Jetpack Security's EncryptedSharedPreferences (AES256_SIV for keys, AES256_GCM for values) with a Keystore-bound master key.

Phaze operates no server that stores the health records you keep in the app. Health information can still reach our service in one way: if you turned on profile sharing and our team contacted you for product research, the notes our team writes about that contact can include what you chose to tell us. The app never copies anything from the records above into those notes. Section 5.4 lists everything our service holds. The flows that leave your device are in Section 6: AI features, analytics, optional Cloud Backup, and optional Health platform sync. If you choose Phaze storage for a backup, an end-to-end encrypted copy is also kept on a service we run, and only your devices and your recovery code can open it (Section 5.2).

5.2 Backups

How a backup works depends on your platform, and the two are not the same.

• iOS: At most once a day, when you open Phaze on an iPhone signed in to iCloud, the app writes an encrypted copy of your Phaze data to Phaze's own folder in your iCloud Drive (iCloud.com.zeit.phaze). The copy holds everything you keep in Phaze, including your medications, your dose history, your logs and your progress photos, and the app keeps the copy it replaces as a second one. We have no access to your iCloud Drive, so we cannot read or retrieve these copies. An entry you delete stays in them until newer copies replace them. The app never replaces a copy with a smaller one on its own, so after you delete entries that can take a while. When you install Phaze on an iPhone signed in to the same iCloud account, it offers to restore your data from iCloud. Your data is also carried by Apple's iPhone Backup, which you control in iOS Settings. A device that used an older build may also hold one earlier archive in the same folder, which Settings, Data and Privacy, Device Backup lets you restore once or delete. Delete All Data removes the daily copies and that archive while iCloud Drive is on for Phaze, within the limits set out below.
• Android: Cloud Backup is opt-in and off by default. When you enable it, an encrypted archive is written to the AppData folder of your own Google Drive. That folder is private to Phaze, application-scoped, and not visible in your normal Drive view. You pick the frequency: off, daily, or weekly.
• Phaze storage (optional, iOS, Phaze Pro): when you tap Back up now in Settings, Data and Privacy, Device Backup and turn on Phaze storage for that backup, the app sends an end-to-end encrypted copy of everything you keep in Phaze, including your medications, your doses, your side effects and your progress photos, to a backup service we run. It happens only when you choose it for that backup. It is never automatic and it never syncs. The iPhones on your Apple Account share these backups, so you can restore one on a new iPhone.

In both cases the archive payload is encrypted with AES-256-GCM before it is written.

About the encryption key for iCloud and Google Drive archives. So that a backup can be restored on a new device without a separate passphrase, the encryption key is generated locally and stored alongside the encrypted payload inside the backup file. On iOS the daily copy also holds the key that unlocks the medical fields encrypted on your device (Section 5.1), such as your medications, doses, side effects and injection sites, so that a restore can read them. When iCloud Keychain is on, the app also keeps a copy of that key in your iCloud Keychain, so that a new iPhone on the same account can read the data it restores. This means the backup is protected by the security of your iCloud or Google account, not by a passphrase you hold. We do not support a user-supplied passphrase, and we do not describe this backup as readable only by you, because that would imply a key we cannot reach. If you require true zero-knowledge encryption, turn off iCloud Drive for Phaze on iOS, and do not enable Cloud Backup on Android.

Phaze storage is readable only by you. The key that opens it is made on your iPhone and kept in your iCloud Keychain and in a recovery code the app shows you. Our service never receives either one, and never receives the key that protects your medical fields in a form it can read. Nobody at Phaze can open these backups. If you lose both your recovery code and every device that holds the key in iCloud Keychain, nobody can open them, including Phaze, and we cannot find them for you, because Phaze has no accounts.

Phaze keeps no copy of the iCloud or Google Drive archives, which exist only in your own iCloud or Google Drive. The only backup our service holds is Phaze storage, and only when you choose it.

On Android, once Cloud Backup is enabled, it runs on the schedule you pick. You can change the frequency or switch it off at any time in Settings, Cloud Backup.

