Privacy policy

To run your private protocol record, we collect:

• Your email address (to create and secure your account).
• Your name (a display name shown in the app).
• Optionally, your date of birth (to confirm you are 18+).
• Your protocol details and the dose, weight, and symptom entries you log. This is health-related data you choose to record.
• Optionally, photos and notes you choose to attach to your record.
• Subscription information, including your Together account ID, App Store transaction and receipt information, products purchased, and entitlement status.
• Crash and diagnostic data. If the app crashes or hangs, we receive a technical diagnostic report (such as the crash type and error codes) so we can find and fix the problem.

Almost everything above is something you enter yourself; the crash and diagnostic reports are generated automatically by your device only when something goes wrong. We collect this data only to provide and maintain the app’s functionality. Together uses no third-party analytics, attribution, crash-reporting, or advertising SDKs of any kind, and the app does not track you across other companies’ apps or websites. (Crash diagnostics come from Apple’s first-party, on-device MetricKit feature, described below.)

Your data is stored with Supabase, our database and authentication provider, encrypted at rest. Access is governed by row-level security so that only your authenticated account can read or write your records.

We use RevenueCat as our subscription processor. RevenueCat receives your Together account ID (a Supabase user ID, not your email), App Store transaction and receipt information, and subscription entitlement status so it can validate purchases, restore purchases, and tell the app whether to unlock Together Pro. We do not use RevenueCat for advertising or cross-app tracking.

We also use Resend to send account emails (such as sign-up confirmation and password resets) and Vercel to host and serve this website. These providers process only what is needed for those functions.

If you choose to use the body scan and grant the separate scan approval, the two photos you capture are sent to Google (the Gemini API) to compute your body-fat estimate. The photos are transmitted only for that request and are not stored by us; only the resulting number and its range are saved to your record. We use Google’s paid Gemini API, under which Google’s API terms provide that your inputs are not used to train Google’s models and are logged only transiently for abuse prevention and legal compliance. If you do not use the body scan, no photo ever leaves your device.

Supabase, RevenueCat, Resend, Vercel, and Google act as service providers (sub-processors) for Together. We require them to protect personal data consistently with this policy and applicable law, and to process it only on our instructions.

We use your data to provide the app’s functionality: showing your logs, plotting your trend, keeping your account secure, and validating purchases and subscription access. We do not share it for advertising, and we do not use third-party advertising trackers.

To keep the app stable we use Apple’s MetricKit, a diagnostics feature built into iOS. When the app crashes or hangs, your device prepares a technical report — the crash type, error and signal codes, and similar low-level details — that helps us locate the bug. This is a first-party Apple feature: we do not use any third-party crash-reporting or analytics service, and the reports do not identify you.

Because of how MetricKit works, these reports are not sent in real time. Your device delivers them to the app on its next launch after the event, batched roughly once a day — so a crash is never captured instantly. In the current version of the app, this diagnostic information stays on your device.

We never sell data that identifies you. We do not sell, rent, or license your personal or identifiable information — your name, email, account, photos, or any record that can be traced back to you or your device — to anyone, for any purpose.

We may sell or share data only in a fully de-identified form that cannot reasonably be linked back to you. Before any such data leaves us, we strip the identifiers, generalize the values (changes and bands rather than exact numbers, relative weeks rather than dates), and release a group only when at least 30 different people share it — so no individual can be singled out. We publicly commit to keep this data de-identified and never to re-identify it, and we require anyone who receives it to do the same by contract. Your photos are never part of this; they are never sold, licensed, or shared.

Depending on where you live, you have rights over the personal data we hold about you. You can, at any time:

• Access the personal data we hold about you, and confirm whether we are collecting, sharing, or selling it.
• Correct inaccurate personal data (you can edit most of your details directly in the app).
• Delete your account and the data tied to it.
• Withdraw consent you previously gave — for example, the separate approval for the body scan.
• Request a portable copy of the personal data you provided. We do not yet offer a self-serve export, but you can request one by email and we will provide it in a common, machine-readable format.
• Appeal a decision we make about one of these requests.

You can start permanent deletion yourself in the app at Profile → Delete Account. To exercise any other right, or to appeal a decision, email us at admin@togetherpep.com. We respond within the timeframes required by law. We will never discriminate against you for exercising a right, and we will never require you to create a new account to do so.

We keep your data only as long as we need it. In general, your record stays available for as long as your account exists, so it is there when you open the app; specific categories are handled as follows:

• Account data (email, display name, date of birth) — kept for the life of your account and removed when you delete it.
• Tracking & health data (protocols, dose, weight, symptom, and note entries) — kept for the life of your account and removed when you delete it.
• Photos (any images you attach, and body-scan photos) — kept for the life of your account. The in-app deletion flow attempts to remove known private photo and scan files before closing the account; if that storage cleanup needs a retry, remaining files are removed within 30 days. Body-scan photos are additionally not retained after the estimate is computed (see “Where your data lives”).
• Subscription records (transaction, receipt, and entitlement data) — RevenueCat may retain these after account deletion under its retention policy, or where needed to comply with legal obligations, resolve disputes, or enforce agreements. You can email us to request deletion of RevenueCat-linked data; some records may still be retained where legally required.
• De-identified aggregates — data we have already de-identified (see “Selling data” above) is kept indefinitely as anonymized, aggregate records.

Once data is de-identified it can no longer be traced to you, so it is no longer your personal data and cannot be individually located or deleted on request — deleting your account removes your identifiable records and the key that could ever link them back to you.

You can start permanent account deletion at any time from inside the app: go to Profile → Delete Account. The flow removes your Together account, protocols, logs, and notes, and begins the private-file cleanup described above. No email to us is required for that in-app deletion.

For deletion of RevenueCat-linked data, email us at the address below. Deleting your Together account does not cancel an active App Store subscription; subscriptions must be canceled in your Apple account subscription settings.

We protect your data with industry-standard safeguards. It is encrypted in transit using TLS and encrypted at rest in our database and storage. Access is enforced by row-level security, so your authenticated account is the only one that can read or write your records. We limit internal access to what is needed to operate the service.

No system is ever 100% secure, and we cannot guarantee absolute security. If a breach affects your personal data, we will notify you and the appropriate authorities as required by applicable law.

Together is intended for adults. The app is not directed at children, and we do not knowingly collect data from anyone under 18.

If we change how we handle your data, we’ll update this page and revise the date above. Material changes will be reflected here before they take effect.

If Together is involved in a merger, acquisition, financing, or sale of all or part of its assets, your data may be transferred as part of that transaction. We will require any successor to honor the commitments in this policy.

If a transfer would ever result in a material change to how your consumer health data is used, we will not make that change without first giving you lawful notice and, where the law requires it, obtaining your consent or offering you the ability to opt out.

Where the law requires it, we honor recognized opt-out preference signals, such as the Global Privacy Control (GPC), for activity on this website. The Together app itself contains no third-party web tracking and no advertising or analytics SDKs, so there is no cross-site activity in the app for such a signal to control.

Together is an observational record. We do not provide medical advice, diagnose, or prescribe. Your health decisions are between you and a qualified healthcare professional.

Questions about your privacy? Email admin@togetherpep.com.