Privacy Policy

Overview

Frontload keeps your health data on your phone unless you turn on Cloud Backup. You can use every tracking feature without an account. If you turn on Cloud Backup, a copy of your tracked data is stored on our servers so you can restore it on a new phone. This page explains what leaves your phone, when, and who can see it.

Data Stored on Your Device

Everything you enter is stored in the app's storage on your phone. That includes your stack, protocols, dose logs, inventory, labs, nutrition, supplements, meds, sleep, fitness, vitals, body scans, side effects, symptoms, profile, progress photos, and AI Coach chats. If you never turn on Cloud Backup, we don't store any of it on a server. A few features send limited data off your phone to work. Each one is named below. Progress photos never leave your phone unless you share one or send it to the AI Coach.

Cloud Backup (Optional)

Cloud Backup is part of Pro (the free trial doesn't include it), and it's off unless you turn it on in Settings → Cloud Backup. To use it, you sign in with your email address. Each time you sign in, we email you a one-time code. There is no password. If you never sign in, the Cloud Backup sections of this policy don't apply to you.

What Cloud Backup Stores

When you back up, we copy this data from your phone to our database: protocols, dose logs, inventory, meds, supplements, and med and supplement check-offs; nutrition, sleep, fitness, and vitals, including data the app read from Apple Health or Health Connect; labs, body scans, side effects, symptoms, and cycle tracking; your profile, including your name, date of birth, sex, height, and weight if you entered them; the app preferences that should follow you to a new phone; and AI Coach chats, coach memory, and pinned facts. We also store your email address, the date each item last changed, and a list of the phones that have signed in to your account. For each phone, that list holds a random ID created only for Cloud Backup, the platform, the app version, and when the phone was first and last seen. For each phone that's signed in, we also keep the IP address and user agent (basic app and phone details) it most recently connected from. They're deleted when that phone signs out or when you delete your account. To check that your account has Pro, we also store the ID each signed-in phone uses for purchases, and what RevenueCat, our subscription service, tells us about it: whether it has Pro and when Pro ends.

What Cloud Backup Does Not Store

Progress photos, images you attach in AI Coach chats, the built-in knowledge base, settings that belong to one phone (such as notifications and Health sync), and any old API keys from earlier versions of the app are never uploaded to Cloud Backup.

Where Cloud Backup Is Stored

Cloud Backup data is stored by Supabase, our database provider, in the United States. It's encrypted in transit and encrypted at rest by the provider. It's not end-to-end encrypted. That means our servers can read it, which is what lets us restore it to a new phone. Database access rules let your signed-in app read and write only your own data.

Who Can Access Your Backup

Frontload is built and run by one developer at Stackeddd LLC, who has admin access to the database. We only look at a backup when you ask us for help, to fix a problem with the service, or when the law requires it. We count, in total, how many people use Cloud Backup and its features, to decide what to improve. This never involves reading what's in your backup. Supabase and the cloud provider it runs on operate the systems your backup is stored on, under their own security and privacy terms. We don't sell your data or use it for ads. If you turn on community sharing, totals across many sharers are shown to other sharers and may appear in our posts. They never identify you. Community sharing is part of Pro and for adults 18 and over.

Community Sharing (Optional, Web Only)

Community sharing is off unless you turn it on yourself, on the Frontload web dashboard, one category at a time: Protocols, then Labs and Side effects, which need Protocols. It's part of Pro and for adults 18 and over. It uses your Cloud Backup, so it's only available to Cloud Backup accounts.

When you turn a category on, the dashboard makes a simplified copy of that category from your Cloud Backup and stores it separately from your backup. Compounds only if they're from the app's list (a custom name is left out, with its labs and side effects). Doses as ranges, such as 100-150 mg a week. Schedules, such as every 3 days. How long a protocol has run as a range of weeks, never a date. For labs: the marker and its value rounded to 3 significant figures, only for draws taken on a shared compound with a dose range, with that dose range, when the draw fell in your dosing interval, and whether the protocol had reached a steady state. For side effects you linked to a protocol: the type from the app's list, how strong, and how many weeks in. Your sex. It never includes your name, email, age, notes or anything you typed yourself, coach chats, coach memory, photos, exact dates or times, record IDs, or anything read from Apple Health or Health Connect. The copy is refreshed from your Cloud Backup when you open the dashboard, at most once a day.

Nobody sees your entries, including other users. People who share can see community totals for a compound only when at least 10 people share it, and a dose range, schedule or side effect reported by fewer than 5 people is folded into "Other" or left out. Shares are rounded to the nearest 5%, counts are rounded down to the nearest 10, and lab values are shown only as a median, or for groups of 50 or more sharers a median and middle range, never a lowest, highest or single value. Totals update once a night. We may publish community totals, for example on our blog or social accounts. Published totals never identify anyone, and totals we've already published stay published.