To remove a backup file: On iOS, Delete All Data removes the Phaze copies in your iCloud Drive only while iCloud Drive is on for Phaze, so use it before you turn iCloud Drive off. It cannot remove a copy that iCloud keeps only in the cloud to save space on the iPhone, and another iPhone signed in to the same iCloud account keeps writing its own copy until you delete the data on that iPhone too. To be sure every copy is gone, also delete Phaze's data in your iPhone's iCloud storage settings. On Android, Delete All Data removes the Cloud Backup file when that phone still has access to your Google Drive for Phaze, and you can switch Cloud Backup off in Settings. You can also delete the files yourself through Apple's or Google's data-management tools. To delete your Phaze storage backups, use Delete from Phaze in Settings, Data and Privacy, Device Backup, which deletes them from our service at once. Delete All Data asks whether to delete them too (Section 9).

5.3 What this means in plain language

• Your data is stored on your device.
• On iOS the app writes an encrypted copy of your data to your own iCloud Drive once a day (Section 5.2). On Android, Cloud Backup is off unless you turn it on, and then an encrypted file lives in your own Google Drive.
• If you choose Phaze storage for a backup, an end-to-end encrypted copy is kept on our service. Nobody at Phaze can open it, and you can delete it at any time from Device Backup.
• AI features and analytics described in Section 6 do transmit specific fields off your device.
• Uninstalling the app removes on-device data. The iOS copies in your iCloud Drive, and an Android Cloud Backup file in your Google Drive, stay until they are deleted.

5.4 What Phaze keeps on its own servers

We run one service of our own, on Cloudflare. It proxies the AI requests described in Section 6.1 and holds a small set of records in a Cloudflare D1 database. An internal dashboard our team uses reads and writes the same database. Workers KV holds rate-limit counters, rankings entries, short-lived caches of food-scan, meal-description, food-search and recipe results, and, while you link Discord (Section 6.4), the link in progress for up to ten minutes. This is all of it. The app never copies a medication, dose, schedule, side effect, injection site, weight, height, or BMI from your records into any of them. Such a value can appear in one place only: in the research notes below, when you tell it to our team.

There is one exception to that, and it is yours to choose. A separate backup service keeps your Phaze storage backups, in a storage bucket and a database of its own. Those backups hold all of your Phaze data, end-to-end encrypted so that our service cannot read it (the Phaze storage bullet below).

