Privacy Policy

Last updated 9 October 2026. The same text the MyPotential app shows in Settings.

Your log is yours. It lives on this phone first and syncs to your account. We show no ads, sell nothing about you, and never train a model on your data. Delete the account and it all goes.

1. Who we are

MyPotential is a personal health and life dashboard. MyPotential is operated from Romania, in the EU. We are the data controller for the information described here. For any privacy question, write to mypotential.contact@gmail.com. We answer privacy requests within one month of receiving them, as the GDPR requires.

This policy covers the MyPotential iOS app. It describes what this app does today. When a new feature starts collecting something new, this page changes in the same update.

2. What we collect

Account data. Your email address, and how you sign in: with Apple, with Google, or with an email and a password. With Apple we receive the identifier Apple gives us and, if you share it, your email, which may be a private relay address. With Google we receive your email and Google’s identifier for you. A password is stored only as a salted hash by our database provider, never in plain text. Before you create an account, the app gives the setup a random anonymous identifier so your answers and any purchase have somewhere to attach.

What you log. Water and caffeine, food and calories, body weight and targets, training sessions and your weekly plan, sleep and recovery, how you feel and what you write in a check-in, medication and supplements, spending, income, your accounts and their balances, and your budget, screen time, goals and the ambitions you set, your faith practice, and the minutes of the mind practice you pick, which stay on this phone. Every one of these is entered by you, for you, except screen time when you let iOS measure it and Apple Pay payments when you turn on Apple Pay logging, both described below, and each section is optional.

Your setup answers. What you told us in the setup quiz: your goals, your name, your body data (sex, age, height, weight and goal weight), your activity level, how many days a week you committed to, your faith if you chose to share it, where you heard about us, and the signature you drew or typed. The signature is stored as pen strokes, not as a picture, so the app can draw it back in either theme. The whole profile is kept on this phone and saved to your account once you sign in, so signing in on a new phone brings it back.

WHOOP, if you connect it. You sign in to WHOOP on WHOOP’s own page. The app then reads, and never writes, your recovery, sleep, daily strain and workouts, including heart rate variability, resting heart rate, blood oxygen and skin temperature. Every request goes through our server, which forwards it to WHOOP and keeps nothing. The keys WHOOP issues are stored only in this phone’s keychain, never on our servers. Each workout WHOOP has finished scoring is added to your training log as a session: the sport, the day, how long it lasted and, when WHOOP has one, the distance. Like a session you log by hand, it is saved to your account, unless you already logged the same workout yourself. The other readings are kept on this phone, not in your account, and fill in your sleep, recovery and day score where you have not typed a number. Like everything on your day, they can be part of the snapshot Luna answers from. Signing out, deleting your account or disconnecting removes the connection, and disconnecting also removes the workouts it added. You can revoke the connection in your WHOOP account at any time.

Oura, if you connect it. You sign in to Oura on Oura’s own page. The app then reads, and never writes, your sleep, readiness, sleep score and blood oxygen, including heart rate variability, resting heart rate, breathing rate and temperature deviation. Every request goes through our server, which forwards it to Oura and keeps nothing. The keys Oura issues are stored only in this phone’s keychain, never on our servers. The readings are kept on this phone, not in your account, and fill in your sleep, recovery and day score where you have not typed a number. Like everything on your day, they can be part of the snapshot Luna answers from. Signing out, deleting your account or disconnecting removes the connection and deletes the readings it left on this phone. You can revoke the connection in your Oura account at any time.

Apple Health, if you connect it. With your permission, the app reads from Apple Health your sleep (time asleep only), heart rate variability, resting heart rate, steps, the active energy you burn through the day, breathing rate, wrist temperature and blood oxygen during sleep, mindful minutes, your workouts with the heart rate recorded during them, and your body weight, so your calorie target stays matched to your weight. While you sleep, it also reads your heart rate and the timing of your heartbeats, to work out your resting heart rate and heart rate variability. Connecting it never writes anything to Apple Health by itself; drinks are saved there only if you turn that on in Hydration, described below. If you turn on Food to Apple Health in Settings, the app asks once for permission, then saves to Apple Health the calories and protein of each food you log, with its name and the time you ate it, and updates or removes that copy when you edit or delete the entry. Turning the switch off stops new copies; what was already saved stays in Apple Health until you delete it in the Health app. The readings themselves are kept on this phone only and are never uploaded. They count toward your day score and its recovery and strain readings, and that score and your pillar percentages are saved with the rest of your log in your account, where they can be part of the snapshot Luna answers from. Data from Apple Health is never used for advertising or marketing, never sold, and never shared with anyone for those purposes. Disconnecting in the app deletes the stored readings, and you can turn off the permission itself at any time in the Health app.

