Privacy notice
Who we are
Treuwin (say it TROO-win) is a wellness coaching app at treuwin.com, run by the Treuwin team. Your coach is an AI. Every message carries a label saying who wrote it: "Your coach" (the AI) or "Treuwin" (the app itself), and both are tagged AI. No person writes in the chat. The Treuwin team can read your thread, and each time someone opens it you see it under You in the app, in Access record.
This is a test of an accountability coach run by the Treuwin team, and the app is invite-only. It is not medical care, and the coach is not a doctor or dietitian.
Who writes the messages
Your coach is an AI: Claude, from Anthropic. Its messages are labelled "Your coach" and tagged AI. It replies on its own from your first day: no person checks its messages before they are sent, and the Treuwin team reads the chats afterwards: all of them in your first week, then flagged ones and a sample. Some messages come from the app itself and are labelled "Treuwin" and tagged AI: safety cards and other fixed messages written in advance, and the cards that list the foods found in a meal you send, with short replies about that meal (such as "Saved to your food log."). No person on the Treuwin team writes to you in this chat. If you write something that sounds like a crisis, the app shows a safety card at once and alerts the Treuwin team, who may not see it straight away.
What we collect
- Your account: your email address, the one on the invite list, which you sign in with.
- Messages: what you write in Chat, and every message in your thread.
- Check-ins: sleep, mood, energy, weight and an optional note.
- Your goal, commitments and ticks.
- The Day 0 health questions. On Day 0 someone from the Treuwin team also asks you a few health questions, on a call or in person (any conditions, and the SCOFF eating questions). From your answers we store only the conditions you name, the number of yes answers, the coaching level they give (0, 1 or 2) and, for level 2, its end date. The answers are never sent to an AI, and the AI coach is told only the level. If you tell the Treuwin team on Day 0 that you take a GLP-1 medicine, that is stored too, and the AI coach is told only that you are "on a GLP-1 plan", never which medicine or dose.
- Meals, from the start: the meals you log, typed or as photos, with the foods, portions and estimates the app shows. If you tick the second box, Google Gemini reads your meal photos and the meals you type to find the foods and estimate the amounts. It gets the photo and the text, never your profile, health or allergy details. Please keep faces and documents out of meal photos. The foods, portions and calories the app shows are estimates, not medical advice: check with a doctor before acting on them. Without the second box, meals you type are matched from our food list on our own server, and photos are not sent.
- What the coach remembers: the notes under "What your coach knows" in You.
- Settings and consents: pause, quiet hours, how often the coach writes, and the consent boxes you ticked, with the version and time of each.
- The push token: if you turn on notifications, your phone's push token, so that notifications reach your phone.
- The app version: with each request the app sends its version, the platform (iPhone or Android) and its build date, so that the server can ask an old version to update.
- For iPhone friends, the iPhone's device identifier: before the test app is built, you send it through Expo's registration link, and it is registered in the Treuwin team's Apple developer account, so that the test app installs on your iPhone. Expo and Apple keep it.
- Safety records: that a safety card was shown, and when, never what was said.
- Server logs: that a request happened and how it went, without message text, food names or health values.
Apart from the Day 0 questions, please do not send lab results, diagnoses, medication names or doses.
Why we collect it
- To run this test of the coach: the AI coach uses your messages, check-ins, goal, commitments, ticks and meals to write to you, and the Treuwin team uses them to check the coach and keep you safe.
- To find the foods in your meals and show your day.
- To keep you safe: your messages, the meals you type and the check-in note are checked for signs of a crisis, an eating disorder or a medical emergency, and the app shows a fixed safety card when a check finds one. The safety records give the yearly crisis-referral counts we report.
- To sign you in, send notifications, ask an old version of the app to update, and keep the server working.
Who reads it
The Treuwin team can read your thread, and each time someone opens it you see it under You, in Access record. The Treuwin team also sees your check-ins, commitments and what the coach remembers. Messages are encrypted in transit but are readable on our server; they are not end-to-end encrypted.
The companies below process your data for us.
Who processes your data
These companies process data for us. We give these companies your data only to run this test. We use no ad or analytics tools, and we never sell or share your data for marketing. The medical conditions, allergies and medications in your health profile are never sent to an AI. What you type in a message is, so please do not send lab results, diagnoses, medication names or doses.
- Anthropic (Claude API). Writes the coach's AI messages and screens messages for safety. Receives your messages and a summary we build for each reply: your check-ins (sleep, mood, energy, weight), commitments and ticks, what the coach remembers about you, your dietary pattern and risk tier (never the conditions behind it), that you are on a GLP-1 plan if you told us so, and the meals you log. Only with your agreement to the coach. When we test the coach, Claude grades anonymised cases only. If Claude is unavailable, no other AI replies: you get a fixed message instead.
