Privacy Policy

This Privacy Policy describes how Reseda Labs LLC ("we", "us", "our") collects, uses, and shares information when you visit suplmnt.app (the "Site") and when you use the Suplmnt app for iOS (the "App"). By using either one, you agree to this Policy.

The Site and the App work differently, so this Policy covers them separately. The Site runs web analytics and an email waitlist. The App has no accounts and no sign-in, and what you record in it is kept on your device.

The Site

Information you provide

The Site does not offer accounts, logins, or purchases. The only information you can submit is your email address, through the waitlist form. When you submit that form we also record which section of the Site the form appeared on.

Information collected automatically

When you visit a page, our analytics providers record the page viewed, the referring page, and general device, browser, and country information. Our hosting provider processes standard web request data, including IP address, in order to deliver the Site.

How we use it

We use the information described above to:

send you a notification when the Suplmnt app becomes available, if you joined the waitlist;
understand which pages and sections are used, so we can decide what to publish next;
operate, maintain, and secure the Site.

We do not use your email address for any purpose other than the waitlist notification described above, and we do not combine it with analytics data.

Cookies and analytics

We use two analytics services on the Site. Umami is self-hosted by us at analytics.suplmnt.app and does not set cookies or use a cross-site identifier. Google Analytics 4 is provided by Google LLC and does set cookies in your browser; it is configured on every page with advertising storage, ad personalization, and ad user data disabled.

You can block or delete cookies through your browser settings, and you can opt out of Google Analytics using Google's browser add-on at tools.google.com/dlpage/gaoptout. Neither analytics service runs in the App.

The iOS App

No account, no sign-in

The App has no accounts, no logins, and no sign-up. It never asks for your name, email address, phone number, or date of birth, and there is no profile of you on our servers, because the App does not create one.

What the App stores on your device

The App keeps a local database on your iPhone so it can remember your stack and what you have looked at. That database holds:

the supplements and products you add to your stack, with their doses, timing, schedule, and the reasons you chose them, plus the history of changes you make to that list;
doses you log as taken;
the health goals and concerns you select, and self-reported safety inputs such as whether you are pregnant or take a medication class the App checks against;
self-experiments you run, including your check-in answers and the responses you give to the questionnaires and phone-based tests inside them;
a record of products you scan, which stores the barcode number, the product it matched, and the time of the scan;
ingredients, products, posts, and articles you have viewed, saved, or searched for;
in-app interaction events (which cards you opened, how long you stayed) and the personalization scores the App calculates from them to rank what it shows you.

Your device data stays on your device

None of the information in the list above is transmitted to us or to anyone else. The App has no code path that uploads it, no server-side account to upload it to, and no iCloud or CloudKit sync. It is stored locally, it is covered by your device's own encryption and passcode, and deleting the App deletes it. We cannot see it, export it, or restore it for you.

What the App downloads

The App downloads its evidence library, article text, images, and product data from cdn.suplmnt.app and suplmnt.app, both served through Cloudflare. These are read-only requests for the same published content every user receives; the App sends no personal information with them, and nothing about your stack or your activity is included in the request. As with any internet request, Cloudflare processes standard web request data, including IP address, in order to deliver the content. We do not use those request logs to build a profile of you.

Camera and label scanning

The App asks for camera access so you can scan a supplement label or barcode. Scanning runs entirely on your device using Apple's Vision framework. Photos and the text read from a label are never uploaded to us or to any third party, and the images themselves are not saved. The App matches a scan against a product index it has already downloaded, so a scan does not require a network lookup of what you scanned. If you decline camera access, the rest of the App still works.

On-device intelligence

Some of the App's writing and search features use Apple's FoundationModels framework, which runs a language model on the device itself. Those prompts and their results stay on the device. The App sends nothing to any external AI service, and there is no such service in it to send to.

Notifications

If you allow notifications, the App schedules them locally on your device. There is no push server, and we do not receive a device token or know whether a notification was delivered. You can turn notifications off at any time in iOS Settings.

Subscriptions and payments

Suplmnt Pro is sold through the Apple App Store. Apple processes the payment, and we never receive or store your payment card details.

We use RevenueCat, Inc. to manage subscription entitlements, which means checking whether your subscription is active. RevenueCat receives your App Store transaction data (the product purchased, purchase and renewal dates, and subscription status), an anonymous identifier it generates for your installation of the App, and basic device and app-version information. We do not give RevenueCat your name, email address, or any other identity, and we do not link your subscription to anything you record in the App. RevenueCat processes this data on our behalf under its own privacy policy.

Health data, tracking, and analytics

The App does not use HealthKit and does not read from or write to Apple Health. It contains no advertising, no advertising identifier (IDFA), no App Tracking Transparency prompt, and no third-party analytics or crash-reporting SDK. It does not track you across other apps or websites, and its App Store privacy manifest declares exactly that.

Beta builds (TestFlight)

We distribute pre-release versions of the App through Apple's TestFlight. If you install a TestFlight build, Apple collects installation, crash, and basic usage data about that build under Apple's own privacy policy, and shares it with us in aggregate along with any feedback you choose to send through TestFlight. This applies only to TestFlight builds, not to the App Store release.

Third-Party Services

We use the following third-party service providers, each of which processes information under its own privacy policy:

Kit (formerly ConvertKit) (Site) — email service provider; receives and stores your email address when you submit the waitlist form.
Google LLC (Site) — Google Analytics 4 and Google Tag Manager, as described above, and Google Fonts, which serves one of the typefaces used on the Site.
Cloudflare, Inc. (Site and App) — hosting and content delivery for pages, images, evidence data, and other assets.
RevenueCat, Inc. (App) — subscription entitlement management, as described above.
Apple Inc. (App) — App Store distribution and billing, and TestFlight beta distribution, as described above.

How We Share Information

We do not sell, rent, or trade personal information, we do not share it for anyone else's advertising or marketing, and we do not use it to train any AI model. We share information only with the service providers listed above, to the extent needed for them to perform their function, and where required by law or legal process.

Neither the Site nor the App carries advertising, affiliate links, or third-party advertising or retargeting pixels.

Data Retention

We retain your waitlist email address until you unsubscribe or ask us to delete it, after which it is removed from our mailing list. Site analytics data is retained in aggregate form for as long as it is useful for the purposes described above.

Information the App stores on your device is retained until you delete it in the App or delete the App itself. RevenueCat retains subscription transaction records for as long as needed to manage entitlements and to meet Apple's and its own record-keeping obligations.

Your Rights

Depending on where you live, including under the EU and UK GDPR and the California Consumer Privacy Act, you may have the right to access, correct, export, or delete the personal information we hold about you, to withdraw consent, and to object to certain processing. You will not be treated differently for exercising any of these rights.

For anything the App holds, you exercise these rights directly: edit or remove it in the App, or delete the App to remove all of it at once. We hold no copy to act on. For your waitlist email address, subscription records, or any other question, email hello@suplmnt.app. You can also unsubscribe at any time using the link in any email we send you.

Children's Privacy

The Site and the App are not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, email hello@suplmnt.app and we will delete it.

International Users

We operate from the United States. If you use the Site or the App from outside the United States, the information described in this Policy will be processed in the United States and in other countries where our service providers operate.

Changes to This Policy

We may update this Policy from time to time. When we do, we will revise the effective date at the top of this page.

Contact Us

Reseda Labs LLC
hello@suplmnt.app