Drinks and Apple Health, if you turn it on in Hydration. If you turn on Apple Health in Hydration, the app asks once for permission, then saves the water and the caffeine of each drink you log to Apple Health, and removes them again when you delete the drink. Alcohol saves no water. With the same permission it reads the water other apps and smart bottles saved to Apple Health and shows it in Hydration, marked Health; that water counts toward your day like a drink you logged and is saved with your drinks in your account. Hiding one of those rows in Hydration leaves it in Apple Health. Nothing else is written. You can turn the switch off in Hydration, and the permission off at any time in the Health app.

Medications from Apple Health, if you import them. On iOS 26 or later you can import medications from Apple Health in Meds. Apple asks you which ones to share. The app reads only their names and forms, never their doses, schedules or when you took them, and adds the ones you pick to your Meds list, where they are saved to your account like any medication you type in. Nothing is written to Apple Health. You can stop sharing at any time in the Health app.

Runs, rides and walks you record. When you start recording a run, ride or walk, the app uses this phone’s location to measure the distance, your pace and your splits, and to draw your route. Location is used only while a recording is running, including with the screen locked, when iOS shows its blue location indicator, and never at any other time. The session is saved to your account like one you log by hand. The route is saved to your account too, with its first and last 200 metres removed so the place you start and finish, often your home, is not on it. The raw points stay on this phone and are deleted once the session is saved. Routes are never shared, never sold and never used for advertising. Deleting a session deletes its route, and deleting your account deletes all of them. If you turn on spoken cues, Luna’s voice is generated on this phone and nothing you say or hear leaves it.

Recordings you save to Apple Health. When you finish recording a run, ride or walk with Save to Apple Health turned on, the app asks once for permission to save workouts, then saves that session to Apple Health: when it started and ended, its pauses, the distance and the route. Apart from the drinks you choose to save from Hydration and the food you choose to copy with Food to Apple Health, this is the only thing the app writes to Apple Health. With a workout it never writes anything estimated, such as calories burned, and never a session you typed in by hand. A workout saved there stays in Apple Health until you delete it in the Health app; deleting the session in MyPotential does not remove it. You can turn the permission off at any time in the Health app.

Screen time, if you allow it. With your permission, iOS Screen Time tells the app each time your phone use passes another 5 minutes, for the whole phone and for the apps you choose for your goal (such as social and video), and the app adds those steps up into daily totals. Those totals, in whole minutes, are saved with the rest of your log in your account, like a number you type in, and count toward your score against your own goal. Which apps you used, and for how long each, is shown only in a panel iOS draws inside the app: MyPotential cannot read it, and it never leaves this phone. The apps you choose for a lock (the bedtime lock, Block now, the limit at your goal, earn it back) are held by iOS in a form the app cannot turn back into names, and the locks run on this phone, as do the pause before a locked app opens and the count of emergency unlocks. Whether today’s workout is logged, which lifts earn it back, is checked on this phone too. Screen Time data is never sent to Luna or any AI service, never shown to other members of a group, never used for advertising or marketing, never sold, and never shared. You can turn the access off at any time in the Settings app, under Screen Time, and typing the number in by hand keeps working.

Apple Pay payments, if you turn on Apple Pay logging. If you turn on Apple Pay logging, a Shortcuts automation you set up on your iPhone hands MyPotential the shop and the amount of each payment you make with Apple Pay, and it is saved as spending, on this phone and, when you are signed in, in your account. MyPotential never receives your card number or anything else from Apple Wallet. A category you set for a shop is remembered on this phone. To stop it, delete the automation in the Shortcuts app; payments already logged stay until you delete them.

Luna conversations. Each message you send to Luna goes to OpenAI, which runs her, as described under who processes your data, together with your first name, the facts she keeps about you that you confirmed, which you can see and delete on her memory screen, the habits you ask her to track and their yes or no log, which you can stop at any time, what you logged today, the last 28 days of your sleep, training, food, water, mind, money spending, screen time settings and other sections, and the time and your time zone. Your medication is never part of it. OpenAI never trains a model on it and keeps it at most 30 days, only to check for misuse.

