Privacy policy

The short version: your health data belongs to you. We store it so your coach can read it, we never sell it, we never share it for advertising, and you can export or delete everything at any time.

Who we are

Cuilvor ("we") operates cuilvor.com and the Cuilvor app. For UK GDPR purposes we are the data controller for the personal data described here. Contact: hello@cuilvor.com.

What we collect

• Waitlist: your email address, used only to contact you about Cuilvor access and launches.
• Account: email address and authentication identifiers (magic link / Google sign-in). We never see or store passwords.
• Health data you choose to log: meals, sleep, training, medications, supplements and other compounds, symptoms, and blood-test results you upload. This is special category data under UK GDPR; we process it on the basis of your explicit consent, given when you log it. Withdraw consent at any time by deleting your data or account.
• Your AI key: if you connect your own Anthropic or OpenAI key, it is encrypted at rest and used solely to run your own parsing and coaching requests. It is never displayed back, logged in plaintext, or used for anyone else's requests.

How your data is protected

• Every user's records are isolated at the database level (row-level security) — no other user can query your rows.
• Sign-up is invite-only during early access.
• AI keys are stored encrypted (Supabase Vault). Data in transit is TLS-encrypted.

Who processes it

We use Supabase (database and authentication) and Vercel (website hosting) as processors. When you use AI features, the text you log is sent to the AI provider of your key (Anthropic or OpenAI) to be parsed; their API terms state API data is not used to train their models. We do not sell or share your data with advertisers or data brokers — ever.

Your rights

You can access, export, correct or erase your data at any time — the fastest route is emailing hello@cuilvor.com. You also have the right to complain to the ICO (ico.org.uk). Deleting your account removes your profile and all health records permanently.

Retention & cookies

We keep your data while your account exists and delete it when you do. The site sets only the cookies/local storage required for sign-in — no analytics trackers, no ad pixels.

Changes

If this policy changes materially we'll email account holders before the change takes effect.