1. Who we are
MyPotential ("MyPotential", "we", "us") is a personal health and life dashboard operated from the Netherlands (EU), available on the web and as an iOS app. We are the data controller for the information described here. For any privacy question, contact mypotential.contact@gmail.com; we answer privacy requests within 30 days.
This policy covers the MyPotential app on every platform. Where the iOS app behaves differently, it is called out below.
2. What we collect
- Account data - your email address and password (passwords are stored hashed by our auth provider, never in plain text). If you sign in with Google, we receive your email and basic profile from Google.
- Health & wellbeing data you enter - water intake, calories & food, body weight and goals, training and workouts, caffeine, medications and supplements, screen time, faith and habit tracking, and similar entries.
- Photos you take or choose (optional) - when you scan a meal, a receipt, or a piece of gym equipment, the image is sent to our AI processor to be read and turned into entries. We do not store the image on our servers and we do not use it to identify you. The app asks for camera or photo-library permission only at that moment; you can decline and enter the data by hand. We never browse your photo library - only the single image you pick is used.
- Financial data (optional) - if you use the Finance section you may enter budgets and expenses yourself, or connect a bank account. Bank connections use GoCardless Bank Account Data (a regulated PSD2 provider); access is read-only by construction - the app cannot move, send or spend money. Your bank authenticates you on the bank's own page; we never see your bank login. We store only a reference to the connection; balances and transactions are fetched on demand and cached in your app data so the section works offline.
- Connected services (optional) - if you link a watch (WHOOP, Oura, Fitbit or Garmin), we receive sleep, heart-rate and recovery metrics from that account. If you use the iPhone app and allow it, we read the same kinds of metrics from Apple Health on your device; that reading happens on the phone, and we never write anything back to Apple Health.
- Notification data (optional) - if you turn on reminders, we store the push subscription or device token needed to deliver them. It is used for nothing else and is removed when you turn reminders off or delete your account.
- Voice (optional, only while you hold a conversation with Luna) - you can talk to the Luna coach instead of typing. If you do, your device's own operating system listens and converts your speech to text; on an iPhone that is Apple's speech recognition, and on other platforms it is your browser's. We never receive your audio and we never store a recording - only the text that came back reaches us, and it is then treated exactly like a message you had typed. The microphone is opened only when you start a voice conversation and is closed when you end it or leave the screen; you can decline the permission and keep using Luna by typing.
- Subscription and purchase data - if you subscribe, Apple processes the payment and tells us that it succeeded. We store the identifier Apple gives the subscription, whether it came from Apple's live or test environment, and the dates your access starts and ends. We never receive or store your card details, your billing address, or your Apple Account.
- Technical data - standard request data (e.g. IP address, browser or app version) processed by our hosting provider to deliver and secure the app. We do not use it to build a profile of you.
- Anti-abuse signals (free trials only) - when you start a free trial we record a one-way, irreversible fingerprint (a salted hash) of your IP address and of a few ordinary browser properties: your operating system, screen size, time zone, language and browser name. We store only the hashes, never the underlying values, so the record can tell us that a trial has been started before from the same setup and can never be turned back into your IP address or your device. It exists solely to stop one person taking unlimited free trials, is used for nothing else, and is deleted with your account. We do not use canvas, audio or font fingerprinting, and none of this is used for advertising or to track you anywhere.
- Launch waitlist (optional, and separate from your account) - if you join the waitlist, the only thing we ask you for is an email address. The waitlist runs on Waitlister, a hosted service, and your address lives there: we keep no copy of it in the MyPotential database. Joining creates no account, and a waitlist address is never joined to any app data. If you arrive through someone's referral link, Waitlister records who referred you, together with the points and queue position you earn from referrals and from following our social accounts. To stop one person inventing referrals, Waitlister's own fraud check and bot check process your IP address and ordinary browser characteristics - this happens on Waitlister's page and not in the app, it is used only to detect fake signups, and it is never used for advertising or to track you anywhere else. Note that the waitlist page shows a leaderboard: other people on the list can see a masked form of your email address (for example j*****@g****.com) next to your position and points. Nothing else about you is shown, and unsubscribing removes your entry.
