STAVEN PRIVACY POLICY

Last updated: September 18, 2026 · Effective: not yet. Staven has not launched. This policy takes effect when the app is released, and this draft will be reviewed by a lawyer before then.

The short version

• We never sell your data. Not ever, not to anyone, for any amount of money or anything else of value.
• We never share your health information with advertising platforms. There is no Meta Pixel, no Google Analytics, no TikTok SDK, and no other third-party advertising or analytics tracker anywhere in the Staven app.
• We are not a HIPAA-covered entity and we do not claim to be. Your data is protected by the commitments in this policy and by federal and state law — not by HIPAA.
• Your conversations with the Staven coach, and any meal photo you log, are sent to Anthropic to generate responses. Staven never stores meal photos. Anthropic does not train its models on them. We ask you for explicit permission before this happens.
• You can delete your account and all of your data from inside the app, at any time.
• Questions: josh@staven.app

The rest of this policy is the detail. It is written to be read, not to be skipped.

1. Who we are

Staven is operated by Staven LLC, an Illinois limited liability company ("Staven," "we," "us").

Contact: josh@staven.app
Mailing address: Staven LLC, 2001 E Hopi Ln, Mount Prospect, IL 60056

This policy covers the Staven iOS app, the staven.app website, and related services (the "Service").

2. Who this Service is for

Staven is for adults 18 and older. We do not knowingly collect personal information from anyone under 18. We use age assurance at signup. If we learn we have collected information from someone under 18, we delete it and close the account. If you believe a minor has used the Service, email josh@staven.app.

3. We are not HIPAA-covered

Staven is not a "covered entity" or a "business associate" under the Health Insurance Portability and Accountability Act (HIPAA). HIPAA does not apply to Staven or to the information you give us.

We do not claim HIPAA compliance. We do not display HIPAA seals or certifications. If you see anything anywhere suggesting Staven is HIPAA compliant, it is wrong — please tell us at josh@staven.app.

This is a statement about which law applies, not about how carefully we treat your information. Your health information is protected by:

• our binding commitments in this policy, enforceable under Section 5 of the FTC Act;
• the FTC Health Breach Notification Rule, 16 C.F.R. Part 318;
• Washington's My Health My Data Act, ch. 19.373 RCW, and similar state consumer health data laws;
• California's Confidentiality of Medical Information Act, Cal. Civ. Code § 56 et seq.; and
• state breach notification laws, including Illinois PIPA, 815 ILCS 530.

4. What we collect

4.1 Information you give us

4.2 Apple Health (HealthKit) — the specific data types we read

If you connect Apple Health, we read only the data types you approve. Apple requires us to list them specifically, and here they are:

• Body Mass (weight)
• Height
• Step Count
• Active Energy Burned
• Apple Exercise Time
• Resting Heart Rate
• Workouts
• Sleep Analysis

What we write to Apple Health: only the weight entries and workouts you log in Staven yourself, and only if you allow it. We never write an estimate or a calculated value to Apple Health.

How we handle Apple Health data:

• We read it only after you grant permission, and only the types you grant.
• You can revoke any or all of it at any time in Settings → Privacy & Security → Health → Staven on your device. Revoking does not delete data already read; to delete that, delete your account or contact us.
• We never use Apple Health data for advertising, marketing, or data mining — by us or by anyone else. This is both our commitment and Apple's rule (App Review Guidelines 5.1.2(vi) and 5.1.3(i)).
• We never store Apple Health data, or any of your health information, in iCloud.

4.3 Information collected automatically

We keep this deliberately minimal.

4.4 What we do NOT collect

We want to be specific, because vagueness here is how other companies got in trouble.

• We do not collect your precise location. The app does not request location permission.
• We do not collect your contacts.
• We do not keep your meal photos. When you log a meal by photo, the photo leaves your device only to be sent to Anthropic for that one estimate (§ 6); Staven does not store it. If you ask the app to save it to your photo library, that copy stays on your device. Anthropic's own retention applies to the photo it receives (§ 6.3). Progress photos are different: you choose to keep them, and they are stored in your account (§ 4.1).
• We do not record or store audio. If you use voice input, the app asks for microphone and speech-recognition permission. Your speech is turned into text by Apple's speech recognition; Staven receives only the text, which is handled like anything you type.
• We do not collect your advertising identifier (IDFA) and we do not present the App Tracking Transparency prompt, because we do not track you.
• We do not receive your payment card information. Apple handles all payments.
• We do not buy personal information about you from data brokers or any other source.

