Privacy policy
1. Summary
My Prime DATA is designed so that we don't need your data to run it. The app understands what you say on your phone. On the free plan there is no account and we receive nothing about you at all. On paid plans we store a backup that is encrypted on your phone before it reaches us. We do not sell personal information, we do not show ads, and we do not share your data with data brokers. You can export everything and delete everything, on any plan.
The short version is the true version. The rest of this page is the detail.
2. What we collect, and where it lives
In the app, on your phone
Everything you say or type into the app — your transcripts, the memories the app builds from them, the tracking rows (for example sleep, water, meals, mood, blood pressure, cycle, fasting), your notes, photos you attach, your settings, and the record of what you said versus what the app inferred — is stored in an encrypted database on your device. We call it your vault. On the free plan, that is the only copy, and we have no access to it.
Account information (Plus, Family Plus)
To back up and sync, you create an account. We collect your email address, the account's creation and last-sign-in dates, your subscription status as reported by Apple or Google (we never see your payment card), and the device identifiers needed to deliver push notifications and sync between your devices.
Encrypted vault backup (Plus, Family Plus)
Your vault is encrypted on your device before it is uploaded. We store the encrypted copy and can see its size and timestamps. Whether we can read it depends on one setting, account recovery:
- Recovery off: the keys exist only on your devices. We cannot decrypt your backup, and if you lose every device and your recovery phrase, neither can you.
- Recovery on: we hold a recovery key for your account so that we can restore your vault to a new device after you prove it's you. While it's on, it is technically possible for us to decrypt your backup. We will only ever do so to carry out a recovery you asked for, or if the law compels us, and we will tell you when we do unless we are legally barred from it. You can turn recovery off at any time in Profile → Account, which destroys our copy of the key.
The app tells you which state you're in.
Requests between people
When you send a task, note or reminder to someone you've connected (see section 5), it travels through our relay as an encrypted envelope addressed to their device. We see who sent to whom and when; we do not see the contents.
Websites
Our websites don't use tracking cookies or analytics that identify you. Our hosting provider keeps standard server logs (IP address, browser, pages requested) for security, for a short time. If you join the waitlist or use a contact form, we keep the email address and message you sent so we can reply.
What we don't collect
We do not collect your location, your contacts, your browsing, or advertising identifiers. We do not use what you say to train models.
3. Consumer health data
Some of what you log is health information: sleep, symptoms, medications, menstrual cycle, mood, weight, blood pressure, and similar. We treat all of it as consumer health data under Washington's My Health My Data Act, Nevada's SB 370, Connecticut's consumer health data rules and similar laws — and we apply the same standard to everyone, wherever you live. This section is our consumer health data privacy notice.
- Collected: only what you choose to log, plus any health data you connect from Apple Health or Health Connect.
- Purpose: to show it back to you, chart it, and find patterns for you. Nothing else.
- Where: on your phone. On paid plans, also in a backup encrypted on your phone before upload (see section 2 for what account recovery changes).
- Shared with: nobody, unless you share a stream with a specific person, or connect a model provider you chose (sections 5 and 6). Our infrastructure providers (section 7) store encrypted data for us and cannot read it.
- Sold: never. We do not sell health data or any other data, and we do not use it for advertising.
- Your rights: access, export, correction and deletion, all available in the app without asking us (section 9).
The app is not a medical device and we are not a healthcare provider. It shows you what you logged; it does not diagnose or advise.
4. Phone permissions
The app asks for each permission when you first use the feature that needs it. You can withdraw any of them in your phone's settings and the app keeps working.
- Microphone and speech recognition — to capture what you say. Recognition runs on the device.
- Notifications — for reminders you set, and for tasks or requests from people you've connected.
- Camera and Photos — only if you attach a picture to an entry. Photos stay in your vault.
- Calendar — only if you connect it, so the app can remind you of what's coming. Read access; it writes only when you confirm.
- Apple Health / Health Connect — only if you connect them, to read the streams you pick (for example steps or sleep) into your cards. We never write to them without your confirmation, and never send Health data to any third party. Data obtained from Apple HealthKit is not used for advertising, marketing, or data mining, and is not sold.
