Privacy

We collect what we need to make the product work, and nothing else.

What we collect

Account: email, optional first and last name, hashed password. Product data you enter (weights, doses, foods, exercise, notes, etc.) tied to your account. Standard server logs (IP, user agent, request paths) for security and debugging.

Security

Passwords are hashed with bcrypt. Sessions use httpOnly cookies on .protokollab.com with a 90-day lifetime. The session cookie is never JavaScript-readable. Native shells use the same JWT in Authorization: Bearer form, persisted in the OS keychain (NSUserDefaults on iOS, SharedPreferences on Android).

Your data, your hardware

Every byte you enter is exportable as JSON at any time. Delete your account and your data is irrevocably wiped from our database, our object storage, and any active Stripe customer record. Nothing is retained.

Third parties

Stripe for payments, SendGrid for transactional email, DigitalOcean for hosting, Cloudflare for DNS + CDN. Each gets only what they need to do their job. We do not sell your data, run ad pixels, or share with analytics brokers.

Contact

Questions about your data: [email protected].