• Profile sharing (optional): on iOS the profile-sharing card is pre-selected during onboarding and you can untick it there or switch it off at any time in Settings, Privacy. On Android it starts off and you switch it on yourself. When it is on, one row is stored for your device: a device-generated identifier, birth year and age band, biological sex, activity level, transformation goal, the reason behind that goal and what you tried before Phaze (each chosen from a fixed list during onboarding), stage, whether you have Phaze Pro, app platform, version and language, and your consent flags. An email address is stored in a separate table, and only if you gave one. Cloudflare adds the country, region, and city it resolved from the request itself. The app holds no location permission and asks for none. Switching the toggle off deletes the row, and so does Delete All Data.
• Feedback and the feature roadmap: when you send quick in-app feedback, we store which screen you sent it from, your rating and, where the screen asks, how easy the task was, your message if you wrote one, an email address if you gave one, your device identifier, and the app platform, version, and language. The longer survey in Settings stores the same identifier and app details, your score, whether Phaze is the only GLP-1 app you use, the other apps you name, the features you use, your comments, and an email address if you gave one. When you vote on the public roadmap, we store a random voter ID that the app keeps for the roadmap only, which is not your device identifier, with each item you voted for and when. When you suggest a roadmap item, we store its title, its description if you wrote one, your voter ID, and the app platform, version, and language. Our team reads a suggestion before it appears, and your voter ID is never shown. A filter rejects a feedback message, a survey answer or a roadmap suggestion that mentions a medication, a dose, or a side effect before it is stored. To have a feedback message or a roadmap entry removed, email privacy@phaze.fit.
• Lifestyle Score rankings (opt-in): if you join rankings, your device identifier, your Lifestyle Score, and your streak length are stored in Workers KV so a position can be calculated. Leaving rankings deletes the entry, and an entry that is not updated for 30 days expires by itself.
• Research questions (optional): if you answer Phaze's short set of research questions, from Settings or from an in-app banner, we store your answers, which set of questions you answered, where you answered from, the app platform, version, and your phone's language and region setting, and the time. The questions can change, and current versions of the app get them from our service. A set has up to five questions, and you can skip any of them. Each question asks you to pick an answer from a fixed list or to write your own, up to 280 characters, and some answers on a list open a short box of up to 140 characters. No device identifier, email address or other identifier is stored with your answers. The one exception is the question of where you first heard about Phaze: if you answer it and send your answers, the app also sends the option you picked, such as Instagram or a friend, to Mixpanel, our analytics provider, linked to the same device identifier as the rest of your analytics data (Section 6.2). Nothing you typed is sent with it, no other answer goes to analytics, and turning analytics off in Settings, Privacy stops it. A server-side filter refuses your answers if anything you wrote mentions a medication, a dose or a side effect, and for some answers also a health condition, a doctor or a treatment.
• Research contact notes (internal): if you turned on profile sharing and our team contacts you for product research, our internal dashboard keeps, against your device identifier, a contact status and follow-up date, whether we left your profile out of research and why, notes our team writes (up to 2,000 characters each), and a log of each call, email, text or video contact with its outcome and an optional summary of up to 2,000 characters. These notes can record what you chose to tell us, which can include health information. They are deleted with your profile row, when you switch profile sharing off or use Delete All Data.
• Community, the room that closed (Phaze app): Community closed on October 28, 2026 (Section 3.1). Its posts, replies, translations, votes, reactions, reports, published profile fields, notification registrations and notification queue were deleted, and so were each member's username, days present, hidden members, karma and consent record. What our service still keeps of it: each former member's record, reduced to the member ID, its public token, the status "left" (or "removed", if the member's access had been removed), the strike count, the avatar number, whether the row was a member's, the open-week dates, until when the member's reports could not hide a post at once, and when it was created and last changed; each former username for 30 days after it was given up, in the form our service compared names in (lowercase, with look-alike letters and digits folded together and periods and underscores removed), with why it was given up and when it becomes free, and with no member attached to it; the moderation log, which holds nothing anyone wrote and no member ID, and names a member's public token on actions taken on their membership; and the work queue, where a job to have an AI character answer a reply names the thread, the day and the first part of the author's public token. None of these records holds a device identifier, an email address or the name you give during onboarding, and none links to the profile or contact records above. Section 9 says how long each one is kept, and what stays on your phone.
• Phaze storage (optional, iOS, Phaze Pro): kept apart from everything above, by a separate service with its own storage:
  • in a Cloudflare R2 bucket (phaze-backups): each encrypted backup, with the exact time it was saved;
  • in a separate Cloudflare D1 database (phaze-backup): a random backup identifier your iPhone makes, each backup's encrypted summary, its size, a sequence number, and the days a backup was started, saved and last listed;
  • for a day or two, a one-way digest of each request to delete backups, so that a copied request cannot run twice;
  • in Workers KV, rate-limit counters keyed by a keyed hash of your IP address (for IPv6, of its /64 network), which expire within about 25 hours;
  • daily totals that name nobody.

  None of it holds your device identifier, your subscription identifier, an email address, your community member ID or your IP address, and our systems never store it beside, or join it to, the profile, contact or community records above. It can still be lined up with them in one way: the storage records when each backup was saved, and our app analytics and crash reports record when the app is in use, so the two times could be matched. The backup service keeps no request logs. Cloudflare's network sees the IP address of each request as it passes, as it does for all of our services. The backups are stored in the United States (Eastern North America).

• Request logs and caches: our service logs the IP address, the route, and the size of each request, for reliability and rate limiting. It does not log the text of an Ember message, an insight, a photo, or any health value. A food-scan result is cached for 24 hours against a hash of the image; the image itself is not stored. Daily Insights are never cached or logged.

