Privacy Policy

3.1 Account information

Collected when you create an account or sign in.

If you sign in with Google or Apple, we receive only the identity token those providers issue — your email address and, if you allow it, your name. We never receive your Google or Apple password. If you use Apple's Hide My Email, we receive only the relay address Apple gives us and never learn your real one.

The emails that confirm your address, reset your password, or confirm a change of address are sent through our email delivery provider, Resend (§6.8), which receives your email address — and, on a change, the new one — with the message.

Passwords for email sign-in are handled by our authentication provider and are stored salted and hashed. We cannot read them.

3.2 Health and wellness data

Read from Apple HealthKit or Android Health Connect only after you explicitly grant permission on your device. Everything below is read-only with a single exception — the period days you log yourself, which Bellwether writes back to your device's health platform. See What we write back below.

Categories read from your device:

• Sleep — time asleep, time in bed (iOS), and the light, deep, REM and awake stages
• Activity — step count and walking/running distance
• Exercise and energy — exercise minutes, workouts, active calories, total calories and basal energy (iOS, optional)
• Heart — heart rate samples and heart rate variability (SDNN on iOS, RMSSD on Android)
• Fitness and oxygen — VO₂ max and blood oxygen (SpO₂), read only if you grant the separate permission the app asks for right after you connect
• Cycle — menstrual flow, read only if you turn on cycle tracking and grant its own separate permission from that screen's Connect step

What is stored on our servers: we do not upload raw samples. Your phone aggregates each day into a single daily summary, and that summary is what is stored: sleep hours and minutes, sleep score, deep/REM/light/awake minutes, steps, distance, exercise minutes, total and active calories, average/minimum/maximum heart rate, heart rate variability, a derived steadiness (“Calm”) reading, whether your phone judged the day a “win” (two of its three daily bars cleared), the date, which platform the reading came from, and an anonymous identifier for the device that wrote the row.

When it is uploaded: when you open the app, and in the background, so your circle sees a current day without your having to open it. On Android the phone runs this about once an hour. On iPhone, Apple Health wakes the app when new steps, heart rate or sleep are recorded, even after you have closed it, and a silent push (§6.3) can wake it too. A background upload is the same daily summary, read the same way; revoking health access stops it.

We read at most the last 30 days from your health platform. We do not request the extended-history permission that would let us reach further back.

What we write back: one category, and only from your own action. When you log a period day in Bellwether, the app writes that flow entry to Apple Health or Health Connect; when you clear the day, it deletes that entry again. This keeps your phone's own Cycle Tracking in step with what you logged. It happens only on your own device, only for days you log yourself, and only after you grant menstrual-flow access from the cycle tracking screen's Connect step. We write nothing else to your health platform, and the flow you log is never uploaded to our servers.