This copy is de-identified, not anonymous: we keep a private link between your account and your shared entries, only so that turning a category off or deleting your account can remove them. Turn a category off and its entries are deleted right away; they leave the totals at the next nightly refresh. Deleting your account deletes them too. Signing out or using Clear All Data on your phone doesn't turn sharing off; turn it off on the dashboard. If your Pro ends, your entries leave the totals at the next nightly refresh, and 90 days after your Pro ends they are deleted. A copy that isn't refreshed for 180 days is deleted. We record which version of the sharing terms you agreed to and when. New or changed shares join the community totals 3 to 14 days after they are sent.

How Long We Keep It

We keep your backup for as long as your account exists and you have Pro. If your Pro ends, backups pause, and we keep your backup for at least 90 days after it ends. After that it may be deleted. We tell you before that happens, in the app or by email. Resubscribe before then and backups pick up where they left off, with nothing lost. When you delete an item and then back up, the item is marked deleted. It's kept for 30 days, during which we can recover it if you ask, then permanently erased. Our database provider also keeps automated backups of the whole database for a limited time, after which they're deleted.

Deleting Your Account

You can delete your account in the app: Settings → Cloud Backup → Delete account. This immediately and permanently deletes your account, your email address, and everything stored in Cloud Backup. It also deletes anything you share with the community. Copies in the provider's automated backups are deleted when those backups expire. The data on your phone isn't touched. If you no longer have the app, email feedback@stackeddd.app from the address you signed in with, and we'll delete your account within 30 days.

Sign-In Emails

Resend, our email provider, sends sign-in codes from noreply@frontloadapp.com. Resend receives your email address and the code. We use your email address only to sign you in and to send notices about your account. We never send marketing to it. Before we send a code, Cloudflare Turnstile checks that the request comes from a person and not a bot. Cloudflare receives technical details from your phone for that check, such as its IP address and browser information. Like most sign-in systems, our providers may keep standard security logs of sign-in requests, such as the IP address a request came from. We keep a record of when each sign-in code was sent, linked to your account's ID, for 7 days to spot abuse, then delete it. It's kept for those 7 days even if you delete your account sooner.

Web Dashboard

With Pro, you can also use your Cloud Backup on the web at app.frontloadapp.com, our web dashboard. You sign in with the same email code. The dashboard reads and changes your Cloud Backup from your browser, and keeps only your sign-in session and display settings there. It's hosted by Vercel and has no analytics. If you use the AI Coach on the dashboard, it goes through the same relay as in the app, and we count your usage in our database by account instead of by an anonymous ID.

AI Coach

When you message the AI Coach, your message, any photo you attach, and the parts of your health data needed to answer it are sent through our relay server, hosted by Netlify, to Anthropic's API to generate a reply. The relay doesn't keep your messages. To enforce limits and track costs, it records usage counts, such as how many tokens a request used, next to an anonymous per-install ID. That ID isn't linked to your name or email unless you turn on Cloud Backup. To check that you have Pro, Cloud Backup stores the ID your phone uses for purchases, which is usually this same ID. Under Anthropic's current API terms, conversations aren't used to train AI models. Your chat history is stored on your phone, and in Cloud Backup if you turn it on.

Lab PDF Parsing & Photo Scanning

When you upload a lab PDF or scan a label or nutrition screenshot, the file is sent through our relay to Anthropic's API for one-time extraction. The extracted data is saved on your phone. The original file is not kept on any server we control.

Knowledge Base Search

When you message the AI Coach, the text of your question is sent through our relay to Voyage AI, an embedding service, to find the most relevant entries in the built-in knowledge base. Voyage AI receives only the text of your question, not your health data. Per its API terms, it doesn't keep the content.

Apple Health (iOS)

On iOS, the app can read selected data types from Apple Health: steps, distance, calories, heart rate, resting heart rate, heart rate variability, sleep stages, oxygen saturation, respiratory rate, workouts, dietary intake (protein, carbs, fat, calories, fiber), body mass, and basal metabolic rate. Reads happen on demand and the data is shown in the app's screens. It is also included in the AI Coach context only when you send a message that benefits from it. Apple Health data is not used for advertising or marketing, is never sold or shared with third parties, and leaves your phone only through the AI Coach, and through Cloud Backup if you turn it on. You can pause this sync at any time in Settings → NOTIFICATIONS & SYNC → Apple Health Sync, or revoke individual permissions in the Health app under Profile → Privacy → Apps → Frontload.

Health Connect (Android)

On Android, the app can read selected data types from Google's Health Connect: steps, distance, calories, heart rate, resting heart rate, heart rate variability, sleep stages, oxygen saturation, respiratory rate, weight, and basal metabolic rate. This data is read on demand and shown in the app's screens. It is also included in the AI Coach context only when you send a message that benefits from it. Health Connect data is not used for advertising or marketing, is never sold or shared with third parties for their own use, and leaves your phone only through the AI Coach, and through Cloud Backup if you turn it on. You can pause this sync at any time in Settings → NOTIFICATIONS & SYNC → Health Connect Sync.

Subscription & Billing

If you subscribe to Frontload Pro, billing is handled by Apple's App Store (on iOS) or Google Play Billing (on Android). Your subscription state (free trial, paid, or expired) is checked through RevenueCat, a third-party subscription management service. RevenueCat sees your platform subscription identifier, your current entitlement state, and the date your app last checked that state. If you use Cloud Backup, our server also asks RevenueCat whether the purchase IDs linked to your account have Pro. RevenueCat does not see your health data, your messages with the AI Coach, or anything you have logged in the app.

