Privacy Policy
Effective date: May 29, 2026Caffeinly ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal information when you use the Caffeinly mobile application (the "App"). It is designed to comply with applicable data protection laws, including the California Consumer Privacy Act (CCPA), the General Data Protection Regulation (GDPR) as applicable, and the data disclosure requirements of the Apple App Store.
By using Caffeinly, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the App.
1. Information We Collect
| Category | Data collected | Purpose | Linked to identity? |
|---|---|---|---|
| Account | Email address, encrypted password | Authentication and account management | Yes |
| Health profile | Caffeine sensitivity, tolerance tier, metabolizer speed, chronotype, wake time, bedtime, sleep duration, morning grogginess, sleep impact rating, dependency score, anxiety response, age range, body size, biological sex factors affecting caffeine metabolism (estrogen status, smoking status) | Personalised pharmacokinetic modelling and recommendations | Yes |
| Caffeine intake | Drink type, volume, unit (oz/ml), caffeine amount (mg), time of dose, date — whether logged manually, via quick-log, or via Siri | Caffeine curve modelling and daily readiness estimates | Yes |
| Sleep | Self-reported sleep quality rating (1–5 scale); if you grant HealthKit access, also sleep stage data (in-bed, core, REM, deep) used to derive a quality score and wake time — see Section 3 | Correlating caffeine timing with sleep quality; refining personalised recommendations | Yes |
| Custom drinks | User-defined drink name and caffeine concentration | Extending the built-in drink catalogue with your own beverages | Yes |
| Server infrastructure | IP address, request timestamps, and HTTP user-agent string — collected automatically by our database provider as part of standard server operation | Security, abuse prevention, and infrastructure reliability | No |
The health profile fields listed above — including age range, body size, estrogen status, and smoking status — are collected solely because they meaningfully affect caffeine half-life and are required inputs to the pharmacokinetic model. They are not used for any purpose beyond personalising your in-app experience.
We do not collect biometric data, precise GPS location, payment card information, photos, microphone or camera input, or advertising identifiers. We do not run analytics or crash-reporting software; no usage events are sent to any analytics service.
Caffeine intake and health profile data are health-adjacent. This information is used solely to generate personalised timing estimates within the App and is never shared with third parties or used for advertising.
2. How We Use Your Information
- Model your personal caffeine metabolism curve and project active caffeine levels throughout the day.
- Generate personalised recommendations for when to drink or avoid caffeine based on your profile, current intake, and bedtime.
- Surface your logged caffeine intake on a paired Apple Watch, using a Bluetooth connection between your devices — no data is sent to external servers for this purpose.
- Enable logging caffeine doses via Siri voice commands, with those doses synced to your account the next time you open the App.
- Deliver local, on-device notifications you have explicitly opted into (see Section 6).
- Respond to support requests and enforce our Terms of Service.
We do not use your data for advertising or marketing profiling. We do not sell, rent, or share your personal information with third parties for their own marketing purposes.
3. Apple Health Integration (HealthKit)
Caffeinly integrates with Apple Health (HealthKit) in two ways, both of which require your explicit permission via the iOS permission prompt.
Reading sleep data. If you grant read access, the App reads sleep analysis records (sleep stages and duration) from Apple Health to automatically derive your sleep quality rating and wake time. This data is used locally on your device for calculation purposes only. It is not transmitted to our servers.
Writing caffeine data. If you grant write access, the App records each caffeine dose you log as a Dietary Caffeine entry in Apple Health. This is a convenience feature so your caffeine intake appears alongside other health metrics in the Health app. Once written, this data is subject to Apple's own privacy controls and the policies of any other apps with Health access on your device.
HealthKit data is never used for advertising, shared with third parties, or used for any purpose other than providing the App's core personalised caffeine tracking functionality. You can revoke HealthKit permissions at any time in iOS Settings → Privacy & Security → Health → Caffeinly. Revoking access does not delete data already written to Apple Health; you can remove that data directly within the Health app.
4. Siri and Voice Logging
Caffeinly supports voice logging via Siri ("Hey Siri, log a cold brew in Caffeinly"). The App registers App Intents with the operating system that allow Siri to log caffeine doses without opening the App.
When you use a voice command, iOS speech recognition processes your voice entirely within iOS — Caffeinly does not access your microphone directly and does not receive or store any audio recording. The App only receives the structured result (drink name, optional volume) that Siri resolves.
