Boring But Good LLC ("we," "us," "our") operates the Uptake mobile application ("Uptake," "the App"). This Privacy Policy explains what information the App collects, how we use it, and the choices you have. We've tried to keep it short and plain.
Summary
- Uptake does not require an email, name, or password. There are no user accounts.
- Your health profile, supplement stack, intake log, and journal entries are stored on your device. Relevant parts are sent to our servers and to AI providers only to power the App's AI features (chat, personalized insights, dosage guidance, and interaction checks) — and only after you agree to this sharing in the App.
- Photos of supplement labels you scan are sent to our servers and to AI providers so they can be parsed into product data.
- We use anonymous analytics and crash reporting, both of which you can turn off in Settings.
- We do not sell your data.
Information We Collect
Device identifier
When you first open Uptake, the App registers your device with our server using Apple's App Attest service. We store:
- A random device ID we generate
- An App Attest key identifier and public key from Apple (these do not identify you personally)
- Your platform (iOS), app version, and timestamps of first and last activity
- A hashed authentication token used to authorize requests from your device
We do not receive your Apple ID, email address, name, or any personal identifier from Apple as part of this process.
Health and lifestyle information you enter
During onboarding and in Settings, you can optionally provide:
- Health goals (for example: energy, sleep, immunity)
- Gender and birth year
- Body weight
- Dietary pattern (for example: vegan, keto)
- Exercise level
- Typical bedtime and wake time
- Medications you take
- Meal timing preferences
- Health and medical context you choose to share (for example: conditions, allergies, pregnancy, or recent blood work)
- Free-form notes you choose to add
This information is stored locally on your device. It is transmitted only to power the AI features described below — chat, personalized insights, dosage guidance, and interaction checks — and only after you have agreed to AI data sharing on the App's consent screen. If you have not agreed, none of it leaves your device.
Supplement and intake data
You can scan or add products to your supplement stack and log when you take them. Your intake log and journal entries are stored locally on your device.
Product information itself (name, brand, serving size, nutrient amounts) is stored on our servers as a shared catalog so that other users who scan the same product benefit from existing parsed data. The catalog does not link products to individual users.
When you submit a correction to a product's information, we store the change associated with your device ID so we can review and merge edits.
Photos of supplement labels
When you scan a supplement, the App captures one photo of the front of the bottle and up to ten photos of the Supplement Facts panel. These photos are uploaded to our servers and processed by AI providers (see "AI Features" below) to extract product and nutrient information.
Photos from barcode scans are retained in object storage to support reprocessing, quality review, and debugging. Photos from label-only scans (scans without a barcode) are automatically deleted from our servers within 7 days. We do not use these photos for any other purpose.
Chat with the AI coach
When you use the in-app AI coach, the following is sent to our server and forwarded to an AI provider in real time:
- The message you typed
- The chat history of the current conversation
- A snapshot of relevant profile information (such as goals, age, gender, weight, dietary pattern, exercise level, medications, health context, and notes) so the coach can give context-appropriate guidance
- Your supplement stack and recent journal entries (from roughly the last 30 days) so the coach can take your routine and how you've been feeling into account
Chat messages and the profile snapshot are not stored on our servers after the response is generated. They are streamed back to your device, where the conversation history is kept locally.
Personalized insights, dosage guidance, and interaction checks
With your consent, Uptake also uses AI to generate content for you without a chat prompt:
- Insights. To write personalized insights and to decide which items in your feed matter most, the App sends the same kind of context as a chat: a profile snapshot, your supplement stack, and recent journal entries.
- Dosage guidance. To show typical intake ranges for the nutrients you take, the App sends the nutrient amounts involved along with basic profile facts (age, gender, body weight, goals).
- Interaction checks. To flag combinations worth knowing about, the App sends the supplements involved (including any notes you've attached to them) and the medication names from your profile.
Like chat, these requests are forwarded to an AI provider and are not stored on our servers after the response is generated. None of these features run before you agree to AI data sharing in the App.