3.3 Circle and social data

• Your circle membership list, and the relationship label and group you assign to each person
• Invitations you send or receive: the invite code, its status and its expiry (codes expire after 7 days)
• Reports and blocks: if you report someone, the reason you chose, any note you added, and a copy of the message you reported, kept so we can review it and cleared 90 days after the report is closed (the person reported is never told who reported them). Each report is also emailed to our support inbox through our email delivery provider (§6.8), so that someone reviews it within a day; that email carries the reason, your note, both people’s display names and account identifiers, the circle’s name, and the copy of the reported message. If you block someone, the fact that you did, so neither of you can connect to the other again. The person blocked cannot see the block.
• Feedback: if you send feedback from your profile, or answer the short survey when you cancel a subscription, what you wrote, the reasons you chose, whether it was a trial or a paid plan, and the app version, platform and language you were using, so we can read it in context. Only we can read it; new feedback, with what you wrote, reaches our support inbox in a daily email sent through our email delivery provider (§6.8).
• “Nudges” — the short encouragement messages you send, including the message text, emoji, category, and whether the recipient has read it
• Circle chat: the messages you post in a family circle’s chat, which message one answers, and when it was sent or edited. Everyone in the circle can read them, except people who joined after they were sent
• In-app notifications generated when someone accepts your invite or sends you a nudge
• Challenges you create or are invited to: the title, the preset it came from, the metric being counted (steps, exercise minutes, sleep minutes or win days), the target, the dates it runs, the circle its invitations were drawn from, and whether you were invited, accepted, declined or left
• What happens inside a challenge: the day you joined, declined, left or cleared the bar, and — once it finishes — your final total and placing, how many league points it gave you or took away, and whether it marked you “most improved” (§5.4)
• League points: the points your finished challenges have added up to, which place you in one of five leagues, and how many challenges they count
• Win streaks and achievements: your current and longest run of win days, the date of the last one, and the badges a finished challenge awards. These are readable by you alone, with one exception: whether a challenge marked you “most improved” is shown to everyone in that challenge (§5.4). The percentage behind it stays in your own badge.
• Personal win goals you set for steps, sleep, or exercise: the target and the days it holds for, kept so that every phone you sign in on counts your streak against the same goals. Readable by you alone; a challenge always scores everyone against the standard goals, never yours.
• Notification choices: which kinds of push you have turned off in Profile → Notifications — among them the morning recap a running challenge sends — kept on the account so that every phone you sign in on respects them
• How closely you watch each person — the “priority” or “weekly” level you set for them, which decides how often the app may prompt you to check in. This is yours alone; the person it is about never sees it.

3.4 Device and technical data

• Push notification token — issued by Firebase Cloud Messaging, stored with your platform name so we can deliver notifications. Removed when you sign out.
• A random per-installation identifier — generated on your device with no link to any hardware ID, advertising ID or phone number. It exists so that when one account syncs from two devices (say an iPhone and an iPad), we can tell which device recorded a given day and avoid stitching together a day neither of them actually observed. It is never shown to your circle.
• Device model and manufacturer — read on-device to detect Samsung phones (which need extra Health Connect setup) and simulators. Used for on-screen guidance; not uploaded.
• App version, shown on your profile page.
• Crash reports — when the app crashes, or an operation fails in a way that means a feature has stopped working (an upload that did not land, a sync that did not run), a report goes to Firebase Crashlytics (§6.3): the error and where in the app’s code it happened, the device model, operating system and app version, an identifier Crashlytics generates for the installation, and your pseudonymous account identifier. A crash report never carries a health value, email address, display name or text you typed. It is how we find and fix what breaks on real phones, and it is not affected by the usage analytics switch in §3.5.

3.5 Usage analytics

We use Mixpanel to understand how the app is used. It receives automatic events (app opens, sessions, app updates) and named events: Signed Up, Signed In, Signed Out, Tab Viewed (which tab), Screen Viewed (which screen), Notification Opened (type), Health Connect Result (success or failure), Invite Created, Invite Sent, Invite Answered (accepted or declined), Circle Joined, Nudge Sent (category), Circle Message Sent (nothing about the message: not its words, not the circle) and Account Deleted. It receives your progress through setup and the guides: Notification Permission Result (whether you allowed notifications, and where you were asked), Onboarding Step (which first-run step, and whether you did it or passed it by), Onboarding Finished (whether you skipped setup, and how many steps you did), Health Walkthrough Started, Health Walkthrough Finished, App Tour Started and App Tour Finished (whether you closed the walkthrough or tour before its last step). It also receives milestones — App Installed, Circle Created (the first person joined your circle), Invite Opened and Member Joined (how: a code or a direct invite), Wearable Connected, First Nudge Shown, Trial Started, Trial Converted and Subscription Cancelled (the plan’s name and whether it was a trial, never a price or payment detail) — and Feedback Sent and Cancellation Survey Shown, Cancellation Survey Submitted (the reasons you chose and whether you wrote a note, never the note itself) or Cancellation Survey Skipped.

