Data Privacy
what we store, where, and how to delete it
our commitment
Your account records are protected by row-level access controls that separate your data from other customers. Authorized service processes and administrators can access necessary records to operate the service, investigate problems, handle support, and fulfill data requests. This is not encryption that prevents all access by titrate or its service providers.
Local-First, Cloud-Synced When Signed In
Your intake answers and analysis results are stored in your browser. When you use the app while signed in, your profile and changes sync automatically to our Supabase database so they can load across your devices. There is no separate cloud-sync switch. Permission to send information to Google Gemini and TypeSafe Jev through OpenRouter is a separate choice.
Calibration Requires an Account
Calibration requires an account. The Free tier does not require a paid plan. Cloud sync requires a signed-in account and happens automatically. Access to other features depends on your plan or current beta access; see Pricing for details.
Never Sold. Ever.
Your biology is not a product. We do not sell your health data to advertisers or brokers. AI generation uses Google Gemini, while routing and quality review can use TypeSafe Jev through OpenRouter — details below.
Data You Can Delete
You can request account deletion from the account menu. This removes your account-linked application records, including profiles, analyses, chats, genetic data, support requests, usage records, and AI permission history. Billing-provider records, delivered emails, expiring caches, and backups are handled separately as described below.
Raw DNA Files Never Leave Your Device
Your raw DNA file (23andMe / Ancestry / etc.) is parsed entirely in your browser. We extract only the targeted SNP rows we interpret (currently 679 markers — rsid + genotype) and discard the raw file from memory. Those extracted rows are sent to our server for reviewed static lookup and, when signed in, stored in our RLS-scoped genomic_data table so findings can re-render across devices. When DNA is shown, analysis, diet, lifestyle, lab synthesis, and Coach may receive allowlisted reviewed phenotypes (gene, rsid, risk, interpretation) rather than nucleotide genotypes in structured AI context. Hide DNA in the menu to keep those phenotypes out of AI context. Genetic details you type in a message can still go to the disclosed AI processors.
What We Collect
- Intake profile: first name, birth year, biological sex, dietary protocol, health goals — kept in browser local storage; mirrored to RLS-scoped Supabase profile_data rows automatically when you use the app while signed in
- Health context: current medications, known conditions, allergies, pregnancy status, lifestyle flags (alcohol, smoking, nicotine, stress, sleep window if you enter one), optional surgeries/injuries, optional peptide protocols, and lab panels you upload or enter — same storage path as the intake profile
- Intake drafts: a short-lived copy of an unfinished calibration form in browser local storage (cleared on save)
- Current supplement stack and analysis results — stored in your browser and automatically mirrored to profile_data during signed-in app use
- AI Coach conversations — stored in our RLS-scoped chat_messages table for authenticated users so history persists across sessions
- Supplement and medication label photos — sent to Google Gemini for extraction after AI permission. Our application does not retain the uploaded photo after processing; medication thumbnails may remain in this browser's IndexedDB
- Ingredient resolution records — extracted label text, AI parsing results, and correction/provenance records may be stored to resolve ambiguous ingredients and review parsing quality. These are separate from the uploaded photo and may contain text printed on the label
- Lab report images/PDFs and extracted lab values — uploaded to Google Gemini when you choose AI lab parsing, then the structured panel may be stored in your RLS-scoped profile data; the uploaded file is not retained by our application after the response
- Wearable screenshots you upload — sent to our AI to extract visible metrics; not retained on our servers after the response
- Extracted genetic markers (rsid + genotype + interpretation) for 679 targeted SNPs — stored in our RLS-scoped genomic_data table for authenticated users so DNA-informed findings can re-render
- Authentication metadata (email, Supabase user id, plan tier) — required for accounts; managed by Supabase Auth
- Product analytics and performance data (Vercel Analytics + Speed Insights) — page views, referrers, browser/device information, route timings, and web-vital metrics. Vercel Web Analytics also derives coarse geography such as country from connection information. We do not send health records, profile content, or genomic findings as analytics event data
Data We Do Not Request or Retain
- Your raw DNA file — it is parsed in your browser and never uploaded
- A retained copy of your raw lab file — when you choose AI lab parsing, the file is sent transiently to Google Gemini for extraction, but our application does not retain the uploaded file after the response
- Phone number or postal address
- Precise device location, such as GPS coordinates. This does not exclude coarse geography derived by our analytics provider from connection information
- Cross-site advertising cookies or device fingerprinting identifiers
- Payment card details — when billing is enabled, payments are processed by Stripe and we never see card numbers
- Data from third-party health apps or wearables except screenshots you choose to upload
Third-Party Services
- Supabase (US-hosted) — managed Postgres + Auth. All user-scoped tables (profile_data, chat_messages, genomic_data) enforce row-level security. Encryption at rest is provided by the platform.
- Google Generative AI (Gemini), our disclosed AI generation processor — receives the structured context needed for stack analysis, diet/lifestyle guidance, lab synthesis, uploads, and Coach responses. This can include conditions, medications, lab values, reviewed genomic phenotypes, and free-text notes. For label, lab, and wearable extraction, the app checks photos and PDFs for personal details in your browser and sends a flattened copy with detected details covered. If that check fails, the upload stops. The original file is not sent as a fallback. Our structured AI context excludes raw DNA files, nucleotide genotypes, account names, and payment details. Automatic detection can miss names and other identifiers, especially handwriting, barcodes, unusual layouts, or text in languages other than English. It does not guarantee anonymity. Messages and notes are shared as you type them. Google processes this data under the applicable Gemini API terms and retention controls.