To enable drink-name resolution, the App publishes a list of your available drinks (names and caffeine concentrations) to a secure, device-local App Group shared between the main App and the Siri extension. This list never leaves your device except as part of the normal dose data synced to your account (see Section 7). Doses logged via Siri are queued locally and ingested into your account the next time you open the App, at which point they are treated identically to manually logged doses.
5. Apple Watch
If you install the Caffeinly Apple Watch app, the iPhone app transmits your current active caffeine level, recommendation state, and projected bedtime caffeine to the Watch over Bluetooth using Apple's WatchConnectivity framework. This sync happens on-device between your paired iPhone and Watch; the data involved is not sent to our servers beyond what is already stored in your account as part of your caffeine curve.
6. Local Notifications
With your explicit permission, Caffeinly schedules notifications on your device to remind you of optimal caffeine windows, approaching cutoff times, and similar timing cues. These notifications are entirely local — they are scheduled on your device by the operating system and are never routed through our servers or any push notification service. We do not collect or store your device push token.
You can withdraw notification permission at any time in iOS Settings → Notifications → Caffeinly, or within the App's settings screen.
7. Data Storage and Security
Your account, profile, caffeine dose history, sleep logs, and custom drinks are stored in Supabase (supabase.com), a managed database service. We implement row-level security (RLS) so that each user can only access their own data. Authentication credentials are hashed using bcrypt and are never stored in readable form. Session tokens are encrypted and stored in your device's secure keychain using iOS Secure Enclave-backed storage.
All data in transit between the App and our servers is encrypted using TLS. Data is stored on servers in the United States.
We do not operate any analytics pipeline, crash-reporting integration, or behavioural tracking system. Caffeinly contains no third-party SDKs beyond those listed in Section 8.
8. Data Sharing and Third-Party Services
| Provider | Purpose | Data shared | Privacy policy |
|---|---|---|---|
| Supabase | Database and authentication hosting | Account, profile, caffeine logs, sleep logs, custom drinks | supabase.com/privacy |
| Apple (HealthKit) | Reading sleep data and writing caffeine data to Apple Health — with your permission | Caffeine doses written to Apple Health; sleep stage data read locally only | apple.com/legal/privacy |
| Apple (Siri / App Intents) | Processing voice commands to log caffeine | Drink catalogue (names and concentrations) provided to the on-device Siri extension; audio is processed entirely by iOS and not shared with Caffeinly | apple.com/legal/privacy |
We do not share your data with any other third party. We have no advertising partners, data brokers, or marketing platforms.
9. Data Retention and Account Deletion
We retain your data for as long as your account is active. You can permanently delete your account and all associated data at any time from within the App (Settings → Delete account). Upon deletion, your personal data — including all caffeine logs, sleep logs, health profile information, and custom drinks — is removed from our systems within 30 days, except where retention is required by law.
Deleting your account does not remove data you have previously written to Apple Health. You can remove that data directly in the Apple Health app.
Local data (notification preferences, trial start date) stored on your device is removed when you uninstall the App.
10. Your Rights
- Access: request a copy of the personal data we hold about you.
- Correction: request correction of inaccurate data.
- Deletion: delete your account and all associated data directly in the App (Settings → Delete account), or by contacting us.
- Portability: request your data in a machine-readable format.
- Objection / Restriction: object to or restrict certain types of processing.
California residents (CCPA): You have the right to know what personal information we collect, to request deletion, and to opt out of the sale of personal information. We do not sell personal information.
EEA and UK residents (GDPR): You have the right to lodge a complaint with your local data protection supervisory authority.
To exercise any of these rights, contact us at privacy@caffeinly.com.
11. Children's Privacy
The App is not directed at individuals under the age of 13. We do not knowingly collect personal information from children under 13. Contact us at privacy@caffeinly.com if you believe we have inadvertently collected data from a child under 13 and we will promptly delete it.
12. International Data Transfers
Your data is stored on servers in the United States. If you access the App from the European Economic Area, the United Kingdom, or another jurisdiction with data transfer restrictions, your data is transferred internationally. We rely on Standard Contractual Clauses (SCCs) approved by the European Commission for EEA and UK data transfers.
13. Changes to This Policy
We will update this policy when we introduce changes to how we collect or use your data. For material changes we will provide at least 30 days' advance notice by email and in-app notification before the change takes effect. The effective date at the top of this page reflects the date of the most recent revision.
14. Contact Us
For privacy-related questions, requests, or concerns:
Email: privacy@caffeinly.com
Company: Substantial Insights LLC