Faith. If you use the Faith section: the tradition you chose and, for Christians, your church; which practices you marked (prayers, reading, fasting, going to a service, the rosary, taraweeh, a day marked excused); the prayer list, gratitude and reflection notes you write, verses you save, where you were reading and your reading plan; and your prayer time settings (calculation method, minute offsets, which prayers remind you) and the daily reminder time. This reveals religious belief, which is special-category data. Faith keeps it in your account only after you agree to that on Faith’s own consent screen; if you choose to keep it on this phone only, nothing from Faith leaves the phone, and any copy an earlier version uploaded is deleted. It is never scored and never shown to Luna. Faith’s reminders are set on this phone and sent by it. When you are signed in, your tradition and the day’s passage are sent to write that day’s reflection (and, for Christians, a prayer), and your tradition and church go with anything you ask Faith’s AI helpers, both as described under section helpers. The only other thing Faith sends anywhere is the city or position used for prayer times, described under reference lookups.

Food scan and meal plan. When you ask for them: the photo of a meal or a label you take or pick, and, for a meal plan, today’s calorie and protein targets, what you have eaten so far and the time of day. Each is sent only to produce that answer and is not stored by us or by the AI provider. A meal photo is deleted from this phone once it is read; a small thumbnail stays on this phone with the meal and goes when you remove the meal. A scan read on the spot is logged only when you tap Log it. A photo taken with no signal waits on this phone and is logged when it is read; the app tells you so, and you can open, change or remove it like any meal. The calories and nutrients are estimates.

Labs and bloodwork. If you add lab results in Health: each test, its value and unit, the day the sample was taken, the reference range you copy from your own report, and any note you add. They are stored with your account like the rest of your log, and deleted with it. If you choose to read a report from a photo or a screenshot, that image is sent to OpenAI only to read the values on it, as described under who processes your data, and it is not kept: not by us, not in your account and not on our servers. Nothing from it is saved until you review the values and keep them.

Section helpers. When you ask for them: the goal you describe to the planner, this month’s spending totals for the money coach, a screenshot you choose to scan, and your conversation with the faith companion. Each is sent only to produce that answer, and nothing is saved until you review and keep it. The faith companion receives your tradition, your church if you set one, and your messages, never your other trackers; it is an AI, not a religious authority, and does not give religious rulings. Faith’s daily reflection, and for Christians the prayer, are also rewritten around the day’s passage when you are signed in, from your tradition and that passage alone, marked as written by AI, and kept on this phone as that day’s text. The Muslim du’a is never AI written: it is a supplication from the Qur’an.

Groups. If you join a group: the display name you choose, which pillar is holding you back (never when it is Meds, Spending or Screen time), which days your own day score reached the group’s target and when each day was marked, your weekly score (the average of your daily scores, which breaks a tie in the race), how far the pillar holding you back rose on the week before, as a percentage (for the Biggest fix title, and never when that pillar is Meds, Spending or Screen time), the titles you earn, and the messages and cheers you send are visible to that group’s members; a nudge is seen only by the person you nudge. A day is marked for you automatically when your own day score reaches the group’s target; the group sees the day, never your score or what you logged, such as how long you slept. Each member has their own invite link for a group. Anyone who has one can see, before they join, the group’s name, how many are in it and the display name of the member who shared it (for the group’s own code, whoever made the group), so they know who it is from. Nothing else about the group or its members is shown. When someone joins with your link, we record that they came through it; only you can see that record, and nothing is given or paid for an invite. To stop codes being guessed, looking one up without an account is counted against a scrambled form of the network address it came from, kept for one hour; the address itself is never stored. A group’s owner can remove a member, and we can remove someone from Groups, and keep them out, for breaking the rules. Reports you file and people you block, with the name and group you saw them in, are stored with your account so they can be acted on. A report keeps a copy of the message it is about, so it can still be reviewed if the message is deleted.

Subscription data. Whether a subscription is active, which plan, and when it renews or ends. Apple processes the payment and tells RevenueCat that it succeeded. We never receive or store your card details, your billing address or your Apple Account.

Usage events. A small number of events recording how the app is used: which setup step you reached, whether you finished it, when you opened the app, and which subscription screens you saw. They never contain anything you typed or any health or financial value. We record that you reached the weight question, never what you weighed.