6. AI features, analytics, and other third-party processors

6.1 AI features

• Ember (AI chat): when you send Ember a message, the message and a context record are sent through an edge service we operate on Cloudflare to Google Gemini. The context record is your own history, and it is broad. Depending on what you have logged, it can include your name, height, biological sex, activity level and goals; the last 30 days of daily logs, with nutrition, activity, mood, energy, hunger, food noise, sleep, and the side effects you recorded with their severity; 90 days of weight entries with exact values; your exercise entries; your body measurements and body composition; your lab results with their values; your milestones; the dates and notes on your progress photos; and your medication name, current dose, dose schedule, dose dates, cycle phase, and estimated medication level. Individual dose amounts, injection sites, and dose notes are held back. Progress photo images are not sent through Ember, only their dates and notes.
• Food scan: when you scan a meal, the photo is sent through the same edge service to Google Gemini for nutrient estimation. Our service caches the returned estimate for 24 hours against a hash of the image, so the same photo is not analyzed twice. The photo itself is not stored, and no biometric identifier is extracted from it.
• Voice meal description: spoken meals are transcribed by Apple Speech Recognition (iOS) or Android SpeechRecognizer. Both are system APIs whose routing Apple and Google control, and Phaze does not force on-device recognition, so on many devices and languages the audio does reach their speech services. The resulting transcript is then sent to Gemini for parsing into food entries.
• Body composition estimate from photo: if you use this feature, the photo is sent through the edge service to Gemini and a numeric estimate comes back. A confirmation sheet tells you the photo is leaving your phone before it does. No biometric identifier is derived or stored.
• Daily Insights (paid plans): if you have a paid plan and have granted the AI permission, Phaze sends 90 days of your own log through the edge service to Gemini and gets back a short written summary of the patterns in it. That payload carries your dose dates, side effects with severity, meals with their names and macros, daily totals, sleep, mood, energy, weights, your medication name, and your current dose. It does not carry per-dose amounts, injection sites, dose notes, progress photos, lab values, or body composition. It is never cached or logged on our servers. Every number in the result is re-checked against your own data on your device, and the insight is dropped if a number does not match.
• Lab and DEXA document import: if you choose automatic extraction, the lab report or DEXA scan image you pick is sent through the edge service to Gemini. A confirmation sheet tells you the document is leaving your phone before it does. You review every extracted value before it is saved.
• Data import: text you paste, or a file you pick from another app, is sent through the edge service to Gemini so Phaze can identify records for your review. That text can contain medication names and dose amounts.
• Recommendations, milestones, streaks, and dose-cycle estimation: run on-device. No external service is called.

Important about AI features:

• AI responses can be inaccurate, incomplete, or out of date. Ember does not provide medical advice, dose recommendations, contraindication guidance, or symptom triage. Our edge service screens every message first, and answers a dosing, drug-interaction, or symptom-triage question with a referral to your provider instead of calling Gemini at all. For dosing decisions, side-effect concerns, or any clinical question, contact your prescribing healthcare provider.
• We do not train any model on your data. We use Google's paid Gemini API, and Google's terms for that tier state that prompts and responses sent to it are not used to train Google's models.
• AI features stay off until you agree. The first time a feature needs to send data to Gemini, Phaze shows what will be sent and asks for permission, and records which version of that disclosure you agreed to and when. Settings, Privacy has an AI features switch and a Withdraw AI permission button. Withdrawing stops every AI feature at once and clears the insights already generated. This applies to AI features inside the Phaze app. Discord moderation is described separately in Section 6.4.
• Following the EU AI Act Article 50, Ember responses carry a per-output "AI-generated" label, Daily Insights carry an "AI generated" label, and AI food-scan estimates are marked with an AI badge.

6.2 Analytics, crash reporting, and attribution

We use the following third-party tools. Each one receives the categories described.

We do not engage providers other than those listed above for the processing of your personal information. We require each provider to (i) act only on our instructions, (ii) implement appropriate security, (iii) not use your data for their own purposes other than aggregate statistics necessary for the service, and (iv) honor your deletion requests passed through us.