5. How we use your information — and the lines we will not cross

5.1 What we use it for

1. To provide coaching — this is the primary purpose. Your logs, profile, Apple Health data, and conversation history are what let the coach remember you and adjust over time.
2. To calculate your targets and enforce the Service's safety limits, including minimum nutritional floors and the pregnancy protections.
3. To detect patterns that may indicate risk, so the Service can respond appropriately — including surfacing crisis resources.
4. To operate, secure, and debug the Service.
5. To communicate with you about your account, your subscription, and safety-related matters.
6. To comply with law and to enforce our Terms of Service.

5.2 THE COMMITMENTS THAT MATTER MOST

1. We do not sell your personal information or your health data. Ever, to anyone. "Sell" here means any exchange for money or other valuable consideration — the broadest definition used in any law that applies to us.

2. We do not share your health information with advertising platforms, ad networks, or data brokers. Not with Meta/Facebook, Google, TikTok, Snap, Pinterest, LinkedIn, Criteo, or anyone else.

3. There are no third-party advertising or analytics SDKs, pixels, or trackers in the Staven app. None. Not on the paywall, not in onboarding, not on any screen.

4. We do not build, upload, or contribute to "custom audiences," "lookalike audiences," or any retargeting list. We do not upload your email address — hashed or otherwise — to any advertising platform.

5. We do not use your health information for advertising or marketing of any kind, including our own.

6. We do not use your data, or your conversations, to train AI models — ours or anyone else's.

7. We do not use targeted or cross-context behavioral advertising.

5.3 If we ever advertise

If we run paid advertising in the future, here is the binding limit on how:

• Any advertising or attribution technology stays on our public marketing website, on pages that carry no health context and that anyone can visit without an account. It never enters the app.
• Any conversion measurement will be server-side, and the payload will contain no health data of any kind — no weight, no food, no activity, no sleep, no goals, no conversation content, no health-related event names, and no health-revealing plan or product names.
• We will not send user-level identifiers — including hashed emails or phone numbers — to advertising platforms.
• We expect to use Apple's own privacy-preserving attribution (SKAdNetwork / AdAttributionKit), which is designed not to identify individuals.
• If this ever changes materially, we will update this policy, tell you before it takes effect, and where the law requires it, ask for your consent. We will not apply a change retroactively to data we already collected.

5.4 Why we are this specific

Because this is exactly where other health apps have failed, and we would rather commit publicly than be vague:

• FTC v. GoodRx (Feb. 2023, $1.5M civil penalty — the FTC's first Health Breach Notification Rule enforcement action): GoodRx put Meta and Google tracking pixels and SDKs on its service, transmitted medication names and health conditions along with identifiers, and built Facebook Custom Audiences segmented by medication class to retarget its own users. The order permanently bans it from disclosing health information to third parties for advertising.
• FTC v. BetterHelp (Mar. 2023, $7.8M in consumer refunds): BetterHelp shared email addresses, IP addresses, and health questionnaire answers with Facebook, Snapchat, Criteo, and Pinterest. The FTC did not need a diagnosis to leak — the email address plus the fact that a person had sought therapy was itself the sensitive disclosure.
• FTC v. Monument (Apr. 2024): transmitted custom analytics event names like "Paid: Weekly Therapy" alongside email addresses and IP identifiers.
• FTC and the States v. Hims & Hers (filed July 29, 2026, N.D. Cal., with Utah and California): the same theory, still being enforced, now with state attorneys general joining. (Pending litigation — no judgment.)

The pattern in every case is identical: promise privacy, ship a third-party tracker, never notify anyone. Our answer is to ship no third-party trackers at all.

6. AI processing — Anthropic

Staven's coaching responses are generated by Anthropic's Claude models, through Anthropic's commercial API.

6.1 What we send

To generate a response, we send Anthropic:

• your message;
• a meal photo, if you log a meal by photo — used for that one estimate, and not stored by Staven;
• relevant recent conversation history;
• relevant context from your profile and logs — for example your current targets, recent weight trend, and recent activity — limited to what is needed to answer you.

