Privacy Policy

Overview

Smart Cycle (the app, we, us) is a personal health tracking application that helps individuals record their GLP-1, TRT, peptide and supplement journeys. We take your privacy seriously, especially given the sensitive nature of the information you choose to record.

This policy applies to mysmartcycle.com, our mobile apps and related services. If you do not agree with it, please do not use the app. For privacy questions, requests or complaints, contact us at contact@mysmartcycle.com.

What data we collect

Almost everything in the app is data you choose to enter. We collect and store:

• Account data: the email address you sign in with. If you use Google sign-in, Google also shares your name and profile picture with us. Our authentication provider records sign-in events, including your IP address, for security purposes.
• Profile information: nickname, first and last name (optional), age or birth date, height, weight, country, state or province, language, timezone, biological sex, avatar and therapy preferences.
• Medication and supply logs: dose dates, dosages, formulations, injection sites, peptide and supplement entries, and purchases you record (product, vendor, price, currency, quantity, expiry).
• Health metrics: weight entries, lab results, daily check-ins and any other measurements you enter or import.
• Side effect notes: any symptoms, severities or free-text notes you log.
• AI content: weekly reports or predictions generated for you are saved in your account so you can read them again. If you choose to use the AI features, the Google Gemini API key you paste is kept only on your own device. It is never stored in our database.
• App preferences: theme, units, notification and scoreboard opt-ins, onboarding and disclaimer state.
• Technical and usage data: device and browser type and server request logs kept briefly by our hosting provider. If you accept analytics, also a pseudonymous analytics identifier and an approximate region derived from your IP address (see Analytics and cookies below).

Much of this is health information about you. We process it only to provide the app to you, on the basis of the consent you give by entering it. You can withdraw that consent at any time by deleting the data or your account.

How and where your data is stored

When you are signed in, your data is stored in our cloud database (Supabase, hosted on Amazon Web Services in the United States), in a row associated with your account. Database row-level security means each account can only read and write its own row. Data is synced as you make changes, and an offline copy is kept on your device (browser local storage, or the app's storage on mobile) so the app keeps working without a connection.

If you are located outside the United States, using the app means your information is transferred to and processed there, under different data-protection laws than your own.

Data is encrypted in transit (HTTPS) and encrypted at rest by our database provider.

Who can access your data

• You. Nobody else can read your account's data through the app.
• The app operator. A single administrator account can access account records for support, security, abuse handling and account deletion. We only look at your data when it is genuinely necessary for one of those reasons.
• Our service providers, strictly to run the service (see below). They act on our instructions and are not permitted to use your data for their own purposes.

Third-party services

• Supabase: authentication and the primary database that stores your account and health data. See Supabase's Privacy Policy.
• Vercel: hosts the website and the small server functions that relay AI requests and handle account deletion. See Vercel's Privacy Policy.
• Brevo: delivers sign-in and account emails. See Brevo's Privacy Policy.
• Google: optional Google sign-in, and Google Analytics (GA4) for pseudonymous usage analytics only if you accept it. See Google's Privacy Policy.
• Google Gemini API: optional AI features, used only if you supply your own API key. See Google's Gemini API Terms.
• DiceBear: avatar images are loaded from DiceBear. Its servers receive the avatar style and seed in the image address. The seed is random text, or your nickname if you have not picked an avatar. See dicebear.com.
• jsDelivr: a public code delivery network that serves a PDF reading library when you scan a PDF lab report. It sees your IP address and browser details, not your documents.

Optional AI features

The AI lab scanning, weekly reports and weight prediction are entirely optional and off by default. They only work if you paste your own Google Gemini API key into your Profile, and only after you agree to send data to Google when the app asks.

• Your permission comes first. Nothing is sent to Google until you explicitly agree. We save the date you agreed, and you can turn AI off again at any time in Profile.
• Your key stays on your device. It is not saved in our database or in exports. When you use an AI feature, your device sends the key with the request to our server function, which passes both to Google. We do not store or log the key or the content.
• We are not an AI provider. We do not build, host, control or train any AI model. Your request is relayed by our server function directly to Google's Gemini API using your own key and Google account. We do not keep a copy of the request.
• What gets sent. For lab scanning: the report photos or PDF pages you upload, and the text your browser reads from any spreadsheet, document or text file you upload (the original file itself is not sent). For weekly reports and predictions: a text summary of your profile, weight history, doses, side-effect notes and lab values.
• Free-tier usage is not private. Google states that content submitted through unpaid tiers may be reviewed by people and used to improve its products. Never submit anything you would not be comfortable sharing with a third party.
• Redact before you upload. Crop, blur or black out your name, date of birth, address, phone, email, health-card, social insurance, SSN or passport numbers, patient or file numbers, barcodes and clinic or doctor details. Only test names, values and units are needed.
• AI output can be wrong and is never medical advice. Always check it against your original report.

