Formulate Privacy Policy

Effective date: 2026-05-11 Last updated: 2026-08-03

This Privacy Policy describes how Formulate ("we," "us," or "the app") collects, uses, stores, and shares information when you use our mobile application. By using Formulate, you agree to the practices described here.

Quick summary (read this first)

• We collect what you tell us (profile, goals, supplements you take) and what you scan (when you tap the shutter on a supplement label, the photo is sent to an AI provider so the model can read the ingredients — see Section 1.3).
• We store this in Supabase (database servers in Sydney, Australia) under your authenticated account. Photos are not retained by us — only the structured ingredient list extracted from them.
• When you talk to the AI Coach, your message and that context are sent to an AI provider for processing. We don't store it on their side.
• Where AI processing happens: every AI request — label photos and Coach messages alike — is restricted to named US-headquartered providers that publish a zero-data-retention policy, and is explicitly blocked from providers under Chinese corporate control. This is enforced per-request, and a response from any other provider is rejected rather than shown to you. See Section 3.1.
• We use RevenueCat to manage your subscription if you're a Pro user.
• We use PostHog for anonymous crash reports and basic lifecycle telemetry (app open/background events only). No personal data, no scan content, no Coach messages. You can turn it off in Settings → Privacy → Anonymous crash reporting.
• We never sell your data. We never run ads.
• You can delete everything at any time from Settings → Account → Delete account.

1. Data we collect

1.1 Account data (required)

• Email address (for sign-in via one-time code).
• Authentication identifiers (user ID assigned by our auth system).

1.2 Profile and health-context data (you provide)

• Stats you optionally enter: height, weight, biological sex, year of birth.
• Goals (e.g., strength, endurance, sleep, focus).
• Dietary restrictions, allergies.
• Training context (frequency, type).
• Time zone.

This data is used to personalize ingredient recommendations and the AI Coach's responses. You can leave any field blank.

1.3 Supplement and scan data (you create through usage)

• Scans you perform: product name, parsed ingredients with doses, barcode (if applicable).
• Your supplement stack: products you take regularly, doses, timing.
• Daily intake log: each time you log taking something.

Note on scan images: When you tap the shutter on a supplement label, the captured photo is resized (longest edge 1600px, typically under 400 KB) and sent over an encrypted connection to a server we operate (a Supabase Edge Function). That server forwards it, through OpenRouter, to a US-based AI provider that reads the panel and returns the ingredient list (see Section 3.1 for exactly which providers and how that is enforced). The image leaves your phone — it does not stay local. Once the model returns the ingredient data:

• Our server stores only the structured ingredient list (names, doses, units) under your account in Supabase.
• We do NOT store the photo itself. The photo is never written to our database or any storage we control.
• We do not send your account identity, email or profile to OpenRouter or the provider with the image.
• We do not control OpenRouter's or the provider's policies. Review OpenRouter's at https://openrouter.ai/privacy.
• Free-tier and Pro scans use the same providers.

If you don't want your label photos processed by these providers, don't use the scan feature. The rest of the app (stack, intake log, AI Coach, ingredient library) works without it.

1.4 AI Coach conversations

• Messages you send to the AI Coach and the responses generated.
• Pinned facts you ask the Coach to remember.

These are stored in our database under your account.

1.5 Subscription data (if you upgrade to Pro)

• Subscription status, product purchased, renewal date — managed by RevenueCat (see Section 4).
• Apple/Google payment data: we never see your card. Apple or Google handles the actual payment.

1.6 Device and diagnostic data (anonymous, optional)

Formulate uses PostHog (posthog.com) to collect anonymous error reports and basic lifecycle telemetry — app open and background events only, plus crash stack traces if the app crashes. We do NOT send: any personally identifying information, your email, your scans, your stack, your Coach messages, or any health data. PostHog never receives screen recordings, screenshots, or the contents of any field in the app.

This telemetry is on by default and you can disable it entirely at any time in Settings → Privacy → Anonymous crash reporting. PostHog acts solely as our data processor and does not share this data with third parties.

We do NOT collect: contacts, precise location, microphone, photos library (the camera is used only for scanning, with your explicit permission, and we don't retain captured images on our servers — see Section 1.3 for how scan images are handled), advertising identifier, browsing history.

2. How we use your data

• To provide the service: store your stack, calculate daily intake totals, decode scans, run the AI Coach.
• To personalize: tailor ingredient recommendations and Coach answers to your stated goals.
• To bill (if Pro): process your subscription via Apple/Google + RevenueCat.
• To improve the app: analyze aggregated, anonymous patterns (e.g., "what % of users have goals set"). We do not look at your individual data for product analytics.

We do NOT use your data to: - Train AI models on your conversations. - Sell or rent to third parties. - Run advertising. - Build profiles for any party other than you.

3. The AI Coach

When you send a message to the AI Coach, the following happens:

1. The message is sent to a server we operate (Supabase Edge Function), together with the context the Coach needs to answer in your situation: - the current conversation (earlier messages in the same chat), - your goals and your supplement stack, - what you have logged taking today, and your caffeine total against your ceiling, - your recent subjective check-ins (how you rated sleep, energy and stress), - your most recent scan, and - any facts you asked the Coach to remember.
2. The server forwards the request, through OpenRouter, to a US-based AI provider that generates a response (see Section 3.1).
3. The response is sent back to your device and saved to your account.