- Usage events - a small number of events recording how the app is used: which setup step you reached, whether you finished it, when you opened the app, and which subscription screens you saw. Each is stored against a random identifier held on your device (and against your account once you have one) so we can tell one visit from another. These events never contain anything you typed or any health, photo or financial value - we record that you reached the weight question, never what you weighed. This identifier is ours alone: it is not an advertising identifier and is never shared.
We collect nothing else. In particular we do not collect your contacts, your location, your precise device identifiers, or your browsing history. The microphone is used only for the voice conversations described above, only while one is running, and never to record or listen in the background.
3. Special-category data
Some information you choose to track (such as health, fitness, recovery, medication and faith data) is special-category personal data under the GDPR. We process it only on the basis of your explicit consent, given when you enter it, and solely to provide the app's features to you. You can withdraw that consent at any time by deleting the data or your account.
Health, fitness and financial data are never used for advertising, marketing, or any form of data mining, and are never sold, rented, or disclosed to data brokers.
4. How we use your data
- To run your dashboard and sync it across your devices.
- To generate AI insights (Daily Brief, Weekly Review, meal suggestions, food and receipt scanning, and the Luna coach). To do this, the relevant snapshot of your tracked data - or the single image you scanned - is sent to our AI processor to produce a response for you.
- To look up nutrition information you search for. Your search term (not your identity or your entries) is sent to public food databases.
- To send the reminders you enable.
- To give you the access you paid for - checking with Apple that a subscription is valid, and keeping it active while it renews.
- To keep the service secure, prevent abuse, and fix faults.
- To understand how the app is used in aggregate - for example how many people finish setup - so we can improve it. This uses only the usage events described above, never your health, photo or financial data.
Legal bases (GDPR Art. 6 & 9): performance of our contract with you, your explicit consent for special-category data and for AI processing, your consent for optional integrations and notifications, and our legitimate interest in keeping the app secure and improving it.
5. Automated processing and AI
The AI features produce suggestions and summaries. They do not make any decision that has a legal or similarly significant effect on you, and no human profiling of you takes place. Your data is not used to train AI models - not ours, not our processor's. AI output can be wrong; it is informational and is not medical advice (see the Terms of Service).
One check is automated: when you ask for a free trial, the hashed anti-abuse signals described above are scored to decide whether to grant it. The only possible outcomes are that the trial starts, that we ask for a payment method first, or that we decline to give a free trial. It never affects an account you already have, never affects your data, and never stops you subscribing normally. If you believe a decision was wrong, email us at the address in section 1 and a person will look at it and can grant the trial by hand.
6. Advertising and tracking
MyPotential shows no advertising and contains no advertising SDK, analytics SDK, or cross-site tracking technology. We do not use advertising cookies or advertising identifiers, we do not build profiles for advertisers, and we do not sell or share your data for advertising. We do not track you across apps or websites owned by other companies (as "tracking" is defined by Apple's App Tracking Transparency framework), which is why the app never asks for permission to do so. If this ever changes, this policy will be updated and your consent obtained first.
Under the California Consumer Privacy Act we do not "sell" or "share" personal information, and we have not done so in the preceding twelve months.
7. Who processes your data
We do not sell your data. We share it only with the providers needed to run MyPotential, each acting as our processor under a data processing agreement:
- Supabase - database, authentication and storage of your account and tracked data.
- Vercel - hosting and delivery of the app.
- Anthropic - processes the data snapshots and images you submit to the AI features to generate responses. Anthropic does not train on this data and retains it only briefly for abuse monitoring.
- GoCardless Bank Account Data - only if you connect a bank, as the regulated provider of read-only account access.
- WHOOP, Oura, Fitbit, Garmin - only the one you connect, as the source of your sleep and recovery data. Apple Health is read on your device only and is not a third party we send anything to.
- Waitlister - runs our launch waitlist. It hosts the signup page, stores the email addresses given to it, counts referrals and points, and sends the waitlist emails and handles their unsubscribes. It is the only place waitlist addresses are stored; they are not copied into our own database. Waitlister uses Cloudflare Turnstile on that page as a bot check, and its own fraud check on the signals described in section 2. If you never join the waitlist, none of this applies to you.