Once you send content to Google it is governed by Google's terms, not this policy. We have no control over, and accept no responsibility for, how Google handles, retains or uses it.

Analytics and cookies

We only use Google Analytics (GA4) if you say yes. The first time you visit, we ask. Until you accept, nothing is loaded from Google and no analytics cookie is set. If your browser sends a Global Privacy Control signal, we treat it as a decline.

If you accept, Google Analytics sets a cookie containing a random identifier and collects page views, session length, device and browser type, and an approximate region derived from your IP address. This is pseudonymous rather than anonymous data. We send only the page address without any query string or fragment, and we turn off Google's advertising features and signals.

Google Analytics never receives the health data you enter, your email address or your account identifier. You can change your mind at any time with the Analytics choices link in the footer of the website and the app. Declining or withdrawing removes the analytics cookies.

Besides analytics, the app stores data on your device to keep you signed in, cache your records for offline use and remember your preferences. This is essential to how the app works and is not used for advertising. If you enable dose reminders, your device, not our servers, handles those notifications.

We do not sell your data

We do not sell, rent or share your personal or health information with any third party for marketing or advertising purposes. We do not use your health data to train any model, and we do not build advertising profiles.

Community scoreboard (opt-in)

The scoreboard is off unless you switch it on in your profile. If you opt in, your nickname, avatar, country and progress statistics may be visible to other users of the app. Your name, email, medications, doses and lab results are never shown. You can opt out again at any time, and you can choose a nickname that does not identify you. Nicknames are unique across the app, so a reserved nickname is stored separately from your health record.

Payments

Smart Cycle is free today. If we introduce paid plans, as described in our Terms and Conditions, payments would be handled by Apple, Google or a payment provider, and we would not store your card details. We would update this policy before any such change.

How long we keep your data

We keep your data for as long as your account exists. Delete an individual entry and it is removed on your next sync. When you delete your account from your Profile, your health record, your reserved nickname and your sign-in are erased from our systems immediately.

Copies may survive for a short period in our providers' routine backups and server logs before they expire. If you ever have trouble deleting your account, email contact@mysmartcycle.com and we will do it for you, normally within 30 days.

Your rights

• Access and export: download all of your data from your Profile at any time.
• Correction: edit or delete any entry at any time within the app.
• Deletion: delete your account and its data from your Profile.
• Withdraw consent: stop using the AI features, opt out of the scoreboard, or delete your account.
• Complain: depending on where you live, you may have the right to lodge a complaint with your local data protection authority.

To exercise any right we cannot handle in the app, contact contact@mysmartcycle.com. We may need to verify your identity before acting on a request.

Security

We protect your data with HTTPS everywhere, encryption at rest, row-level database isolation, server-side secrets that are never exposed to the browser, and a strict content security policy. Please help by keeping access to your email account secure.

No method of transmission or storage is completely secure, so while we work hard to protect your information we cannot guarantee absolute security.

This is not a regulated medical service

We are not a healthcare provider, pharmacy, insurer or covered entity, and the app is not a medical record system. It is not certified under HIPAA, PHIPA or equivalent health-privacy regimes, and the protections those laws give to records held by your clinic do not apply here. Please keep that in mind when deciding what to record.

Children

The app is intended for adults aged 18 and over and is not directed at children. We do not knowingly collect data from anyone under 18. If you believe a minor has provided us with data, contact us and we will delete it.

Medical disclaimer

Smart Cycle is a personal tracking tool only. It is not a medical device and does not provide medical advice, diagnosis or treatment. All medication level curves, cycle timelines, benchmarks and progress indicators are estimates based on publicly available pharmacokinetic models and published trial averages, and may not reflect your situation. Always consult a qualified healthcare professional before making any change to your medication or treatment plan.

Changes to this policy

We may update this Privacy Policy from time to time. Changes will appear here with an updated effective date, and material changes will be highlighted in the app. Continued use of the app after a change means you accept the updated policy.

Contact us

Questions, requests or concerns about this policy or your data: contact@mysmartcycle.com.