Those requirements bind the providers that process data on our behalf. Some recipients in the table are not our processors and act under their own terms and privacy policies: Apple and Google, for the app stores and your own iCloud Drive or Google Drive; Meta and TikTok, for the install attribution events; and the food and recipe databases (USDA, Open Food Facts and Spoonacular), for your lookups. Each receives only what the table says. A deletion request you send us does not reach them, and each one's privacy policy says what it keeps and how to ask it to delete it.

6.3 What about advertising trackers?

In the Phaze mobile app we use the Meta Aggregated Event Measurement SDK on both platforms, and the TikTok Business SDK on Android, for install attribution. They tell us which campaign brought a new user to Phaze. They are not used to serve advertising inside Phaze, and no health value is sent to either. On iOS, Phaze shows Apple's App Tracking Transparency prompt for Meta attribution. We do not embed Meta Pixel, TikTok web pixel, Snap Pixel, Google Ads conversion tags, Pinterest tag, or LinkedIn Insight tag on phaze.fit. We do not sell your personal information.

7. Apple HealthKit and Google Health Connect

Phaze integrates with Apple HealthKit (iOS, watchOS) and Google Health Connect (Android) only if you authorize it. You choose which categories to share. You can revoke this access at any time from your device system settings.

In accordance with Apple's HealthKit terms (Apple Developer Program License Agreement section 5.1.4) and Google's Health Connect terms:

• We do not use HealthKit or Health Connect data for advertising or other use-based data mining purposes other than improving health, medical, and fitness management, or for the purpose of medical research.
• We do not sell HealthKit or Health Connect data to advertising platforms, data brokers, or information resellers.
• We do not share HealthKit or Health Connect data with third parties for advertising or marketing purposes.
• We do not use HealthKit or Health Connect data to identify users beyond what is necessary for personalization within Phaze.
• We will not access an end user's HealthKit or Health Connect data without their authorization.

HealthKit and Health Connect data is stored on your device. What Phaze records from them, such as weights and activity, becomes part of your Phaze data, so it is included in the encrypted daily copy on iOS and, if you enable Cloud Backup, in the encrypted Android archive (Section 5.2).

8. Sharing

We share personal information only in these limited cases:

• With your direction: when you choose to export a PDF report, share a milestone card, send a screenshot, or grant a feature access to your data.
• With processors: the third-party providers listed in Section 6, bound by data-processing terms.
• For legal reasons: to comply with valid legal process (subpoena, court order), respond to government requests where required by law, or protect the safety and rights of Phaze, our users, or the public. We narrow disclosures to what is legally required.
• Business transfer: if Phaze is acquired, merged, or assets transferred, your information may be transferred to the successor entity subject to this Policy. You will be notified of any material change in handling.

We do not "sell" your personal information as that term is defined under the California Consumer Privacy Act, Washington My Health My Data Act, Connecticut Data Privacy Act, Texas Data Privacy and Security Act, or any other applicable law. We do share app install, app launch, and subscription events with Meta on both platforms, and with TikTok on Android, so we can tell which ad brought someone to Phaze. Each event carries an identifier the attribution SDK creates and stores on your device, plus basic device information such as model and OS version. No medication, dose, weight, food, or other health value is included. Meta and TikTok can use these events to measure and target advertising on their own platforms, which some state laws count as "sharing" for "cross-context behavioral advertising." We do not show ads inside Phaze.

9. Retention

When you use Delete All Data in the app, one action removes the data on your device, deletes the Phaze backup files it can reach in your iCloud Drive or Google Drive (Section 5.2 explains when it cannot), cancels every scheduled reminder, opts your device out of analytics, session replay, and crash reporting, and deletes your profile and contact rows from our servers. If your phone is offline at that moment, the app keeps only the identifiers and pending deletion markers needed to complete server erasure, including, on Android, this device's profile ID, and sends the request again each time you open Phaze until our service confirms it. If you uninstall Phaze before that happens, the request is lost with the app. In that case, email privacy@phaze.fit (Section 12). If you have Phaze storage backups, Delete All Data asks whether to delete them too. If you say yes, it deletes the backups every one of your iPhones saved up to that moment, and your recovery code stops working. A key made on another iPhone that had not reached this one yet is not covered, and backups another iPhone makes later are kept. If you say no, the backups and their key stay, and the key also stays on this iPhone until you sign out of iCloud on it. To have a feedback message or a roadmap entry removed, email privacy@phaze.fit. Subscription and tax records are kept where the law requires.

