1origin is a nutrition and training companion with an AI coach. This policy describes exactly what data the app handles, where it goes, and how to delete it. The short version: we collect what the coaching needs and nothing more, we never sell your data, we never use it for advertising, and you can delete everything from inside the app.
Who we are
1origin is operated by TODO(user): legal entity name, TODO(user): registered postal address. We are the data controller for the personal data described here. Contact: TODO(user): privacy contact email.
What we collect
- Account. You sign in with Sign in with Apple or Sign in with Google. Apple gives us a user identifier and the email address you choose to share (which may be Apple's private relay address); Google gives us a user identifier, your Google account email, and your given name (used only to address you in the app). There is no password.
- Profile. What you tell us during onboarding: your goal, your sport and training experience, dietary preferences and restrictions, equipment, injuries, timezone, an optional display name, and the body basics used to compute your targets (height, weight, sex, birth year, activity level).
- Logs you create. Meals you log (food names, portions, calorie and protein estimates), workout sets, and weight entries. You can log a meal by typing it, by snapping a photo of your plate, or by scanning a product barcode. We store the resulting food names, portions, and estimates — never the photo itself (see "Where your data goes" below).
- Lab results you type in. If you enter results from a blood panel — the marker, the value, the date — they are saved to your account, so they follow you across your devices and you can watch a marker move. They are yours to read: 1origin shows them back to you against published reference ranges and nothing more. Your coach never sees them. The only thing that travels with a coach message is how many results you have saved and the date of your most recent panel — never a marker name, never a value, never a count of what sits outside a range. Reading a panel is your doctor's or dietitian's job, and the app is built so that the coach cannot do it even if you ask.
- Coach conversation. Your messages to the coach and the coach's replies are processed to generate each reply and kept on your device; what is saved to your account are the short memory notes the coach extracts (Settings, What Sloane remembers) and the corrections you make to food estimates, used to keep your numbers consistent over time.
- Plans and lists. The weekly meal plan the app builds for you and the grocery list derived from it are built and kept on your device; they are not sent to our servers, 1origin does not order groceries for you, and nothing is sent to a delivery service.
- Pantry estimates. Approximate on-hand food quantities derived from what you log, so the coach can notice when staples run low.
- Push token. If you turn on notifications, the device token Apple issues so we can deliver coach nudges. Nothing else about your device is registered.
- Usage and diagnostics. Basic product analytics (e.g. "onboarding completed", "paywall shown") and crash diagnostics, keyed to your user identifier. Daily AI-usage metering (token counts) keyed to your user identifier, used to enforce fair-use limits.
- Payments. Subscriptions are processed entirely by Apple. We never see your name, card number, or billing address — only your subscription status.
Apple Health data
With your permission, 1origin reads — never writes — these types from Apple Health: your heart-rate variability (HRV) and resting heart rate, so your coach can be recovery-aware, your sleep, for insights computed on your device — your sleep records are never uploaded or stored on our servers; a compact sleep summary is included only in your own coach messages to generate replies: last night's sleep in minutes and hours, its restfulness and overall sleep score, your seven-night and thirty-night averages, your rolling sleep debt, your bedtime consistency and tonight's sleep need, plus, on an evening check-in only, the bedtime, screens-off time and time in bed the app suggests — your steps and your active energy (the calories you burn moving), both read on your device and shown on Home's activity line, so your coach can weigh what you've done against what you've eaten — only today's totals and your own 30-day averages ride your coach messages, and they never change your calorie targets — your body weight, so the app can chart your weight trend, and the readings behind the in-app health monitor — your heart rate, respiratory rate, blood oxygen, wrist temperature and blood glucose, if something you wear or use writes it. Your heart rate, blood oxygen and blood glucose are read only to be shown to you on that screen: they stay on your device, they are never uploaded, and unlike your recovery and sleep summaries they never travel in your coach messages either. Your respiratory rate and your wrist temperature while you sleep are read for that screen too, and they are now also used to score your recovery against your own baseline — your respiratory rate feeds your stress read as well. For those two readings, the scores travel with your coaching; the raw readings do not. Two more, cardio fitness (VO₂ max) and lean body mass, are read only when your watch or scale writes them, and only to build your body-age read on your device; the readings themselves never leave your phone. Those are the only Health types the app requests.
- Your HRV, resting heart rate, sleep, steps and active energy are never uploaded to or stored on our servers. Some of their figures do travel inside your own coach messages, listed below under the one exception you should know about, and are used only to generate that reply.
- Your blood glucose is read for one purpose: to draw your last 24 hours against the meals you logged, on the health monitor screen. Nothing scores it, nothing stores it, and it is never placed in a coach message.
- Cardio fitness and lean body mass, when your watch or scale writes them, are read on your device to build your body-age read; the reading itself never leaves your phone. What can travel — only in your own coach messages, so the reply can talk about it — is the body-age figure itself: a number of years, how it sits against your calendar age, how it has moved over 90 days, and one word for that movement — improving, steady or drifting. The whole model runs on your phone and its formula is printed in the app under Methodology. It is a summary computed on your device, never a diagnosis, and it is never sent to advertisers, brokers, or analytics.
- Your respiratory rate and your wrist temperature while you sleep are read on your device to score your recovery against your own baseline — never against anyone else's — and your respiratory rate scores your stress the same way. What can travel is the score, never the reading behind it: your recovery percentage rides your own coach messages and the request that builds your training plan, so both can take account of how you are recovering, and your stress percentage rides your coach messages only. The readings themselves are never uploaded, never stored on our servers, and never sent to advertisers, brokers, or analytics. Your HRV and resting heart rate are handled differently and are described below under the one exception you should know about: their figures, not only a score, ride your coach messages.
