Enphana Privacy Policy

Effective date: October 29, 2026 Last updated: November 4, 2026

Enphana is a local-first wellness tracking app operated by Colyden LLC ("Enphana," "we," "us," or "our"). This Privacy Policy explains how we handle information when you use the Enphana mobile app (the "App") and the Enphana websites and link services connected to it.

Privacy contact: privacy@colyden.com

1. The short version

Your wellness entries are stored on your device by default. Enphana sends them to an Enphana service only when you choose one of these optional features, each of which requires an Enphana account:

• Cloud backup: you create a backup of your App data in your account.
• AI links: you create a temporary link that lets an AI app you choose read a snapshot of selected Enphana information.
• Nutrition share links: you create a temporary link to share a recipe or meal.

We do not sell health or wellness information, use it for advertising, or share it for cross-context behavioral advertising. Optional health-platform imports occur only after you choose to connect Apple Health or Health Connect and grant the applicable read permission. Purchases are administered by the applicable app store and RevenueCat.

For details about health-data handling and rights, read the separate Consumer Health Data Privacy Policy.

2. Information the App handles

Information you enter or create

Depending on how you use the App, this can include:

• wellness reflections, symptoms or experiences, body-location notes, ratings, and free-text notes;
• meals, recipes, ingredients, nutrition information, food preferences, and barcode or nutrition-label scans;
• activity sessions and related measurements you enter or import;
• sleep sessions, sleep stages, timing, and related observations;
• body measurements such as weight, and heart-rate and step information you import;
• an optional nutrition reference profile (an age group and a sex or reference value you choose, used to show general nutrition reference targets);
• self-directed experiments, projects, questions, things tried, results, an optional AI Profile (personal background you write for AI use), and patterns generated from your entries; and
• device preferences, a locally generated App identifier, time zone, and integration status.

This information may reveal health, fitness, dietary, or other sensitive information. Treat it carefully.

Optional connected-health information

If you choose to connect Apple Health (iOS) or Health Connect (Android) and grant the relevant read permissions, the App can import:

• Apple Health: sleep sessions and stages; workouts, including type, timing, distance, and speed; steps; heart rate and resting heart rate; and body weight. For some workouts, the App also reads route location points from Apple Health only to calculate elevation gain; it does not store the route.
• Health Connect: sleep sessions; exercise sessions with type and timing; distance, speed, elevation gained, and average heart rate for those workouts; daily step totals; heart rate; resting heart rate; and body weight.

Imported health information is stored in local storage on your device. The App does not write information to Apple Health or Health Connect. Imported information is uploaded to Enphana only if it is included in something you choose to send, such as a cloud backup or an AI link that includes your logs (see below). You can decline, revoke, or manage these permissions through your device settings and the connected-app settings in Enphana.

Apple and Google independently operate their health platforms. Their handling of information is governed by their own terms and privacy policies.

Enphana account

An Enphana account is required to use the App, and first-run setup asks you to create one. Your wellness entries still stay on your device unless you choose a cloud backup, AI link, or share link. The App asks for your email address and sends a one-time verification code through Supabase Auth. Supabase processes the account identity, email address, authentication/session data, and security metadata needed to sign you in. We use the resulting account identifier with RevenueCat to associate subscription entitlements across supported platforms, and our servers keep records of your trial and subscription status so they can decide whether you have access to Premium features. To help detect repeated free-trial claims, we also store a limited, pseudonymous trial-eligibility record (see Section 3); it does not contain your wellness entries.

Cloud backups (optional)

If you are signed in with access to Premium, you can choose Settings → Local Backups → Cloud backups to create a backup of your App data. The backup archive contains the content of your local database, which can include any of the health and wellness information described above. It is uploaded to a private storage area at Supabase that is accessible only to your account. We keep up to three cloud backups per account. A backup is created only when you tap Back up and confirm after the App explains what will be uploaded. You can restore or delete a cloud backup at any time. If your trial or subscription ends, cloud backups remain for 90 days after your access ends, after which they become eligible for deletion and are removed by scheduled cleanup. Enphana does not add its own end-to-end encryption to cloud backups, so treat them as sensitive.

AI links (optional)

If you use the App's AI features, you can create a temporary link and give it to an AI app such as ChatGPT, Claude, or Grok. When you create an AI link, the App uploads a snapshot to Enphana's link service, which runs on Cloudflare. Depending on the link, the snapshot can include selected logs and dates, your projects, and your AI Profile. The App explains what will be included and asks you to confirm when you first share through an AI link, and requires you to be signed in. After a link has been created or you have acknowledged AI-link sharing, tapping the create, copy, or refresh action again can replace the link with a newly uploaded snapshot without repeating the same confirmation. The new snapshot can reflect changes to information within the scope you chose. These uploads happen only when you take that action.