If an iPhone is offline during Delete All Data, its separate request to delete the server profile and contact row can fail without an automatic retry. Email privacy@phaze.fit to complete that deletion. Android keeps a pending device-ID marker and retries that profile deletion when the app next opens online.

10. Security

We implement reasonable administrative, technical, and physical safeguards:

• AES-256-GCM at rest on device and for backup archives
• End-to-end encryption for Phaze storage: each backup is encrypted on your iPhone with AES-256-GCM under a key our service never receives, and your iPhone signs each request it makes to the backup service
• TLS 1.3 in transit
• Apple Keychain and iOS Data Protection (iOS)
• Android Keystore plus EncryptedSharedPreferences (Android)
• Role-based access control on internal tools
• Code review and automated tests before a release that changes how data is handled
• Vendor diligence on processors

Phaze storage has two limits we want you to know. Our service can see the size of each backup, to the mebibyte, and when it was saved, and those times could be matched with our analytics (Section 5.4). And replacing your recovery code protects you against a lost iPhone only once that iPhone is removed from your Apple Account, because the new key reaches every device still signed in to it.

No method of transmission or storage is perfectly secure. We do not claim to be HIPAA-compliant, and Phaze is not a HIPAA-covered entity.

Breach notification. If we discover a security incident that compromises the confidentiality of your personal information, we will notify you and applicable regulators in accordance with the FTC Health Breach Notification Rule (16 CFR Part 318), GDPR Article 33 and 34, LGPD Article 48, and applicable state breach-notification laws. Where required, we will notify affected individuals within 60 days of discovery (HBNR) and applicable regulators within 72 hours (GDPR).

11. Children

Phaze is intended for users 18 years of age or older. Onboarding asks for a date of birth and will not let you continue if it puts you under 18. We do not knowingly collect personal information from anyone under 18. If you believe a person under 18 has provided us with personal information, contact privacy@phaze.fit and we will delete it.

If we discover that we have collected personal information from a person under 18, we will delete that information promptly.

12. Your choices and rights

You have the following choices regardless of where you live:

• Access and export: view your data in-app. Settings, Privacy, Export Data gives a JSON file of your logs; that file leaves medical fields out for security, so use Settings, My Report for a PDF that includes your medication, your recent doses, and your side effects.
• Correct: edit any entry in-app.
• Delete: delete individual entries, or use Settings, Privacy, Delete Everything, Delete All Data. That one action removes the data on your device, deletes the Phaze backup files it can reach in your iCloud Drive or Google Drive (Section 5.2 explains when it cannot), cancels scheduled reminders, opts your device out of analytics and crash reporting, and deletes your profile and contact rows from our servers. It also asks whether to delete your Phaze storage backups (Section 9).
• Disable AI features: Settings, Privacy has an AI features switch and a Withdraw AI permission button. Withdrawing stops every AI feature at once and clears the insights already generated.
• Community, after it closed: there is nothing of yours left to delete or leave. When Community closed on October 28, 2026, our service erased every member the same way Leave Community did, and Section 5.4 lists what remains. Those records name no one, so we may not be able to tell which one was yours, but you can ask about them at privacy@phaze.fit.
• Delete your Phaze storage backups: Settings, Data and Privacy, Device Backup, Delete from Phaze deletes them from our service at once.
• Get a copy of a Phaze storage backup: restore it on your iPhone. We cannot give you a readable copy, because we have none.
• Disconnect HealthKit or Health Connect: revoke from device system settings.
• Stop backups: on Android, toggle it off in Settings, Cloud Backup. On iOS, first remove the copies already written: use Delete All Data, which also removes the data on your device, or delete Phaze's data in your iPhone's iCloud storage settings. Then turn off iCloud Drive for Phaze in your iPhone's iCloud settings, which stops the daily copy. Once iCloud Drive is off for Phaze, Delete All Data can no longer reach the copies.
• Opt out of analytics: Settings, Privacy has one switch that turns off product analytics, session replay, and crash reporting together. That switch does not cover the install-attribution SDKs. For those, use your platform's controls: App Tracking Transparency on iOS, and the advertising ID controls in Android settings. Declining App Tracking Transparency moves Meta to its aggregate measurement path. It does not stop install and launch events from being sent.
• Push notifications: disable in device system settings.