- Google. Google Gemini (Gemini API) reads meal photos and meals you type to find the foods, only if you tick the second consent box; please avoid faces and documents in photos. On the paid tier we use, Google keeps the prompts Gemini receives, meal photos included, and its responses for 55 days. Google Cloud (Cloud Run, Cloud Tasks, Cloud Scheduler) runs our server in the US, so your messages, check-ins and meals pass through it. Cloud Logging keeps server logs for 30 days, without message text, food names or health values. Firebase Cloud Messaging delivers notifications to Android phones; it receives the notification text, which never contains health words.
- USDA. If Gemini finds a brand, we look up the brand and food in USDA's food database, with nothing about who you are.
- Apple. So that the test app installs without TestFlight, your iPhone's device identifier is registered through Expo's registration link in the Treuwin team's Apple developer account, so Expo and Apple keep it. Apple's push service delivers notifications to iPhones; it receives the notification text, which never contains health words. TestFlight comes later, and then delivers the iPhone test app and receives the email address you are invited with.
- Expo. Builds the app, and delivers notifications and app updates. Its registration page receives your iPhone's device identifier. Its push service passes notifications to Apple and Google; it receives your device's push token and the notification text. When the app opens, it asks Expo for an update, sending technical details about the app and your phone (such as the app version and the platform), never your health data.
- Supabase. Our database and sign-in, in the US. Stores your account (your email address) and everything you send: messages, check-ins, commitments and ticks, and your meals.
- Cloudflare. R2 stores meal photos and our encrypted backups. Pages hosts these web pages, which run no scripts.
- Resend. Sends sign-in codes by email; receives your email address and the code.
- GitHub. Runs the nightly backup job, which encrypts the backup before it is stored in Cloudflare R2. Backups never hold the record of what was sent to an AI.
- UptimeRobot. Checks every 5 minutes that our server is up.
Not used yet
These are added in later versions of the app, each named here when it starts:
- Apple HealthKit and Google Health Connect: data sources on your phone, read only with your consent.
- Apple WeatherKit: receives a coarse area, never your precise location.
- RevenueCat: purchase data only, no health data.
How long we keep it
| Data | Kept for |
|---|---|
| Meals, photos, profile, check-ins, commitments and ticks (sprint photos included) | Until the user deletes them. A meal photo goes with its meal or the account; a photo never saved may stay until the account is deleted |
| Chat thread | Until the user deletes it ("Forget everything" or account deletion) |
| Memory lines | Until the user deletes them; edited lines keep their history until forgotten |
| AI transcript (what was sent to and returned by the model) | 30 days, then deleted; run rows without content stay |
| Shadow drafts and diffs | 30 days; the edit code and the gate's reason stay without text |
| Anonymised eval cases from the sprints | Until the friend asks for removal (private repo) |
| Snapshots | 30 days |
| Safety events (no content) | 3 years, for the yearly referral counts; on account deletion the row loses its account id |
| Operator access log | Life of the account |
| Model call ledger | 90 days |
| Cloud Logging (no food names, message text or descriptions) | 30 days |
| Encrypted backups | Up to 93 days. They never hold the AI transcript, snapshots or shadow drafts, so the 30-day rows above hold for backups too |
| GitHub Actions logs | 14 days |
| Data sent to Anthropic and Gemini (paid tier) | As each vendor's API data terms state: Anthropic: Anthropic deletes API inputs and outputs from its backend within 30 days of receipt or generation, but may keep them longer to enforce its Usage Policy (including up to 2 years, with classification scores up to 7 years, if its automated trust and safety systems flag them as violating that policy) or to comply with the law. Source: Anthropic's privacy center, read 2026-11-06. Google Gemini: On the paid tier, Google keeps text prompts, other context sent with them and responses for 55 days to detect and prevent policy violations and for any required legal or regulatory disclosures. Google's usage policies page for the Gemini API does not name images, but Google's Terms count them as part of prompts, so we treat meal photos as kept for those 55 days too. Source: that page, read 2026-11-06. |
| Push tokens | Until sign-out, notifications off, account deletion, or Expo reports the device unregistered |
Your choices
- Export: in You, Export my data gives you a file of your data, without the photos.
- Forget everything: in You, under "What your coach knows", deletes what the coach remembers, your chat thread, and your commitments and ticks; your meals and check-ins stay. The confirm screen first lists exactly what goes and what stays. You can also edit or delete a single line there.
- Delete a meal: open the meal and choose Delete this meal; a meal with a photo goes with its photo.
- Delete your account: in You, Delete my account erases your data from the app at once and from our backups within 93 days. Support says what stays.
- Withdraw consent: in You, under Consents. Without the second box, photos are not sent to Google Gemini and meals you type are matched from our food list. Withdrawing the main agreement turns the coach off, and your thread stays readable.
- Pause: Pause stops messages, but safety cards still reach you.
You can quit at any time, with no reason.
Who can use the app
You are 18 or older, live in the US, India or Germany, and do not live in Washington or Nevada. The app is invite-only.
Health data
How we handle consumer health data is set out in the separate Consumer Health Data Privacy Policy.
Contact
To reach the Treuwin team, contact the person who invited you.