These events are tied to your pseudonymous account identifier. By design, no health value, email address, display name or text you typed is ever sent to analytics. This is a hard rule enforced in our code, not a promise about intent. Analytics identity is detached the moment your session ends.

You can turn usage analytics off in Profile → Privacy → Share usage analytics. The choice is saved on your account, so from then on Mixpanel receives nothing from any device you sign in on, until you turn it back on.

3.6 Messages you send us

When you write to us — by email, or through the form on the support page — we receive what you put in it: your email address, your name if you give one, the topic you picked, the platform and app version if you fill them in, and the text of your message.

The form posts to our own server, which hands the message to our email delivery provider, Resend (§6.8), to deliver to bellwether.mobile@gmail.com. It is not routed through a help-desk product or a form-hosting service, and the message is not stored in our database, linked to your account record, or sent to analytics.

We use it to answer you and to fix what you reported, and we keep the correspondence in that mailbox for as long as it is useful for support history. Please do not put health readings or medical details in it — we never need them, and the note on the form says so too.

To stop the form being used to send mail in bulk, two more things happen. The form may show a check from Cloudflare Turnstile (§6.7), which loads only once you start filling it in, not when you open the page. And our server caps how many messages it accepts from one network address and for one email address — five an hour each. It counts them under a one-way keyed code made from each, never the address itself, and deletes the count within the hour.

3.7 What we do not collect at all

Location or GPS · contacts or address book · microphone or audio · calendar · SMS or call logs · advertising identifiers (IDFA / GAID) · payment or financial information · biometric identifiers for identification · browsing history outside the app · any data about people who are not Bellwether users.

There are no advertising SDKs, no ad networks and no third-party trackers in this app.

5.1 Your circles — and nobody outside them

Bellwether shares inside circles. A circle has an owner and up to eight people in all, and you are in one only because you accepted an invitation to it: one sent to your account, or a link or code someone gave you. Everyone in a circle sees everyone else in it, so before you join, the app shows you the circle's name; once you are in, it shows you who else is there.

5.2 What the people in your circles see

1. Sleep — how long you slept, the light, deep and REM stages, time awake, and a nightly score
2. Steps and distance — your daily step count and how far you walked. Never where you walked.
3. Exercise and energy — active minutes, and calories burned in total and through movement
4. Heart — your average, lowest and highest heart rate for the day, and heart rate variability
5. Calm — a single steadiness reading worked out from your heart figures

They also see your display name, profile photo, and the email address you signed up with.

They do not see: which platform or device your data came from, your device identifier, your timezone, individual samples or timestamps within a day, anything older than the history window the app displays, or any health category not listed above.

5.3 Ending sharing

• Revoke health access in iOS Settings → Privacy & Security → Health → Bellwether, or in Android's Health Connect settings. New data stops being read and uploaded immediately.
• Leave a circle, or, in a circle you own, take someone out of it or delete the circle. You stop sharing with its people, except anyone you are also in another circle with.
• Delete your account in the app, at Profile → Delete Account (see §9).

Revoking health access stops new uploads; summaries already uploaded stay visible to your circles until you delete them or your account. To delete them, open Profile → Privacy → Delete Uploaded Health Days (while health access is off, the “What your circle sees of you” card offers the same). Every day you uploaded is deleted at once, and so is what was worked out from those days and is still shown to other people: your win streak, the alerts and summaries about you in your circles’ feeds (“had a short night”), and the days you cleared the bar in a challenge’s feed. Challenge totals that counted them go down; in a challenge that has already finished you keep your place, without a total, and the league points and any “most improved” mark it settled stay as they were. Nothing is removed from Apple Health or Health Connect, and a notification already delivered to someone’s phone cannot be taken back. If health access is still on, sharing picks up again the next day, and the days you deleted are not uploaded again.

5.4 Challenges

A challenge is a scoreboard for one metric over a set stretch of days. Whoever creates it can only invite people they share a circle with, but the people invited do not necessarily share one with each other — your mother can invite both you and your cousin to the same step challenge.

