privacy, in plain words

the app

your logs live on your phone: weight, food totals, sessions, measurements, and anything else you add. there's no account, no name needed, no ads, no tracking and no analytics. there's no AI inside: the coaching and the learning are plain maths that run on your phone.

if you allow Health Connect, the app reads only the parts you switch on: your steps, weigh-ins from a scale, and with cycle care, period days. it never writes anything back, and it never sends any of it anywhere.

scanning a barcode asks Open Food Facts, a free and open food database, for that product. only the barcode number is sent. the camera is used only while you scan; nothing it sees is kept, and the app never uses the microphone.

cycle care is off unless you turn it on. your period days, symptoms, mood and symptom diary stay on your phone like everything else. if you share the diary with a doctor, you choose where the file goes. if you switch on backup, they're locked on your phone before they leave it, like the rest of your logs.

a few things open other apps when you tap them: the music button opens Spotify, "open in YouTube" opens that exercise's video, and helpline numbers open your phone's dialer. nothing about you is sent with them.

every exercise has a short how-to video from YouTube. nothing is loaded from YouTube until you tap play; then the video plays inside the app from YouTube's no-cookie player, and YouTube sees that request the way it sees any video you watch.

"notice walks" is off unless you turn it on. while the app is open, it counts steps from your phone's own step sensor, so your companion can walk along and the steps can join your day. it never uses your location, and the steps stay on your phone like everything else.

the body read (how ready you are each day, from your sleep, food, training and logs) is worked out on your phone. nothing is sent anywhere to make it.

the weather is off unless you pick a city. then the app asks our server for that city's weather and air, at most once an hour while it's open; our server asks Google for it and keeps each area's reading for half an hour, so everyone nearby shares one. if that doesn't work, the app asks Open-Meteo, a free weather service, instead. only the city's place on the map is sent (and the name you type, to find it, to Open-Meteo's city search), never your own location. our server keeps a salted hash of your address for the day's limit, like everywhere else on it. turning the weather off forgets the city.

backup (optional)

if you switch on backup with an invite, the app makes 12 words for you. everything is locked on your phone with a key made from those words before it's sent. our server stores the locked records, which it can't open, plus a one-way hash of your key, how big each record is and when it changed. records are padded, so sizes don't give away what they are.

progress photos are never backed up. they stay on your phone.

keep your 12 words safe. we can't recover them, and we can't read your data, even if asked.

you can delete your cloud copy from the app at any time. you have 7 days to change your mind, then it's gone for good.

invites and downloads

invite codes are kept only as a one-way hash. we count downloads per invite. to stop people guessing codes or backup keys, a salted one-way hash of your internet address is kept for up to 7 days, then deleted. the code after the # in an invite link never reaches our server's logs.

updates

the app checks for a new version by asking for a small file that lists the latest version. it sends nothing about you.

who else is involved

Cloudflare runs our server and this site, and keeps short technical logs. Google provides the weather and the air, and Open-Meteo the city search. that's it.

questions

write to hello@thekatto.app.