Technical data. Standard request data such as your IP address and app version, processed by our hosting provider to deliver and secure the service. We do not use it to build a profile of you. We also keep a record of what you agreed to, with the wording and the time, and daily counters that limit how many AI requests an account can make.

3. What we do not collect

We do not read your contacts or use your microphone. We never browse your photo library: an image leaves the phone only when you take or pick it yourself to scan. Faith asks for your location only to point you to the qibla and, if you have not set a city, to find today’s prayer times. The qibla is worked out on this phone. For prayer times your coordinates, rounded to about ten metres, go straight from your phone to the prayer times service named below and never to us, and Faith never stores your location. We do not collect precise device identifiers or your browsing history. The app contains no advertising SDK, no third-party analytics SDK and no cross-site tracking technology, and it never asks for permission to track you across other apps, because it does not.

4. Special-category data

Some of what you choose to track, such as health, fitness, recovery and medication data and your faith practice, is special-category personal data under the GDPR. We process it only on the basis of your explicit consent, given when you enter it or connect a source, and solely to run the app for you. You can withdraw that consent at any time by deleting the entry, disconnecting the source or deleting the account.

Health, fitness and financial data are never used for advertising, marketing or any form of data mining, and are never sold, rented or disclosed to data brokers.

5. How we use it

To keep your log, score it, name the pillar holding the rest back, and sync it to your account so a new phone picks up where this one left off.

To let Luna and the helpers answer from your own numbers rather than from generic advice.

To give you the access you paid for, by checking with Apple that a subscription is valid.

To keep the service secure, prevent abuse, act on reports in Groups and fix faults.

To understand how the app is used in aggregate, for example how many people finish setup. This uses only the usage events described above, never your health or financial data.

Legal bases. Performance of our contract with you, your explicit consent for special-category data and for AI processing, and our legitimate interest in keeping the app secure and improving it. GDPR Articles 6 and 9.

6. Luna and automated processing

Luna is an AI, not a person, and so is every helper in the app that writes an answer for you. Nothing she says is written or checked by a human before you see it. She produces suggestions and summaries. She does not make any decision with a legal or similarly significant effect on you, and no human profiling of you takes place. Your data is not used to train AI models, not ours and not our processors’. AI output can be wrong. It is informational and is not medical or financial advice.

Nothing is sent to an AI until you agree to it, the first time you use an AI feature. You can turn AI features off in Settings at any time, and the rest of the app keeps working.

7. Who processes your data

We do not sell your data. We share it only with the providers needed to run MyPotential, and each receives only what its job needs. Where a provider acts as our processor, a data processing agreement governs it.

Supabase. Database, sign in and storage of your account and everything you log. It runs our server functions, and it stores your password, if you set one, only as a salted hash.

Apple. Distributes the app and processes every subscription payment as the seller of record. Your card details go to Apple and never to us. If you sign in with Apple, Apple provides your identifier and, if you allow it, your email.

Google. Only if you choose to sign in with Google: Google confirms who you are and provides your email address and account identifier. It receives nothing you log.

RevenueCat. Tells the app whether your subscription is active. It receives a random identifier for your account and the receipt Apple issues, never your card or your log.

OpenAI. Every AI request, for Luna, the food scan, the lab report reader, the meal plan and the Goals, Finance and Faith assistants, goes from our server to OpenAI, which runs the model that answers. Each request carries only what that feature sends, described above. OpenAI never trains a model on it. Every request we send tells OpenAI not to store it, and OpenAI keeps it at most 30 days, only to check for misuse, then deletes it.

Food lookups. Food search asks USDA FoodData Central and Open Food Facts through our server, with only the words you type, so neither sees your IP address or your account. A barcode goes from your phone straight to Open Food Facts, which receives the barcode and an ordinary web request, including your IP address, and nothing you logged.

Reference lookups. The World English Bible and the Qur'an (Arabic, Pickthall's English and a transliteration) are built into the app and read without any request. Some Faith content is fetched straight from your phone from public services, not from us: Bible chapters in the King James, American Standard or Basic English versions from bible-api.com when you choose one, Qur'an recitation audio from islamic.network when you press play, and prayer times and the Hijri date from aladhan.com. They receive an ordinary web request, which includes your IP address. Prayer times also receive either the city you typed or, if you allowed location, your coordinates, and the calculation settings you chose. None of them receives anything you logged. Prayer times are calculated, not set by a religious authority; your mosque's own times are the ones to follow.