Accepting an invitation to a challenge shares one metric with everyone else in it. For as long as the challenge runs, the others see your display name, your profile photo, your running total for that one metric, a feed of the days you cleared the bar, with the figure at the time, and your league: the points your earlier challenges have added up to. When it finishes they also see how many league points it gave you or took away, and whether it marked you “most improved”. That is the whole of it: your sleep stages, heart figures, the other metrics and your daily summaries stay inside your circles (§5.1), and a challenge never reveals a day you did not clear.

“Most improved” looks at the two weeks before the challenge. When a challenge finishes, each player’s daily average for its metric during the challenge is compared with their own average over the 14 days before it started — days you had already uploaded for your circles, but from before you agreed to share anything with this challenge. Whoever rose the most, by at least 5%, is marked. The others see only the mark, never the percentage or the figures behind it; but in a challenge of two or three people, the mark alone tells them that your average rose by at least 5% on your previous fortnight.

The same feed, roster and leagues are visible to people who have been invited but have not yet answered, so they can see what they are being asked to join. Until you accept, you share nothing — an unanswered invitation and a declined one both put you nowhere in the standings, no events in the feed, and no league on show.

A challenge for one circle announces its winner in that circle’s chat. When a challenge created for a single circle finishes, the circle’s chat shows a line with the winner’s name and the challenge’s title — never a figure — which everyone in the circle can read, including people who did not take part. It is posted only while everybody who played is still in that circle, and only when one or two people won rather than everybody. Like the rest of the chat, it is deleted after 90 days, or sooner if the winner leaves the circle (§8). A challenge made across circles posts nowhere.

While a challenge runs, the app may send you a morning recap: a push saying where you stand and what today needs. In a race it names the person just ahead of or behind you and the gap between you — what the standings already show you; in a daily-bar challenge it counts only your own days. On the last day it may also tell you when the person next to you is within reach. You can turn the morning recap off in Profile → Notifications.

Leaving a challenge stops the sharing at that moment: the standings are built from accepted participants only, so leaving takes your running total out of them. The days you had already cleared stay in that challenge's feed, and we will remove them if you ask. When a challenge finishes, the final placings and totals, the league points each one moved, and the “most improved” mark stay visible to the people who took part (a total goes sooner if its owner deletes their uploaded health days).

Challenges do not change who can see your daily summary, and being in one with somebody does not put you in a circle with them.

6.1 Supabase — hosting, authentication, database, file storage

Stores your account, circle data, daily health summaries and profile photos. Hosted in the United States, encrypted in transit (TLS) and at rest, and protected by row-level security policies that enforce the sharing rules in §5 at the database itself.

6.2 AI providers — AI insights and suggested nudges

When you view AI insights, the app sends a request through our own server (never directly from your phone, and never with an API key in the app) to one AI provider at a time, in an order we set. The next provider receives the request only if the one before it failed to answer.

• OpenRouter forwards the request to one of the companies hosting OpenAI's gpt-4o-mini model. OpenRouter does not store prompts or responses; the hosting company that serves the request handles it under its own terms.
• Anthropic (claude-haiku-4-5 model). Under Anthropic's commercial terms, data submitted through its API is not used to train its models.
• Google (Gemini API, gemini-3.5-flash-lite model), on paid terms, under which Google does not use prompts or responses to improve its products and keeps them only for a limited period to detect abuse.

Whichever provider answers receives the same data:

What is sent: your daily figures only — sleep hours and score, deep and REM minutes, steps, distance, exercise minutes, heart rate and its range, heart rate variability, VO₂ max and a stress score; plus the reply language and whether the data belongs to you or “a family member.”

A cycle-tracking insight sends cycle figures in place of the daily ones: the current cycle day and phase, roughly how many days until the next predicted period, your average cycle length, and how many logged cycles that average is based on. No dates and no individual flow levels are sent.