Analytics and crash reports
If you leave analytics enabled, the App sends anonymous usage events (for example: "scanned a barcode," "logged intake," "opened chat") to Mixpanel, and sends crash and error reports to Sentry. These services receive your device ID and basic device information (app version, iOS version) but do not receive your health profile, journal entries, chat messages, or the contents of your notes.
You can disable analytics and crash reporting at any time in Settings.
AI Features and Third-Party Providers
Uptake uses third-party AI providers — OpenAI and Google (Gemini) — to power its AI features:
- Supplement label parsing. Photos of supplement labels are sent to OpenAI and/or Google to extract product and nutrient information.
- AI coach. Your message, conversation history, a profile snapshot, your supplement stack, and recent journal entries are sent to an AI provider to generate a response.
- Insights and feed ranking. A profile snapshot, your supplement stack, and recent journal entries are sent to an AI provider to write personalized insights and rank what shows up in your feed.
- Dosage guidance and interaction checks. The nutrients and supplements involved, basic profile facts, and your medication names are sent to an AI provider to generate intake ranges and flag interactions.
The App asks for your permission before any of this data is sent: you agree on the consent screen during setup (or a one-time notice if you started using Uptake before that screen existed), and until you agree, no AI feature sends anything.
These providers process the data on our behalf under their own terms. We do not authorize them to use your data to train their public models.
How We Share Information
We do not sell your personal information.
We share information only as needed to operate the App, with the following categories of service providers:
- Cloud hosting: Our server runs on a cloud platform, and product images are stored in Cloudflare R2.
- AI providers: OpenAI and Google, as described above.
- Analytics: Mixpanel (anonymous usage events).
- Crash reporting: Sentry (error and crash data).
- In-app purchases: Subscription payments are processed by Apple, and we use RevenueCat to manage subscription entitlements (RevenueCat receives your device's anonymous app user ID and purchase receipt information). We do not receive or store payment card details.
- Ad attribution: We use ASATools to measure the performance of our Apple Search Ads campaigns (ASATools receives Apple's install attribution data, such as the campaign and keyword an install came from, along with purchase receipt information to measure campaign revenue). This uses Apple's privacy-preserving AdServices framework: it involves no cross-app tracking and no advertising identifier.
We may also disclose information if required by law or to protect the rights, safety, or property of Uptake, our users, or others.
Your Choices
- Turn off analytics and crash reporting. Toggle the "Enable Analytics" setting in the App.
- Clear your local data. Use "Clear All Profile Data" in Settings to wipe your on-device profile, stack, journal, and intake history.
- Request server-side deletion. Reach out through the contact page listed below to request deletion of your device record, product corrections you've submitted, and any associated images.
- Disable notifications. Manage notification permissions for Uptake in the iOS Settings app.
Permissions
Uptake requests the following device permissions:
- Camera — to scan barcodes and photograph supplement labels.
- Notifications — to remind you to take your supplements (these are local reminders scheduled on your device; we do not send push notifications from our servers).
Uptake does not request access to your photo library, HealthKit, contacts, location, Bluetooth, or microphone.
Data Retention
- On-device data remains on your device until you delete it or uninstall the App.
- Device records and product corrections on our servers are retained for as long as your device is active, or until you request deletion.
- Supplement label photos from barcode scans are retained in object storage for ongoing parsing and quality review; photos from label-only scans are automatically deleted within 7 days.
- AI feature requests (chat messages, profile snapshots, and the inputs to insights, dosage guidance, and interaction checks) are not stored on our servers after the response is generated.
Children
Uptake is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided information through the App, please contact us so we can remove it.
International Users
The App is operated from the United States. If you use Uptake from outside the US, your information will be transferred to and processed in the US and other countries where our service providers operate.
Security
We use industry-standard practices to protect the limited information we hold, including encryption in transit and hashed authentication tokens. No system is perfectly secure, and we cannot guarantee absolute security.
Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date above and, for material changes, provide notice in the App or on our website. Your continued use of Uptake after changes take effect means you accept the updated policy.
Contact
If you have questions about this Privacy Policy or want to request deletion of your data, please contact us through our contact page.
Boring But Good LLC