Weather. If you turn on local weather in Hydration, today's temperature comes straight from your phone from open-meteo.com, which receives your position rounded to about 10 km and an ordinary web request, including your IP address, and nothing you logged. Only the temperature is kept, on this phone, to add to the day's water target.

Exercise pictures. The pictures in the exercise library are loaded from GitHub (raw.githubusercontent.com), where the open exercise library they come from is published. GitHub receives an ordinary web request, which includes your IP address, and nothing you logged.

We may also disclose data if we are legally required to, or to establish or defend legal claims. If that ever happens we will tell you unless the law forbids it. Some providers process data outside the EU. Where they do, the European Commission’s Standard Contractual Clauses or an equivalent safeguard applies.

8. Where it lives

The app stores your log on this phone so it works instantly and offline, and mirrors it to your account. Deleting the app removes the local copy. Your account copy remains until you delete it. Data is encrypted in transit and at rest, access to your rows is enforced at the database level so one account can never read another’s, and server-side keys never reach the app.

9. How long we keep it

For as long as your account exists. When you delete your account, your login and everything logged against it are removed from our live systems immediately and from any backup we keep within 30 days. The copy on this phone is removed at the same time.

Reports in Groups. A report someone else filed about a message of yours keeps its copy of that message after you delete your account, with your account removed from it, so the report can still be reviewed. Reports cannot be withdrawn or erased by the person they concern, or they would not work. Reports you filed are deleted with your account.

Your Apple subscription is separate. Apple holds the billing relationship, so deleting your account does not cancel a subscription. Cancel it in your device’s Settings, under your name, then Subscriptions. Apple keeps its own record of the transaction under its policy. RevenueCat, which checks subscriptions for us, keeps the subscription record linked to your account until we ask it to delete it, which we do on request.

10. Your rights

Under the GDPR you have the right to access, correct, export, restrict, object to and delete your personal data, and to withdraw consent at any time. Directly in the app you can:

Export. Everything on this phone, as a JSON file, from Settings.

Delete. Your account and all data, from Settings. It is permanent and needs no email to us.

For anything else, write to mypotential.contact@gmail.com. You also have the right to lodge a complaint with your local data protection authority. In Romania, where we are established, that is the National Supervisory Authority for Personal Data Processing (ANSPDCP, dataprotection.ro), and you may also complain to the authority of the EU country where you live.

11. Children and teenagers

MyPotential is not for anyone under 13. The setup quiz asks your age before your body measurements and before any health consent, and someone under 13 is turned away and what they typed so far is erased from the phone. We do not knowingly collect data from anyone under 13. If you believe a child has given us personal data, contact us and we will delete it.

If you are 13 to 15. Under 16, the law in Romania and most of the EU says you cannot agree on your own to an app using your health information. So before the app keeps any of it, a parent or guardian has to read what it keeps and agree, on your phone. We record that they agreed and which words they agreed to, and they or you can withdraw it at any time in Settings, which deletes the account and the health data in it.

Under 18. The app never sets a weight-loss calorie target for anyone under 18. If you are under 18 and want to lose weight, talk to a doctor first. In Goals, a weight goal only aims down if a parent or guardian enters a target weight the child’s doctor set and confirms it came from the doctor. We keep that target, when it was entered and that a parent confirmed it, with the goal. The plan is then paced at no more than 0.5 kg a week, the calorie target still stays at maintenance, and the parent can change or remove the target in Settings. Parents and guardians can ask us at mypotential.contact@gmail.com to see or delete their child’s data.

12. If you live in the United States

We do not sell your personal information and do not share it for cross-context behavioral advertising, as the California Consumer Privacy Act uses those words, and we have not done so in the past 12 months. We use sensitive personal information, such as health data, only to provide the app to you.

If you live in Washington, Nevada or another state with a consumer health data law, our Consumer Health Data Privacy Policy, in Settings and on our website, describes the health data we collect and your rights over it, including how to appeal if we refuse a request.

Wherever you live, you can ask to access, correct or delete your data at mypotential.contact@gmail.com, and we will not treat you differently for asking.

13. Changes

We may update this policy. The date at the top always reflects the current version, and we will tell you in the app before any material change takes effect.