6.2 What we do not send

• We do not send your email address, name, or account identifier.
• We do not send your raw Apple Health export or your full history in bulk.
• We do not send payment information.

6.3 What Anthropic does with it

Under the Anthropic Commercial Terms of Service that govern our API use:

• Anthropic does not train its models on our inputs or outputs. (Commercial Terms, Section B: "Anthropic may not train models on Customer Content from Services.") Note that this is the commercial API commitment, which is different from Anthropic's consumer product terms.
• By default, Anthropic deletes inputs and outputs from its backend within 30 days. Content flagged for policy violations may be retained longer, and Anthropic may retain data where legally required.
• Before the Service launches, we will have a signed Data Processing Addendum with Anthropic.

6.4 Your consent

Before your first conversation, we show you a screen explaining that your messages and health context are sent to Anthropic, and we ask for your explicit permission. You can review that disclosure at any time in Settings → Privacy → AI Processing.

If you withdraw that permission, the coaching conversation feature stops working — it cannot function without it — but you keep access to your logs, targets, and history, and you can export or delete your data.

7. Who else we share information with

We share your information only with the service providers we need to run Staven, and only for that purpose. Each of them is contractually bound to provide protection for your data that is the same as, or equivalent to, what this policy promises, and to use it only for the purposes we specify.

We do not share your information with anyone else, except:

• When you ask us to.
• When the law requires it — a valid subpoena, court order, or other lawful demand. We will notify you unless we are legally prohibited from doing so.
• To prevent serious harm — where we believe in good faith that disclosure is necessary to prevent imminent death or serious physical injury.
• In a business transfer — if Staven is acquired or merges, your information may transfer to the acquirer, who will remain bound by this policy for information collected under it, and we will notify you before that happens and before any material change in how your information is handled.

8. Security

We protect your information with:

• Encryption in transit (TLS) for all communication between the app and our servers;
• Encryption at rest for the database;
• Row-level access controls so a user's data is only accessible to that user's authenticated session;
• Least-privilege access — access is limited to what is necessary, and revoked when no longer needed;
• Logging and monitoring of security-relevant events;
• Keeping dependencies patched and maintaining an inventory of the components we run.

We do not claim our security is perfect, and we will not use marketing language like "military-grade" or "completely secure," because no system is. What we commit to is the specific measures above, and to telling you promptly if something goes wrong.

9. Breach notification

If your unsecured health information is ever acquired, accessed, used, or disclosed without authorization, we will tell you.

Specifically, consistent with the FTC Health Breach Notification Rule (16 C.F.R. Part 318) and applicable state law, we commit to:

1. Notify you without unreasonable delay, and no later than 60 calendar days after we discover the breach, by email — and, where appropriate, by an in-app message as well.
2. Notify the Federal Trade Commission at the same time we notify you if 500 or more people are affected; and report smaller incidents to the FTC annually as the Rule requires.
3. Notify prominent media in a state or jurisdiction where 500 or more residents are affected.
4. Notify state authorities as required, including the Illinois Attorney General under 815 ILCS 530.
5. Tell you what actually happened — what occurred and when, the name of any third party that acquired your information, what types of information were involved, what we are doing about it, what you can do, and at least two ways to reach us with questions.

We treat an unauthorized disclosure the same as a hack. Under the FTC's Rule as amended in 2024, sharing your health information without your authorization is itself a breach, and we will report it as one.

10. How long we keep your information

We publish this schedule and we follow it. If we change it, we will update this policy.

11. Your choices and rights

These rights are available to everyone who uses Staven, regardless of where you live. We think that is the right way to do it, and it is simpler than sorting users by state.

How we handle requests: we respond within 45 days. If we need more time we will tell you within that window and take up to 45 more. We will never charge you, deny you service, or give you a worse price for exercising any of these rights.

If we deny a request, you can appeal by replying to our response. We will decide the appeal within 45 days and explain our reasoning in writing.

What deleting your account does:

• Removes your profile, logs, targets, and conversation history from our production systems within 30 days.
• Removes them from backups within 90 days.
• Instructs Anthropic, Supabase, and Vercel to delete any copies they hold.
• Does not cancel your Apple subscription. You must cancel that separately in your Apple subscription settings — we will remind you during the deletion flow, and we cannot do it for you.
• Does not delete data in your own Apple Health app, which is yours and stays on your device.