What is not sent: your name, email address, account identifier, device identifier, profile photo, circle membership, or any free text you have typed. When generating a suggested nudge for a family member, the recipient's name is deliberately excluded — it adds nothing to the suggestion.

Requests are rate-limited to 20 per user per hour. The resulting insight text is cached on your device.

If you would rather no health figures reach any AI provider at all, simply do not open the AI insights card; the app falls back to insights computed entirely on your own device.

6.3 Firebase (Google) — push notifications and crash reports

Firebase Cloud Messaging receives your device push token and the content of notifications we send you (for example, “Anna accepted your invitation” or a nudge message). Used for transport only. Some pushes are silent, carrying no content, and exist only to wake the app so it can upload the day's data.

Firebase Crashlytics receives the crash reports described in §3.4, keyed to your pseudonymous account identifier. No health values, emails, names or typed text.

6.4 Mixpanel — usage analytics

Receives only the events in §3.5, keyed to your pseudonymous account identifier. No health values, emails, names or typed text.

6.5 Google Sign-In and Sign in with Apple — authentication

Used only if you choose them. They confirm your identity and return an identity token. We do not receive your credentials.

6.6 Apple HealthKit and Android Health Connect — on your device

These are your phone's own health platforms, not our processors. They grant us access only with your explicit permission. We read from them, and the one thing we ever write to them is a period day you logged yourself (§3.2).

6.7 Cloudflare Turnstile — the support form

Used only on the support page, and only once you start filling in the form. To tell a person from a script, Cloudflare receives your IP address and information about your browser and how the page was used, and tells our server only whether the check passed. It never receives what you wrote in the form. It is not used in the app.

6.8 Resend — email delivery

Sends the emails our server writes, and nothing else:

• Account emails — confirming your address, resetting your password, confirming a change of address. Resend receives your email address (and, on a change, the new one) and the message.
• Support messages — what you send through the support form (§3.6): your email address, your name if you gave one, the platform and app version, and your message, delivered to our support inbox.
• Reports and feedback — the email about each report (§3.3): the reason, the reporter’s note, both people’s display names and account identifiers, the circle’s name, and the copy of the reported message; and the daily email with the feedback sent that day and what was written in it.

Resend keeps a copy of each email, with its delivery record, for 30 days and then deletes it. It never receives a health value, and it handles the emails only to deliver them, as our processor. Our support inbox itself is a Gmail mailbox (Google).

If you are in California

Under the CCPA/CPRA you have the right to know what we collect and why, to delete it, to correct it, to obtain a portable copy, and to limit the use of sensitive personal information. Health data is sensitive personal information; we use it only to provide the service you asked for and for no secondary purpose, which is the limit the law allows you to request. We do not sell or share personal information, so there is nothing to opt out of — but you may still submit a request and we will confirm this in writing. We will never discriminate against you for exercising these rights. You may use an authorized agent; we will verify their authority.

If you are in the EU, UK or Switzerland

Our legal bases are: your explicit consent for health data (Art. 9(2)(a) GDPR — this is special-category data, and the device permission prompt is where you give that consent); performance of a contract for account and circle features; and legitimate interests for security, abuse prevention, crash reporting and product analytics. You have rights of access, rectification, erasure, restriction, portability and objection, and may withdraw consent at any time without affecting prior processing. To withdraw consent for health data, revoke health access in your device settings; to erase what was uploaded on that consent, open Profile → Privacy → Delete Uploaded Health Days. To object to product analytics, turn off Profile → Privacy → Share usage analytics. You may lodge a complaint with your national supervisory authority.

Your data is processed in the United States. Where personal data is transferred out of the EEA, UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses, incorporated into our agreements with the providers in §6.

Other US states

If you live in Colorado, Connecticut, Virginia, Utah, Texas, Oregon or another state with a comprehensive privacy law, you have comparable rights of access, correction, deletion and portability, and the right to appeal a refusal. Use the same address above.