- Kit (ConvertKit) - our email provider for account holders. If you have an account and ticked the optional "email me tips and product news" box when you signed up, Kit holds your account email address so we can send you a small number of setup emails - for example, if you did not finish the questionnaire, if you have not tracked anything yet, or shortly before a free trial ends. Kit receives your email address and a label saying which of those emails to send. It never receives any of your health, financial, or tracked data, and it handles your unsubscribe. If you did not tick that box, we never send your address to Kit at all.
- Google - only if you use Google sign-in.
- Open Food Facts and the USDA FoodData Central database - receive the food search terms you type, and nothing that identifies you.
- Apple - distributes the iOS app and delivers push notifications. Apple also processes every subscription payment as the seller of record: your card details go to Apple and never to us, and Apple tells us only that the purchase is valid and when it expires. If you speak to Luna on an iPhone, Apple's speech recognition also converts that speech to text on your device's behalf, under Apple's own privacy policy; we receive only the resulting text.
Apple is the only payment processor involved, and it never gives us your payment details.
We may also disclose data if we are legally required to, or to establish or defend legal claims. If that ever happens we will tell you unless the law forbids it.
Some providers may process data outside the EU; where they do, appropriate safeguards (such as the European Commission's Standard Contractual Clauses) apply.
8. Where data is stored on your device
The app stores your data on your device (local storage) so it works quickly and offline, and mirrors it to your account in the cloud. Deleting the app, or clearing your browser data, removes the local copy; your cloud copy remains until you delete it.
9. Security
Data is encrypted in transit (HTTPS/TLS) and at rest by our database provider. Access to your rows is enforced at the database level so one account cannot read another's data, and server-side keys never reach the app. No system is perfectly secure, but if a breach affects your personal data we will notify you and the relevant authority as the GDPR requires.
10. How long we keep it
We keep your data for as long as your account exists. When you delete your account, your login and all associated data are permanently removed from our live systems immediately, and purged from encrypted backups within 30 days. Usage events, push subscriptions, your subscription record and any bank connection reference are deleted along with it. Deleting your account does not cancel an Apple subscription - because Apple, not us, holds the billing relationship, you must cancel it in your device's Settings → your name → Subscriptions, and Apple keeps its own record of the transaction under its policy. Anonymous, aggregated counts that can no longer be linked to you may be retained.
A waitlist address has no account attached, so it follows its own rule: Waitlister holds it until you unsubscribe, or until six months after launch, whichever comes first, and it is then deleted along with the referral count and leaderboard entry attached to it. Because we keep no copy in our own database, unsubscribing deletes it everywhere. Deleting your MyPotential account does not remove you from the waitlist, and leaving the waitlist does not affect your account - they are separate.
If you opted in to setup emails, the record of which ones we have already sent you is deleted along with your account. Unsubscribing from any email stops all of them immediately.
11. Your rights and choices
Under the GDPR you have the right to access, correct, export, restrict, object to, and delete your personal data, and to withdraw consent at any time. Directly in the app you can:
- Export all your data yourself in Settings → Export my data.
- Delete your account and all data in Settings → Delete account. This is permanent and needs no email to us.
- Disconnect a watch or a bank connection at any time in Settings, which revokes our access. Disconnecting a watch also deletes the readings it left on this device.
- Turn off reminders, or revoke camera and photo access in your device settings, at any time.
- Leave the waitlist, if you joined it, using the unsubscribe link in any waitlist email. That withdraws your consent and erases your address, your referral count and your leaderboard entry from Waitlister; you do not need an account to do it, and it does not touch your MyPotential account.
For anything else, contact us at mypotential.contact@gmail.com. You also have the right to lodge a complaint with your local data protection authority (in the Netherlands, the Autoriteit Persoonsgegevens).
12. Children
MyPotential is not directed to and not intended for children under 16. We do not knowingly collect data from them. If you believe a child has given us personal data, contact us and we will delete it.
13. Changes
We may update this policy. The "last updated" date above always reflects the current version, and we will notify you in the app before any material change takes effect.