Anyone who has the link can read the snapshot until the link expires or you revoke it. Links expire after 2 hours (Profile and Projects links) or 24 hours by default (analysis links), and in any case no later than 72 hours. You can revoke a link in the App. When you give the link to an AI app, that provider receives the snapshot and handles it under its own terms and privacy policy; we do not control what it does with the information. Please read the AI provider's policies before sharing.

For service operation and abuse prevention, our AI-link service logs request time, route, method and status, a shortened derived identifier for the link where applicable, and technical request metadata such as browser/app user-agent, network ASN, and country. These request logs do not include the shared snapshot content or an unmasked AI-link token. The service’s own stored abuse-log entries are configured to expire after approximately seven days; infrastructure/provider logs may be subject to different provider retention practices.

AI responses are not all handled the same way. Project proposals and AI Profile changes that need manual review are presented for your approval before saving. Certain valid, trusted AI Profile return links can apply changes automatically when you open them in Enphana, without a separate Save confirmation. The App displays the result and provides an undo option where available. Review the information supplied by an AI provider, since it may be incomplete or inaccurate.

Nutrition share links (optional)

If you share a recipe or meal, the App uploads the recipe or meal (names, ingredients, portions, and nutrition values) to Enphana's servers and gives you a link. Anyone with the link can view it and import a copy. Before creating the link, the App explains what will be uploaded and asks you to confirm. Share links expire after 30 days. You can stop sharing at any time in Settings → Shared Links, which lists your active links, including links created on other devices. Closing the share sheet does not remove a link. Expired and revoked shares are deleted from our servers daily. The public preview of a share link applies rate limits that use technical request information, such as an IP address-derived key, to prevent abuse.

Camera, microphone and speech

You may allow camera access to scan a food barcode or a nutrition label. Enphana uses the camera for scanning and does not intend to keep the images it captures for a label scan.

You may allow microphone and speech-recognition access to search foods by voice. Speech recognition is provided by your device's operating system, and Apple or Google may process your audio under their own terms and privacy policies. Enphana receives only the resulting text. Manage camera, microphone, and speech-recognition access through your device settings.

Subscription and purchase information

Apple App Store or Google Play processes purchases, not Enphana. The App uses RevenueCat to obtain subscription entitlement and offering information. We do not receive your full payment-card number. RevenueCat and the applicable app store may process device, transaction, subscription-status, and technical information under their own privacy terms. Our servers also receive subscription-status notices from RevenueCat and keep your entitlement status, expiration, and product so they can enforce access.

Information we do not intentionally collect through the App

The App does not include third-party advertising SDKs or third-party behavioral analytics. Food, barcode, and nutrition lookups use data stored on your device and are not sent to a third-party food database by the App.

3. Where information is stored and how long it remains

Your App content is stored locally on your device, primarily in the App's local database and local app storage. It remains there until you edit or delete it, reset local data, uninstall the App, or your device/platform removes it. The App is configured so that the local database is not included in Android Auto Backup or device-to-device transfer.

The following table summarizes information that Enphana keeps on its servers.

The App may also create local recovery backups before certain resets, restores, or database migrations. It keeps recent automatic recovery backups locally and lets you create and delete manual backups. Resetting active local data can create a recovery backup; to remove that copy, use Settings → Local Backups and delete it. A data export is a JSON file stored locally and may be shared only when you choose to do so. Enphana does not add its own encryption to exports or local backups, so protect them carefully.

When you delete your account, we delete your account identity and authentication data, your cloud backups, and your account-linked subscription and trial-access records that we control, and we request deletion of your customer record at RevenueCat, unless a limited record must be kept to meet a legal obligation, resolve a security issue, or enforce our rights. To help prevent repeated free-trial claims, we retain a limited trial-eligibility record even after account deletion. That record is pseudonymous, not anonymous: it may include a hash derived from an app installation/device identifier, an optional hash derived from the account email address, platform, and trial dates. It does not contain your wellness entries. The account association is removed when the account is deleted, and the current service has no automatic expiration schedule for this record. Contact privacy@colyden.com to ask about your rights and deletion of retained data, subject to applicable law. Apple and Google maintain their own purchase records under their respective policies. See the Data Deletion Policy for practical instructions.

Deleting a project may first place it in a recoverable state for up to 30 days. Other delete or reset actions may be permanent, subject to the local recovery-backup behavior described above.