- The readiness percentage the app shows you is computed on your device against your own baselines: your HRV first — today's reading against your own 30-day baseline — joined by your resting heart rate, last night's sleep, and your breathing rate and wrist temperature when your device records them. Every weight is printed in the app under Methodology, so you can recompute your own number. It is guidance, not a medical measurement, and it is never sent to advertisers, brokers, or analytics.
- The one exception you should know about: when you message your coach, a compact summary of your health figures is included with that message so the reply can reference them. It carries your recovery percentage and, once you have a current baseline, today's HRV in milliseconds beside your own thirty-day HRV baseline, your latest resting heart rate in beats per minute beside your own thirty-day average, your stress percentage, the sleep summary described above, and today's step and active-energy totals with your own thirty-day averages. These figures are read from your device at the moment you send, processed to generate the reply, and not stored by us; they are compared only to your own baselines, never to anyone else's, and your steps and active energy never change the app's calorie targets, which stay deterministic.
- A body weight read from Apple Health is treated exactly like a weight you type into 1origin: it is saved to your own account and synced so your weight trend follows you across your devices. It is your data, scoped to your account.
- Health data never appears in analytics, is never used for advertising or marketing, and is never sold or shared with data brokers — these uses are also prohibited by Apple's HealthKit rules, and we follow them.
- You can decline or revoke Health access at any time in the Health app; 1origin works fully without it.
Where your data goes
We use a small number of service providers, each for one job. We name them because you deserve to know:
- Anthropic (Claude). 1origin's coaching is generated by Claude, an AI model from Anthropic. To write each reply, your message travels to Anthropic together with a compact daily summary: today's logged meals, your latest recovery snapshot, and profile basics like your goal. If you log a meal by photo, that image is also sent to Claude — solely to identify the foods on your plate; 1origin never stores the photo, and EXIF/location metadata is stripped before it is sent. The app asks for your explicit consent before the first message or photo is ever sent. Under Anthropic's commercial API terms, this data is not used to train Anthropic's models; Anthropic may retain it for a limited period — currently up to about 30 days, or longer where content is flagged for trust-and-safety review — after which it is deleted.
- Open Food Facts. When you log a meal by scanning a product barcode, just that barcode number is sent to Open Food Facts — a free, open nutrition database — to look up the product's name and label nutrition. No account, profile, health, or message data is sent with it, and we cache the result so a repeat scan needs no further lookup.
- Supabase. Hosts our database and sign-in infrastructure. Your profile, logs, lab results, weight entries, the coach's memory notes and your food-estimate corrections are stored here, scoped to your account with row-level security, encrypted in transit and at rest.
- Cloudflare. Runs the server code that connects the app to the database and to Anthropic. Your requests transit Cloudflare's edge network; Cloudflare is infrastructure, not a data store.
- PostHog. Product analytics (US cloud). Receives event names and coarse properties keyed to your user identifier — never your health data, meals, messages, or email contents.
- Apple. Processes payments and delivers push notifications (APNs).
That is the complete list. We do not sell personal data, we do not share it for cross-context behavioral advertising, we use no ad networks, and we do not track you across other companies' apps or websites.
How long we keep it
- Your profile, logs, lab results, memory notes and corrections are kept while your account exists, so your coach keeps its memory.
- Push tokens are deleted when they become invalid or when you delete your account.
- Analytics and usage-metering records are kept in identifiable form only as long as needed for product and fair-use purposes.
- Encrypted database backups expire on a short rolling window (no more than 30 days), after which deleted data is gone from backups too.
Deleting your data
Settings → Delete Account inside the app deletes your account and your server-side data — profile, logs, lab results, messages, memories, corrections, pantry estimates, push tokens, and usage records — immediately and permanently, and wipes the app's local database on your device. Analytics events keyed to your user identifier are removed through a deletion request we file with our analytics provider, which completes shortly after. No email required, no support ticket, no waiting period. You can also email us (address below) and we will do it for you.
One thing deletion does not do: cancel an active 1origin premium subscription. Subscriptions are billed by Apple — cancel in iOS Settings → your Apple ID → Subscriptions, or you will keep being charged.
Your rights
Depending on where you live (including under the EU/UK GDPR and the California CCPA/CPRA), you have the right to access, correct, delete, and receive a copy of your personal data, to object to or restrict certain processing, and to not be discriminated against for exercising these rights. We do not sell or share personal data as those terms are defined under the CCPA, so there is nothing to opt out of. To exercise any right, use the in-app deletion flow or contact us; we respond within the legally required timeframes, and you may also lodge a complaint with your local supervisory authority.
For users in the EU/UK, our legal bases are: performance of contract (providing the coaching service you signed up for), consent (Apple Health access, push notifications, and sending your coach messages and any meal photos to Anthropic — each asked for explicitly in the app and revocable at any time), and legitimate interests (security, abuse prevention, and understanding basic product usage).
What 1origin is not
1origin is a wellness product, not a healthcare provider. It is not a HIPAA covered entity, and your data here is not a medical record. Calorie and macro figures are estimates, and nothing in the app is medical advice.
Age
1origin is for users 17 and older. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.
International transfers
Our service providers process data in the United States. Where required, transfers are protected by appropriate safeguards such as standard contractual clauses entered into by our providers.
Changes
If this policy changes in a way that matters, we will update this page and tell you in the app before the change takes effect. We will never quietly broaden what we collect.
Contact
Privacy questions and requests: TODO(user): privacy contact email — the same address, and the entity and postal address, as "Who we are" above. These are the only facts on this page that cannot be derived from the app itself; everything else is already true of what ships.