To exercise any right not available in-app, email privacy@phaze.fit. We will verify your identity (typically by matching to the email of record) and respond within the timeframe required by your local law (generally 30 days under GDPR, 15 days under LGPD, 45 days under CCPA). If we cannot complete the request in that time, we will tell you why and what timeframe applies. You may appoint an authorized agent under CCPA and CPRA.

13. Jurisdiction-specific notices

13.1 European Economic Area and United Kingdom (GDPR / UK GDPR)

Controller and representatives: Zeit Capital Ltda. EU Representative: not currently appointed; see Section 1 for status and contact route. UK Representative: not currently appointed; see Section 1.

Lawful basis: see Section 4 table. We rely on explicit consent for special category health data (Art 9(2)(a) GDPR).

Your rights: access (Art 15), rectification (Art 16), erasure (Art 17), restriction (Art 18), portability (Art 20), object (Art 21), withdraw consent (Art 7(3)), and not be subject to solely automated decisions with legal or similarly significant effects (Art 22). Automated decision-making: AI-generated suggestions in Ember and food scan are decision-support, not solely automated decisions with legal effects. You can disable them and continue using Phaze.

International transfers: We are based in Brazil. Your data may be transferred to the United States or other jurisdictions where our processors operate. We rely on EU Standard Contractual Clauses with our processors and, where a processor is certified, on the EU-U.S. Data Privacy Framework. Contact privacy@phaze.fit for details of the safeguards in place for a specific transfer.

Complaints: you may lodge a complaint with the supervisory authority of your habitual residence. For UK users: the Information Commissioner's Office (ico.org.uk). Cookies and similar technologies on phaze.fit are covered in Section 14.

13.2 Brazil (LGPD)

Controller: Zeit Capital Ltda, registered in Brazil. Encarregado de Dados: Vinicius, privacy@phaze.fit.

Legal bases: Article 7 (general) and Article 11 (sensitive data: health, biometric where applicable). We rely on specific consent (Art 11(I)) for health data.

Your rights (Art 18): confirmation of processing; access; correction; anonymization, blocking, or deletion of unnecessary or excessive data; portability; deletion of data processed with consent; information about public and private entities with whom we share; information about the possibility of not providing consent; revocation of consent.

International transfers: we use standard contractual clauses approved by ANPD (Resolucao CD/ANPD no 19/2024) for cross-border transfers where applicable.

ANPD: you may submit a complaint to the Autoridade Nacional de Protecao de Dados (gov.br/anpd).

13.3 California (CCPA / CPRA)

We collect the following CCPA categories of personal information:

Sale and share: we do not sell personal information (including SPI) for money or other valuable consideration. We do disclose app install, app launch, and subscription events to Meta, and on Android to TikTok, for advertising attribution. Each event carries an identifier the attribution SDK creates and stores on your device, plus basic device information. No SPI and no health value is included. Because Meta and TikTok can use these events for their own ad measurement and targeting, we treat this as a "share" for cross-context behavioral advertising rather than claim it falls outside the definition. Sources are: directly from you, from your device, from Apple HealthKit or Google Health Connect if you authorize. Business purposes are as listed in Section 4. Disclosure to other third parties is limited to the processors listed in Section 6, in their service-provider capacity (Section 8).

Phaze storage: a Phaze storage backup is sensitive personal information that we keep only to provide the backup you asked for. We never sell or share it, and we cannot read it.