5. Sharing with people you choose
You can connect with a household member, a loved one, or a friend, and later a professional such as a coach. Every connection is one-to-one and invite-only. Sharing is off until you turn it on, stream by stream, and you control the cadence (live, daily, weekly, or only when you tap send). You can always see exactly what the other person can see of you. Turning a stream off stops their view immediately. Something you already sent them stays with them, in the same way an email you sent stays in the recipient's inbox.
The app never shares something because it "looks like" household information. It may suggest sharing; only you decide.
6. Connected models and services
By default the model that understands your speech runs on your phone and nothing leaves. On paid plans you can choose to connect a cloud model (for example from Anthropic, OpenAI or Google, or a server you run) using your own API key. If you do, one sentence per capture — the words you just said — and the app's schema are sent to that provider under your account with them and their privacy terms. Your vault, history, memories and other people's data are never sent. Every capture is labelled with the model that read it, and you can disconnect with one tap; nothing is re-sent afterwards.
If you connect a calendar, health data or files, the app reads them into your vault on your device. We do not receive them.
7. Backup, sync and encryption
Paid plans back up your vault and sync it between your devices. Backups are encrypted end-to-end. Our providers, all processing data on our behalf under contract: Supabase (United States) for accounts, encrypted vault storage and the relay; Expo (United States) for app updates and push delivery; Apple and Google for billing and push; Vercel (United States) for hosting these websites. None of them can read your vault. If we add a provider that handles personal data we'll update this list before it starts.
8. How long we keep things
- Your vault on your phone: for as long as you keep it. We don't have it.
- Encrypted backup: while your subscription is active, and for 30 days after it ends so you can come back. Then deleted.
- Account record: until you delete the account. Then deleted within 30 days; residual copies in our providers' backups expire within a further 90 days.
- Relay envelopes: deleted once delivered, or after 30 days if undeliverable.
- Waitlist and support emails: until you ask us to remove them, or two years after the last message.
- Server logs: 30 days.
9. Your rights and choices
Wherever you live, you can: see everything the app holds about you (it's in the app); export it in full (Profile → Data → Export, on every plan, in JSON and CSV); correct anything (every row and memory is editable); and delete it (section 10). If you are in the EU, UK or Switzerland, our legal bases are: performing our contract with you (running the account and backup you signed up for), your consent (health data, optional recovery, any connector you add), and our legitimate interest in keeping the service secure. You also have the rights to restrict or object to processing, to data portability (that's the export), and to complain to your local data protection authority. Wherever you are — the EU or UK, California, another US state, Brazil, Australia, anywhere — you can exercise your rights by emailing support@myprimedata.app. We will respond within 30 days and will not treat you differently for asking. If we decline a request you can appeal by replying to our response. We do not sell or share personal information for targeted advertising, so there is nothing to opt out of.
10. Deleting your account
In the app: Profile → Account → Delete account. This erases the vault on the device and deletes your encrypted backup and account record from our servers within 30 days. If you can't access the app, email support@myprimedata.app from your account email with the subject "Delete my account". Cancel any subscription with Apple or Google first; we can't do that for you. On the free plan there is no account: deleting the app deletes everything.
11. Children
My Prime DATA is for people aged 13 and over. Where local law sets a higher age for consenting to data processing without a parent (for example 16 in parts of the EU), that higher age applies, or a parent must consent. We do not knowingly collect information from anyone under 13, and accounts are not offered to them. If you believe a child under 13 has used the app with an account, email us and we will delete it.
12. Security
The vault is encrypted at rest on the device using the platform's secure key storage. Backups are encrypted before upload. Connections to our servers use TLS. Destructive actions ask for confirmation. No system is perfectly secure; if we learn of a breach affecting your data we will tell you and the relevant authorities as the law requires.
13. International use
We are a United States company, our servers are in the United States, and the app is available worldwide. If you use it from elsewhere, the data you choose to back up is transferred to and stored in the US. For people in the EU, UK and Switzerland, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum and the Swiss equivalents for those transfers, and the backup is encrypted on your device before it travels. You can ask us for a copy of the clauses.
14. Changes to this policy
If we change this policy in a way that matters, we'll tell you in the app before it takes effect and keep the previous version available on request. The effective date at the top always reflects the current version.
15. Contact
My Prime Data Annotation Tracking and Analysis App LLC
30 N Gould St, Suite R, Sheridan, Wyoming 82801, USA
support@myprimedata.app