If you don't want your messages processed by these providers, don't use the AI Coach feature. The rest of the app works without it.

3.1 Where AI processing happens

This section exists because it is a question people reasonably ask, and because the honest answer takes more than one line.

The models. Formulate uses two open-weight AI models: DeepSeek V4 Flash (the Coach, and reading OCR'd label text) and MiniMax M3 (reading label photos). Both were originally developed by Chinese companies. Open-weight means the model files themselves are published and can be run by anyone, on any hardware — running one does not send anything back to its authors.

The providers. What actually matters is whose computers your data is processed on, and whether they keep a copy. Every AI request from Formulate is restricted, on a per-request basis, to a named list of United States–headquartered providers that publish a zero-data-retention policy. As of the "Last updated" date that list is:

Zero data retention is the criterion we select on first: a provider that keeps no copy of your request is a better outcome than one that keeps a copy in a known location. Alongside the list above, each request separately instructs OpenRouter to exclude any provider that may store request data.

Requests are also explicitly blocked from six providers under Chinese corporate control — DeepSeek, Baidu, StreamLake, Alibaba, MiniMax and SiliconFlow. We do not send your data to DeepSeek's or MiniMax's own services, and requests cannot fall back to them.

How this is enforced. In three places. Each request names the permitted providers and forbids falling back beyond them; each request separately names the blocked providers; and our server then checks which provider actually answered, discarding the response and showing you an error if it is not on the list. We would rather a scan fail than succeed somewhere we did not promise.

Being straight about the limits. Three of them:

• The list is maintained by us, not enforced by OpenRouter. OpenRouter has no "United States only" routing setting, so we re-derive the list from each provider's published details before releases and rely on those details being accurate.
• Parasail, DeepInfra and Together AI do not publish the specific locations of their datacenters. All are United States companies, and that is the basis of the claim above — we are not in a position to tell you which building your request was processed in, and we would rather say so than imply we know. Venice does publish a United States–only datacenter list, as do other providers we have assessed and keep available (GMICloud, CoreWeave).
• We do not control OpenRouter's or these providers' own policies. Review OpenRouter's at https://openrouter.ai/privacy, Parasail's at https://www.parasail.io/legal/privacy-policy, DeepInfra's at https://deepinfra.com/privacy, Together AI's at https://www.together.ai/privacy, and Venice's at https://venice.ai/legal/privacy-policy.

Storage is separate from processing. AI processing happens in the United States. Your stored data — profile, stack, scans, Coach conversations — lives in Supabase in Sydney, Australia, and does not move to the United States. These are two different things and we don't want to imply otherwise.

Training. We do not permit providers that retain request data for training. Your Coach messages and label photos are not used to train any model.

4. Service providers we share data with

We rely on the standard data-processing terms each of these providers publishes and incorporates into its terms of service. We have not separately negotiated bespoke agreements with them.

5. Data retention

• Active users: data is retained as long as your account exists.
• Account deletion: you can delete your account at any time from Settings → Account → Delete account. All data — profile, scans, intake, Coach conversations, memory, entitlements — is permanently deleted from our database within 30 days. Backups are purged within 90 days.
• Inactive accounts: if you don't sign in for 24 months, we may delete your account after notifying you by email.

6. Your rights

You can: - Access: see your data via the in-app settings (most fields are visible) or by emailing the contact below. - Export: request a copy of all your data in JSON format. We respond within 30 days. - Correct: edit your profile fields directly in the app. - Delete: see Section 5. - Withdraw consent: stop using the app. To delete data, see Section 5.

If you're in the EU/EEA/UK, you also have: - The right to lodge a complaint with your local data protection authority. - The right to object to certain processing. - The right to data portability (covered by export above).

If you're in California, you have CCPA rights including: - The right to know what personal information we collect, use, and disclose. - The right to deletion. - The right to opt out of "sale" — note that we do not sell your personal information. - The right to non-discrimination for exercising any CCPA right.

To exercise any of these rights, email the address in Section 9.

7. Children

Formulate is not intended for users under 13 years old (or the equivalent minimum age in your country). We do not knowingly collect data from children under that age. If you believe a child has provided us data, contact us at the address below and we will delete it.

The supplement guidance in Formulate is intended for adults. We do not provide pediatric dosing information.

8. Important limitations (medical disclaimer)

Formulate is not a medical device. The information we provide is educational, based on published research, and does not constitute medical advice. We are not a HIPAA covered entity. The data you store with us is not protected by HIPAA — it's protected by this Privacy Policy and applicable consumer protection law.

If you have a medical condition, are pregnant or nursing, take prescription medications, or have any concern about supplements interacting with your health, consult a healthcare professional. The AI Coach is explicitly instructed to defer medical questions to clinicians.

9. Contact us

For privacy questions, data access requests, or to delete your account:

Email: [email protected]

This address forwards to the founder's personal inbox. Response time is typically 1–2 business days. For privacy or data-deletion requests, mention "PRIVACY" in the subject line so it's not missed.

10. Changes to this policy

If we change this policy materially (e.g., add a new data-sharing partner, change retention periods), we will notify you in the app and by email at least 14 days before the change takes effect. Minor changes (typos, clarifications) take effect immediately and are reflected in the "Last updated" date at the top.