12. Consumer health data — Washington, Nevada, and Connecticut

If you are in Washington, Nevada, or Connecticut, you have specific rights regarding "consumer health data" under state law. We honor these for all users.

Our separate Consumer Health Data Privacy Policy is published as its own page, as Washington's My Health My Data Act (RCW 19.373.020) requires.

Summary:

• We collect consumer health data only to provide the coaching you ask for when you use the app, for the purposes described in this policy.
• We ask for a separate, explicit consent before any of it is sent to Anthropic to generate coaching responses. You can withdraw it at any time.
• We do not sell consumer health data, under any definition, and therefore we never ask you to sign an authorization to sell.
• You may withdraw consent at any time, and it is as easy to withdraw as it was to give.
• You may request deletion, and we will direct our processors to delete their copies.
• We do not use geofencing around healthcare facilities or anywhere else. The app does not request location permission at all.

Washington residents: a violation of the My Health My Data Act is enforceable under the Washington Consumer Protection Act, ch. 19.86 RCW.

13. California residents

13.1 Our current status

Staven is a small company. We do not currently meet the thresholds that make a business subject to the California Consumer Privacy Act (CCPA/CPRA) — annual gross revenue over approximately $26.6 million, buying/selling/sharing the personal information of 100,000 or more California consumers or households, or deriving 50% or more of revenue from selling or sharing personal information.

We provide the rights below anyway. If we later cross a threshold, this section applies of its own force and nothing changes for you.

13.2 Categories of personal information we collect

Using the CCPA's own categories (Cal. Civ. Code § 1798.140):

We collect sensitive personal information only to provide the Service you asked for. We do not use or disclose it for any purpose other than those permitted under Cal. Civ. Code § 1798.121 — which means we are not required to offer a "Limit the Use of My Sensitive Personal Information" link, and there is nothing for such a link to do. We will tell you if that ever changes.

13.3 Sale and sharing

We have not sold personal information in the preceding 12 months. We have not "shared" personal information for cross-context behavioral advertising in the preceding 12 months. We do not do either of these things, and we have no plans to.

Because we do not sell or share, we do not offer a "Do Not Sell or Share My Personal Information" link — there is nothing to opt out of. We honor Global Privacy Control signals on our website regardless.

13.4 California rights

Know, access, correct, delete, portability, limit use of sensitive personal information, opt out of sale/sharing, and non-discrimination for exercising any of them. Exercise any of them through the app or by emailing josh@staven.app. An authorized agent may submit a request on your behalf with proof of authorization.

13.5 Confidentiality of Medical Information Act

California's CMIA (Cal. Civ. Code § 56 et seq.) applies to mobile applications that maintain medical information so that individuals can manage their own health information. We treat Staven as subject to it. That means we obtain your affirmative consent before disclosing your medical information, and we do not disclose it for marketing.

13.6 Shine the Light

We do not disclose personal information to third parties for their own direct marketing purposes, so Cal. Civ. Code § 1798.83 requests will always return a nil response.

14. Users outside the United States

Staven is currently offered in the United States only. Our servers are in the United States, and your information is processed there.

If you are outside the United States and use the Service anyway, you understand that your information is transferred to and processed in the United States, under United States law.

15. Changes to this policy

We may update this policy. When we do:

• We update the "Last updated" date at the top.
• For any material change, we notify you by email and in the app at least 30 days before it takes effect.
• Material changes apply prospectively only. We will not apply a new policy retroactively to information we already collected under the old one. Where a change would materially expand how we use or share information we already hold, we will ask for your consent first rather than assume it.
• We keep every prior version, and we will send you any of them on request.

16. Contact

Email: josh@staven.app — this is monitored, and we aim to respond within 5 business days.
Mail: Staven LLC, 2001 E Hopi Ln, Mount Prospect, IL 60056

You can also contact:

• The Federal Trade Commission at reportfraud.ftc.gov
• Your state attorney general
• Washington residents: the Washington Attorney General at atg.wa.gov
• California residents: the California Privacy Protection Agency at cppa.ca.gov