Your CCPA rights: know, access, delete, correct, opt-out of sale or share, limit use of Sensitive Personal Information, no retaliation, authorized agent. We do not sell. No setting in Phaze stops the attribution sharing described above: declining App Tracking Transparency on iOS moves Meta to its aggregate measurement path, and the advertising ID controls in Android settings govern only your device's advertising ID, but in both cases the attribution events are still sent. Submit requests to privacy@phaze.fit. Premium subscription tiers ("Phaze Pro") are payment for additional features, not a "financial incentive" tied to data collection. Shine the Light: you may request information about disclosures of personal information to third parties for direct marketing. We make none.

Universal opt-out signals (GPC): we honor Global Privacy Control signals on phaze.fit.

13.4 Washington (My Health My Data Act)

See the Consumer Health Data Privacy Policy for the disclosures required by the Washington My Health My Data Act, including categories of consumer health data, purposes, third parties, your right to withdraw consent, delete, and appeal.

13.5 Other US states (CO, CT, VA, UT, TX, OR, MT, IA, DE, NJ, MD, MN, NH, RI, TN, NV)

Residents of these states have rights including access, correction, deletion, portability, and opt-out of targeted advertising or sale. We do not sell personal information. The install-attribution events described in Section 13.3 may count as targeted advertising under some of these laws. No setting in Phaze stops them, and Section 13.3 explains what the iOS and Android controls change and what they do not. Health information is treated as sensitive data and we obtain opt-in consent before processing. Universal opt-out signals are honored where required. Submit requests to privacy@phaze.fit.

13.6 Japan (APPI)

Health data is treated as special care-required personal information and processed only with your opt-in consent. International transfer recipients and their data-protection frameworks are disclosed in Section 6.

13.7 China (PIPL)

Phaze does not actively offer the Service in mainland China. The Simplified Chinese localization is provided for users in other regions. Users in mainland China should not use the Service.

14. Cookies and similar technologies (phaze.fit)

The phaze.fit website uses:

• Strictly necessary cookies: a country cookie set from your IP-derived country header, used for locale and pricing routing; a sidebar_state cookie that remembers whether the documentation sidebar is open; a cookie_consent cookie that records your answer to the notice below; and a gpc cookie set when your browser sends a Global Privacy Control signal.
• First-party performance and analytics: Vercel Analytics and Vercel Speed Insights, which use first-party storage and do not load third-party tracking pixels.

When you open phaze.fit from a link in the Phaze app, we count the visit by app screen, page, platform and language, in aggregate, and the count keeps no IP address, cookie or other identifier.

We do not embed Meta Pixel, TikTok Pixel, Snap Pixel, Google Ads conversion tag, Pinterest tag, or LinkedIn Insight tag on phaze.fit, so the website shares nothing for cross-context behavioral advertising. The app's install-attribution events, which we treat as such a share, are described below and in Section 8.

phaze.fit sets no optional cookies, so the banner is a notice with a single acknowledgement rather than an accept-or-reject choice. A Global Privacy Control signal is treated as a rejection without prompting you. Your Privacy Choices in the footer reopens the notice, and you can clear cookies from your browser settings at any time.

The Phaze mobile app uses the Meta Aggregated Event Measurement SDK on both platforms and the TikTok Business SDK on Android, for install attribution. On iOS, Phaze shows Apple's App Tracking Transparency prompt for Meta attribution. We do not use these SDKs to serve personalized advertising within Phaze, and we do not embed advertising tags on phaze.fit.

15. Changes to this Policy

We will post material changes here and notify you in-app or by email at least 30 days before they take effect, except where a shorter timeframe is required by law. We will not apply material new uses to data we already hold without obtaining your consent where required.

A new optional feature applies to you from when you first use it. The version of September 30, 2026 adds new optional features: Community, with its notifications, its thread inspired by the news and the fields you can show on your profile, and Phaze storage for backups. It takes effect on that date because it changes nothing about how we use data we already hold, and each of those features starts only once you use it.

16. Contact

Questions, requests, complaints:

Phaze is not a medical device. The Service does not provide medical advice, diagnosis, or treatment. Always consult your healthcare provider regarding medications, dosing, or symptoms.