Feedback

If you submit feedback with the Send Feedback button, your message is sent through our relay to the developer's Google Workspace email inbox. Feedback may include the text you type, your email address (if provided), and any screenshots you attach. This data is used only to respond to your feedback and to fix the issue you're reporting. It is not shared with third parties.

Crash Reporting

If the app crashes, anonymous crash data (the type of error, which file it occurred in, and the device's OS version) is sent to Sentry to help us fix bugs. Crash reports do not contain your health data, your messages with the AI Coach, or anything you have logged. They contain only technical details about what failed.

First-run milestones

To find where people get stuck, and to tell whether a problem is specific to iPhone or Android, we record a small, fixed set of anonymous signals: which milestones you reached (for example, finishing onboarding, adding a first protocol, logging a first dose, or opening the AI Coach), how many days after installing you reached each one, your platform, your app version, and a once-a-day note that the app was opened. That daily note is what lets us see how long people keep using the app, which is the only way to tell a real problem from normal drop-off. These signals never include what you log: not your compounds or doses, not your labs, not anything you type to the coach. They're stored on Netlify, which hosts our relay, tied only to the per-install ID described above (it resets if you reinstall), never to your name or email. If you turn on Cloud Backup, that ID is usually linked to your account, as described above. They're never sold and never shared with advertisers. We keep them for 12 months.

No third-party analytics

We don't use any analytics or advertising SDKs in the app (no Google Analytics, Amplitude, or similar). The signals above are our own minimal measurement: which steps were reached, how long after install, on what platform and app version, and whether the app was opened on a given day. The one exception is the diagnostic data Google's ML Kit library sends on Android, described in the next section. We don't track what you view, what you tap, or how long you spend anywhere in the app, and these signals never include the contents of what you log.

Progress photo pose detection (Android)

On Android, the Progress Photos camera uses Google ML Kit to find your pose and line up each shot. Pose detection runs on your phone. Like every app that uses ML Kit, it sends Google a small amount of diagnostic data: device information (manufacturer, model, OS version), the app's package name and version, device and per-installation identifiers, performance metrics such as latency, and settings such as image format and resolution. Google says it uses this data for diagnostics and usage analytics, does not transfer it to third parties, and encrypts it in transit. For pose detection, ML Kit also uses Firebase remote configuration and installation services. Your photos are not part of what Google lists as collected. On iPhone, pose detection uses Apple's on-device Vision framework instead of ML Kit.

This Website

Our website, frontloadapp.com, is hosted by Vercel and uses Vercel Web Analytics to count visits to its pages. That is separate from the app. Nothing you log in the app is sent to the website. If you sign up for bloodwork price alerts on our website, your email address, your IP address, and the time you signed up are sent through our relay to our Google Workspace email inbox. We use your email only to send those alerts, and you can email feedback@stackeddd.app anytime to stop them and have it removed.

No Advertising, No Data Sales

We do not run ads. We don't sell your data or use it for ads. If you turn on community sharing, totals across many sharers are shown to other sharers and may appear in our posts. They never identify you.

Legal Requests

If we receive a legal demand for user data, we respond only as the law requires. Data that stays on your phone isn't on our servers, so we can't hand it over.

Data Deletion

You can delete the data on your phone at any time by clearing the app's data through your device settings, or by uninstalling the app. Doing that doesn't delete your Cloud Backup. To delete your Cloud Backup, see Deleting Your Account above. Clearing the app's data doesn't turn off community sharing. Turn it off on the web dashboard, or delete your account. The anonymous usage signals described above are deleted automatically after 12 months; to have them removed sooner, email feedback@stackeddd.app with your install ID (shown in Settings) and we'll delete that record. To request deletion of your subscription state held by RevenueCat, email the same address and we will request its removal. Crash reports held by Sentry expire automatically per its retention policy.

Service Providers

These are the services we use and what they receive. Supabase (United States) stores Cloud Backup and community sharing and runs sign-in, and receives your email address, your backup, what you choose to share with the community, and your list of phones, only if you turn on Cloud Backup. Resend sends sign-in codes and receives your email address and the code. Cloudflare runs the bot check before a code is sent and receives technical details from your phone for it. Netlify hosts our relay and stores usage counts and milestones. Anthropic runs the AI Coach and lab and label scanning, and receives your message, the health data needed to answer it, and files you scan. Voyage AI runs knowledge base search and receives the text of your coach question. RevenueCat checks your subscription status. Apple and Google handle billing. Sentry receives crash reports. Google ML Kit (Android) receives the diagnostic data described above, not your photos. Google Workspace receives what you send with Send Feedback and bloodwork price alert signups from our website. Vercel hosts our website and counts its visits, and hosts the web dashboard.

Children

This app is not intended for users under 18. We do not knowingly collect information from minors.

Changes to This Policy

We may update this policy as the app evolves. Material changes will be noted with an updated date at the top.

Contact

Questions about privacy? Email feedback@stackeddd.app or use the Send Feedback button in the app.