4. How we use information

We use information to:

• provide logging, reflection, pattern, experiment, history, backup, restore, and export features;
• import sleep, activity, and body-measurement data only when you request an optional connection and grant permission;
• calculate insights and patterns locally on your device;
• store and restore cloud backups, and create and serve AI links and share links, only when you ask us to;
• provide and administer paid access, restore purchases, display subscription status, and check access to account-based features;
• provide account sign-in and connect a Premium identity to RevenueCat; and
• protect, maintain, and improve the App and our services, including preventing abuse, responding to a security issue, and complying with law.

We do not use health or wellness information for advertising, marketing profiling, or sale to data brokers, and we do not use it to train AI models.

5. When information is disclosed

Information can leave your device only in these situations:

• You choose to export or share it. Your chosen recipient, destination, or sharing service then handles the information under its own practices.
• You create an AI link. The AI provider you give the link to receives the snapshot, and Cloudflare hosts it for us while the link is active.
• You create a share link. Anyone with the link can view the shared recipe or meal.
• You create a cloud backup. Supabase stores the backup for us.
• Service providers. We use Supabase (account, authentication, database, and storage), Cloudflare (website and link hosting), and RevenueCat (subscriptions). They process information on our behalf under their terms and our instructions. Their servers may be located in the United States or other countries.
• Connected platforms. Apple Health or Health Connect provide data to the App only under permissions you grant. Enphana does not send imported health content back to those platforms.
• App stores. Apple and Google process purchases and, for speech recognition, audio you choose to dictate.
• Legal and safety reasons. If disclosure is required by law or reasonably necessary to protect people, rights, safety, or the integrity of the App.
• Business transition. If applicable law permits, in a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, subject to appropriate safeguards and notice where required.

6. Your choices and privacy rights

You can choose whether to grant camera, microphone, speech-recognition, Apple Health, or Health Connect permissions; manage or revoke permissions in device settings; export selected App content from Settings → Export Data; delete active App content from Settings → Reset Local Data; delete local and cloud backups from Settings → Local Backups; revoke AI links and share links in the App; and manage or cancel a subscription through the applicable app store.

You can create, use, sign out of, or delete an Enphana account from the App. Account deletion does not cancel an App Store or Google Play subscription; use the store's subscription controls separately.

Depending on where you live, you may have the right to know what personal information we collect, use, disclose, or sell; to access, correct, or delete it; to limit the use of sensitive personal information; to opt out of sale, sharing for targeted advertising, or profiling; and not to be discriminated against for exercising your rights. We do not sell or share personal information for targeted advertising. Personal information we collect, depending on the features you use, includes identifiers (email address, account ID), commercial information (subscription status), and sensitive personal information (health information you choose to back up or share through an AI link or share link). We use it for the purposes described in this Policy.

Residents of the European Economic Area, the United Kingdom, and Switzerland may also have rights of access, rectification, erasure, restriction, portability, and objection, and the right to complain to a data protection authority. Where those laws apply, we process information to perform our contract with you, based on your consent (including for health data that you choose to back up or share), for our legitimate interests in security and abuse prevention, and to comply with law. Your information may be transferred to and processed in the United States, where our providers operate.

For locally stored entries, you control them directly through the App; we generally cannot retrieve, correct, export, or delete them for you unless they are in a cloud backup or link you created, which you can also manage in the App. To exercise a right regarding information we control, email privacy@colyden.com. We may need to verify your request. We aim to respond within 45 days; if we need an extension permitted by law, we will notify you and explain why.

If we deny a privacy request, you may appeal by replying to our decision with the subject line Privacy Appeal. We will review the appeal and explain our decision. This Policy does not limit rights that cannot be waived under applicable law.

7. Security

We use access controls on our servers and keep cloud backups in private storage that only your account can read. We design the App to minimize data transfer by storing core content locally. No method of electronic storage or transmission is completely secure. Keep your device protected with a passcode or biometric lock, use care when exporting, backing up, or sharing data (especially AI links, which anyone with the link can read until they expire), and delete exports and backups you no longer need.

If you believe there is a vulnerability or unauthorized access involving Enphana, contact privacy@colyden.com promptly. Do not include passwords, one-time codes, payment-card numbers, or sensitive health entries in an initial report.

8. Children

Enphana is a general-audience app and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn that a child under 13 has provided personal information through the App, we will delete it. If you believe this has happened, contact privacy@colyden.com.

9. Changes to this Policy

We may update this Policy to reflect changes to the App, law, or our practices. We will post the revised Policy with a new effective date and provide additional notice when required by law. If Enphana adds analytics, advertising, new integrations, a new category of health data, a new recipient of health data, or a new use of health data, we will update this Policy and, where required, provide notice or obtain consent before the change.