- OpenRouter and TypeSafe Jev, our disclosed AI routing and quality-review processors — receive bounded text-only context for Coach request routing, review of generated explanations against supplied context, condition-topic matching, supplement search and product-detail review, wearable-summary checks, and admin curation. Jev is advisory: it does not establish scientific evidence, set lab ranges, change lab status labels, diagnose conditions, calculate schedule timing, or discover interaction rules. The app requests OpenRouter zero-data-retention processing, denies provider data collection, disables provider fallback, and excludes direct account identifiers and raw genomic fields from Jev state. Text you type can still contain identifying details.
- Vercel — application hosting, Web Analytics, and Speed Insights. Hosting processes connection information, including IP addresses. Analytics reports aggregate traffic, device/browser information, and coarse geography; it does not require access to your device GPS. See Vercel's privacy documentation for its data handling. We do not pass health data, profile content, or genomic findings into analytics events.
- Upstash Redis — rate-limit counters keyed by user id; no profile content stored.
- Stripe — payment processing for paid plans (when enabled). Stripe receives card data directly; we receive only a customer id and subscription status.
- Resend — transactional email (account confirmations, password resets) when you have an account.
AI Data Processing Disclosure
- AI sharing is off until you explicitly allow Google Gemini and OpenRouter Jev processing. Accepting Terms or Privacy, signing in, or purchasing access does not grant this permission. We record the processor scope, disclosure version, choice, and time separately from legal-document acceptance. The server checks permission before AI requests, including automatic requests within the app. Adding OpenRouter Jev requires a new choice even if you previously allowed Gemini.
- You can withdraw permission under Account settings → AI sharing. This blocks future AI requests across your account while leaving stored information and manual features available. Withdrawal cannot recall data already sent or stop processing already underway. A material change to the provider or disclosure requires a new choice.
- When you calibrate a profile, scan a medication or supplement label, parse a lab report, classify a free-text condition, run an analysis, or use the AI Coach, the following may be transmitted to Google Gemini: medications, conditions, allergies, pregnancy status, biometric inputs, lab values or uploaded lab images/PDFs, supplement stack, reviewed genomic phenotypes, extracted label text, and free-text notes you type. OpenRouter Jev may receive the minimum text needed to classify or review that feature, such as a message, draft answer, lab narrative, lab-result name or status, reported condition, wearable reading, supplement detail, search result, or existing warning. DNA-aware surfaces receive reviewed phenotype summaries only — not nucleotide genotypes or raw DNA files — and respect the Hide DNA setting. Before file uploads, a local text-recognition step looks for known profile names and common labeled identifiers such as patient names, birth dates, contact details, and record numbers. Detected areas are covered in the exported pixels. PDFs are rebuilt from page images, without their original hidden text, metadata, or embedded files. This is a best-effort privacy measure; it may miss identifiers or cover useful text. If you type genetic or identifying details into a message, that text can be transmitted. We exclude account names and billing details from structured AI context, but identifying details missed in files or included in typed messages can still reach an AI processor.
- AI results are educational and are not reviewed by a clinician. Safety and validation checks vary by feature and do not establish that a result is accurate or safe for you.
Retention and account deletion
- Saved profiles, analyses, Coach messages, and ingredient-resolution records remain in application storage until removed through the relevant controls or account deletion. Temporary resolution caches can remain until expiration. Uploaded-file handling and provider retention are separate from these saved records.
- Deleting your account removes linked records from our active application database and clears browser storage and locally saved media on the device completing deletion. If local cleanup fails, we show instructions for clearing site data. Other devices may retain local copies until you sign out or clear their site data.
- If a Stripe customer is linked to your account, we expire open checkouts and confirm cancellation of its live subscriptions before completing deletion. If billing cannot be verified or canceled, deletion pauses and shows an error so the subscription is not silently left active. You can contact support for help.
- Account deletion does not erase Stripe billing records, delivered support emails, or information already processed by Google or OpenRouter. These records follow the relevant provider's retention policies and any applicable obligations. Temporary server caches and database backups may persist until expiration or rotation; deletion is not a promise of immediate erasure from every processor or backup.
- If you used Sign in with Apple and we do not hold a token that can revoke the connection, account deletion still completes. We then show instructions for removing titrate from Sign in with Apple in your Apple Account settings.
Server Logs and Telemetry
- We log request-level metadata (route, status, latency, pseudonymous user id, model name, token counts) to operate and debug the service. We do NOT log prompt content, AI response content, medication names, condition names, gene names, rsids, genotypes, or lab values into observability sinks.
- Error reports use sanitized error codes and scope identifiers — never the raw row content that triggered the error.
How we handle genetic information
- If you upload DNA data, we process the extracted SNP markers against reviewed static interpretations for screening context. GINA restricts employers and health insurers from using genetic information in certain decisions — we are not an employer or insurer. We do not share genetic data with employers or insurers. You can delete all genetic data at any time from your DNA settings; deletion also wipes DNA-derived blobs (diet plan, lifestyle protocol, genomic supplements) from your profile.
Your Rights
- Access — request a copy of all data we store about you
- Correct — edit your profile data directly in the app at any time
- Delete — request account deletion from the account menu; retention boundaries are described above
- AI sharing — review or withdraw Google Gemini and OpenRouter Jev processing permission in Account settings
- Export — download your analysis history as PDF or JSON
- California (CCPA) and Washington (My Health My Data Act) residents may have additional rights, including the right to opt out of any data processing not strictly necessary to deliver the service. Contact privacy@titrate.app to exercise these rights.