Privacy Policy and Consumer Health Data Privacy Policy

Last updated: October 31, 2026

You Got This ("the app", "we") is run by Rebecca Merendino. This page explains what the app collects, why, who else touches it, how long we keep it, and how you can see, export or delete it. It is also our Consumer Health Data Privacy Policy under Washington's My Health My Data Act and similar state laws.

Questions or requests: support@yougotthisbuddy.com.

1. What we collect

Account. When you sign in with Apple or Google, we receive an account identifier from that service and, if the service shares it, your email address. We do not receive or store a password.

Health and fitness data you enter or the app reads (we treat all of this as consumer health data):

• food and drink logs: names, portions, calories and nutrients, water;
• workouts and activity;
• body weight, height, goals and calorie targets;
• menstrual cycle entries, if you turn cycle tracking on (you can turn it off);
• progress (body) photos and body estimates, if you use that feature;
• meal plans, recipes and grocery lists.

Photos and text you send for an AI estimate — a food photo, a note about a meal, or a progress photo (with the height, weight, age and sex you entered) — see section 3.

Purchases. If you subscribe, we receive Apple's signed record of the purchase (product, dates, status), not your payment details.

Partner features. If you link with a partner, we store your partner code, the display name you choose, and the link between your two accounts.

What we don't collect: we don't use advertising or analytics SDKs, we don't track you across other apps or websites, and we don't collect your location or contacts.

2. Apple Health

With your permission, the app reads from Apple Health: workouts, steps, active and resting energy, body weight, height, sleep, date of birth, biological sex, and — only if you track a cycle — menstrual flow; and writes to Apple Health: workouts, active energy, food energy, protein, carbs, fat and water that you log in the app (meal plans are never written). Deleting a food log in the app also removes what it wrote to Apple Health. You can change these permissions any time in the iPhone Settings app → Health → Data Access.

Data from Apple Health is used only to show and run the app's features for you. It is never used for advertising, marketing, or selling, and never shared with anyone for those purposes.

3. AI estimates (Anthropic)

Some features send what you give them to Anthropic, an AI company, to get an answer back: food photo estimates, food text estimates, progress photo estimates, meal-plan drafts (recent meal names and your calorie target), translations, and in-app chat. The app asks your permission before the first time.

• It goes from your phone to our server, then to Anthropic's API. We don't send Anthropic your email or account identifier.
• Anthropic's published policy for its API is that it does not train its models on these inputs and outputs by default, and deletes them within 30 days, except where it must keep them longer to enforce its usage policy or comply with law.
• The AI request itself is not stored on our server. A food photo you save with a log is stored in your account like your other records; progress photos are stored on our server only if you turn that on.

If you don't want this, don't use the AI features; everything else works without them.

4. Where your data is stored

Your account data is stored on our server, which runs on Cloudflare (Workers and Durable Objects). Each account has its own separate storage. Records and photos are encrypted at rest with a key unique to your account, and everything travels over HTTPS. Data is also kept on your phone so the app works offline.

5. Who can see it

• You.
• Your partner, only what you choose to share once you link (for example a shared meal plan). Unlinking stops it.
• Our service providers: Cloudflare (hosting and storage), Anthropic (AI estimates, section 3), Apple and Google (sign-in), Apple (purchases and TestFlight). They process data only to provide their service to us. We require them to protect your data at least as well as this policy does.
• The people who run the app, only to restore your data, fix a problem you reported, or comply with law. That access is logged.
• Authorities, if the law requires it.

We do not sell your data, and we do not share it for advertising.

6. How long we keep it

As long as your account exists. When you delete your account, your records, photos, sessions and your account's encryption key are deleted from our server right away. Copies on your phone stay until you delete the app. What Anthropic received follows section 3.

7. Your choices and rights

• See or export your data: in the app (Settings → Move my data), or write to us.
• Delete your account and its data: in the app (Settings → Delete account), or write to us.
• Withdraw consent: turn off Apple Health access in iPhone Settings, stop using the AI features, turn off cycle tracking or partner sharing in the app, or delete your account.
• Ask whether we hold your data, or appeal a decision about your request: write to support@yougotthisbuddy.com. We answer within 45 days. If we refuse a request, you may appeal by replying to our answer; Washington residents may also contact the Washington State Attorney General.

We won't treat you differently for using these rights.

8. Children

The app is for people 18 and over. We don't knowingly collect data from children under 13. If you think a child has used it, write to us and we will delete the account.

9. Beta testers

If you test the app through TestFlight, Apple also shares crash reports and the feedback you send with us, under Apple's own TestFlight terms. Beta data is treated exactly like everyone else's under this policy.

10. Changes

If we change this policy, we'll update the date above. If a change lets us use your health data in a new way or share it with someone new, we'll ask your permission in the app first.

11. Contact

Rebecca Merendino · support@yougotthisbuddy.com